Privacy

Who we are

The organisation that engaged you — the employer, host or agency whose workforce you are part of — is the data controller for the personal information held here, and in this statement "we", "us" and "our" mean that organisation. One statement is published for every organisation that uses the service, so yours is identified by its relationship to you rather than by name; if you are not sure which organisation holds your records, ask whoever engaged you for work, or use the platform contact at the end of this statement.

The service runs on ATHEXIS, the workforce-management platform operated by Ashley Technology Pty Ltd, which holds and processes that information on the organisation's behalf as its data processor, and publishes this statement on its behalf. Each organisation's records are held separately from every other organisation's. Personal information is handled in accordance with the Privacy Act 1988 (Cth) and the Australian Privacy Principles ("APPs").

Information we collect

We collect personal information you provide directly and information collected in writing or from third parties in the course of engaging you for work — your name, date of birth, gender, contact details, qualifications and employment history, health information where it is relevant to a role or a vocational assessment, payment details, and responses to assessment questionnaires. We also collect technical information such as your IP address, browser type, and device information when you interact with the service.

Where you use the mobile app, it can record your location in the background while a shift is running, so that a clock-in can be confirmed against the site it was recorded for. Background location is off unless your organisation has switched it on, you have consented to a named notice, and a supervisor has an open, audited viewing session; it stops on its own when the shift window closes, and you can withdraw consent or turn the permission off in your device settings at any time. One exception is deliberate: if you raise a duress alert, your position is sent with it, so that help can reach you.

How we use your information

We use your personal information for course administration, employment processing, vocational assessment, job matching and recruitment, identity verification, communication about employment opportunities, running the workflows the service enables, direct marketing (which you can opt out of at any time), and complying with our legal obligations.

Disclosure of your information

We may disclose your personal information to related entities within our own corporate group, to our service providers (including the platform sub-processors listed below), to prospective and host employers for job matching, and to government authorities where required or authorised by law.

Sub-processors and AI processing

The platform uses a small, fixed set of sub-processors: AWS Bedrock, hosted in Sydney (ap-southeast-2), and Anthropic for AI inference; and SMSGlobal for SMS notifications. For the sovereign IRAP-assessed deployment, AI inference is served from in-region Australian models. We do not sell your personal information.

The mobile app reaches a small number of further sub-processors, each limited to a single purpose. Sentry receives crash diagnostics from the mobile app only — the failure class, a redacted message, the stack, and the device, operating system, app version and runtime — and never your name, your account, your e-mail address, the contents of your requests, your location or your screen, and there is no session recording. Sentry is active only in builds configured to send diagnostics, and is not used at all in the sovereign IRAP-assessed deployment. ElevenLabs receives microphone audio and the assistant's spoken replies for the length of a live voice turn, sent from your device straight to ElevenLabs under a single-conversation link the platform signs for you; it applies only where your organisation has configured a voice assistant, and only while you are speaking to it. Firebase Cloud Messaging and the Apple Push Notification service receive your device's push token and the contents of notifications, so that notifications can reach your device.

Cross-border transfers

Data is hosted in the region the customer's deployment was provisioned for. For the IRAP-assessed sovereign deployment, personal information — including AI inference — is processed within Australia and is not moved between deployments. Where a deployment relies on any overseas processing, we take reasonable steps to ensure the recipient handles your information in accordance with the APPs.

Data retention

We retain your personal information for as long as necessary to fulfil the purposes for which it was collected, or for as long as the law requires. Employment, payroll and tax records that the Fair Work Act requires us to keep are retained for the statutory period.

Direct marketing and cookies

Where we send you direct marketing you may opt out at any time using the unsubscribe facility in the message or by contacting our Privacy Officer. Our web surfaces use cookies to keep you signed in and to operate the service; you can control cookies through your browser settings.

Data security

We implement appropriate technical and organisational measures to protect your personal information, in both paper and electronic form, against unauthorised access, loss, or misuse. These measures include encryption, tenant-scoped access controls, and regular security assessments. The platform's security posture is described on our Trust & security page.

Your rights

Under the Privacy Act 1988 you have the right to access the personal information we hold about you, request correction of inaccurate information, request deletion of your personal information, opt out of direct marketing, and lodge a complaint with the Office of the Australian Information Commissioner (OAIC). This statement aligns with the Australian Privacy Principles.

Deleting your account & data

You can permanently delete your account from the ATHEXIS mobile app (Settings → Delete account) or, without the app, at agentic-ai.au/account/delete after signing in. Deletion revokes your login, signs you out of every device, and erases your contact details, profile and saved sign-in tokens.

Employment, payroll and tax records that Australian law (the Fair Work Act) requires us to retain for seven years are not deleted on request — they are kept in anonymised form and are no longer accessible to you. Questions about a deletion request go to the organisation that engaged you, or to the platform operator at privacy@agentic-ai.au.

Contact us

To exercise your privacy rights or ask about this statement, contact the privacy officer of the organisation that engaged you: it is the data controller for your records, and it holds the contact details for that role. Questions about the platform itself — how it is secured, where the data is held, which sub-processors it reaches, or which organisation holds your records — may be directed to Ashley Technology Pty Ltd, which operates ATHEXIS, at privacy@agentic-ai.au.