Privacy Policy

Last updated: 5 September 2026

FlexiConnect is operated by Code Of Things Pty Ltd (ABN 40 130 223 175) ("FlexiConnect", "we", "us"). We are bound by the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs). This policy explains what personal information we collect, why, how we hold it, who we share it with, and your rights — across the website at www.flexiconnect.au, the FlexiConnect web app, and our mobile apps (together, the "Platform").

1. Two roles: our data and your employer's data

FlexiConnect handles personal information in two ways, and it matters which one applies:

• Information we collect for ourselves. When you create an account, subscribe an Organisation, visit the website or contact support, we collect that information as the organisation responsible for it under the Privacy Act.
• Worker information an Organisation enters or invites into the Platform. Organisations use the Platform to manage their own casual workers. The Organisation decides what worker information to collect and why; we store and process it on the Organisation's behalf to provide the Platform. If you have a question about why an Organisation holds particular information about you, ask the Organisation first — and we will help it respond.

The Privacy Act's employee-records exemption may apply to how an Organisation handles the records of its own employees or workers. FlexiConnect is not the employer, and we do not rely on that exemption for information we process on an Organisation's behalf. We handle all personal information on the Platform under the APPs, regardless of whether an exemption might apply to the Organisation itself.

2. What we collect

We collect information directly from you where practical. Worker profile information is usually entered by the Organisation that registers or invites the worker.

We do not collect billing card data — Organisation subscriptions are invoiced manually and we do not process online payments. We do not, by design, collect health or medical information. If an Organisation enters sensitive information (for example, in a free-text note) that is outside what the Platform is designed to hold, we discourage it, and responsibility for that information rests with the Organisation that entered it.

3. Why we collect and use it

We collect, hold and use personal information to:

• run rosters, release shifts to the workers an Organisation targets, and record accept/withdraw outcomes;
• deliver shift notifications by push, email or SMS;
• provide support and respond to enquiries;
• keep the Platform secure, prevent fraud and misuse, and debug problems;
• improve the Platform using aggregated, de-identified usage information; and
• comply with our legal obligations.

We do not sell personal information, we do not use it for advertising, and we never expose one Organisation's data about a worker to another Organisation — a worker's shift history, attendance or activity with one employer is never visible to a different employer, even where the same worker is registered with both.

4. Worker age and eligibility

Workers do not sign themselves up to FlexiConnect. A worker's profile is created only when an Organisation registers or invites them. Where a worker is under 18, the inviting Organisation is responsible for obtaining any consent required before registering that worker on the Platform. [Pending lawyer confirmation — see draft-review checklist.]

5. Direct marketing and communications

• Shift notifications (a shift becoming available, being filled, or a reminder) are part of the Platform and are sent to workers based on how their Organisation targets shifts and their own notification settings.
• Marketing from us is sent only where the law allows and always with a working unsubscribe. We comply with the Spam Act 2003 (Cth).
• Messages from your Organisation sent through the Platform are the Organisation's communications; Organisations must only message their own registered workers.

6. Who we share information with

• Your employer(s) on the Platform. Worker information is visible to authorised staff of the Organisation(s) that registered that worker. Organisations cannot see each other's data.
• Service providers who help us run the Platform, under contracts that limit what they may do with the data:
  • Amazon Web Services — hosting, storage, and email and SMS delivery (Sydney, Australia);
  • Neon Inc. — the managed database service that stores the Platform's records, hosted in Sydney, Australia;
  • Cloudflare, Inc. — the content delivery network and edge security service that all web and app traffic to the Platform passes through;
  • Google — Firebase Cloud Messaging, used to deliver push notifications to Android and iOS devices;
  • Apple — push notification delivery to iOS devices via APNs.
• Authorities — where disclosure is required or authorised by law, such as a court order, or where necessary to prevent a serious threat to someone's life, health or safety.
• A buyer or successor — if our business is sold or restructured, on terms that keep this policy's protections in place.

7. Overseas disclosure

Platform data is stored in Australia (AWS Sydney region and Neon's Sydney, Australia region).

We use Cloudflare to deliver the website, web app and mobile app traffic securely and to protect the Platform from attacks. In plain terms: every time you or your device connects to FlexiConnect, that connection passes through Cloudflare's global network first. Cloudflare decrypts the connection at one of its data centres, which may be located outside Australia, before the request reaches our servers. This means personal information travelling to and from the Platform can pass through an overseas data centre in transit. The personal information we store is not affected by this and stays hosted in Australia as described above; only the momentary act of decrypting the connection happens through Cloudflare's network, which is not Australia-only on the plan we currently use.

Our database provider, Neon, is a company controlled overseas (based in the United States). The personal information in our database — including account, worker and roster records — is stored in Sydney, Australia, and stays there. However, because the company operating that database service is based overseas, limited technical and support access to the database may occur from overseas as part of running the service. Where this occurs, we take the reasonable steps required by APP 8 to ensure it is handled consistently with the APPs.

Shift notifications are delivered through Google's and Apple's global push-notification networks (Firebase Cloud Messaging and APNs). To deliver a notification to your device, its content — for example, that a shift is available at a stated time and place — and your device's push token pass through infrastructure those companies operate, which may be located overseas. We keep notification payloads to the minimum information needed to alert you and direct you back into the Platform for the details.

8. How we hold and protect information

• Data is encrypted in transit (TLS) and at rest.
• Access is restricted by role — Organisation staff see only their own Organisation's data; workers see only their own information and the Organisations they are registered with; our staff access production data only when needed to operate or support the Platform.
• Passwords are stored only as salted hashes. We maintain logging, monitoring and regular backups.
• No system is perfectly secure. If a data breach occurs that is likely to result in serious harm, we will notify affected individuals and the Office of the Australian Information Commissioner (OAIC) in accordance with the Notifiable Data Breaches scheme.

9. Retention and deletion

• Audit logs are retained for 7 years.
• Notification records are retained for 12 months.
• Device push tokens are deleted after 90 days of inactivity.
• A departed worker's personal information is anonymised 12 months after their last membership with an Organisation ends.
• If an Organisation's subscription ends, its data is available for export for at least 30 days, after which we delete or anonymise it, except where the law requires longer retention.
• You can ask us to delete your account by emailing info@flexiconnect.au. Where the information was entered by an Organisation, we will coordinate the request with them. We action deletion requests within 30 days unless the law requires us to keep something, and we will tell you if it does.

10. Access and correction

You may ask for access to the personal information we hold about you, and ask us to correct anything inaccurate, out of date or incomplete. Much of it you can see and edit directly in the Platform. For anything else, email info@flexiconnect.au — we respond within 30 days and do not charge for making a request. If we refuse access or correction (which the Privacy Act permits only in limited circumstances), we will tell you why and how to complain.

11. Automated decision-making

The Platform's first-accept-wins shift allocation is an automated operational mechanic: when a shift is released, it applies the Organisation's configured targeting and simply records which eligible worker accepted first. It does not score, rank or profile workers — every eligible worker who can see and accept the shift has the same chance to be first. If this changes, we will update this policy before the change takes effect, as required by APP 1.7 (obligations commencing 10 December 2026).

12. Cookies and analytics

The website uses privacy-light analytics to measure page visits in aggregate. We do not use marketing or advertising cookies, and we do not track you across other websites. The Platform uses cookies and similar storage only for essential functions such as keeping you signed in.

13. Complaints

If you believe we have mishandled your personal information, contact us at info@flexiconnect.au. We will acknowledge your complaint promptly, investigate, and respond within 30 days. If you are not satisfied with our response, you can complain to the Office of the Australian Information Commissioner:

OAIC — www.oaic.gov.au · 1300 363 992 · GPO Box 5218, Sydney NSW 2001

14. Changes to this policy

We review this policy regularly and update it when our practices or the law change. The current version is always at this page, with the date above. For material changes we will notify account holders by email or in-app notice before the change takes effect.

15. Contact us

Code Of Things Pty Ltd (ABN 40 130 223 175)
Privacy Officer
Email: info@flexiconnect.au