Privacy policy

1. Purpose of This Policy

This Privacy Policy explains how we collect, use, disclose, store, and protect personal information in accordance with the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs).

It applies to Clients, Candidates and Staff, the referees Candidates name, and contractors, suppliers and visitors to our website.

Our Terms of Use set out the rules for using the website and accounts.

Read the Terms of Use

2. What Personal Information We Collect

We collect information to provide services to Clients and Candidates, operate Staff accounts, and respond to enquiries.

2.1 Candidate Information

• Name, email, phone, country, city and optional state or region
• CVs, including every version you upload, and other documents such as certificates, qualifications and security clearance records
• Employment history, qualifications, licences and skills
• Work rights (e.g. visa status, citizenship)
• Security clearance status (if applicable)
• Referee contact details you provide
• Preferences, availability and career goals
• Applications, including the answers and CV version submitted with each one
• Results of assessments, interviews, or background checks

Sensitive information (only with consent):

• Health information relevant to role requirements
• Criminal history checks
• Diversity information (optional)

2.2 Referee Information

• Name, relationship to the Candidate and email address, supplied by the Candidate
• Organisation, role and phone number, if the Candidate provides them
• Your answers to our referee questions and your overall rating

2.3 Client Information

• Account name, email and organisation name
• Organisation industry, headcount, systems, data ownership and business priorities supplied for a maturity check
• Check answers, examples and limitations, supporting PDF or Word documents and check feedback
• Agreed assessment scope, business objectives, evidence, findings and approved reports
• Your choice about comparison with other organisations, where offered
• Contract and billing information needed for service delivery

2.4 Website & Digital Information

• IP address and device identifiers
• Cookies and usage analytics
• Online form submissions
• Communication logs (email, chat, SMS)

3. How We Collect Personal Information

• Direct submissions (online forms, email, phone, in person)
• Information and documents Clients and Candidates add to their accounts
• Applications submitted through third-party platforms
• Interviews, assessments and referee checks
• Referee details supplied by Candidates, and the answers referees give us
• Background screening providers
• Public sources such as LinkedIn, job boards and professional websites
• Client interactions and service delivery activities

Where reasonable, we collect information directly from you.

If we collect information from third parties, we will take reasonable steps to notify you.

4. Why We Collect Personal Information

4.1 Recruitment & Placement

• Assessing suitability for roles
• Conducting interviews, tests, and background checks
• Sending referee requests to the referees a Candidate names
• Submitting candidate profiles to clients
• Managing placements, onboarding and compliance

4.2 Maturity Assessments

• Saving Clients questionnaire drafts and producing self-rated checks
• Reviewing evidence and preparing findings for Digital Maturity Assessments
• Preparing approved reports and delivering them to the organisation
• Discussing results with Clients when they ask us to

4.3 Running Our Services

• Communicating with Clients, Candidates and referees
• Contract management and invoicing
• Improving our services and website
• Maintaining security and preventing fraud and spam

4.4 Legal & Regulatory Compliance

• Verifying work rights
• Meeting obligations under employment, WHS and immigration law
• Responding to lawful requests from regulators or law enforcement

We use information for the enquiry, account, recruitment or consultancy purpose for which it was provided, subject to the choices and access controls described here.

5. Sensitive Information

We only collect sensitive information when:

• It is required for a role or legal compliance;
• You have provided explicit consent; or
• Collection is authorised by law.

Sensitive information is handled with heightened security and confidentiality.

6. Client Accounts and Maturity Assessments

A client account holds your name, email address and organisation name. We email you a link to confirm your address before you start a check.

The free Digital Maturity Check saves your answers and self-rated results to your account. Staff can see a submitted check so that we can discuss it with you.

Your account holds only your own checks. Your answers and the documents you upload are visible to you and authorised Staff. A Digital Maturity Assessment is carried out by DMS Staff with your organisation, and its report is delivered outside your account.

Supporting documents must be PDF or Word (DOCX) files of up to 5 MB. We keep a rebuilt copy without macros, scripts or embedded content, in private storage in Sydney, and do not keep the file as uploaded. Please leave out other people's personal information unless the check needs it and you are allowed to share it.

Where we offer comparison with other organisations, it stays off unless the check owner turns it on. A comparison shows median results from at least ten organisations and never names another organisation or shows its answers.

7. CVs, Documents and Referees

7.1 CVs and Documents

Candidates can upload a CV and up to 10 other documents, each a PDF or Word (DOCX) file of up to 5 MB. As with Client documents, we keep a rebuilt copy in private storage in Sydney rather than the file as uploaded.

Your CV and documents are visible to you and authorised Staff, and we record each time Staff download one. Staff may also keep an updated CV on your record, and your documents page tells you when they do.

We keep every CV version until your account is closed and its records are disposed of. Each application keeps a copy of what you sent, including the CV version, so it can be reviewed as submitted.

7.2 Referees

Candidates can name up to three referees. Please ask each person before adding their details. Saving a referee does not contact them.

When Staff send a referee request, we email the referee a link that works once and expires. The referee's answers and rating go to Staff only. The Candidate can see whether a referee request was sent, answered, expired or withdrawn, but not what the referee said.

Referees can contact us to ask what we hold about them or to correct it.

8. Disclosure of Personal Information

8.1 Clients

To present you for roles, conduct interviews, or manage placements.

8.2 Service Providers

• Background check providers
• Skills testing platforms
• Payroll or onboarding systems
• IT, cloud storage, email and CRM providers, including those named in 8.4
• Legal or professional advisors

8.3 Government & Regulatory Bodies

• Fair Work Ombudsman
• Department of Home Affairs
• Police or courts where legally compelled

8.4 Overseas Recipients

DigitalOcean hosts our website, database and uploaded files in its Sydney data centre. These providers handle some personal information outside Australia:

• Resend, Inc. (United States) sends our emails, such as account confirmations, password resets, referee requests and alerts about new enquiries. It receives each recipient's email address and the content of the message.
• Cloudflare, Inc. (United States) runs the Turnstile check that blocks automated spam on our contact form and the Clients and Candidates registration forms. It receives your IP address and information about your browser and device, and may process them in any country where its network operates.
• OpenFreeMap supplies the Positron office map on our About page. Its servers receive your IP address when the map loads. The OpenStreetMap Foundation (United Kingdom) supplies the map on our Privacy page and receives your IP address when that map loads.

We take reasonable steps to ensure these providers handle personal information consistently with the APPs. We will update this list before we start using another provider that handles personal information overseas.

We do not sell personal information.

9. Data Storage & Security

• Secure cloud storage in Sydney
• Private file storage, with uploads rebuilt before they are stored
• Access controls and authentication
• Encryption of data in transit
• Regular security audits
• Staff training on privacy obligations
• Secure destruction of data when no longer required

10. Data Retention

We retain personal information only as long as necessary for recruitment, legal or business purposes.

Candidates can close their account in account settings. Staff then review the request, and if you were ever placed through DMS, they first check what we must keep for legal or business reasons.

We review whether to keep a closed maturity check or assessment 12 months after it closes. Check owners can ask us to delete their check.

When records are deleted through account closure or Staff data deletion, they are removed from normal use immediately. We retain a restricted copy of the deleted records and their stored files for 30 days from deletion, then schedule them for permanent removal. For deleted accounts, sign-in credentials and sessions are revoked immediately. Minimal deletion evidence is retained to prevent deleted records being reintroduced from backups. Copies held by email providers and in backups are handled separately under our retention and deletion procedures.

11. Access and Correction

You may request access to personal information we hold about you and request corrections where necessary.

We will generally respond within 30 days.

12. Anonymity and Pseudonymity

Where lawful and practical, you may interact with us anonymously or using a pseudonym.

However, anonymity may limit our ability to provide recruitment services.

13. Cookies and Usage Analytics

Our website uses a small number of essential cookies to keep it working: they keep you signed in to a Clients or Candidates account or the Staff app, and protect our forms from spam and abuse. Our forms also use Cloudflare Turnstile to check that a person is submitting them. Essential cookies cannot be turned off, because the site cannot work without them.

On public pages, we ask whether you allow analytics, and nothing is collected until you choose Allow. Your browser remembers your choice for 12 months if you allow analytics and 6 months if you do not, and then we ask again. If your browser sends a Global Privacy Control signal, we treat it as a refusal unless you choose otherwise.

We use first-party analytics across the public website, Clients, Candidates and Staff to understand how the platform is used. A random browser identifier recognises returning browsers, and separate tab sessions describe screen visits, generic actions and visible or active time. These usage histories are not linked to accounts, enquiries or Staff identities. They do not contain private record addresses, entered values, assessment answers or document contents.

Public website attribution is recorded separately. If you send an enquiry, that separate public journey may be linked to your enquiry; it cannot include activity from private areas. Analytics delivery is best effort, so recorded journeys may be incomplete. Raw analytics records are currently retained without an automatic expiry.

Use Cookie settings in the public website footer or Analytics preferences in the account footer or Staff account menu, to stop collection for this browser. The preference applies across open tabs and clears pending events and browser identifiers; it does not delete records already received. In configurations requiring consent, collection waits for your choice. Essential functions remain available when analytics is off.

14. Direct Marketing

We may send role alerts, newsletters, or service updates.

You can opt out at any time using the unsubscribe link or by contacting us.

15. Complaints

If you believe we have breached the Privacy Act or APPs, you may lodge a complaint with us.

If you are not satisfied with our response, you may contact the:

Office of the Australian Information Commissioner (OAIC)

16. Contact Us

Privacy Officer

Data Maturity Solutions

20/41 Liardet Street, Weston ACT 2611

[email protected]

17. Updates to This Policy

We may update this Privacy Policy periodically.

The latest version will always be available on our website.