Privacy Policy

This Privacy Policy explains how Hatchet Pty Ltd (ABN 51 607 716 718), trading as Hatchet and operating the TwoStreams platform ("TwoStreams", "we", "us" or "our"), collects, uses, stores, discloses and otherwise handles your personal information.

TwoStreams is a workforce management platform for the labour hire and event staffing industry. It is made up of our website (https://twostreams.com.au), our web application (https://app.twostreams.au) and our TwoStreams mobile applications for iOS and Android (together, the "Platform"). This policy applies to all of them.

We are committed to protecting your privacy and to handling your personal information in accordance with the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs). Because we handle Tax File Numbers, we also comply with the Privacy (Tax File Number) Rule 2015. By using the Platform, you agree to the collection and use of your information in accordance with this policy.

1. Who this policy applies to

The Platform is used by two broad groups of people:

• Workers (also called members or staff), who create a profile, apply for jobs and shifts, upload qualifications and provide onboarding details so they can be engaged and paid; and
• Employers and administrators (workspace owners and admins), who post jobs, manage shifts, review applications, verify qualifications and prepare payroll for their workforce.

A single account may act as a worker in one organisation (workspace) and as an administrator in another. This policy applies to everyone who uses the Platform.

2. The personal information we collect

The information we collect depends on how you use the Platform and the role you hold. We only collect information that is reasonably necessary for our functions and activities.

2.1 Identity and contact information

• Title, first name, middle name and last name
• Email address and phone number
• Residential and postal address (including geocoded coordinates for that address)
• Date of birth
• Gender and pronouns
• Profile photo (avatar)
• Emergency contact name, relationship and phone number
• T-shirt or uniform size (for event staffing)

2.2 Sensitive and financial information

To engage and pay workers, we collect information that is sensitive in nature. This includes:

• Tax File Number (TFN) and related tax declarations, including your Australian tax residency status, tax-free threshold election and study or training support loan (STSL) status
• Bank account details, including BSB, account number and account name, for payment of wages
• Superannuation details, including your superannuation fund and member number
• Working rights and right-to-work information, including whether you are an Australian citizen, permanent resident or hold another status, together with supporting documents such as visa or citizenship evidence

Your TFN, bank account details, superannuation member number and similar highly sensitive fields are stored in encrypted form. We handle your TFN strictly in accordance with the Privacy (Tax File Number) Rule 2015 and Australian taxation law.

2.3 Documents and uploads

• Qualification and certification documents (for example, photographs or scans of licences and tickets)
• Right-to-work and visa documents
• Resumes or curricula vitae
• Attachments you include in enquiries or messages

In our mobile apps, you can upload qualification documents by taking a photo with your camera or selecting an image from your photo library. Location metadata (EXIF) is stripped from photos captured through the app.

2.4 Employment and activity information

• Job and shift applications, application status, notes and outcomes
• Shift history and completed shift counts
• Qualification verification status and expiry dates
• Performance ratings, strengths and reviews recorded by administrators
• Points, achievements, referrals and other gamification data
• Workspace memberships and the role you hold in each workspace

2.5 Account, technical and usage information

• Login credentials and one-time verification codes
• Social login connections (for example, Google, Apple, Facebook or LinkedIn), including the provider and the associated email address
• Device push notification tokens and platform (iOS or Android)
• IP address, device and browser type, and user-agent information
• Session, audit and activity logs recording actions taken on the Platform
• Analytics and usage data (see section 6)
• Crash and error diagnostics

2.6 Employer and company information

If you set up or administer a workspace, we also collect business information such as the legal and trading name, ABN or ACN, business structure, industry, GST registration, company Tax File Number (stored encrypted), business contact details, registered and postal addresses, and payroll configuration.

3. How we collect your information

We collect personal information in the following ways:

• Directly from you when you register, complete your profile, onboard, apply for jobs, upload documents, or contact us
• From your employer or a workspace administrator who invites you or manages your engagement
• Automatically as you use the Platform (for example, log, device and usage data)
• From third parties who help us verify or process your information, such as our onboarding and taxation partner (see section 5)
• From identity or social login providers when you choose to sign in using them

Where it is reasonable and practicable, we collect personal information directly from you. Some fields (such as your Tax File Number, bank and superannuation details) are typically completed through the web application during onboarding rather than in the mobile app, although the mobile app may display and transmit that information when you are signed in.

4. Why we collect, hold and use your information

We use personal information to:

• Create and manage your account and profile
• Verify your identity, qualifications and right to work
• Match you to jobs and shifts, and process applications
• Roster, manage and record shifts and attendance
• Prepare and process payroll, tax and superannuation
• Send you notifications, reminders and service messages by email, SMS, push notification and in-app messaging
• Provide dashboards, reporting and analytics to you and to workspace administrators
• Operate features such as achievements, referrals and worker ratings
• Maintain the security, integrity and performance of the Platform, and diagnose and fix faults
• Comply with our legal obligations, including taxation, superannuation, employment and record-keeping laws
• Respond to your enquiries and provide support

If you do not provide the information we request, we may be unable to provide you with access to the Platform, engage you for work, or pay you correctly.

5. Disclosure of your information

We do not sell your personal information. We may disclose your personal information to the following categories of recipients:

• Employers and workspace administrators. Because TwoStreams is a multi-tenant platform, the employers and administrators of a workspace you belong to can access the information needed to engage, roster and pay you. This includes your profile, qualifications, working rights, and, where required for payroll, sensitive information such as your name, email, Tax File Number and bank account details. Each workspace can only access the workers associated with it.
• Onboarding, tax and superannuation provider. We use SuperAPI, an Australian provider, to facilitate employee onboarding and to collect and verify tax, superannuation and banking details. Relevant personal information is shared with this provider for that purpose.
• Service providers. We use trusted third parties to host and run the Platform and to deliver communications, including cloud hosting and file storage, email delivery, SMS delivery, push notification delivery, mapping, bot protection, product analytics, crash and error reporting, and user feedback tools. These are described further in section 6.
• Professional advisers and authorities. We may disclose information to our advisers, or to government agencies, regulators, law enforcement or courts, where required or authorised by law.
• In connection with a business transfer. If our business or assets are sold or reorganised, your information may be disclosed to the relevant party, subject to appropriate protections.

6. Third-party services and tracking

We rely on the following categories of third-party services, some of which set cookies or collect technical information:

• Cloud hosting and storage for the Platform and uploaded files, hosted in Australia
• Email and SMS delivery for account, service and notification messages
• Push notification delivery for our mobile apps, using Expo together with Apple Push Notification service (iOS) and Firebase Cloud Messaging (Android)
• Mapping to display the location of jobs and shifts
• Product analytics to understand how the Platform is used and to improve it, which may identify signed-in users by identifier, email and name
• Crash and error reporting, which may include your user identifier, email, name and workspace to help us diagnose faults
• Bot protection on our sign-in and public forms
• User feedback tooling
• Social login providers where you choose to sign in using them

Some of these providers process data outside Australia (see section 8). We do not use the Platform to serve third-party advertising, and our mobile apps do not include advertising SDKs.

Cookies

Our website and web application use cookies and similar technologies to keep you signed in, remember your preferences and understand usage. Most browsers let you refuse or delete cookies. If you disable cookies, some parts of the Platform may not function properly.

7. Push notifications and permissions

Our mobile apps can send push notifications about jobs, shifts, applications and messages. You can enable or disable push notifications through your device settings and manage your notification preferences within the app. The apps also request permission to use your device camera and photo library, solely so that you can upload qualification documents. We do not collect your device location, contacts, microphone or biometric data.

8. Overseas disclosure and data location

We store the core Platform data, including uploaded files, in Australia (Amazon Web Services, Sydney region). Our onboarding, tax and superannuation partner is an Australian provider.

Some of our service providers are located overseas or process data overseas. In particular, our product analytics and crash and error reporting providers may process data in the United States, and mapping, bot protection, feedback and social login providers may process data in the United States or other countries. Where we disclose personal information overseas, we take reasonable steps to ensure it is handled consistently with the Australian Privacy Principles.

9. Security of your information

We take reasonable steps to protect your personal information from misuse, interference and loss, and from unauthorised access, modification or disclosure. These steps include encryption of highly sensitive fields (such as Tax File Numbers and bank account details), encrypted storage of authentication tokens on your device, certificate pinning in our mobile apps, access controls, multi-factor authentication for privileged accounts, and audit logging.

No method of transmission or storage is completely secure. While we strive to protect your information, we cannot guarantee absolute security. You are responsible for keeping your account credentials confidential.

10. Retention and deletion of your information

We retain personal information for as long as it is needed for the purposes described in this policy, or for as long as we are required to keep it under applicable laws (for example, taxation, superannuation and employment record-keeping obligations).

• You can delete individual sensitive records, such as your banking, tax, superannuation, working-rights, resume and qualification records, from within the Platform.
• You can request deletion of your account. Deleting your account permanently removes your account data from our active systems.
• Inactive workspaces and unverified invitations may be deleted automatically after extended periods of inactivity, following advance notice.

Some information may be retained in backups for a limited period after deletion, and may be retained where we are required to keep it by law. Deletion of your TwoStreams account does not delete separate accounts you may hold with third-party login providers.

11. Your privacy rights

Under the Australian Privacy Principles, you may:

• Request access to the personal information we hold about you
• Request correction of information that is inaccurate, out of date, incomplete or misleading
• Ask us how we handle your personal information
• Withdraw consent or opt out of non-essential communications

You can update much of your information directly through your profile. To make a request, contact us using the details in section 13. We may need to verify your identity before acting on a request. We will respond within a reasonable time.

12. Children

The Platform is intended for people who are legally able to work in Australia and is not directed at children. We do not knowingly collect personal information from anyone who is not eligible to hold a work-related account. If you believe we hold information about a person who should not have an account, please contact us.

13. Contact us and complaints

If you have any questions about this Privacy Policy, wish to access or correct your information, or would like to make a privacy complaint, please contact us:

• Email: privacy@twostreams.au
• Post: Hatchet Pty Ltd, A4/435 Roberts Road, Subiaco, WA 6008

We will acknowledge your complaint and investigate it promptly. If you are not satisfied with our response, you may contact the Office of the Australian Information Commissioner (OAIC) at www.oaic.gov.au.

14. Changes to this policy

We may update this Privacy Policy from time to time. When we do, we will revise the "Last updated" date at the top of this page. If the changes are significant, we will take reasonable steps to notify you. Your continued use of the Platform after any change indicates your acceptance of the updated policy.