Privacy and Information Security Policy

1. Policy statement

Axiom Data handles sensitive personal information every day: resumes, identity documents, security clearance details, referee contacts, pay and tax details, and health information when a worker is injured. It also works inside Commonwealth systems that hold official and sometimes classified information. We comply with the Australian Privacy Principles as if we were bound by them regardless of turnover, and with every client's security requirements, because our Commonwealth contracts require it and because the people who trust us with their information deserve it.

2. Scope and application

This policy applies to Ontology Analytics Pty Ltd, trading as Axiom Data (Axiom Data) and to every director, employee, labour-hire worker, contractor and agent engaged by Axiom Data, whether working at Axiom Data's premises, remotely, or on placement at a client site. Where a worker is placed with a client, this policy applies alongside the client's own policies; where the two differ, the worker follows the stricter requirement and raises the difference with Axiom Data.

3. Personal information we collect

We collect personal information directly from the person wherever possible, tell them what it is for, and collect sensitive information (such as health information) only with consent or where the law requires.

4. Use and disclosure

• A candidate's information is submitted to a client only with the candidate's express consent for that specific opportunity, and only to the client. We never submit a candidate to a buyer through more than one seller.
• We do not disclose one candidate's or partner's commercial information (including rates) to another.
• We disclose personal information to third parties only as needed to run the business (payroll and accounting providers, superannuation funds, insurers, the ATO, AGSVA for clearance sponsorship) or as required by law.
• We do not sell personal information or use it for direct marketing without consent, and we honour every request to stop receiving communications immediately.
• Personal information is stored in Australia on systems hosted in Australian regions.

5. Commonwealth official and classified information

• Workers on placement handle official and classified information only on client systems, in accordance with the client's security policies, the PSPF and the ISM, and at or below the level of their clearance and need-to-know.
• Client information is not copied to personal devices, personal email or Axiom Data systems without written client authority.
• Commonwealth records created on placement belong to the agency and are kept in the agency's recordkeeping system in accordance with its policy.
• Security incidents are reported immediately under POL-05, to the client and to Axiom Data.
• Workers comply with their clearance conditions, including reporting changes in personal circumstances to the sponsoring agency.

6. Security of information

• Axiom Data systems use multi-factor authentication, full-disk encryption on laptops and phones, automatic screen locking, and vendor-supported software kept patched.
• Access to candidate and worker records is limited to the Director and those who need it for their role, and is removed when a role ends.
• Documents containing identity, clearance, tax or health information are stored in access-controlled locations and are not sent by unencrypted email where a secure alternative exists.
• Backups are maintained and tested. Devices are wiped before disposal.
• Paper records are kept to a minimum, stored locked, and shredded when no longer required.

7. Retention

Candidate information is retained for two years after the last contact unless the candidate asks us to delete it sooner or has been placed. Worker records are retained for seven years after the engagement ends as employment law requires. Information is destroyed securely when no longer needed.

8. Data breaches

A suspected breach of personal information is reported and handled under POL-05. It is contained immediately, assessed within 30 days to determine whether it is likely to result in serious harm, and, where it is, the affected individuals and the Office of the Australian Information Commissioner are notified. Breaches involving client information are reported to the client the same day.

9. Access, correction and complaints

A person may ask to see or correct the personal information we hold about them by emailing [email protected]; we respond within 30 days. Complaints about privacy are handled by the Director, and a person who is not satisfied may complain to the Office of the Australian Information Commissioner.

10. Review

This policy is owned by the Director and is reviewed at least annually, and sooner if legislation, a client requirement or an incident shows the need. The current version, effective date and next review date are recorded in the policy register on the Employee Resources page.