iComply Australia organisation agreement

iComply Australia organisation agreement

Version 0.9. Last updated 14 October 2026.

This agreement is signed once for the whole organisation by an administrator who is authorised to bind it. Each person who uses iComply also accepts the terms of service and the privacy policy for themselves.

1. Parties and authority

This agreement is between iComply Australia ("iComply", "we", "us") and the school, sports club, charity, peak body or similar body named when it is signed (the "organisation").

If you accept these terms for an organisation or business, you confirm you are authorised to do so. The person signing records their name and title and confirms "I am authorised to bind this organisation".

2. The customer terms

The iComply terms of service (icomplyaustralia.com.au/terms (opens in a new tab)), in the version current when this agreement is signed, are incorporated into this agreement by reference and apply to the organisation, its staff and its admins. They include the pricing, trial and refund terms, what a status means, the organisation's responsibilities, acceptable use, availability and support, the Australian Consumer Law, liability, ending the service, changes and governing law. Our privacy policy (opens in a new tab) explains how we handle personal information.

3. Data processing terms

These terms record how iComply handles personal information on the organisation's behalf. The wording comes from the terms of service and the privacy policy.

3.1 Who decides

• Your organisation decides: you choose which checks your people need, approve what they submit and decide who can work with children. You are responsible for the information you record about your people and for answering their privacy requests. We handle it on your behalf, only to provide iComply.
• When an organisation uses iComply, it decides what its people and providers must hold and who can work with children. In most cases we handle that information on the organisation's behalf. Organisations have their own privacy obligations and policies, which also apply.
• Organisations own their registers and records, people own the details they add from their personal link, and providers own their documents and profiles. You give us permission to store, process and display that data only as needed to provide iComply, as set out in our privacy policy (opens in a new tab).
• We do not sell personal information, and we do not use it for third-party advertising. We use it only for the purpose we collected it for, or a related purpose you would reasonably expect, unless the law permits otherwise (APP 6).
• You must not upload information about the children you serve, such as students' or players' records.

3.2 Sub-processors

We use these service providers to run the platform:

"Section 9" in this table means section 9 of the privacy policy (Overseas processing).

These providers may only use the information to provide their service to us. We may also disclose information where the law requires or authorises it, for example to a regulator or law enforcement body.

We take reasonable steps to make sure these providers handle information consistently with the APPs, including by contract. Our database (Neon) and stored documents (Vercel Blob) are hosted in Sydney.

3.3 Security

• Data is stored in Sydney, Australia, and encrypted in transit (TLS) and at rest.
• Uploaded documents are scanned for malware and kept in private storage that is not publicly accessible.
• Each organisation can see only its own data, enforced in the app and, for club, charity and peak-body records, again in the database. Access within an organisation is limited by role.
• An append-only audit log records sign-ins, approvals, uploads, exports and changes.
• Support access: our staff act inside your account only when needed to help, with a recorded reason, for a limited time, and every such session appears in your activity log.

No system is perfectly secure, but we take reasonable steps to protect personal information from misuse, interference, loss, and unauthorised access or disclosure (APP 11).

3.4 Data breaches

We follow the Notifiable Data Breaches scheme in Part IIIC of the Privacy Act. If we suspect a data breach, we will contain it and assess it promptly (within 30 days). If it is likely to result in serious harm, we will notify affected individuals, the organisations involved and the Office of the Australian Information Commissioner (OAIC) as soon as practicable.

3.5 Export, exit and retention

• Export and exit: admins can export your people and their checks as CSV at any time. If your plan ends, we keep your data for 90 days so it can be exported, then delete it, except records we must keep by law (see our privacy policy (opens in a new tab)).
• WWC Connect records (Victoria): kept for 7 years after the person stops, as the Victorian rules require; the platform will not delete them earlier.
• Sign-in records and audit logs: 7 years, as evidence for organisations' compliance records.
• Invoices and billing records: 7 years, as tax law requires.

4. Australian Consumer Law and liability

These clauses are sections 13 and 14 of the terms of service, unchanged.

Our services come with guarantees that cannot be excluded under the Australian Consumer Law. Nothing in these terms excludes, restricts or modifies any right or remedy, or any guarantee, that cannot lawfully be excluded.

• Where the law allows us to limit our liability for failing to meet a consumer guarantee, our liability is limited to supplying the services again or paying the cost of having them supplied again.
• To the extent the law allows, we are not liable for indirect or consequential loss, or for loss caused by inaccurate information supplied by organisations, people or providers, or by an organisation's own compliance decisions.
• Otherwise, and to the extent the law allows, our total liability to an organisation or provider in any year is limited to the fees it paid us in the previous 12 months.

5. Changes

We may update these terms. We will email account holders at least 30 days before a significant change takes effect. If a change disadvantages an organisation or a provider on a directory plan, it may end its plan and receive a pro-rata refund for the unused period.

6. Governing law

These terms are governed by the laws of Victoria, Australia, and the courts of that state have jurisdiction.

Contact: hello@icomplyaustralia.com.au.