Privacy

1. Introduction

Welcome to Skill Society ("we," "us," or "our"). We are committed to safeguarding the privacy and security of your personal data. This Privacy Policy describes how we collect, use, retain, and disclose information when you use our services. It also explains the rights and options available to you regarding your personal data.

2. Scope

This Privacy Policy applies to all users of our platform and any related websites or applications that link to this Policy. It is intended to comply with the requirements of the Australian Privacy Act 1988 (Cth), the Australian Privacy Principles (APPs), and relevant SOC 2 security and privacy principles. Any reference to 'personal data' or 'personal information' in this Policy encompasses data or information relating to an identified or identifiable individual.

If you access or use our services from outside Australia, please note that your data may be transferred and stored in Australia or other jurisdictions where our service providers operate. In such cases, we will ensure your personal data receives an adequate level of protection, consistent with this Policy and applicable laws.

Our services are not intended for individuals under the age of 16. We do not knowingly collect personal data from minors. If you believe a child has provided us with personal data, please contact us immediately and we will delete such data.

3. Information We Collect

We may collect the following types of personal data, depending on your interactions with our platform:

• Contact information (e.g., name, email address, phone number)
• Account details (e.g., login credentials, profile data)
• Usage data (e.g., IP address, browser type, device information, browsing activity)
• Interview data (e.g., audio recordings, transcripts, and AI-generated evaluations)
• Employment-related information (e.g., job titles, qualifications, salary expectations, availability)
• Communication data (e.g., messages, feedback, support requests)
• Third-party integration data (e.g., ATS records, synced job descriptions, integration metadata)
• Technical details (e.g., operating system, screen resolution, crash reports, feature usage)
• Other details you provide voluntarily in the course of using our services

3A. Cookies and Tracking

We may use cookies, pixels, and similar tracking technologies to collect information about how you interact with our platform. This data helps us personalise content, analyse usage, and improve user experience.

You can manage cookies through your browser settings. For more information, please see our Cookie Policy (if applicable).

4. How We Use Your Information

We use personal data for the following purposes:

• To provide and maintain our platform and its core functionalities
• To process and respond to inquiries, support requests, or feedback
• To personalize content and improve user experience, including analytics and performance metrics
• To comply with legal obligations or respond to lawful requests from public authorities
• To support and document our compliance with SOC 2, including security event logging and audits
• To facilitate AI-powered interviews, including generating transcripts, ranking/scoring, and performance insights
• To allow hiring managers to review candidate interviews and assessment outcomes within their organisation
• To improve and train our AI systems using anonymised and aggregated data, where permitted
• Please note that while we strive to ensure our AI-powered interviews and assessments are informative and reliable, they are provided for guidance only. Hiring decisions remain solely your responsibility.

5. Data Retention and Deletion

We retain personal data only for as long as necessary to fulfill the purposes described in this Policy or to comply with legal, regulatory, or contractual requirements.

For comprehensive details on our retention periods, secure deletion procedures, and audit processes, please refer to our Data Deletion, Retention, and Audit Procedures. This document outlines:

• Verification steps for deletion requests and user identity
• How data is removed from live systems, backups, and logs
• Compliance with third-party or subprocessor requirements
• Maintenance of detailed audit logs of all deletion requests
• Customers may request data deletion or custom retention terms by contacting our team.

6. Security Measures

We take the security of personal data seriously. We maintain administrative, technical, and physical safeguards designed to protect against unauthorized access, disclosure, or misuse of the data in our custody. These measures include:

• Encryption of data at rest and in transit
• Access controls and role-based permissions
• Regular vulnerability scans and security assessments as part of our SOC 2 compliance
• Intrusion detection and monitoring of logs for suspicious activity
• Despite our safeguards, no method of transmission over the internet or electronic storage is completely secure. While we continually strive to protect your personal data, we cannot guarantee its absolute security.

7. Third-Party Services and Subprocessors

We may engage third-party service providers (subprocessors) to perform certain functions on our behalf, such as hosting, analytics, or payment processing. We require these subprocessors to adhere to security and data protection obligations consistent with this Policy and any legal requirements. We remain responsible for how they handle your personal data within the scope of the services they provide to us.

While we contractually require them to follow strict data protection standards, we cannot guarantee their operations are entirely free from vulnerabilities. However, we remain your primary point of contact and will work diligently to address any concerns arising from subprocessor handling of your data.

8. Your Rights and Choices

You may have the right to:

• Access the personal data we hold about you
• Request correction of inaccurate personal data
• Request deletion of your personal data where permitted by law or contract
• Object to or restrict certain forms of data processing, including direct marketing
• Please note: If your data originates from a third-party source (such as a job board or client ATS), we may be unable to prevent it from being re-sent to us after deletion. While we can remove it from our system upon request, the data may reappear unless it is also deleted at the original source. We recommend contacting the source platform directly to ensure permanent removal.

To exercise these rights, please contact us using the information provided below. We will respond to most requests within 30 days and take reasonable steps to verify your identity prior to fulfilling any data-related request.

9. Data Breach Notification

In the unlikely event of a data breach that poses a risk to your rights and freedoms, we will promptly notify you and the relevant regulatory authorities as required by applicable law.

10. Policy Updates and Review

We review and update this Privacy Policy at least annually or whenever significant changes occur to our operations or legal obligations. Any updates or modifications will be posted here with an updated "Last Updated" date. If we make material changes, we may notify you by email or by posting a notice on our platform.

11. Contact Us

If you have any questions or concerns about this Privacy Policy, or if you wish to make a complaint or exercise your data protection rights, you can reach us at:

Data Protection Officer (DPO) Skill Society Email: daniel@skillsociety.com.au Phone: +61 (0) 403 962 102

4. How We Use Your Information

We use personal data for the following purposes:

• To provide and maintain our platform and its core functionalities
• To process and respond to inquiries, support requests, or feedback
• To personalize content and improve user experience, including analytics and performance metrics
• To comply with legal obligations or respond to lawful requests from public authorities
• To support and document our compliance with SOC 2, including security event logging and audits

5. Data Retention and Deletion

We retain personal data only for as long as necessary to fulfill the purposes described in this Policy or to comply with legal, regulatory, or contractual requirements.

For comprehensive details on our retention periods, secure deletion procedures, and audit processes, please refer to our Data Deletion, Retention, and Audit Procedures. This document outlines:

• Verification steps for deletion requests and user identity
• How data is removed from live systems, backups, and logs
• Compliance with third-party or subprocessor requirements
• Maintenance of detailed audit logs of all deletion requests

6. Security Measures

We take the security of personal data seriously. We maintain administrative, technical, and physical safeguards designed to protect against unauthorized access, disclosure, or misuse of the data in our custody. These measures include:

• Encryption of data at rest and in transit
• Access controls and role-based permissions
• Regular vulnerability scans and security assessments as part of our SOC 2 compliance
• Intrusion detection and monitoring of logs for suspicious activity

7. Third-Party Services and Subprocessors

We may engage third-party service providers (subprocessors) to perform certain functions on our behalf, such as hosting, analytics, or payment processing. We require these subprocessors to adhere to security and data protection obligations consistent with this Policy and any legal requirements. We remain responsible for how they handle your personal data within the scope of the services they provide to us.

Please note that we are not associated with external platforms beyond our direct control (e.g., third-party job boards, client ATS). Any requests to remove or delete data retained by such third parties must be addressed directly with those external providers, though we will assist in facilitating the request where possible.

8. Your Rights and Choices

You may have the right to:

• Access the personal data we hold about you
• Request correction of inaccurate personal data
• Request deletion of your personal data where permitted by law or contract
• Object to or restrict certain forms of data processing, including direct marketing

To exercise these rights, please contact us using the information provided below. We will respond to most requests within 30 days and take reasonable steps to verify your identity prior to fulfilling any data-related request.

9. Data Breach Notification

In the unlikely event of a data breach that poses a risk to your rights and freedoms, we will promptly notify you and the relevant regulatory authorities as required by applicable law.

10. Policy Updates and Review

We review and update this Privacy Policy at least annually or whenever significant changes occur to our operations or legal obligations. Any updates or modifications will be posted here with an updated "Last Updated" date. If we make material changes, we may notify you by email or by posting a notice on our platform.

11. Contact Us

If you have any questions or concerns about this Privacy Policy, or if you wish to make a complaint or exercise your data protection rights, you can reach us at:

Data Protection Officer (DPO) Skill Society Email: daniel@skillsociety.com.au Phone: +61 (0) 403 962 102

12. Approval and Versioning

Version: 1.2

Approved by: Senior Management Team & DPO