1. About Neuva and this policy
1.1 Neuva is a multi-tenant software-as-a-service (“SaaS”) platform that helps labour-hire and field-workforce businesses coordinate their workforce, including tracking compliance documents, worker readiness, mobilisation and scheduling, timesheets and invoicing.
1.2 Neuva has its headquarters in Perth, Western Australia and supplies goods and services to customers in Western Australia, Australia and internationally.
2. What is this Privacy Policy about?
2.1 We respect the privacy of your personal information in our care and are committed to protecting the privacy of the personal information we collect and receive.
2.2 The purpose of this Privacy Policy is to explain:
2.2.1 the application of this Privacy Policy
2.2.2 the kind of information we collect about you, how we collect it, and how we use it;
2.2.3 how we may disclose that information;
2.2.4 how you can access the information we hold about you;
2.2.5 when we may use your information to contact you;
2.2.6 the protection of your personal information;
2.2.7 our use of cookies and other online marketing tools to collect information, and how you can control or delete these cookies; and
2.2.8 our use of Automated Decision Making systems to provide the Service.
2.3 This Privacy Policy also informs you of your rights to privacy and describes how we comply with our privacy requirements as set out in the Privacy Act 1988 (Cth) (the “Privacy Act”) and the Privacy Amendment (Enhancing Privacy Protection) Act 2012 (Cth) (the “Privacy Code”). The Australian Privacy Principles contained in the Privacy Act govern the way in which we collect, use, disclose, store, secure and dispose of your personal information.
2.4 This Privacy Policy also deals with how we collect, manage, store and disclose your “personal information”. Certain parts of this Privacy Policy also apply to “sensitive information”. These terms are discussed below.
3. Your consent
3.1 By using the goods or services provided by Neuva, or supplying goods and/or services to Neuva, you consent to the privacy practices set out in this Privacy Policy. In particular, you consent to us collecting, storing, using and disclosing personal information and sensitive information about you as set out in this Privacy Policy, including medical information about you and data showing your physical location.
3.2 If you do not agree with the Privacy Policy and do not give the above consent, please contact us to discuss your options.
4. What is personal information and sensitive information?
4.1 The term “personal information” is defined by the Privacy Act. Personal information is information or an opinion that can be used to identify you or which allows your identity to be worked out from the information. This might include personal details like your name, address, date of birth, other contact information like your email address and phone number and financial information like your credit card number or bank details. It may also include your opinions about our goods and services and our staff, as well as any information sent to us through correspondence.
4.2 “Sensitive information” is a type of personal information. Sensitive information can include information like your racial or ethnic origin, health information, political opinions, membership of a political association, professional or trade association or trade union and criminal record. We are required by the Privacy Act to ask for your consent to collect sensitive information.
4.3 This Privacy Policy applies to personal information and sensitive information collected by us, whether we have asked for the information or not.
5. Personal Information
5.1 The personal information we collect and hold depends on our dealings with you and the role Neuva is performing and what information we are handling.
5.2 Neuva typically performs two functions:
5.2.1 Data processor: when a customer of Neuva (for example, a labour-hire firm) uses Neuva to manage its workforce, that organisation is described as a “tenant organisation”. The tenant organisation decides what information about its worker is collected and why. The tenant organisation passes some or all of that information to Neuva and Neuva processes it on the tenant organisation’s behalf in order for Neuva to provide the service to the tenant organisation.
5.2.2 Data controller: Neuva also collects information for the running of its own business. If we collect information directly for our own business purposes we are a data controller.
5.3 Where Neuva acts as a data processor, personal information is supplied to us by tenant organisations. Workers should usually direct initial requests about their personal information to the tenant organisation that employs or engages them.
5.4 The different kinds of personal information provided to us by tenant organisations or which we collect and hold about individuals may include:
5.4.1 legal name and preferred name;
5.4.2 contact details, including address, phone number and email address;
5.4.3 emergency-contact details
5.4.4 Australian Business Numbers (ABN’s);
5.4.5 signatures;
5.4.6 dates of birth or other significant dates;
5.4.7 locations;
5.4.8 employment details, including employer, role, employment type, start date, availability, placement and leave history, and reliability information derived from placement history;
5.4.9 compliance documents and licences, including uploaded photos or PDFs of licences, tickets, inductions and similar, together with extracted details such as document type, document number, issue and expiry dates, and licence classes;
5.4.10 timesheets including hours worked by day and shift, and related comments;
5.4.11 approximate location at timesheet submission: where a worker’s device permits it, our services may record the latitude/longitude and accuracy at the moment a timesheet is submitted, as a submission-integrity record;
5.4.12 profile photographs;
5.4.13 information sent to us by tenant organisations; and
5.4.14 information sent to us through communications with us.
5.5 We also collect personal information that you supply to us when you use our services or contact us online, such as when you complete an online form, when you accept an invitation sent from us, including through our marketing campaigns, or information you provide to us when you send us an email. This may include your feedback and opinions.
5.6 We also collect technical information when you use our services, including:
5.6.1 name, email address, role and authentication credentials when you log in;
5.6.2 essential authentication information and session cookies needed to keep you securely signed in;
5.6.3 records of actions taken in the platform, including an audit log of approvals, edits, deletions and similar; and
5.6.4 server and security logs generated by our hosting providers (for example IP address, timestamps and request metadata) used to operate and secure the service.
5.7 Generally, we do not collect financial information such as tax file numbers, bank-account details or superannuation details. We prefer that payroll and banking are handled outside Neuva.
6. Sensitive information
6.1 Generally, we do not collect sensitive information other than medical information that tenant organisations supply to us.
6.2 If we think sensitive information is reasonably necessary to allow us to perform our functions or activities we will ask for your consent to collect this information.
6.3 We may collect sensitive information if the Australian Privacy Principles allow us to do so in the manner permitted to do so.
6.4 If you apply for employment with us, we may collect sensitive information from you in connection with your application, or your employment with us. This sensitive information is required by us to assess whether you have any medical conditions that might impact on your ability to safely perform the role you have applied for. By providing us with this information you consent to us using that information for the purpose of assessing your employment application and, if you are employed, for purposes in connection with your ongoing employment with us.
7. Why we collect personal information
7.1 We collect personal information for a number of reasons including:
7.1.1 to communicate with you;
7.1.2 to provide services to tenant organisations;
7.1.3 to enable our suppliers to supply goods and or services to us or our customers;
7.1.4 for managing and administering a tenant organisation's business relationship with us, including processing certifications, payments, accounting, auditing, billing and collection, support services to deliver goods or services;
7.1.5 for marketing purposes;
7.1.6 to approve a request by you or a tenant organisation that we provide services to, made via our website, any platform on our website or otherwise;
7.1.7 to assess any account or profile created on our website;
7.1.8 to measure and analyse our performance and usage of our goods and services and to improve our services;
7.1.9 to measure and analyse your performance, including in relation to work, goods and services you supply to tenant organisations;
7.1.10 to generate revenue;
7.1.11 to develop new goods and services;
7.1.12 to better understand your requirements and preferences;
7.1.13 for insurance purposes;
7.1.14 to recruit employees and engage contractors and subcontractors;
7.1.15 to perform other administrative functions;
7.1.16 to comply with legal requirements; and
7.1.17 for purposes directly related to any of the above.
8. How we collect personal information
8.1 We collect personal information in many ways, including during our business dealings with you, by selling you goods and services, from forms you submit to us, by correspondence, telephone, email, via our platform, when you provide feedback, when you use any chat facility on our platform, from media and publications, from other publicly available sources, from cookies and from third parties.
8.2 In most cases, we or our tenant organisations will collect information directly from you. However, in certain circumstances we may also collect personal information from third parties, including the following:
8.2.1 our customers and suppliers;
8.2.2 government, regulatory, licensing and law enforcement bodies;
8.2.3 publicly available records, including court or tribunal records;
8.2.4 ratings agencies;
8.2.5 search or recruitment agencies;
8.2.6 parties to whom you refer us, including previous customers, employers and referees;
8.2.7 online searches; and
8.2.8 social media (such as Instagram, LinkedIn and Facebook).
8.3 If we are provided with information by a third party we may take reasonable steps to notify you that the information was provided to us by a third party, but do not guarantee to do so.
8.4 We may also collect personal information from third parties if we are required or authorised by an Australian law or court/tribunal order to do so.
8.5 If you are considering sending us any personal information electronically, be aware that the information may be insecure in transit, particularly where no encryption is used (e.g. email, standard http). We cannot guarantee that any information sent or accessed electronically is secure.
8.6 If you supply us with the personal information of a third party we accept that information on the condition that you have all the rights required from that third party to provide that personal information to us to use for our functions and activities.
8.7 Given that our core service is providing labour force management tools that collect and process personal information about individual workers, it is impractical for us to offer the option of not identifying yourself or using a pseudonym.
9. How we store personal information and information security
9.1 We may hold your personal information in physical and electronic form both at our premises and with the assistance of our service providers. We will take reasonable steps to ensure your personal information is stored in a manner that reasonably protects it from misuse, loss and unauthorised access, modification or disclosure.
9.2 We implement a range of measures to protect the security of information we hold. This includes:
9.2.1 database-level access control (row-level security): access rules are enforced in the database itself, so each organisation’s data is isolated, and workers can only ever reach their own records — even if application code has a bug;
9.2.2 encryption in transit: connections to the Neuva platform use HTTPS/TLS;
9.2.3 role-based access: system administrators, staff and workers see different information; sensitive actions are restricted;
9.2.4 restricted data access for workers: they read only their own data, through narrow functions that do not expose other people’s records or internal fields; and
9.2.5 an append-only audit log of significant actions is maintained.
9.3 We store electronic personal information on our computer systems and computer servers. Most of our systems and servers are used and hosted by third party providers and are located in secure data centres that are managed by third parties. Some systems and servers may be cloud hosted.
9.4 We prefer to use hosting companies that have servers physically located in Australia. However, we cannot guarantee that your personal information will always reside on servers that are physically located in Australia. Your personal information may be stored on servers located overseas. This includes in the United States of America.
9.5 We also may use service providers and contractors located overseas, and your personal information may be disclosed to them or stored by them in overseas countries. This includes in the United States of America.
9.6 Where your personal information is stored or hosted overseas, access to and use of that personal information will be governed by laws that apply in those overseas locations.
9.7 We will use reasonable endeavours to ensure that our service providers and contractors use and handle your personal information in a manner that is not inconsistent with Australian privacy laws, but we cannot guarantee that will always occur. Where possible and reasonable in the circumstances, we will enter into an enforceable contractual arrangement with the overseas recipient that requires the recipient to handle the personal information in accordance with the Australian Privacy Principles.
9.8 Where our external service providers have access to personal information we rely on them to use industry accepted and reasonable steps to protect the personal information provided to them. However, we cannot guarantee that they will do so.
9.9 Only our authorised personnel have access to our server and computer systems and our hard copy files. Access to all of our server and computer systems are protected by password.
9.10 We may also hold personal information in hard copy in our office.
9.11 All of our employees who might come into contact with personal information are educated about the terms of our Privacy Policy.
9.12 If we suspect on reasonable grounds that personal information we hold has been subject to unauthorised access, disclosure or loss, we will promptly assess whether it is likely to result in serious harm to any affected individual (“eligible data breach”), taking reasonable steps to complete the assessment within 30 days. If we have reasonable grounds to believe an eligible data breach has occurred, we will as soon as practicable notify the OAIC and any affected individuals of the breach.
10. How we disclose personal information
10.1 As part of providing goods or services to you, we will sometimes need to disclose your personal information to third parties.
10.2 We use a small number of trusted service providers (“sub-processors”) to provide our services. The sub-processors process information in order for us to provide services. Our current sub-processor providers are:
10.2.1 Supabase: database, authentication and file storage;
10.2.2 Vercel: application hosting and delivery;
10.2.3 Resend: transactional email delivery;
10.2.4 Anthropic: artificial intelligence processing of uploaded documents and chatbot and support assistant; and
10.2.5 Google: various functions including address autocomplete/lookup when an address is typed into a form.
10.3 We may also disclose information to the tenant organisation that controls it or provides it to us.
10.4 We may also provide your personal information to our related bodies corporate and our service providers who assist us with customer contact, auditing, accounting, legal, business consulting, IT support, banking, delivery, data processing, website or technology services.
10.5 We will take reasonable and practicable steps to ensure third parties we deal with take steps to protect your privacy. All of our employees are required to maintain the confidentiality of any personal information held by us.
10.6 In some circumstances we may be permitted under Australian law or a court order to use or disclose your personal and sensitive information. For example, if our disclosure of your information will reduce or prevent a serious threat to life, health or safety or our disclosure is in response to any unlawful activity.
10.7 We will never sell your personal information to anyone.
10.8 Generally we will not disclose your personal information to anyone overseas, except if we are required to do this by law or if it is necessary to provide you with goods and services you have ordered from us.
10.9 If you are located overseas, or you use our goods and services overseas, then your personal information may be made available to overseas service providers and suppliers due to the fact you will access the internet and our service from overseas.
11. Destroying personal information
11.1 We take reasonable steps to destroy, or de-identify, personal information, when it is no longer required by us for a permitted purpose. However, worker compliance records may need to be produced long after a worker stops working. Accordingly, deactivating or archiving a worker does not mean that their personal information and records are automatically deleted.
11.2 Even if Neuva destroys personal information that does not automatically mean a tenant organisation also destroys the personal information, and vice versa.
11.3 We will otherwise destroy information after 7 years since we have last dealt with you.
11.4 We will also destroy or de-identify personal information when required to do so by law.
12. Access and correction of personal information
12.1 We will take reasonable steps to ensure that the personal information we collect, use and disclose is accurate, up-to-date and complete. However, we do not promise that we will contact you to check that the personal information we hold about you is up to date. Generally we will rely on you to keep us informed and to ensure personal information we hold about you is up to date.
12.2 We will take reasonable steps to protect personal information that we hold from misuse, interference, loss, unauthorised access, modification or disclosure.
12.3 You have the right under the Privacy Act to request access to personal information about you that is held by us. You also have the right to request correction of any of your personal information that we hold. For worker information, the quickest route is usually through the tenant organisation that controls it (which could be your employer or engager). We will take reasonable steps to make appropriate corrections to your personal information so that it is accurate, complete and up to date.
12.4 If you would like to access, or correct, your personal information please write to our Privacy Officer using the contact details set out below. Please make sure you clearly identify the information or correction requested. In order to protect your personal information we will require identification from you before releasing the requested information.
12.5 We will use reasonable endeavours to promptly provide the information requested, and within the period required under the Privacy Act.
12.6 If we are permitted by law we may charge a reasonable fee to cover the cost of meeting your request.
12.7 In some cases, we may refuse to provide you with access to your personal information. We will only do this if we are permitted to do so under the Privacy Act or Privacy Code. If access is refused, we will write to you and explain why.
13. Direct Marketing
13.1 We may use your personal information to send marketing materials to you or our customers or suppliers if the marketing material is related to the purpose for which we collected that information.
13.2 We will ask for your consent before we use your personal information for marketing purposes if we have not collected that personal information directly from you or where sensitive information is involved.
13.3 If you receive marketing offers from us and do not wish to receive them in the future, please contact us. You can unsubscribe from our mailing/marketing lists at any time by contacting us in writing.
14. How artificial intelligence tools are used
14.1 Neuva uses Automated Decision Making (“ADM”) systems, which includes the use of artificial intelligence, to assist us in making decisions that may be substantially and directly related to making decisions that could reasonably be expected to affect your rights or interests as an employee.
14.2 We do not authorise ADM systems to act autonomously. A person always makes the final decision, but these systems carry out steps that that may be a substantial and direct part of arriving at a decision. The kinds of decisions ADM systems helps us make include whether you are deployed to a site, whether you are treated as ready for work and whether you are qualified to that work.
14.3 To help make these decisions, ADM systems may use these kinds of personal information we have collected from you:
14.3.1 Identity documents such as passport and drivers licence;
14.3.2 Your contact details such as email and phone number;
14.3.3 Health information such as medical records;
14.3.4 Your qualifications, licenses and site tickets; and
14.3.5 Work history and previous site experience.
14.4 Neuva will use commercially reasonable efforts to ensure:
14.4.1 that ADM systems never decide whether a worker holds compliant qualifications and certificates. A worker’s readiness status (Green/Amber/Red) is determined by a fixed, deterministic rules engine embedded in Neuva’s software, not by ADM systems;
14.4.2 that a human reviews and approves every compliance related document supplied to Neuva by a worker;
14.4.3 that any chatbot or AI-powered support assistant that answers “how the platform works” questions has no access to live worker records; and
14.4.4 that any conversations between a user of a Neuva service and a chatbot or AI-powered support assistant are not stored permanently.
15. Internet cookies, marketing and analytics tools
15.1 An internet cookie is a data file that is placed on the computer of an internet user during a visit to our website. Cookies are necessary to allow our website and your computer to interact effectively and to enhance security. Cookies can record information about your visit to assist us in better understanding your needs and requirements. Our website uses cookies and related technologies for a variety of purposes including to operate and personalise our website.
15.2 Cookies may also be used by us to track how you use our website, including to target adverts to you. To opt out of this you can visit opt-out websites such as www.aboutads.info, youronlinechoices.eu and networkadvertising.org/choices.
15.3 We may use third party vendor remarketing tracking cookies, including Google Adwords tracking cookies. This means we may show adverts to you across the internet, including via Google and other commercial services and networks.
15.4 Third-party vendors, including Google, may utilise cookies and web browsers in order to serve adverts to you based on visits to our website. This allows us to market our goods and services to those who have shown interest in our goods and services.
15.5 Our website may also use cookies to facilitate sampled reporting of demographics and interests of visitors to our website using Google Analytics and other similar technologies. This data is used to provide better services and more relevant content to our users based on demographic and interest data.
15.6 If you would like to access our website but do not wish to receive any cookies, you should set your browser settings to refuse to accept cookies. This may mean that you are unable to access parts of our website.
15.7 You may also be able to opt out of Google’s use of cookies, analytics and tracking services by visiting the Ads Preferences Manager setting in your browser and/or by visiting Google’s website. You may also be able to opt out of other third-party vendor’s use of cookies by visiting the opt-out website’s set out above.
16. Your European privacy rights
16.1 If you are a data subject in Europe under the General Data Protection Regulations 2016/679 (“GDPR”) you have the right to:
16.1.1 request access to and obtain copies of the personal information we have collected from you in an easily readable format;
16.1.2 modify or rectify your personal information if it is no longer accurate;
16.1.3 exercise the “Right to be Forgotten” and request that we erase your personal information if you believe it is no longer required for the purposes for which we originally collected it; and
16.1.4 object to or restrict the collection or processing of personal information we have collected from you.
16.2 Please contact our Privacy Officer if you wish to exercise any of these rights.
17. Complaints
17.1 If you have any questions or complaints about the way we have handled your personal information you can contact our Privacy Officer by emailing us at hello@neuva.com.au.
17.2 We take all enquiries seriously and will attend to your question or complaint promptly. Our Privacy Officer will review your complaint, consider our conduct in relation to the complaint and the requirements of the Australian Privacy Principles, and will consider appropriate action. We will respond to complaints within a reasonable period of time (usually 30 days).
17.3 If you are dissatisfied with our response to your complaint, you can make a complaint to the Office of the Australian Information Commissioner (OAIC). You can find more details about making a complaint to the OAIC here: www.oaic.gov.au/individuals/how-do-i-make-a-privacy-complaint
18. Updates to this Privacy Policy
18.1 We will review and update this Privacy Policy from time to time. If we make any changes to this Privacy Policy, we will upload a revised policy to our website.
18.2 You agree that it is your responsibility to check for updates to our Privacy Policy.
For more information about privacy issues, and to obtain a copy of the Australian Privacy Principles you can visit the OAIC website at http://www.oaic.gov.au.
19. Contact us
For privacy questions or requests, contact our Privacy Officer at hello@neuva.com.au.
Policy Updated September 2026