Privacy policy

1. Introduction and who we are

This privacy policy explains how Corpshore Australia handles personal information when you visit this site, contact us about our services, apply for a role, or subscribe to our communications. Corpshore Australia is the Australia and New Zealand division of Corpshore Solutions Corporation, a company headquartered in Toronto, Canada, with its head office at The Exchange Tower, 130 King Street West, Suite 1900, Toronto, Ontario M5X 2A2, Canada. Where this policy says "Corpshore", "we", "us" or "our", it means Corpshore Australia acting through this website and the systems described below.

Our practices are designed to align with the Privacy Act 1988 (Cth) and the Australian Privacy Principles for Australian visitors, and with the Privacy Act 2020 for New Zealand visitors. This is a stated alignment, not an independently audited certification, consistent with the honesty commitment set out on our compliance and security page.

2. Our Privacy Officer and how to contact us

We have designated a Privacy Officer who is accountable for our compliance with this policy and with applicable privacy law. You can reach the Privacy Officer at info@corpshore.solutions. Please use this contact for any question about this policy, to exercise your rights, or to raise a concern about how we have handled your personal information.

3. Scope of this policy

This policy covers the personal information we collect and control through this site and its forms and scheduling tools. It does not cover two things. First, where we process personal information on behalf of a client as part of a service engagement, for example when our teams handle a client's own customer records, we act as a service provider under the client's instructions, and the client's own privacy notice and our contract with the client govern that processing, not this policy. Second, third-party websites we link to have their own privacy practices, and we are not responsible for them.

4. Key terms

To keep this policy clear: "personal information" means information about an identifiable individual; "processing" means any operation performed on personal information, such as collection, use, disclosure, storage or disposal; a "service provider" is an organisation that processes personal information on our behalf under our instructions; and "consent" means your agreement to the collection, use or disclosure of your personal information for identified purposes.

5. The personal information we collect, by context

We collect only the personal information we need for the purposes described below, and only what you give us or what is generated automatically when you use the site.

5.1 Client and prospective-client context

When you enquire about our services, request a quote, or book a discovery call, we collect your name, business email address, company name, role or title where you provide it, telephone number where you choose to give it, the location and country you are enquiring from, the services, industry, team size and timeline you indicate, and the content of the message you write. Where you book a discovery call, the scheduling is operated through our booking provider and we receive the booking details you enter so we can prepare for and attend the call.

5.2 Candidate context

When you apply for a role we collect your name, contact details, location and country, right-to-work status, languages, experience, current or most recent role, availability, your resume and any documents or covering letter you provide, and your answers to application questions.

5.3 Visitor and subscriber context

When you browse the site we collect limited technical information, your internet protocol address and basic request metadata, used for security, rate limiting and abuse prevention, and, only if you accept analytics cookies, aggregate usage data. When you subscribe to a communication you give us your email address and any name you provide, together with a record of your consent, consistent with the Spam Act 2003 (Cth).

We do not deliberately collect sensitive information such as health, biometric, racial or ethnic origin, religious belief, or political opinion through this site. Please do not enter such information into free-text fields unless strictly necessary for your request.

6. Purposes and the basis for processing

Our purposes for collecting personal information are: to respond to enquiries and prepare quotes; to schedule and hold discovery calls; to evaluate job applications; to deliver communications you have asked to receive, under the consent and identification requirements of the Spam Act 2003 (Cth); to secure the site and prevent fraud and abuse; to measure and improve the site, with your consent to analytics cookies; and to meet our legal obligations.

7. Consent and how to withdraw it

For marketing communications and analytics we rely on your consent, given by a clear affirmative action such as accepting analytics cookies or opting in to a subscription. You may withdraw consent at any time. To withdraw consent to analytics, use the cookie settings link in the site footer. To unsubscribe from marketing email, use the unsubscribe link in any such message. To withdraw any other consent, contact our Privacy Officer at info@corpshore.solutions.

8. Who we share your personal information with

We share personal information only with the service providers that help us operate this site and our commercial and recruitment processes, and only to the extent each provider needs it for the service it performs for us:

• Zoho CRM (records of client and prospective-client enquiries, proposal requests and discovery-call bookings), operated by Zoho Corporation.
• Zoho Recruit (records of candidates and members of our talent community), operated by Zoho Corporation.
• Zoho Campaigns (delivery of newsletters and marketing email you have expressly asked to receive, and the related consent and unsubscribe records), operated by Zoho Corporation.
• Vercel (hosting, content delivery and privacy-respecting traffic measurement), operated by Vercel, Inc.
• Cloudflare Turnstile (bot and abuse protection on our forms), operated by Cloudflare, Inc.
• ZeptoMail (transactional email such as confirmation and acknowledgement messages), operated by Zoho Corporation.
• Calendly (scheduling of discovery calls), operated by Calendly, LLC, when you choose to book a call.
• Google Analytics and Microsoft Clarity (aggregate usage and interaction measurement), loaded only after you accept analytics cookies.

Each provider processes personal information on our behalf under contractual terms that require a comparable level of protection. We may also share personal information within the Corpshore group where necessary to respond to your request under consistent governance. We may disclose personal information where the law requires or permits it. We do not sell your personal information.

9. Cross-border processing and transfers

Personal information collected through this site is disclosed to recipients outside Australia and New Zealand. Australian Privacy Principle 1.4 requires us to tell you the countries those recipients are likely to be in, so far as it is practicable to do so. They are:

• Canada, where Corpshore Solutions Corporation, our parent, has its head office.
• The United States, where the Zoho platforms listed above hold our account, and where our hosting, bot-protection, scheduling and analytics providers are established.
• The Philippines, Vietnam, Uzbekistan, Malaysia and Fiji, where the group's delivery teams work. A team member in one of these countries may handle personal information you give us where your enquiry or engagement is served from that hub.

Under Australian Privacy Principle 8 and section 16C of the Privacy Act 1988 (Cth), we take reasonable steps to ensure an overseas recipient does not breach the Australian Privacy Principles, and if the recipient does breach them we are taken to have breached them ourselves. Accountability does not transfer with the data. For New Zealand visitors, under information privacy principle 12 of the Privacy Act 2020, data sent overseas purely for processing on our behalf, where the recipient does not use it for its own purposes, is not treated as a disclosure requiring separate authorisation.

10. How long we keep your personal information

We keep personal information only for as long as it is needed for the purpose we collected it and to meet our legal obligations, then we securely destroy, erase or anonymise it. Our retention periods by category are:

• Client and prospective-client enquiry and quote records: twenty-four months after our last substantive contact with you.
• Candidate application records: twenty-four months after the recruitment decision.
• Newsletter and marketing subscriber records: until you unsubscribe.
• Cookie consent records: twelve months, after which we ask again.
• Server and security logs: ninety days, unless a longer period is needed to investigate an incident.
• Records of privacy rights requests: three years, so we can demonstrate how we responded.

11. Your right of access and correction

You have the right to ask whether we hold personal information about you, to access it, to be told how it has been used and disclosed, and to have inaccurate or incomplete information corrected. To make a request, contact our Privacy Officer at info@corpshore.solutions. We verify your identity before acting and respond in writing.

Our deadlines differ by country because the two Acts differ. For an Australian request, Australian Privacy Principle 12.4 gives us thirty days from the request. For a New Zealand request, section 66 of the Privacy Act 2020 requires us to decide as soon as reasonably practicable and no later than twenty working days after we receive it. We work to the shorter of the two where it is unclear which applies.

If we refuse access in whole or in part, we will tell you why in writing and explain how to complain, as Australian Privacy Principle 12.9 requires. If we correct your information and you ask us to tell anyone we previously disclosed it to, we will take reasonable steps to do so under Australian Privacy Principle 13.2.

You may also ask to deal with us anonymously or under a pseudonym under Australian Privacy Principle 2. We will accommodate that where it is lawful and practicable, though we usually cannot prepare a quote or assess a job application without knowing who you are.

12. Automated decision-making

We do not make decisions about you based solely on automated processing that produce a legal or similarly significant effect. Our tools help our people organise and prioritise information, but a person reviews and makes the decision.

13. How we safeguard your personal information

We apply physical, organisational and technical safeguards proportionate to the sensitivity of the information, including encryption in transit, access controls, logging and monitoring, and vendor management. No method of transmission or storage is perfectly secure, but we work continuously to protect your personal information.

14. Notifiable data breaches

If personal information we hold is subject to unauthorised access, unauthorised disclosure or loss, and we have reasonable grounds to suspect that this is likely to result in serious harm to any individual, Part IIIC of the Privacy Act 1988 (Cth) requires us to carry out a reasonable and expeditious assessment and to complete it within thirty days. Where the assessment confirms an eligible data breach, we notify the Office of the Australian Information Commissioner and the affected individuals as soon as practicable.

New Zealand runs a separate regime. Under section 114 of the Privacy Act 2020 we must notify the Office of the Privacy Commissioner and the affected individuals as soon as practicable after becoming aware of a privacy breach that it is reasonable to believe has caused, or is likely to cause, serious harm.

We keep a record of every breach we assess, whether or not it turns out to be notifiable.

15. Children's personal information

This site is directed at businesses and at adults seeking work. It is not intended for children, and we do not knowingly collect personal information from children. If you believe a child has provided us with personal information, contact our Privacy Officer and we will delete it.

16. Changes to this policy

We may update this policy as our site, services, providers or legal obligations change. When we make a material change we will update the date shown on this page. Please review this policy from time to time.

17. Complaints

If you have a concern about how we have handled your personal information, please raise it first with our Privacy Officer at info@corpshore.solutions.

This is how we will deal with it. We acknowledge your complaint in writing within five business days of receiving it. We then investigate, which may involve asking you for more detail so we can identify the records concerned, and we give you a written response within thirty days of the acknowledgement. That response tells you what we found, what we have done or will do about it, and what you can do if you are not satisfied. If we need longer because the complaint is complex, we tell you why and when to expect an answer.

If you are not satisfied with our response, or we do not respond in time, you may take it further. Australian visitors have the right to complain to the Office of the Australian Information Commissioner. New Zealand visitors have the right to complain to the Office of the Privacy Commissioner. You do not have to come to us first, though it is usually quicker.