Privacy Policy and Collection Notice

Version v2.2

Effective date: 29 October 2026

Version 2.2, last updated 29 October 2026

This document is both our privacy policy and the notice we give you when we collect your personal information. It explains what we collect, why, who sees it, how long we keep it and what you can do about it.

1. Who We Are

We are Creative Directions Management Consulting Pty Ltd (ACN 655 132 166, ABN 78 655 132 166), trading as WorkProof. We provide the training courses on this website and we are responsible for handling your personal information under the Privacy Act 1988 (Cth) and the Australian Privacy Principles. We apply those principles to everything we do, whether or not the Act requires it of a business our size.

Privacy contact: contact@workproof.com.au

2. What We Collect

2.1 Information you give us. When you buy or access a Course, or accept an invitation to a WorkProof Current plan, we collect: your name, to issue your Certificate of Completion and personalise your learning; your email address, to send login details, course access, certificates and service messages; and payment information, which is processed by Stripe (section 5.1). We do not store your full card details.

2.2 Business details for tax invoices. For purchases of $1,000 or more (including GST), tax law requires us to issue a tax invoice with your business name (if applicable) and, if you choose to give it, your ABN. We collect this only to meet GST and tax invoice requirements. You are responsible for its accuracy; we do not verify it.

2.3 Optional billing address (Company Accounts only). A Company Account may enter a billing address for its organisation. This is optional, and your purchase, invoice and access do not depend on it. We collect it for one purpose only: to print on your tax invoice so it matches your accounts-payable records. It is held on the order record and kept, and deleted, on the same terms as that record (section 6.2).

2.4 WorkProof Current plan billing. If your organisation buys a WorkProof Current plan, we collect what we need to sell, invoice and renew it: the organisation's legal name or registered business name, its ABN if it gives one, and its billing address if it gives one; the name and email address of its billing contact; the name, email address and, if given, phone number of each of its account administrators; its plan tier; whether it was counted among the first 100 companies (we never tell an organisation its position); and a record of each quote, order form, acceptance, tax invoice, payment, refund and adjustment note.

If the plan is bought on this website, Stripe saves the card used at checkout so that we can charge it for the plan's automatic renewal (section 5.1). We hold only the card type, its last four digits, its expiry date and Stripe's references to it, never the full card number. We also keep: the record of the organisation's agreement to save and charge the card (the wording shown and its version, the date and time, the version of our Terms of Sale, and Stripe's reference to the checkout); the automatic renewal setting and each change to it, with which account administrator made it and when; and each renewal notice, charge, card try, reminder and refund, with its result. We do not store the internet (IP) address used at checkout; Stripe keeps its own records of the payment.

When an account administrator adds, edits or removes another account administrator, or assigns or removes a Course, we record which administrator's account made the change and when, as part of the plan's records (section 6.2).

2.5 Information collected automatically. When you use the website and complete a Course we collect: course progress and completion data (which lessons you accessed and when, and your assessment scores); certificate details (completion date and a unique certificate identifier); and IP address and device information, for security, fraud prevention and to deliver the website. If you are named on a WorkProof Current plan, we also record the date and time you accepted the invitation, or the date and time we added you to the plan at your organisation's request, and the date, time and version of the plan notice we showed you before your first plan Course (section 3.2). We keep this because it shows you were told how the plan works before you started.

2.6 Public certificate verification. When we issue a Certificate of Completion, the following becomes searchable by anyone who enters the certificate identifier into our verification page: your full name as it appears on the certificate, the Course title, your completion date, the certificate identifier and the certificate's status. This lets employers, clients and others confirm your completion. Every certificate is verifiable; this is not optional, and it is a standard feature you should expect when you complete a Course. The status is "Current" unless we have withdrawn the certificate under clause 4.2(b) of our Terms of Sale, because the assessment was not completed by you alone; it then shows "Withdrawn". A refund never withdraws a certificate or changes its status. The page does not show your assessment score and does not name your employer. A certificate is never shown as expired, and nothing done later changes its completion date.

2.7 Account verification emails and security records. When you create an account or make a purchase we email the address you gave so you can confirm it is yours, and if you ask to reset your password we email a reset link. These are transactional security messages, not marketing, and you cannot opt out of them while you hold an account. The one-time tokens behind them are stored only as cryptographic hashes, can be used once, and are deleted when used or expired (email confirmation tokens after 24 hours, password reset tokens after one hour). We also keep a short rolling log of requests to the service, and rate-limiting records for each request key, which include the IP address the request came from. Log entries are overwritten as new requests arrive; rate-limiting records are removed 24 hours after the last request on that key, or when a temporary lockout ends.

2.8 Website analytics. We use Google Tag Manager (Google LLC) and Microsoft Clarity (Microsoft Corporation) to understand how visitors use the website, including which pages are viewed, how far people scroll and where they click. These tools set cookies or similar identifiers and record how you interact with pages. They do not record what you type into forms or assessments. Both providers are based in the United States and process this data on servers outside Australia. You can block these tools with your browser's cookie controls or a tracker-blocking extension; the website works without them.

3. When Someone Else Buys Training for You

3.1 Course Seats bought by an employer. If your employer or another organisation buys a Course Seat for you, we usually collect your details in two stages: the purchaser tells us how many Seats it is buying, generally without your name; and you give us your name and email address yourself when you activate your Enrolment Code. From that point we handle your information as this Policy describes.

3.2 WorkProof Current plans: when an organisation names you. If your employer, or another organisation you work for, holds a WorkProof Current plan, it names you by entering your name and email address in its Company Account or by giving them to us. That is the first time we receive your details, and we receive them from that organisation, not from you. The organisation has confirmed to us that you agreed to be named and that it has told you where to read this Policy. We then email you an invitation to create or sign in to your own Learner account. The invitation stays open for 14 days. If you do not want to join the plan, do not accept the invitation and tell the organisation. We hold your name and email address only while the invitation is open, and we delete them if it is not accepted within those 14 days. The organisation also chooses which Courses you can do under its plan by assigning them to you, and may add or remove a Course at any time. We record which Courses it assigned to you and when each was added or removed. Under the plan you can open only the Courses assigned to you. The organisation can take you off its plan when you leave it and, in the 30 days starting on each renewal date of its plan, for any reason.

Before you start your first Course under the plan, we show you a short notice that explains how the plan works for you, and we ask you to confirm you have read it. It covers what the organisation can see (section 3.3), what happens when you leave it, when it takes you off its plan, or when its plan ends (section 3.3), and what happens if the organisation takes the plan's 30 day money back refund (section 3.5). Your account is yours: it is in your name, uses your own email address, and stays yours after you leave the organisation or its plan ends.

3.3 What your employer can see. If your employer bought your Course Seat or named you on a WorkProof Current plan, it can see: whether you have activated the Seat or accepted the plan invitation; which Courses it has assigned to you under a plan; whether you have started each assigned Course; which Courses you have completed under that Seat or plan; your completion dates; and your assessment scores. Each of its account administrators can see this. It cannot see your lesson by lesson progress, your answers to assessment questions, or any other personal learning data. Your Certificate of Completion is issued in your name, and you keep access to it through your own account after you leave that employer.

For a plan, these results are kept in the organisation's training register in its Company Account.

If you leave, or the organisation takes you off its plan. When the organisation takes you off its plan in its Company Account, your access under its plan ends at once. Your own account is not closed and you keep every certificate you have earned. The organisation keeps, in its training register, the record of plan Courses you completed before it took you off, because that is its own training record. From that moment it cannot see anything you do later in your account, for example a Course you buy for yourself.
If the plan ends. For 12 months after the plan ends, we send the organisation a copy of its training register when one of its account administrators asks us. After that, we send the organisation a copy on request for as long as we still hold the records (section 6.2). This does not apply if the organisation took the plan's 30 day money back refund (section 3.5). The organisation cannot see anything you do in your account after its plan ends.

3.4 Consent. By activating an Enrolment Code or accepting a plan invitation, you consent to us disclosing your completion status, completion dates and assessment scores for Courses you complete under that Seat or plan to the organisation that provided it, and to that organisation keeping them as section 3.3 describes, including after you leave it and, by a copy we send when it asks, for 12 months after its plan ends and afterwards while we still hold the records, unless it took the plan's 30 day money back refund. If you have concerns about that, raise them with the organisation before you activate or accept. Your right to access the information we hold about you (section 7) is not affected.

3.5 If the organisation takes the plan's 30 day money back refund. A WorkProof Current plan comes with a 30 day money back guarantee for the organisation that buys it, in its first plan year only. If the organisation takes that refund: your access under the plan ends; you keep, in your own account, every certificate you earned through the plan, and none is withdrawn; the organisation can no longer see your name, your results or your certificates in its Company Account, and we do not send it a copy; and any plan Course assigned to you that you have not completed, whether you started it or not, is blocked. You can buy that Course yourself, and for a Course you started you continue from where you stopped.

4. How We Use Your Information

We use your personal information: (a) to provide your training — creating your account, delivering Courses, tracking your progress and issuing certificates; (b) to process payments through Stripe, including charging a card an organisation saved for its plan's yearly renewal, with the further tries our Terms of Sale describe, and to issue and record quotes, order forms, tax invoices, adjustment notes and refunds; (c) to communicate with you about your training — login details, access reminders, plan notices, renewal notices and reminders, completion notifications and replies to your support requests; (d) to meet our legal obligations — tax invoices, retaining completion records for verification, and complying with tax and consumer law; (e) to improve our Courses and website, using completion rates and assessment results in de-identified or aggregated form; (f) for direct marketing, only with your consent (section 4.1).

4.1 Direct marketing. We send marketing email only if you have opted in. You can opt out at any time by using the unsubscribe link in any marketing email or emailing contact@workproof.com.au with "Opt out" in the subject line. Opting out does not stop essential service messages such as course access details, plan notices, renewal notices, charge, card and reminder emails, a notice that we will not renew a plan, the email telling a person they have been made an account administrator, a notice that a certificate has been withdrawn, completion notifications and refund confirmations.

5. Who We Share Your Information With

5.1 Stripe (payments). Payments made on this website are processed by Stripe Payments Australia Pty Ltd, part of the Stripe group, which is headquartered in the United States. Stripe collects your card details, billing address and transaction information; we do not receive or store your full card details. Your payment information is transmitted to and processed by Stripe, including on servers outside Australia. Stripe's privacy policy: stripe.com/au/privacy. For a WorkProof Current plan bought on this website, Stripe also stores the card used at checkout so that we can charge it for the plan's automatic renewal; we hold only its type, last four digits, expiry date and Stripe's references to it.

5.2 Resend (email). We use Resend to send our emails. Resend processes your name and email address on our behalf, is based in the United States, and may process them on servers outside Australia.

5.3 Hosting. Our website and course platform are hosted by DigitalOcean in Sydney, Australia. Your personal information is stored on Australian servers, except as described in sections 2.8, 5.1 and 5.2.

5.4 Analytics providers. Google LLC and Microsoft Corporation receive the website usage data described in section 2.8, in the United States.

5.5 Employers and organisations. Section 3.3 describes what we disclose to an organisation that provides your Seat or names you on a plan, including after you leave it and after its plan ends.

5.6 Public certificate verification. Section 2.6 describes what is searchable through our verification page.

5.7 Required by law. We may disclose personal information where the law requires or authorises it, including to law enforcement or a regulator, or in response to a subpoena or court order.

5.8 Overseas disclosures. The overseas recipients named in this Policy are in the United States. Where we disclose personal information overseas we take reasonable steps to ensure the recipient handles it in a way consistent with the Australian Privacy Principles, including through our contracts with those providers. We do not sell personal information to anyone. If section 5.9 names a place outside Australia, that place is added to this list.

5.9 Invoicing and accounts. For a purchase made on this website, including a WorkProof Current plan bought online, we issue the tax invoice from this website, and any adjustment note the law requires. We keep our accounting records in Zoho Books, an online accounting service from Zoho, using an account held in our own name (Creative Directions Management Consulting Pty Ltd, ABN 78 655 132 166). For a quoted plan, a move to a bigger plan tier, and any invoice or adjustment note we issue from Zoho Books, Zoho Books holds the organisation's invoice details and the name and email address of its billing contact on our behalf, in Zoho's Australian data centre.

5.10 Decisions our website makes automatically. Some decisions that affect you are made by our website without a person reviewing each one: (a) for an organisation's plan, charging its saved card on the day our Terms of Sale set, trying a failed card again, and ending a plan that is not paid by its last day; (b) ending a named worker's access to a plan when the organisation takes the worker off its plan or the plan ends, and blocking plan Courses the worker has not completed when the organisation takes the plan's 30 day money back refund; and (c) whether an assessment is passed, and so whether a Certificate of Completion is issued. These use the information in sections 2.1, 2.4 and 2.5: names and email addresses, plan and payment records, which Courses are assigned, and course progress and assessment results. If you think one of these decisions is wrong, contact us (section 7) and a person will review it.

6. How We Protect and Keep Your Information

6.1 Security. We take reasonable steps to protect personal information from misuse, interference, loss and unauthorised access, modification or disclosure, including hosting on Australian servers, encrypting data in transit (HTTPS/TLS), limiting access to authorised people, and reviewing our security practices. No internet transmission is completely secure, and we cannot promise absolute security.

6.2 How long we keep it. We keep personal information only as long as we need it for the purposes in this Policy or as the law requires:

When information is no longer needed we delete it or de-identify it.

6.3 If there is a data breach. If personal information we hold is lost or accessed without authorisation and that is likely to cause serious harm, we will tell the people affected and the Office of the Australian Information Commissioner as soon as practicable, and tell you what you can do to protect yourself.

7. Your Rights

7.1 Access. You may ask for a copy of the personal information we hold about you. Email contact@workproof.com.au with "Access Request" in the subject line and enough detail to identify your account. We respond within 30 days, there is no charge for a standard request, and we may need to verify your identity first.

7.2 Correction. If your information is inaccurate, out of date, incomplete or misleading, you can update your profile in your account or email us the correction. We respond within 30 days, and if we refuse a correction we tell you why in writing.

7.3 Deletion. You may ask us to delete your personal information by emailing contact@workproof.com.au. We cannot delete what the law requires us to keep (such as tax records), and we keep certificate verification records for the period in section 6.2 so that certificates already issued can still be checked. Deleting your account removes your access to your certificates, so download them first. If you were named on a WorkProof Current plan, deleting your account does not remove the record of plan Courses you completed from the organisation's training register for the period in section 6.2, because that record is also the organisation's own training record, and it cannot undo a copy the organisation already holds. This does not apply after the organisation took the plan's 30 day money back refund (section 3.5). If you are an account administrator and we delete your account at your request, you stop being an account administrator straight away. We delete your phone number and keep your name and email address only within the plan records in section 6.2, because they show who made changes to the organisation's plan. If you were the organisation's only account administrator, we tell the organisation so that it can name another.

7.4 Complaints. Email contact@workproof.com.au with the details. We will acknowledge your complaint and respond as soon as reasonably practicable, and tell you if we need more time and when you can expect our response. If you are not satisfied, you may complain to the Office of the Australian Information Commissioner: oaic.gov.au, 1300 363 992, enquiries@oaic.gov.au.

8. Changes to This Policy

We may update this Policy when our practices or the law change. The version and date at the top show when it was last revised. A change that reduces your rights under this Policy will not apply to information we already hold without your consent.