This policy explains how HRM8 collects, uses, shares and protects personal data, and the choices and rights you have. It covers our platform, websites, the HRM8 job board and our services.
This Privacy Policy is issued by HRM8 Pty Ltd (ACN 694 475 208, ABN 93 694 475 208) and its subsidiaries and affiliated entities (the HRM8 Group, HRM8, we, us). It applies to personal data we handle in connection with the HRM8 platform, the HRM8 websites, the HRM8 job board, and our recruitment and HR services (the Services).
Some HRM8 customers have their own privacy notices that apply when you interact with them as their candidate or employee. This policy describes our practices. Where we handle data on behalf of a customer, that customer's privacy notice also applies.
This policy applies to: visitors to our websites; representatives and users of our business customers; job seekers who use the HRM8 job board; candidates who apply for, are sourced for, or are assessed for roles through the Services; employees and workers whose records a customer manages in the HRMS; and referees who provide reference information.
We act as a controller (deciding how and why data is used) for data we handle for our own purposes, such as running our websites, managing our customer relationships, and operating job seeker accounts on the job board.
We act as a processor (handling data on a customer's instructions) when our business customers use the Services to manage their own candidates, employees and hiring. In that case the customer is the controller and is responsible for the privacy notices and lawful basis for that data, and our handling is governed by our agreement and Data Processing Addendum with them. If you are a candidate or employee and want to exercise rights over data a customer holds about you, contact that customer.
Some data may be sensitive (for example information about health, background or diversity). We only handle sensitive data where permitted by law and, where required, with consent or on a customer's lawful instructions.
We collect data directly from you when you create an account, apply for a role, take an assessment, contact us or use the Services. We receive data from our customers when they put candidate or employee data into the Services. We receive data from third parties such as referees, identity or single sign-on providers, and job boards or distribution partners. We also collect data automatically through cookies and similar technologies when you use our websites and platform.
We use personal data to: provide, operate and support the Services; create and manage accounts and applications; run assessments and produce results; deliver recruitment and HR services; communicate with you; process payments; keep the Services secure and prevent misuse; improve and develop the Services; and comply with our legal obligations.
Where data protection law requires a legal basis (for example in the EU and UK), we rely on: performance of a contract; our legitimate interests in running and improving our business and Services, balanced against your rights; your consent, where we ask for it, such as for certain marketing or cookies; and compliance with legal obligations. Where we rely on consent, you can withdraw it at any time.
Some Services use artificial intelligence to assist with tasks such as screening, assessment, drafting and analysis, including AI interviews. These tools support human decision making and are not intended to make decisions that have a legal or similarly significant effect on a person without human review. Customers who use these tools are responsible for how they use the outputs and for any human review required by law. Where we make solely automated decisions about you that have a legal or similarly significant effect, we will tell you and provide the safeguards the law requires, including a way to ask for human review. We do not use customer or candidate personal data to train general-purpose AI models without consent.
We share personal data with: other members of the HRM8 Group to provide and support the Services; our customers, where the data relates to their candidates, employees or hiring; service providers and sub-processors who help us run the Services, such as cloud hosting, under appropriate contracts; third-party job boards and distribution partners where you ask us to advertise or distribute a role; and authorities or others where required by law, to enforce our terms, or to protect rights and safety. We may share data in connection with a business sale or reorganisation. We do not sell personal data. Our cloud infrastructure is provided on Amazon Web Services, and payments are processed by Airwallex. Our current sub-processors are listed in our sub-processor list.
HRM8 operates across multiple regions, and personal data may be transferred to and processed in countries other than your own, including by HRM8 Group entities and sub-processors. Where we transfer data across borders, we put appropriate safeguards in place as required by law, such as standard contractual clauses or other recognised transfer mechanisms. We host the Services on Amazon Web Services, and your data is processed in the AWS region or regions in which the Services are hosted.
We keep personal data for as long as needed for the purposes in this policy, to provide the Services, and to meet legal, accounting or reporting requirements. For data we process on behalf of a customer, we keep it in line with our agreement with that customer, and we make it exportable to them and delete it after a reasonable period following the end of the relationship, except where we must keep it by law. We retain AI interview recordings and assessment data for up to 12 months, after which we delete them, unless the law requires otherwise or a customer agreement provides for a different period.
We use technical and organisational measures designed to protect personal data, including encryption in transit and at rest, access controls, and monitoring. You can read more on our Security and Trust page. No system is completely secure, and you also have a role in keeping your account safe.
Depending on where you are and your relationship with us, you may have rights to: access the personal data we hold about you; correct it; delete it; object to or restrict certain processing; withdraw consent; receive a copy in a portable form; and not be subject to certain solely automated decisions. To exercise a right, contact us using the details below. We will respond as required by law and may need to verify your identity. If your data is held by us on behalf of a customer, we will direct your request to that customer.
If you are a candidate, employee or referee, the employer or organisation using HRM8 usually decides how your data is used and is the first point of contact for your privacy requests. We handle that data on their instructions. We use it to operate the Services, including running assessments and producing results, and to keep the Services secure. If you are not sure who holds your data, contact us and we will help direct your request.
We use cookies and similar technologies to run our sites, remember preferences, measure use and, where you allow it, for analytics. You can control cookies through your browser and any cookie controls we provide. For more detail, see our Cookie Policy.
The Services are for businesses and for job seekers of legal working age. They are not directed to children, and we do not knowingly collect data from children below the minimum age that applies. The minimum age for job seekers is 16.
We handle personal information in line with the Australian Privacy Principles and applicable New Zealand privacy law. You may complain to us, and if not satisfied, to the Office of the Australian Information Commissioner or the relevant New Zealand authority.
Where the GDPR or UK GDPR applies, you have the rights described above, and you may complain to your local supervisory authority. You can contact us about privacy at info@hrm8.com. Where the GDPR or UK GDPR requires us to appoint a representative or a data protection officer, we will make their contact details available.
Additional rights and information may apply in other regions where HRM8 operates, including India, parts of South East Asia and the Americas. If you are in one of these regions, additional local privacy rights may apply to you, and you can contact us at info@hrm8.com to exercise them or to ask how this policy applies to you.
We may update this policy from time to time. We will post the updated version with a new date, and where changes are material we will take reasonable steps to notify you.
For privacy questions or to exercise a right, contact us at info@hrm8.com, or by post to HRM8 Pty Ltd, Level 1, 63-73 Ann Street, Surry Hills, NSW 2010, Australia. If you have a concern, please contact us first so we can try to resolve it. You also have the right to complain to your local privacy regulator.
