CheckPro Privacy Policy

CHECKPRO PTY LTD (ABN 85 688 115 862, ACN 688 115 862) provides employment background screening services in Australia. In this policy, "CheckPro", "we", "us" and "our" mean CHECKPRO PTY LTD.

Postal address: Suite 711, Level 2, UL40, 1341 Dandenong Rd, Chadstone VIC 3148
Privacy contact: Hayden Langhorn — privacy@checkpro.com.au

We are bound by the Privacy Act 1988 (Cth) and the Australian Privacy Principles. We do not rely on the small business exemption in the Privacy Act, and we do not rely on the employee records exemption in relation to the candidates we screen.

This policy explains how we handle personal information about:

• Candidates — people being screened, usually because they have applied for a job or are being engaged for work
• Client contacts — people who work for the employers and organisations that engage us
• Referees — people a candidate nominates to speak about their work
• Verification contacts — people at former employers, educational institutions and professional bodies who confirm information for us
• Website visitors — people who visit checkpro.com.au or contact us through it
• Suppliers and contractors — people we engage to provide services to us

Our own employee records are handled separately and are not covered by this policy.

3.1 About candidates

The information we collect depends on the checks requested and is limited to what those checks require. It may include:

We do not collect Medicare numbers, tax file numbers, bank account details or credit card numbers from candidates.

3.2 What we do not currently do

• We do not currently conduct police checks or criminal history checks. We are not an accredited body of the Australian Criminal Intelligence Commission. We will update this policy before offering them.
• We do not currently offer credit checks. We are not a credit provider and we do not obtain consumer credit reports about candidates.
• We do not use automated decision-making (section 8.4).
• We do not currently screen anyone under 18. If that changes, we will update this policy and put an appropriate consent process in place first, taking into account the person's capacity to consent and the requirements of the check.

3.3 About client contacts, referees and verification contacts

We collect name, employer, role and business contact details. For referees and verification contacts, we also record the information they provide, because it forms part of the verification result.

3.4 About website visitors

We collect your IP address, browser and device information, the pages you visit, and information you enter into our forms (section 14.2).

The Privacy Act gives additional protection to sensitive information, which includes health information, criminal records, biometric information, racial or ethnic origin, political opinions, religious beliefs, sexual orientation, and membership of a professional or trade association or a trade union.

Some checks may bring us into contact with sensitive information. The most common are:

Professional registration checks. Most of these confirm a registration or licence held with a regulator or registration board. That is generally not sensitive information. Where a check confirms your membership of a professional or trade association, that membership is sensitive information under the Privacy Act. We collect it only with your consent, and only to the extent needed to confirm your status.

Adverse media screening. A media search can return material about criminal allegations, political views, religious beliefs, health or ethnicity, even though we do not search for it. Section 8.3 explains how we review and exclude this material.

Other checks. Reference responses, sanctions results and documents you give us can sometimes contain sensitive information too. We do not use it unless it is reasonably necessary for the check.

We collect sensitive information only where you have consented and where it is reasonably necessary for the check that has been ordered.

Directly from you — primarily through our candidate portal and forms.

From the employer or organisation that ordered the check — usually your name, contact details and the checks they have requested.

From third parties, once you have consented — former employers, educational institutions, professional registration bodies, referees, the Department of Home Affairs (to verify work rights), the Australian Securities and Investments Commission registers, the Australian Financial Security Authority personal insolvency index, the Department of Foreign Affairs and Trade Consolidated List and comparable sanctions sources, and publicly available media and online sources.

Automatically, when you use our website — section 14.2.

Where it is reasonable and practicable, we collect information directly from you.

You can make a general enquiry without giving your name, or using a different name, where that is practicable. We cannot carry out screening without identifying you.

If we receive personal information we did not ask for and do not need, we destroy or de-identify it as soon as practicable, where it is lawful and reasonable to do so.

6.1 Collection notice

This policy explains how we handle personal information generally. It is separate from the notice we give you when we collect your information.

Before or at the time we collect your information, we give you our Candidate Collection Notice. It tells you who we are, why we are collecting your information, the types of information we may collect, what we use it for, who we usually disclose it to, whether any of it is required by law, what happens if you do not provide it, whether it may be accessed from overseas, and your rights.

It is a single general notice covering all the types of checks we carry out: identity, right to work, employment history, education and qualifications, professional registration, references, company directorships, insolvency, sanctions and publicly available media. Your employer chooses which checks apply to you, so not every candidate undergoes every type of check.

You will see it in the candidate portal on the consent screen, before you agree and before we start any checks.

6.2 Consent

We ask you, not your employer. We collect consent directly from you, through our own candidate portal. We do not rely on an employer telling us you have agreed.

What your consent covers. Your consent covers collecting, using and disclosing the information reasonably necessary to carry out the checks your employer has requested, as described in the Candidate Collection Notice. We collect only what those checks require.

Sensitive information. Some checks may involve sensitive information (see section 4). We collect it only where it is reasonably necessary for a requested check, and with your consent.

If your employer asks for more. If your employer later asks for materially different or additional information, we will ask for your consent again, or give you further notice, where the law requires it or where it is appropriate to the additional collection.

Consent is informed and voluntary. We tell you what the checks involve before you agree, and what happens if you do not consent. We keep a record of the version of the notice you were shown, your consent, and the date and time you gave it.

You can withdraw consent at any time by emailing privacy@checkpro.com.au. We will stop any check that has not been completed. Withdrawal does not affect checks already completed and reported, and we may keep records that we are required or permitted by law to retain. We will delete information we no longer need. Withdrawing consent may mean the employer is unable to progress your application.

We recognise that you are being asked to consent as part of a job application. That is why we limit what we collect to what the requested checks require, and explain what declining means.

We use candidate information to:

• confirm your identity
• carry out the specific checks that have been ordered and that you have consented to
• prepare and deliver the verification report to the employer or organisation that ordered it
• respond to your questions, access requests, corrections and complaints
• keep records showing that a check was properly authorised and correctly performed
• meet our legal obligations
• maintain and secure our systems

We disclose your check results only to the organisation that requested the checks, our service providers (section 9.1), the sources we contact to complete the checks, and others where required by law.

We report what we verified. We do not make or recommend hiring decisions, or score, rate or rank candidates. Assessing what a result means for a particular role is the employer's responsibility. Anti-discrimination laws limit how some results, such as criminal records, can be used, and our reports are not a judgement about you.

We provide screening reports to the client that ordered the checks, as part of our paid screening service and with your consent. We do not sell candidate information to data brokers, use it for advertising, or give it to anyone for their own marketing.

8.1 Reference checks

We currently conduct reference checks by email only, and we record each referee's written response.

We do not currently conduct reference checks by phone, and we do not record calls. If we introduce phone or AI-assisted reference checks, we will update this policy before doing so.

8.2 Identity documents

To confirm your identity, we may ask you to upload a copy of at least one photographic identity document.

We accept an Australian or international passport, an Australian driver licence, an Australian government-issued proof of age or photo identity card, an Australian firearms licence, or a student photo identity card.

We do not accept Medicare cards, because they are not needed to confirm identity and could bring health information into our records.

Identity document images are stored in Sydney, Australia. Access is limited to staff who need them to complete or review a check, and the images are deleted 90 days after the check is completed (section 10.2).

8.3 Adverse media and sanctions screening

Where these checks are ordered, we search publicly available media and online sources, and sanctions and watchlist sources including the Department of Foreign Affairs and Trade Consolidated List, for material relating to you.

We manage two specific risks:

False matches. Name-based searches can return results about other people. A person reviews every potential match before anything appears in a report. We do not pass raw search output to a client. Where we cannot confirm that a result relates to you, we exclude it.

Irrelevant and sensitive material. These searches can surface material about your health, political views, religion, ethnicity or unproven allegations. We exclude from our reports material that is not relevant to the verification that was ordered. We report the source and the date so that you and the employer can assess it.

If you believe a reported result does not relate to you or is inaccurate, section 11.2 explains how to ask us to correct it.

8.4 Automated processing and automated decisions

We do not currently use automated decision-making. No computer program at CheckPro makes decisions about you or produces a risk score, rating, pass or fail indicator, or recommendation. Every check result that reaches a client has been reviewed by a person.

We use software in ordinary ways — to store records, route work, send notifications, and search sources. Where a search returns possible matches, that output is a starting point for human review, not a conclusion.

If we introduce automated matching, result classification, risk flags, or AI-assisted verification or calling, we will update this section before doing so and will set out the kinds of information used, the kinds of decisions made solely by the program, and the kinds of decisions the program contributes to.

9.1 Service providers

We use service providers to operate our business. They may use your information only to provide their services to us, are contractually required to protect it, and may not use it for their own purposes.

Our main providers are:

We use other business tools, such as customer support and client relationship software, to communicate with our clients. These tools are not used to store candidate records.

We maintain a current list of our service providers and will supply it to clients on request.

9.2 Where your information is held

Candidate records are stored in Australia. Everything you give us through our candidate portal, and every check result, is held in Sydney.

We do not accept candidate information by email. If you email us information, we transfer it to our secure portal and delete the email.

Some of our service providers are based overseas, mainly in the United States, and may access information from outside Australia where needed to provide and support their services. Where that happens, we take reasonable steps to ensure they handle your information consistently with the Australian Privacy Principles, including through contractual obligations.

Where a check you have consented to requires us to contact a source outside Australia — for example verifying an overseas qualification or employer — we will tell you which country before we do it.

10.1 Storage and security

We take reasonable steps to protect personal information, including:

• encryption of information in transit and at rest by our hosting providers
• limiting access to candidate records to the people who need it for their work

No system is completely secure. We do not publish detailed information about our security architecture.

10.2 Retention and deletion

We keep personal information only as long as we need it, and then destroy it or de-identify it.

Our retention periods:

Deleted information may remain in our system backups for a limited period, until those backups are overwritten in the normal cycle.

If we begin offering police checks, different rules will apply to those records and we will update this section.

11.1 Access to your information

You can ask for a copy of the personal information we hold about you. Email privacy@checkpro.com.au.

We will ask you to confirm your identity first, so that we do not disclose your information to someone else.

We will respond within 30 days. There is no charge to make a request. If a request takes substantial work we may charge a reasonable cost-based fee, and we will tell you what it is before doing the work.

We may refuse or limit access only where the Privacy Act permits it — for example, where giving access would have an unreasonable impact on another person's privacy. If we do, we will tell you in writing why (unless it would be unreasonable to do so) and how you can complain. Where appropriate, we will give you access another way, such as by removing another person's personal information.

11.2 Correcting your information

If something we hold about you is wrong, out of date, incomplete, irrelevant or misleading, tell us at privacy@checkpro.com.au and we will take reasonable steps to correct it. There is no charge.

We will respond within 30 days. If we refuse, we will explain why in writing and tell you how to complain, and you can ask us to attach a statement to the record noting that you consider it inaccurate.

Where the information came from somewhere else. The table below explains what we can correct and what only the original source can correct.

We will always take reasonable steps to correct what we hold, no matter where it came from. We cannot change a third party's original records, but we remain responsible for the information we hold and report. Depending on the issue, we may re-verify it, correct or add to our report, or remove information that should not be included.

If we have already given the incorrect information to a client, you can ask us to notify them of the correction, and we will unless it is impracticable or unlawful.

If you think we have mishandled your personal information, email privacy@checkpro.com.au with the details.

We will acknowledge your complaint within 5 business days and respond substantively within 30 days. If we need longer we will tell you why and when to expect an answer.

If you are not satisfied with our response, or we do not respond in time, you can complain to the Office of the Australian Information Commissioner:

• Online: oaic.gov.au
• Phone: 1300 363 992
• Post: GPO Box 5218, Sydney NSW 2001

The OAIC generally expects you to raise a complaint with us first and give us 30 days to respond. If exceptional circumstances prevent you from doing that, you can contact the OAIC for guidance.

If a data breach occurs that is likely to result in serious harm to you, we will notify you and the Office of the Australian Information Commissioner as required by the Notifiable Data Breaches scheme in the Privacy Act.

Our service providers are contractually required to notify us promptly of any breach affecting information they hold for us.

14.1 Direct marketing

We may send business contacts at our clients and prospective clients information about our services. Every message includes an unsubscribe option, and we act on unsubscribe requests promptly. You can also email privacy@checkpro.com.au to opt out.

We do not send marketing to candidates. We contact candidates only about their checks, and we do not use or disclose candidate information for marketing.

14.2 Website, cookies and analytics

Our website uses only the cookies needed to make it work. It does not currently use analytics, advertising or session-recording tools. If we add any, we will update this section before we do.

Analytics, session recording and advertising technologies do not run on our candidate portal. Pages where you enter personal information, upload identity documents or view check results carry no third-party analytics, session replay or advertising scripts.

We do not use candidate information for advertising, and we do not build advertising audiences from anyone who has been screened by us.

You can block or delete cookies through your browser settings. Blocking necessary cookies may stop parts of the site working.

We may update this policy. The current version is always at checkpro.com.au, with the date it took effect. Where a change materially affects how we handle your information, we will take reasonable steps to tell you.

Privacy contact: Privacy Officer
Email: privacy@checkpro.com.au
Post: Suite 711, Level 2, UL40, 1341 Dandenong Rd, Chadstone VIC 3148

CHECKPRO PTY LTD — ABN 85 688 115 862