iComply Australia privacy policy

iComply Australia privacy policy

Version 0.9. Last updated 14 October 2026.

1. Who we are

In short: iComply Australia is an Australian business. You can reach us about privacy at any time by email.

iComply Australia ("iComply", "we", "us") provides a web platform that helps schools, sports clubs, charities, peak bodies and other organisations ("organisations") keep a register of the people they engage: contractors, program providers, volunteers and hirers ("providers"), and, for clubs and charities, their Board, staff, coaches and volunteers ("people"), together with the checks and documents they hold.

This policy explains how we handle personal information under the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs). It covers this website and the iComply platform at app.icomplyaustralia.com.au and organisations' own addresses (for example yourclub.icomplyaustralia.com.au).

Privacy contact: hello@icomplyaustralia.com.au.

When an organisation uses iComply, it decides what its people and providers must hold and who can work with children. In most cases we handle that information on the organisation's behalf. Organisations have their own privacy obligations and policies, which also apply.

2. What personal information we collect

In short: Contact and account details, the checks and documents people record or upload, sign-in and audit records, and, for directory plans, billing and listing details. We do not take payment card details.

We do not take or store payment card details. Invoices are paid by bank transfer or the organisation's usual process.

You can contact us without identifying yourself (APP 2), but we need your name and email to give you an account.

3. Checks, police checks, interviews and other sensitive information

In short: Some of what people record deserves extra care. We keep only what the organisation needs, and police check certificates aren't stored unless the organisation chooses to.

A WWCC number, card or clearance status, a police check result and some licences may be or may reveal sensitive information, and some state laws restrict how WWCC information is used. We collect this only with consent, given when you upload or record it, or from the organisation that engages you, and only so that organisations you are linked to can see whether you meet their requirements.

• Register checks: iComply records what people enter and upload. Unless a screen says otherwise, we do not check documents or WWCC numbers against government registers. Where an organisation records that it checked an official register, we show who checked and when. Organisations remain responsible for the official checks the law requires of them.
• Police checks: by default we record only the date a National Police Check was seen and its result category. We don't keep a copy of the certificate unless the organisation turns certificate copies on. We do not ask for details of any criminal history; please don't enter more than your organisation's policy needs.
• Interviews: if an organisation uses them, we record the date, the interviewers, the format, answers to its child-safety questions, the outcome and the reason. Private interview notes are visible only to the organisation's admins.
• Reimbursements: if an organisation pays back check fees, we keep the receipt, the amount, the approval or rejection with its reason, and the date and payment reference the organisation records when it pays. We don't collect bank account details and we never hold or move money.
• We never use this information for marketing, profiling or any purpose other than the organisation's compliance records.

4. Clubs, charities and peak bodies

In short: The organisation decides what to record about its people and is responsible for it. We handle it on the organisation's behalf.

• Who is responsible: a club, charity or other organisation decides which checks its people need and what it records. It is responsible for that information and for answering its people's privacy questions. We store and process it on the organisation's behalf, only to run iComply for it. If your organisation needs a data processing agreement with us, email us.
• Personal links: people can be sent a personal link to see what's needed, add their checks, sign policies and claim fees. The link works without a password for 30 days. Anything added through it counts only once an admin approves it.
• Peak bodies: a club links to an association only when one of its admins accepts. The association sees counts (how many people are compliant, expiring or overdue), not names or details, unless the club chooses to share more. Every time the association views a club, it is written to that club's activity log.
• Support acting on your behalf: our staff can act inside an organisation's account only with a recorded reason, for a limited time (up to 60 minutes), and every such session is logged in the organisation's activity log.
• Under 18s: some clubs record young volunteers or junior coaches. The organisation is responsible for getting any consent needed from a parent or guardian.

5. How we collect it

In short: Mostly from you directly, or from the organisation that invites you.

• From you, when you sign up, complete your profile, upload documents or contact us.
• From an organisation, when it invites its staff, adds a provider or person (for example name and email), or records a check it has seen.
• Automatically, when you use the platform (sign-in events, audit records and IP addresses).

If an organisation gives us your details, the invitation email tells you who we are and links to this policy (APP 5).

6. Why we use it

In short: To run the service: show organisations whether people meet their requirements, remind people before anything expires, keep accounts secure, run the directory, and invoice.

• To provide the register, the provider portal, personal links, the front-desk kiosk and match-day lists.
• To show each organisation whether a person's or provider's records meet that organisation's requirements.
• To send service emails and push notifications, such as invitations, expiry reminders and approval notices.
• To run the provider directory, enquiries and reviews for providers who choose a directory plan.
• To secure accounts, investigate misuse and keep an audit trail.
• To invoice organisations and providers on directory plans, and manage trials.
• To answer enquiries and provide support.
• To meet legal obligations.

We do not sell personal information, and we do not use it for third-party advertising. We use it only for the purpose we collected it for, or a related purpose you would reasonably expect, unless the law permits otherwise (APP 6). We do not send direct marketing to providers or to people in an organisation's register. If we email organisation contacts about the product, every message has an unsubscribe option (APP 7).

7. Provider directory and reviews

In short: A directory listing is public only if the provider chooses a plan. Documents are never public. Reviews never name the organisation that wrote them.

• A provider's compliance profile is private. Only a provider on a paid directory plan (Listed, Preferred or Partner) appears in directory search, with the profile they write. Compliance documents, contact details and ABNs are never shown in the directory.
• Reviews are written only after real work logged in iComply. Public review text describes the organisation in general terms (for example "A primary school in VIC") and never names it. Comments and replies are public only after we moderate them.
• A provider's profile shows how many organisations work with them. An organisation's name appears only if one of its admins agrees, and it can withdraw that at any time.

8. Who we share it with

In short: Providers choose which organisations see their file. Each organisation sees only its own register. We use a small number of service providers to run the platform.

Organisations

A provider's profile and documents are visible only to organisations the provider has linked with, by accepting an invitation or joining. Each organisation approves providers separately, and one organisation cannot see another's register, approvals or sign-ins. A person's record in a club or charity is visible only to that organisation's admins (and, as counts only, to a peak body the club has linked to).

Service providers

These providers may only use the information to provide their service to us. We may also disclose information where the law requires or authorises it, for example to a regulator or law enforcement body.

9. Overseas processing (APP 8)

In short: Your register and documents are stored in Sydney. A few supporting services process data overseas: email delivery (Japan), virus scanning and optional insurance read assist (United States).

• Email: service emails are sent through Resend's Tokyo, Japan region. The recipient's name, email address and the content of the email (for example a document name and expiry date) are processed there.
• DNS and email routing: Cloudflare operates a global network. Email sent to our domain may pass through it.
• Insurance read assist: when a provider uploads a certificate, the file may be sent to Anthropic, PBC so its software can read the dates, cover and policy details. Anthropic processes it in the United States and, under its commercial terms, does not use it to train its models. It runs only with the provider's consent: providers can untick "Read the details for me" when uploading, and schools can switch it off. A person always checks the result; the software never approves anything.
• Virus scanning: uploaded files are scanned for malware by Cloudmersive (United States) before they are stored. Infected files are rejected and not kept.

We take reasonable steps to make sure these providers handle information consistently with the APPs, including by contract. Our database (Neon) and stored documents (Vercel Blob) are hosted in Sydney.

10. How we protect it

In short: Sydney hosting, encryption, two-step sign-in, separation between organisations, and a log of every action. More on security (opens in a new tab).

• Data is stored in Sydney, Australia, and encrypted in transit (TLS) and at rest.
• Uploaded documents are scanned for malware and kept in private storage that is not publicly accessible.
• Passwords are stored only as salted hashes. Session tokens are stored only as hashes.
• Two-step sign-in (a code by email or an authenticator app) is available to everyone, and a school's admins can require it for all their staff. iComply staff must use an authenticator app. Accounts lock after repeated failed sign-ins.
• Each organisation can see only its own data, enforced in the app and, for club, charity and peak-body records, again in the database. Access within an organisation is limited by role.
• An append-only audit log records sign-ins, approvals, uploads, exports and changes.

No system is perfectly secure, but we take reasonable steps to protect personal information from misuse, interference, loss, and unauthorised access or disclosure (APP 11).

11. How long we keep it

In short: While your account is active, then 90 days so it can be exported, then deletion, except records that must be kept longer.

• Accounts, registers and documents: while the account is active. When an organisation's plan ends or a provider closes their account, we keep data for 90 days so it can be exported, then delete it.
• Superseded or expired documents: kept for 12 months after they are replaced or expire, so organisations can show what was on file at the time.
• WWC Connect records (Victoria): kept for 7 years after the person stops, as the Victorian rules require; the platform will not delete them earlier.
• Sign-in records and audit logs: 7 years, as evidence for organisations' compliance records.
• Invoices and billing records: 7 years, as tax law requires.
• Backups: overwritten on our providers' normal cycle.

When we no longer need information for any permitted purpose, we destroy or de-identify it (APP 11.2).

12. Cookies and analytics

In short: One essential cookie to keep you signed in. No analytics, advertising or tracking cookies.

The platform sets a single session cookie when you sign in. It is HTTP-only, secure and same-site, and is needed for the platform to work. This marketing website sets no cookies and uses no analytics, advertising pixels or tracking scripts. Everything it uses, including fonts and icons, is served from our own site, so no third party receives your IP address when you browse it. If you send a message through the contact form, it goes to our platform at app.icomplyaustralia.com.au and is used only to reply to you. Pages of this website ask our platform's public provider directory whether it has listings yet, to label the directory link; those requests carry no cookies or personal information.

13. Children and students

In short: We do not collect information about the children organisations serve.

iComply records the adults and volunteers who work with children, not the children themselves. We do not collect student or player names, records or images. WWCC information relates to the person who holds the check. Accounts are intended for adults; where a club records a volunteer under 18 (for example a junior coach), it does so on that person's behalf and is responsible for any consent needed.

14. Accessing and correcting your information

In short: Ask us, and we'll give you a copy or fix it, usually within 30 days and free of charge.

Providers can view and update their own details and documents in the provider portal, and people in a club's or charity's register can do the same from their personal link. You can also email us to request access to, or correction of, the personal information we hold about you (APP 12 and APP 13). We will respond within 30 days. If we refuse, we will tell you why in writing and how to complain. If the information is held for an organisation, we may refer you to it or work with it to respond.

15. Data breaches

In short: If a breach is likely to cause serious harm, we will tell you and the OAIC.

We follow the Notifiable Data Breaches scheme in Part IIIC of the Privacy Act. If we suspect a data breach, we will contain it and assess it promptly (within 30 days). If it is likely to result in serious harm, we will notify affected individuals, the organisations involved and the Office of the Australian Information Commissioner (OAIC) as soon as practicable.

16. Complaints

In short: Tell us first. If you're not satisfied, you can go to the OAIC.

Email hello@icomplyaustralia.com.au with details of your concern. We will acknowledge it within 5 business days and aim to resolve it within 30 days. If you are not satisfied, you can complain to the OAIC at oaic.gov.au (opens in a new tab) or on 1300 363 992.

17. Changes to this policy

In short: We'll post updates here and tell account holders about significant changes.

We may update this policy. The date at the top shows the current version. We will email organisation administrators and providers about significant changes before they take effect.

Last updated 14 October 2026.