BizPilot Australian Privacy Policy

1. About BizPilot

This Privacy Policy explains how NEXA DIGITAL PTY LTD trading as BizPilot, ABN 39 676 911 309 ("BizPilot", "we", "us" or "our") collects, holds, uses, discloses, stores and otherwise handles personal information. Our address is 1/22 O'Connell Street, North Adelaide SA 5006, Australia.

BizPilot provides a cloud-based business operating platform. The Platform may include functionality for recruitment; human resources; employee files; employment contracts; onboarding; training; rostering; time and attendance; payroll; workplace compliance; reservations; events; gift cards; customer management; finance; banking integrations; stock; suppliers; ordering; recipe and product costing; analytics; marketing; artificial intelligence; AI Co-Pilots; reporting; integrations; and related business-management functionality. Together, our websites, software, applications, modules and services are referred to as the "Platform".

Where applicable, we handle personal information in accordance with the Privacy Act 1988 (Cth) and the Australian Privacy Principles.

2. Who this Privacy Policy applies to

This Privacy Policy may apply to: prospective customers; Customers; business owners; directors; administrators; employees; prospective employees; contractors; former workers; job applicants; customers and guests of businesses using BizPilot; reservation customers; event customers; gift-card purchasers; gift-card recipients; suppliers; professional advisers; partners; website visitors; users of the Platform; and other individuals whose personal information is processed through BizPilot.

3. BizPilot's role

The role BizPilot performs depends upon the circumstances.

Where BizPilot handles information for its own purposes — including account administration; billing; subscriptions; Platform security; fraud prevention; customer support; service analytics; legal compliance; communications; website operations; marketing; and BizPilot's own business operations — BizPilot determines the purposes for which that information is handled.

Where a Customer uploads, enters, connects or otherwise provides information concerning its employees, contractors, candidates, customers, guests or other individuals, BizPilot generally processes that information for the purpose of providing services to that Customer. The Customer remains responsible for ensuring it has the authority and lawful basis necessary to collect, use and provide that information to BizPilot and for providing required notices or obtaining required consents.

4. Personal information we may handle

Depending upon the modules used, BizPilot may process the following.

Identity information — names, preferred names, dates of birth, photographs, employee identifiers, applicant identifiers and customer identifiers.

Contact information — email addresses, mobile numbers, telephone numbers, residential addresses, postal addresses and emergency contacts.

Employment information — employer, role, position, employment status, department, workplace, commencement date, employment history, availability, employment agreements, salary, hourly rates, classifications, entitlements, leave, qualifications, licences, certificates, performance information and workplace records.

Recruitment information — CVs, resumes, applications, cover letters, qualifications, employment history, references, interviews, candidate notes, candidate assessments, communications, candidate ratings, availability, recruitment stage and recruitment recommendations.

Payroll and financial information — salary, hourly rates, hours worked, timesheets, allowances, overtime, penalties, leave, deductions, PAYG information, superannuation information, payroll history, payment information, bank account information, tax-related information and STP-related information.

Government-related information — where permitted and reasonably necessary, BizPilot may process government-related identifiers or information required for payroll, employment, taxation or regulatory purposes. Government-related identifiers must only be handled in accordance with applicable law.

Time and attendance information — rostered shifts, actual attendance, clock-in and clock-out times, breaks, worked hours, device information and location verification data where enabled.

Location information — certain BizPilot functionality may allow a Customer to verify whether a worker is at or near an approved workplace when performing an attendance action. BizPilot's standard Time & Attendance functionality is not intended to provide continuous or covert employee surveillance. Customers are responsible for ensuring location functionality is used in accordance with applicable privacy, employment and workplace surveillance requirements.

Training and compliance information — training modules, progress, quiz responses, assessments, certificates, licences, qualifications, policy acknowledgements and compliance records.

Reservations and events — customer names, email addresses, mobile numbers, booking information, guest numbers, customer notes, event enquiries, event details, deposits, transaction information, customer communications and special requests.

Gift Cards — purchaser information, recipient information, email addresses, mobile numbers, messages, card values, card identifiers, transaction history, redemption history, balances and delivery information.

Financial and operational information — where enabled, BizPilot may process invoices, expenses, supplier information, bank-feed information, business transactions, financial summaries, budgets, forecasts and financial reports.

Technical information — IP addresses, browsers, operating systems, devices, login activity, authentication information, sessions, Platform activity, audit logs, security logs and cookies.

Communications — emails, customer-support requests, complaints, feedback, account communications and other communications.

Sensitive information — certain Platform functionality may involve information defined as sensitive information under Australian law. Such information should only be collected or processed where it is reasonably necessary, lawfully permitted and appropriately authorised.

5. How information is collected

Information may be collected: directly from an individual; when an account is created; through Platform usage; from a Customer; from an employer; from an authorised administrator; during a recruitment process; through an authorised integration; through customer support; from third-party providers; through our websites; through cookies and similar technologies; and from publicly available sources where lawful.

6. How we use information

Information may be used to: provide BizPilot; operate accounts; authenticate users; administer subscriptions; process payments; provide recruitment; operate HR functionality; facilitate employment contracts; onboard workers; provide training; build rosters; track attendance; provide payroll functionality; support workplace compliance; process reservations; manage events; issue and redeem Gift Cards; provide finance functionality; provide analytics; provide marketing functionality; provide AI functionality; maintain audit trails; operate integrations; provide support; protect accounts; prevent fraud; investigate suspicious activity; maintain security; improve the Platform; communicate service information; enforce contractual rights; comply with legal obligations; and protect BizPilot, Customers, users and third parties.

7. Artificial Intelligence and BizPilot Co-Pilot

BizPilot may provide AI and machine-learning functionality through BizPilot Co-Pilot and related features. These features may generate summaries; recommendations; forecasts; classifications; candidate insights; candidate rankings; suggested rosters; compliance alerts; payroll alerts; anomaly detection; financial insights; operational recommendations; and marketing content.

AI-generated output can be incorrect, incomplete or unsuitable. Unless expressly stated otherwise, BizPilot AI is designed to provide decision support, not to replace appropriate human judgement. Customers should independently review AI outputs before making decisions materially affecting an individual.

BizPilot should not ordinarily be relied upon as the sole decision-maker for significant hiring; candidate rejection; employee discipline; termination; workplace investigations; payroll approval; legal compliance; financial decisions; or health and safety decisions.

8. Automated decision-making

BizPilot may arrange for computer programs to use personal information in connection with decisions or actions substantially and directly related to decisions. Examples may include candidate recommendations; candidate scoring; compliance alerts; rostering recommendations; payroll anomaly detection; workforce recommendations; and financial anomaly detection.

Where Australian privacy law requires disclosure concerning automated decision-making, BizPilot will provide information required by law. The Platform preserves appropriate human oversight over decisions materially affecting employees, candidates or other individuals.

9. AI training and Customer Content

Customer Content does not become BizPilot property merely because BizPilot stores or processes it. BizPilot will not use Customer Content or personal information to train unrelated general-purpose artificial-intelligence models unless that use has been transparently disclosed and there is an appropriate legal and contractual basis. Where third-party AI providers are used, BizPilot will seek appropriate contractual, privacy and security protections.

10. Disclosure and service providers

BizPilot may disclose information to service providers necessary to operate the Platform. These may include providers of cloud infrastructure; databases; cybersecurity; authentication; email; SMS; payment processing; banking connectivity; analytics; artificial intelligence; accounting integrations; payroll integrations; monitoring; document processing; and customer support. We only disclose information reasonably necessary for the relevant service or another lawful purpose. Our current material providers are listed in our Subprocessor List.

11. Third-party integrations

Customers may connect BizPilot to third-party products. When a Customer enables an integration, the Customer instructs or authorises BizPilot to exchange information with the relevant provider as required for that functionality. Independent third parties have their own contractual and privacy practices.

12. Payments

Payments may be processed through external providers such as Stripe. BizPilot minimises direct storage of payment-card information where payment providers can process it securely. Third-party payment providers may process information under their own privacy policies.

13. Overseas processing

BizPilot may use infrastructure and service providers located outside Australia. Where applicable law requires BizPilot to take particular steps in connection with overseas disclosure, we will take reasonable steps required by that law. BizPilot maintains a current public Subprocessor List identifying material processing locations.

14. Security

BizPilot uses technical and organisational measures designed to protect information. Depending on the system and risk, these may include encrypted communications; encryption at rest where implemented; authentication; MFA; role-based access; least-privilege controls; audit logging; monitoring; vulnerability management; secure development; backups; recovery procedures; incident response; and vendor risk controls. See our Security & Trust Centre.

No online system can guarantee absolute security. Customers are responsible for protecting their credentials, devices and user permissions.

15. Data breaches

BizPilot maintains procedures to identify, investigate, contain and respond to suspected data breaches. Where applicable law, including the Notifiable Data Breaches scheme, requires notification, BizPilot will take appropriate notification steps.

16. Data retention

BizPilot may retain information for as long as reasonably necessary to: provide services; comply with law; maintain payroll/employment records; maintain financial records; provide support; protect security; prevent fraud; resolve disputes; and enforce agreements. Retention periods may differ depending on the record and jurisdiction. Information may remain temporarily in secure backups following deletion from active systems.

17. Access and correction

Individuals may request access to or correction of personal information in accordance with applicable law. Where BizPilot processes information on behalf of a Customer, the request may be referred to the Customer. BizPilot may reasonably assist Customers in responding to legitimate privacy requests.

18. Marketing

BizPilot may send marketing communications where lawful. Marketing preferences remain separate from acceptance of contractual Terms. Users may unsubscribe from marketing. Unsubscribing does not prevent necessary security, account, employment, payroll, transactional, booking or service communications.

19. Cookies

BizPilot may use cookies and similar technologies for authentication, security, preferences, analytics, performance and functionality. Further information is contained in our Cookie Policy.

20. Children

BizPilot is primarily a business-management platform and is not designed to be marketed directly to children. Where a Customer lawfully processes information relating to a minor, the Customer remains responsible for appropriate authority and lawful handling.

21. Privacy complaints and enquiries

Contact: Privacy & Complaints Officer, NEXA DIGITAL PTY LTD trading as BizPilot, ABN 39 676 911 309, 1/22 O'Connell Street, North Adelaide SA 5006, Australia. Email: complaints@bizpilot.com.au

We will investigate privacy complaints and endeavour to respond within a reasonable period. Individuals may also have the right to lodge a complaint with the Office of the Australian Information Commissioner (OAIC).

22. Changes

We may update this Privacy Policy. The current version will display its effective date. Material changes may be separately communicated where appropriate. Historical versions are retained.

NEXA DIGITAL PTY LTD trading as BizPilot · ABN 39 676 911 309

1/22 O'Connell Street, North Adelaide SA 5006, Australia

Privacy, complaints and legal enquiries: complaints@bizpilot.com.au