Processing of (personal) data by the entity in charge of the online application process

1. Introduction
This Privacy Policy explains how our agile software development agency,  The Dev Shop Holding Company Pty Ltd ACN 644 731 680 including its subsidiaries, The Dev Shop IP Co Pty Ltd ACN  644 731 804 and The Dev Shop Ops Co Pty Ltd ACN 644 731 840 trading as VisualR (together, “VisualR” "we", "our", or "us"), collects, uses, discloses, and protects your personal information. 

We are committed to protecting your privacy and handling your personal information in an open and transparent manner in accordance with the Privacy Act 1988 (Cth), including the Australian Privacy Principles (APPs) and any other applicable privacy laws.

This policy outlines our practices for handling personal information and provides information about your rights regarding the personal information we hold about you. By providing your personal information to us, accessing our website, or using our services, you consent to the collection, use, and disclosure of your information under the terms of this policy and agree to its terms.

It applies to all individuals who interact with us, including customers, employees, contractors, and website visitors.


2. Definitions
Australian Privacy Principles (APPs) means the principles set out in Schedule 1 of the Privacy Act.

Personal Information means information or an opinion about an identified individual, or an individual who is reasonably identifiable, whether the information or opinion is true or not, and whether the information or opinion is recorded in a material form or not.

Privacy Act means Privacy Act 1988 (Cth).

Sensitive Information means information or an opinion about an individual's racial or ethnic origin, political opinions, membership of a political association, religious beliefs or affiliations, philosophical beliefs, membership of a professional or trade association, membership of a trade union, sexual preferences or practices, criminal record, or health information.


3. Who We Are
We are an agile software development agency based in Australia, specialising in providing software development and related services to our clients. As part of our operations, we collect and manage client information through our contact form and client database.


4. Personal Information We Collect

4.1 Types of Information Collected
In the course of our business activities, we collect Personal Information that is reasonably necessary for our functions and activities, including:

• Providing products and services to clients;
• recruiting and managing employees and contractors;
• conducting marketing and promotional activities; and
• complying with legal and regulatory obligations.

The types of Personal Information we collect may include:

For clients or prospective clients: 

• Contact information: including your name, email address, mobile phone number, and company name, details about products and services purchased, and information about website interactions
• Project-related information: including project details, briefing documents, task descriptions, and other information you provide to us in relation to software development projects
• Communications: including messages submitted through our contact form and subsequent correspondence
• For employees and contractors: name, contact details, employment history, qualifications, and other information required for employment purposes;
• For website visitors: IP addresses, browser information, cookies, and information about website interactions.

We will not generally collect Sensitive Information. However you may wish to provide us with sensitive information about you from time-to-time. For example, if you are a contractor you may wish to provide us with information about your health in connection with an incident on one of our work sites. If we do collect sensitive information about you we will only do so with your consent or where the collection is required or authorised by law.

We do not collect payment details or financial information as part of our standard data collection practices.

4.2 How We Collect Personal Information
We collect Personal Information through direct interactions with you, including:

• When you complete and submit our contact form on our website
• When you communicate with us via email, phone, or in meetings
• When you provide project briefs, requirements, or other documentation
• Through our ongoing client relationship management processes

We collect Personal information directly from you unless it is unreasonable or impracticable to do so, or unless otherwise specified in this policy. We may also collect it from third parties, such as recruitment agencies, referees, third parties who supply us services and publicly available sources.


5. How We Use Your Personal Information
We use the Personal Information we collect for purposes including:

• To respond to your inquiries submitted through our contact form
• To communicate with you about projects, services, and our business relationship
• To provide you with the software development services you have requested
• To manage our client relationships and maintain our client database
• To improve our services and develop new offerings
• To comply with our legal and regulatory obligations
• For internal record keeping and administrative purposes

We primarily communicate with clients through email and project management meetings. We may also use communication platforms such as Slack for project-related discussions and updates.


6. Disclosure of Your Personal Information
We respect the confidentiality of your Personal Information and are committed to protecting it. We do not share, sell, rent, or disclose your Personal Information to third parties except in the following circumstances:

With your consent

• To service providers and contractors who assist us in our business operations;
• To website hosts
• Debt collectors
• Insurers, assessors and underwriters
• Credit reporting bodies, credit providers other information providers
• Government agencies and regulatory bodies, as required by law
• Professional advisors, such as lawyers and auditors
• To comply with legal obligations, such as responding to subpoenas, court orders, or other legal processes
• To protect our rights, property, or safety, or that of our clients or others
• Other entities within the Paramount Liquor group
• In the event of a business transition, such as a merger, acquisition, or sale of assets.

Before disclosing Personal Information to a third party, we take reasonable steps to ensure that the recipient is bound by privacy obligations that are at least as protective as those under the Privacy Act.

We will disclose your Personal Information when we outsource certain of our functions to third party service providers. The functions we may outsource include (but are not limited to): · managing the supply of our products and services (including processing invoices, receipts and payments); · establishing credit accounts and managing the credit provided to our clients; · assessing credit applications and/or guarantees (which may involve disclosures to trade referees or credit reporting bodies for those purposes); · responding to enquiries about applications, accounts, and our products and services; · conducting checks for credit worthiness and/or fraud; and/or · debt collection.

Where we disclose your Personal Information to our third party service providers we require those providers to comply with the Privacy Act and APPs. Our third party service providers will not collect, use, or disclose your Personal Information for any purpose than our own, as set out in this Privacy Policy.

We will comply with the requirements of APP 8 (cross-border disclosure of personal information) under the Privacy Act when transferring Personal Information to overseas recipients.


7. Data Security
We take reasonable steps to protect your Personal Information from misuse, interference, loss, unauthorised access, modification, or disclosure. We implement appropriate physical, technical and organisational measures to ensure a level of security appropriate to the risk, including:

• Using cloud services with appropriate security measures
• Implementing access controls to limit access to Personal Information
• Regular review and updating of our security practices

In the event of a data breach involving Personal Information that is likely to result in serious harm, we will notify affected individuals and the Office of the Australian Information Commissioner (OAIC) as required under the Notifiable Data Breaches (NDB) scheme.

While we strive to protect your Personal Information, no method of transmission over the Internet or electronic storage is 100% secure. Therefore, while we strive to use commercially acceptable means to protect your Personal Information, we cannot guarantee its absolute security.


8. Direct Marketing
We may use Personal Information for direct marketing purposes, such as sending promotional materials or updates about our products and services. In such cases, we will provide individuals with an opportunity to opt-out of receiving further marketing communications.

We will not use Sensitive Information for direct marketing purposes without an individual's consent.

We will comply with the requirements of the Spam Act 2003 (Cth) and other applicable laws when conducting direct marketing activities.


9. Data Retention
We retain your Personal Information for as long as necessary to fulfil the purposes for which it was collected, including for the purposes of satisfying any legal, accounting, or reporting requirements.

Our standard retention period for client information is 5 years from the date of last interaction or the completion of services, whichever is later. After this period, Personal Information is securely deleted or anonymized, unless we are required by law to retain it for a longer period.


10. Your Rights and Choices
Under the Australian Privacy Principles, you have the right to:

• Access your Personal Information held by us
• Request correction of your Personal Information if it is inaccurate, out-of-date, incomplete, irrelevant, or misleading
• Opt out of receiving marketing communications from us
• Make a complaint if you believe we have breached the Australian Privacy Principles

10.1. Accessing and Correcting Your Personal Information
You may request access to your Personal Information held by us or ask us to correct or update your Personal Information by contacting us using the details provided below. We will respond to your request within a reasonable timeframe.

In certain circumstances, we may deny your request to access or correct your Personal Information as permitted by law. If we deny your request, we will provide you with reasons for our decision.


11. Cookies and Analytics
Our website may use cookies and similar technologies to enhance your experience, improve our services, and for analytics purposes. You can control cookies through your browser settings, although disabling cookies may limit your ability to use certain features of our website.


12. Changes to This Privacy Policy
We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, and other factors. We will post the updated Privacy Policy on our website, and the revised policy will take effect from the date of posting.

We encourage you to periodically review this Privacy Policy to stay informed about how we collect, use, and protect your personal information.


13. How to Contact Us
If you have any questions, concerns, or requests regarding this Privacy Policy or our privacy practices, please contact us at:

Address:

• 54 Hunter Rd, Derrimut VIC 3030
• team@visualr.com.au

14. Complaints
If you believe that we have breached the Australian Privacy Principles or have a complaint about our handling of your personal information, please contact us using the details above. We will investigate your complaint and respond to you within a reasonable timeframe.

If you are not satisfied with our response, you may complain to the Office of the Australian Information Commissioner (OAIC) at www.oaic.gov.au.

Processing of (personal) data by the operator of the recruitment website

General information

This recruitment website is operated by Personio SE & Co. KG, which offers a human resource and candidate management software solution (https://www.personio.com/legal-notice/). Data transmitted as part of your application will be transferred using TLS encryption and stored in a database. The sole controller of this data within the meaning of article 24 of the GDPR is the enterprise carrying out this online application process. Personio’s role is limited to operating the software and this recruitment website and, in this context, being a processor under article 28 of the GDPR. In this case, the processing by Personio is based on an agreement for the processing of orders between the controller and Personio. In addition, Personio SE & Co. KG processes further data, some of which may be personal data, to provide its services, in particular for operating this recruitment website. We will refer to this in more detail below.

The controller

The controller under data protection law is:
Personio SE & Co. KG
Seidlstraße 3
80335 München
Tel.: +49 (89) 1250 1004
Entry in the commercial register
Commercial register entry number: HRA 115934
Registration Court: Amtsgericht München
Data Protection Officer contact: privacy@personio.com

Access logs (“server logs”)

Each access to this recruitment website automatically causes general protocol data, so-called server logs, to be collected. As a rule, this data is a pseudonym and thus does not allow for inferences about the identity of an individual. Without this data, it would, in some cases, be technically impossible to deliver or display the contents of the software. In addition, processing this data is absolutely necessary under security aspects, in particular for access, input, transfer, and storage control. Furthermore, this anonymous information can be used for statistical purposes and for optimizing services and technology. In addition, the log files can be checked and analyzed retrospectively when unlawful use of the software is suspected. The legal basis for this is §25 subsection 2 Sentence 2 TDDDG. Generally, data such as the domain name of the website, the web browser and web-browser version, the operating system, the IP address, as well as the timestamp of the access to the software is collected. The scope of this log process does not exceed the common log scope of any other site on the web. These access logs are stored for a period of up to 7 days. There is no right to object to this.

Error logs

So-called error logs are generated for the purpose of identifying and fixing bugs. This is absolutely necessary to ensure we can react as quickly as possible to possible problems with displaying and implementing content (legitimate interest). As a rule, this data is a pseudonym and thus does not allow for inferences about the identity of an individual. The legal basis for this is §25 subsection 2 Sentence 2 TDDDG. When an error message occurs, general data such as the domain name of the website, the web browser and web-browser version, the operating system, the IP address, as well as the timestamp upon occurrence of the respective error message and/or specification is collected. These error logs are stored for a period of up to 7 days. There is no right to object to this.

Use of cookies

So-called cookies are used on parts of this recruitment website. They are small text files which are stored on the device with which you access this recruitment website. As a general rule, cookies serve the purpose of ensuring secure access to a website (“absolutely necessary”), implementing certain functionalities such as standard-language settings (“functional”), improving the user experience or the performance of the website (“performance”), or placing targeted advertisements (“marketing”). On this recruitment website, we generally use only cookies that are absolutely necessary, functional or performance-related, in particular for implementing certain default settings such as language, for identifying the job advertising channel, or for analyzing the performance of a job advert via which a user accessed this recruitment website. The use of cookies is absolutely necessary for providing our services and thus for the performance of the contract (article 6 (1) b) of the GDPR). Period of storage: up to 1 month or until the end of the browser session Right to object: You can determine via your browser settings whether you allow or object to the use of cookies. Please note that deactivating cookies may result in limited or completely blocked functionalities of this recruitment website.

Rights of data subjects

If Personio SE & Co. KG as the controller processes personal data, you as the data subject have certain rights under Chapter III of the EU General Data Protection Regulation (GDPR), depending on the legal basis and the purpose of the processing, in particular the right of access (article 15 of the GDPR) and the rights to rectification (article 16 of the GDPR), erasure (article 17 of the GDPR), restriction of processing (article 18 of the GDPR), and data portability (article 20 of the GDPR), as well as the right to object (article 21 of the GDPR). If the personal data is processed with your consent, you have the right to withdraw this consent under article 7 III of the GDPR. To assert your rights as a data subject in relation to the data processed for the purpose of operating this recruitment website, please refer to Personio SE & Co. KG’s Data Protection Officer (see item B).

Concluding provisions

Personio reserves the right to adjust this data privacy statement at any point in time to ensure that it is in line with the current legal requirements at all times, or in order to accommodate changes in the services offered, for example when new services are introduced. In this case, the new data privacy statement applies to any later visit of this recruitment website or any later job application.