WorkProof training courses - last updated 2026-09-07
This notice tells you how we collect, use, and protect your personal information when you purchase or complete a training course on this website.
We are Creative Directions Management Consulting Pty Ltd (ACN 655 132 166, ABN 78 655 132 166), operating under the name WorkProof. We are the business that provides these training courses, and we are responsible for handling your personal information in accordance with the Privacy Act 1988 (Cth).
Privacy contact: support@workproof.com.au
2.1 Information You Provide Directly. When you purchase or access a Course, we collect: your name (to issue your Certificate of Completion and personalise your learning); your email address (to send you login details, course access, completion certificates, and service messages); payment information (processed by Stripe - see section 5 below; we do not store your complete card details).
2.2 For Purchases of $1,000 or More. If your purchase totals $1,000 or more (including GST), we are required by taxation law to issue a tax invoice containing your business name (if applicable) and, if you choose to provide it, your Australian Business Number (ABN). This information is collected solely to comply with GST and tax invoice requirements. You are responsible for the accuracy of any business name or ABN you provide - we do not verify it, and printing it records only what you told us.
2.2A Optional Billing Address (Company and Business Accounts Only).
If you purchase through a company or business account, you may choose to enter a billing address for your organisation. This field is optional. You do not have to provide it, and your purchase, your tax invoice and your course access do not depend on it. The field is not available on individual accounts.
We collect this address for one purpose only: so that it can be printed on your tax invoice - for example, so the invoice matches your organisation’s accounts-payable records. It is not required by GST or tax invoice law, and we do not use it for anything else.
The billing address is held on the order record for that purchase, and nowhere else. It is kept, and deleted, on the same terms as that order record under section 6.2 (Retention).
2.3 Information Collected Automatically. When you use the website and complete a Course, we automatically collect: Course progress and completion data (which lessons you have accessed, when you completed them, your assessment scores); Certificate details (the date you completed the Course, your final score, and a unique certificate identifier); IP address and device information (for security, fraud prevention, and to deliver the website).
2.4 Public Certificate Verification Data. When we issue your Certificate of Completion, the following information becomes publicly searchable through our certificate verification system (available to anyone who enters your certificate ID): your full name as it appears on the certificate; the Course title; your completion date; your assessment score; the unique certificate identifier. This public verification is provided so that employers, clients, and others can confirm your completion. You do not choose whether your certificate is verifiable - this is a standard feature of all our certificates.
2.5 Account Verification Emails and Security Logging. When you create an account or make a purchase, we send an email to the address you supplied so that you can confirm it is yours. If you ask us to reset your password, we send a reset link to that address. These are transactional and security communications, not marketing, and you cannot opt out of them while you hold an account.
To do this we generate a one time token. Email-confirmation tokens expire 24 hours after they are issued; password-reset tokens expire 1 hour after they are issued. Every token is stored only as a cryptographic hash, never in plain text, can be used once, and is deleted when it is used or when it expires.
We keep a short rolling security log of requests to our service. That log holds only the most recent 200 request entries; as new requests arrive, the oldest entries are overwritten, so the period any single entry is held depends on how busy the service is. We also keep rate limiting records for each request key; these are removed 24 hours after the last request on that key, except that where a temporary lockout is in force the record is kept until the lockout ends. These records include the IP address from which the request was made.
We handle this information in accordance with the Privacy Act 1988 (Cth) and the Australian Privacy Principles.
3.1 Team and Site Licences. If your employer (or another organisation) purchases a Course Seat on your behalf, we collect your personal information in two stages: (a) from the purchaser at the time of purchase, they provide us with basic details about the Seats they are purchasing, but at this stage they do not usually provide us with your name or contact details; (b) from you when you activate your Seat - when you receive an Enrolment Code from your employer and activate it on our website, you provide your name and email address directly to us. From that point, we handle your information as described in this notice.
3.2 What Your Employer Can See. If your employer purchased your Seat: they can see whether you have activated your Seat, whether you have completed the Course, your completion date, and your assessment score. They cannot see your individual lesson progress, your responses to assessment questions, or any other personal learning data beyond completion status. Your Certificate of Completion is issued in your name, and you retain access to it through your own account even after your employment ends.
3.3 Consent and Access. By activating an Enrolment Code provided by your employer, you consent to us disclosing your completion status and assessment score to the organisation that purchased the Seat. If you have concerns about this, please discuss them with your employer before activating your Seat. Under the Privacy Act, you have the right to access the personal information we hold about you (see section 7 below).
We collect and use your personal information for the following purposes: (a) to provide the Course to you - creating your account, delivering course content, tracking your progress, issuing your certificate; (b) to process your payment - via Stripe (see section 5); (c) to communicate with you about your Course - sending you login details, access reminders, completion notifications, and responding to your support requests; (d) to meet our legal obligations - issuing tax invoices for purchases over $1,000, retaining completion records for verification, and complying with Australian tax and consumer law; (e) to improve our courses and website - analysing course completion rates and assessment results (in de-identified or aggregated form) to improve content quality; (f) direct marketing, with your consent - see 4.1.
4.1 Direct Marketing and Your Right to Opt Out. We will only send you marketing communications if you have opted in to receive them. You can opt out at any time by clicking the “unsubscribe” link in any marketing email, or emailing us at support@workproof.com.au with “Opt out” in the subject line. Opting out of marketing does not affect essential service messages (such as your course access details, completion notifications, or refund confirmations).
5.1 Stripe (Payment Processing). All payments are processed by Stripe Payments Australia Pty Ltd. When you make a purchase, Stripe collects and processes your payment card details, billing address, and transaction information. We do not receive or store your complete card details. Stripe is a United States-based company. Your payment information is transmitted to and processed by Stripe, including on servers located outside Australia. Stripe’s privacy policy is available at: stripe.com/au/privacy.
5.2 Email Service Provider. We use Resend to send you emails (such as course access details, completion notifications, and password resets). This provider processes your name and email address on our behalf. Resend is based in the United States. Your name and email address may be processed on servers outside Australia.
5.3 Hosting and Infrastructure. Our website and course platform are hosted on servers provided by DigitalOcean in Sydney, Australia. Your personal information is stored on Australian servers, except as disclosed in sections 5.1 and 5.2 above.
5.4 Employers and Organisations (for Team Licences). If your Course Seat was purchased by your employer or another organisation, we disclose the following information to that organisation: whether you have activated your Seat; whether you have completed the Course; your completion date and assessment score. We do not disclose your lesson-by-lesson progress, individual assessment responses, or other detailed learning data.
5.5 Public Certificate Verification. As described in section 2.4, your name, Course title, completion date, and assessment score are publicly searchable by anyone who enters your certificate ID into our verification system.
5.6 Required by Law. We may disclose your personal information if required or authorised by law, including to law enforcement agencies, regulatory bodies, or in response to a subpoena or court order.
6.1 Security. We take reasonable steps to protect your personal information from misuse, interference, loss, and unauthorised access, modification, or disclosure. These steps include hosting our platform on secure servers in Australia (DigitalOcean Sydney), using encryption for data transmission (HTTPS/TLS), restricting access to personal information to authorised personnel only, and regularly reviewing our security practices. No method of transmission over the internet is 100% secure. While we take reasonable precautions, we cannot guarantee absolute security.
6.2 How Long We Keep Your Information. We retain your personal information for as long as necessary to: provide you with ongoing access to your account and certificate (indefinitely, unless you request deletion); meet our legal obligations, including tax record-keeping requirements (minimum 7 years for tax invoices and transaction records); resolve disputes and enforce our agreements. If you close your account or request deletion of your information (see section 7.3), we will delete or de-identify your personal information, except where we are required by law to retain it (such as for tax or verification purposes).
7.1 Access to Your Information. You have the right to request access to the personal information we hold about you. Email support@workproof.com.au with “Access Request” in the subject line, and provide sufficient detail for us to identify your account. We will respond within 30 days. There is no charge for a standard access request. In some cases, we may need to verify your identity before providing access.
7.2 Correcting Your Information. If your personal information is inaccurate, out of date, incomplete, or misleading, you can request that we correct it - log in to your account and update your profile details, or email support@workproof.com.au with the details you wish to correct. We will respond to correction requests within 30 days. If we refuse to correct information, we will give you a written notice explaining why.
7.3 Deleting Your Information. You may request that we delete your personal information by emailing support@workproof.com.au. We cannot delete information we are required by law to retain (such as tax invoice details and transaction records). Deleting your account will remove your access to certificates and completion records. Public certificate verification data may remain available for a period after deletion to allow third parties to verify certificates previously issued.
7.4 Complaints. Contact us first - email support@workproof.com.au with details of your concern; we will acknowledge within 2 Business Days and investigate and respond within 30 days. If you are not satisfied with our response, you may lodge a complaint with the Office of the Australian Information Commissioner (OAIC): oaic.gov.au, phone 1300 363 992, email enquiries@oaic.gov.au.
We may update this Collection Notice from time to time to reflect changes in our practices or legal obligations. The “last updated” date at the top of this notice shows when it was last revised. We will not reduce your rights under this notice without your consent.
See also our Terms of Sale.
