Preview build. ComplianceForge is not yet trading.
ComplianceForge

Privacy policy

Last updated [EFFECTIVE DATE].

1. Collection notice

ComplianceForge is operated by [LEGAL ENTITY NAME] (ABN [XX XXX XXX XXX]), a Lodestone Nexus Group business ("we", "us"). This notice explains what happens when we collect your personal information.

  • What we collect:
    • from the contact form: your name, work email, company, role (optional), phone (optional), how you found us (optional), the standard you're interested in, what's driving it, your audit timing and any message you choose to add;
    • with any form you send: the exposure-check reading if you completed it, and the campaign tags in the link you arrived on (for example which ad or page sent you), so we know which of our advertising works;
    • by email or in meetings: what you choose to tell us;
    • during a Gap Analysis or engagement: business information you share, such as documents, records and site observations;
    • privacy-focused analytics about how the site is used.
  • Why: to respond to you, provide what you ask for, run and improve this site, and, if you agree, send you updates.
  • If you don't provide it: we may not be able to respond or provide the product or service. You can browse the site and use its in-page tools without giving us your name.
  • Who we share it with: service providers who host this site and handle email on our behalf, and other Lodestone Nexus Group businesses only where you ask to be referred to one. We do not sell personal information.
  • Overseas: some of those providers store data outside Australia, which may include the United States and the European Union.
  • Your rights: you can ask to see or correct your information, or complain, as set out in this policy. Contact [email protected].

2. Who we are

ComplianceForge builds ISO management systems for Australian businesses and provides a named person to defend them in certification audits. It is operated by [LEGAL ENTITY NAME] (ABN [XX XXX XXX XXX]), [REGISTERED ADDRESS]. ComplianceForge is part of the Lodestone Nexus Group. We handle personal information in line with the Australian Privacy Principles in the Privacy Act 1988 (Cth), whether or not the Act applies to a business of our size.

3. The information we collect

We collect only what we need for the purpose you're engaging with us for.

  • Contact details: name, email address, phone number, company and role, when you give them to us.
  • What you tell us: the content of enquiries, diagnostic or questionnaire answers you choose to submit, and your preferences.
  • Technical information: pages visited, approximate location derived from IP address, device and browser type, collected through privacy-focused analytics. See section 8.
  • Business information: information about your organisation that you share for a diagnostic, proposal or engagement, such as operating figures, documents and system data. We treat this as confidential whether or not it contains personal information. Engagement-specific confidentiality and data terms in your proposal or contract take priority over this policy.
  • Records about your people: management system records (for example training, induction or incident records) can name your staff and contractors. We use them only to build, validate and defend your system, under your engagement terms.

We do not ask for sensitive information (such as health information) unless it is necessary for a service you request, and then only with your express consent.

You can deal with us anonymously or under a pseudonym where that's practical, for example when browsing or using an in-page tool.

4. How we collect it

Directly from you: through forms on this site, by email, by phone, or in meetings. We only collect information about you from someone else (for example, a colleague who refers you) where it's reasonable to do so, and we tell you when we've done that.

5. How we use it

  • To respond to enquiries and provide the products and services you ask for.
  • To administer our relationship with you, including invoicing.
  • To improve this site and our products, using aggregated information wherever possible.
  • To send you updates or marketing, only where you've agreed or would reasonably expect it. Every marketing email has an unsubscribe link, and we act on it within five working days.
  • To meet our legal obligations.

6. Who we disclose it to

  • Service providers acting for us: website hosting, email and newsletter delivery, analytics, file storage. They may use the information only to provide their service to us.
  • Other Lodestone Nexus Group businesses, only where you ask to be referred or the enquiry is clearly for them.
  • Professional advisers (accountants, lawyers, insurers) under confidentiality.
  • Regulators or others where the law requires or authorises it.

We do not sell, rent or trade personal information.

7. Overseas disclosure

Some of our service providers store or process data outside Australia, which may include the United States and the European Union. We take reasonable steps to ensure they handle it consistently with the Australian Privacy Principles. Current providers: hosting Cloudflare, email [EMAIL PLATFORM], analytics [ANALYTICS PROVIDER].

8. Cookies and analytics

This site uses privacy-focused analytics that do not use advertising cookies or build profiles of individual visitors. In-page tools (calculators, health checks, quizzes) run in your browser; your answers are not sent to us unless you choose to submit them. Some tools may remember your answers in your own browser so you don't lose them; clearing your browser data removes them.

The "Are you audit-exposed?" self-check runs entirely in your browser. Your answers stay on your device unless you choose to send them to us.

9. Automated decisions

We do not make decisions that significantly affect you using only automated processes. See section 9A.

9A. AI-assisted features

Some of our products use AI models to draft text from information you provide. When we build your management system, we may use AI tools to prepare first drafts of procedures, forms and records from the documents and answers you give us. Your information is processed by our AI provider [AI PROVIDER] under terms that do not allow it to be used to train their models. A person at ComplianceForge reviews AI-drafted output before it is final, and you can ask for a human to review anything an AI feature produced for you.

10. Storage, security and retention

We store information with reputable providers and protect it with access controls, encryption in transit, and staff confidentiality. We keep personal information only as long as we need it for the purpose it was collected or as the law requires (for example, tax records for five years). Then we delete or de-identify it. Enquiries that don't lead to work are deleted after 24 months.

If a data breach is likely to cause you serious harm, we will notify you and the Office of the Australian Information Commissioner as the law requires.

11. Accessing and correcting your information

You can ask for a copy of the personal information we hold about you, or ask us to correct it, by emailing [email protected]. We respond within 30 days. We may need to confirm your identity first. There is no charge for asking.

12. Complaints

Email [email protected] with the details. We will acknowledge your complaint within five working days and aim to resolve it within 30 days. If you're not satisfied, you can contact the Office of the Australian Information Commissioner at oaic.gov.au or on 1300 363 992.

13. Changes

We may update this policy. The current version is always on this page, with its date at the top.

14. Contact

Privacy enquiries: [email protected]. Post: [LEGAL ENTITY NAME], [REGISTERED ADDRESS].

Check your exposureTalk to us