Privacy Policy

1. About Contracx

Contracx is the business responsible for this Privacy Policy. In this Privacy Policy, “Contracx”, “we”, “our” and “us” refer to Contracx.

Contracx is committed to handling personal information openly, responsibly and securely. This Privacy Policy explains how we collect, hold, use, disclose and protect personal information through our website, business operations and professional services.

Where applicable, we handle personal information in accordance with the Privacy Act 1988 (Cth), the Australian Privacy Principles and other applicable Australian requirements.

2. Scope of This Policy

This policy applies to personal information handled through:

• The Contracx website
• General and privacy enquiry forms
• Client and prospective-client communications
• Professional service engagements
• Contract and subcontract reviews
• Commercial and contract management advisory services
• Research and due diligence assignments
• AI-assisted services and AI advisory engagements
• Workshops and stakeholder consultations
• Supplier and service-provider relationships
• General business administration

Client documents may contain information about employees, contractors, subcontractors, suppliers, stakeholders or other individuals. Such information will be handled in accordance with this policy, the applicable client agreement and any agreed confidentiality, privacy, security or data-handling requirements.

3. General Website Information

Information published on the Contracx website is general in nature and is provided for information purposes only.

Website information does not take account of a particular organisation’s circumstances, objectives or requirements. It should not be relied upon as legal advice or as a substitute for professional advice tailored to a specific situation.

Accessing or using the Contracx website does not create a consultant-client or other professional relationship.

4. General Enquiry Form

The general enquiry form on the Contracx website requests only:

• Name
• Company Name
• Contract number
• Email address
• Subject
• Message

The form is intended solely for general enquiries. Users must not submit confidential, commercially sensitive, legally privileged, security-classified or sensitive personal information through the form.

Contracx will never ask clients to upload or provide project data, contract documents, confidential commercial information or sensitive personal information through the public website or general enquiry form.

Information submitted through the form will be used to respond to the enquiry and, where appropriate, discuss a potential engagement.

5. Privacy Enquiry Form

The Contracx website provides a separate Privacy Enquiry form for privacy questions, access requests, correction requests and complaints.

Users must not attach or include identity documents, client records, commercially sensitive material or sensitive personal information in an initial privacy enquiry. If further information or identity verification is required, Contracx will arrange an appropriate method for it to be provided.

6. Information We May Collect

The information Contracx collects depends on the nature of the interaction or engagement. It may include:

• Names and business contact details
• Job titles and employer or organisation details
• Information contained in enquiries and correspondence
• Meeting, workshop and consultation records
• Contract, subcontract and project information
• Information contained in policies, reports, registers and supporting records
• Company officer, employee, contractor and supplier information
• Publicly available corporate, professional and project information
• Website usage, device, browser and IP address information
• Billing, transaction and business administration information

For company, contractor, subcontractor or supplier due diligence, we may review publicly available corporate, ownership, professional, licensing, accreditation, capability and performance information.

Contracx does not generally seek to collect sensitive personal information unless it is reasonably necessary for an agreed engagement and appropriate arrangements have been established with the client.

7. How We Collect Information

Contracx may collect information:

• Directly from an individual
• Through the general or privacy enquiry forms
• Through email, telephone calls, meetings and workshops
• Through client engagements and project documentation
• From a client or authorised project participant
• From contractors, subcontractors, suppliers or professional advisers
• From publicly available sources, registers and professional platforms
• Through routine website hosting and security logs

Client and project information will not be collected through the public website. The method of transferring information for an engagement will be agreed with the client and will use the client’s preferred or approved source, platform or transfer method where practicable.

This may include a client-controlled document management system, an approved SharePoint location, secure cloud storage, protected email or another agreed platform.

8. Why We Collect and Use Information

Contracx may collect, hold and use information to:

• Respond to enquiries
• Prepare proposals and engagement scopes
• Establish and manage client relationships
• Deliver agreed professional services
• Conduct contract, subcontract, policy and process reviews
• Provide commercial and contract management advice
• Undertake research, benchmarking and due diligence
• Review milestones, deliverables and compliance information
• Conduct workshops and stakeholder consultations
• Provide AI advisory and contract management improvement services
• Maintain project, contract and business records
• Manage accounts, insurance and business administration
• Operate, maintain and secure our website and systems
• Meet contractual, legal, regulatory and professional obligations
• Protect our systems, business and lawful interests

We will use client-provided information only for the agreed engagement and related administrative purposes unless otherwise authorised or required by law.

9. Client Documents and Project Information

Client documents may contain personal, confidential or commercially sensitive information. Contracx will handle this information in accordance with the applicable engagement terms, confidentiality obligations, agreed security requirements and this Privacy Policy.

Clients should provide information through their preferred or approved document-sharing method. Contracx will work with the client to identify an appropriate transfer and storage arrangement having regard to the nature, sensitivity and volume of the information.

Clients should avoid providing personal or sensitive information that is not reasonably necessary for the engagement. Where practicable, unnecessary information should be removed, redacted or de-identified before documents are shared.

Access to client information will be limited to authorised personnel and approved systems reasonably required to perform the engagement.

10. Use of Artificial Intelligence

Contracx uses artificial intelligence and technology-assisted tools across its business operations and professional services.

AI tools may support research, document analysis, comparison, information organisation, obligation identification, drafting, reporting, workflow improvement and quality review.

The tools selected may vary according to the nature, scope, complexity, security requirements and technical needs of each assignment. Because available technologies and project requirements change, Contracx does not maintain a public list of every AI tool used and may not identify every tool used during each stage of an engagement.

Contracx applies reasonable human oversight and does not rely solely on AI-generated outputs when forming professional conclusions or recommendations. AI use remains subject to applicable contractual, confidentiality, privacy, security and client requirements.

Contracx will not knowingly enter client confidential information or personal information into an AI service unless the proposed use is permitted under the engagement arrangements and appropriate privacy, confidentiality and security controls have been considered.

Clients must notify Contracx before providing information if they prohibit AI-assisted processing or require specific restrictions concerning approved tools, confidential information, personal information, data location or overseas processing. Contracx will confirm whether it can perform the services subject to those restrictions.

Contracx does not ordinarily use personal information to make automated decisions that significantly affect an individual’s rights or interests.

11. Website, Email and Cloud Services

Contracx uses reputable third-party providers to host and operate its website, email services, cloud collaboration platforms, document management systems and related business technology.

These providers may process limited technical information necessary to operate, maintain and secure those services.

Contracx implements reasonable security measures, including encrypted communications where supported, access controls and authentication, to help protect information transmitted through these systems.

While Contracx configures Australian data residency where available, some technology providers may use overseas infrastructure, subprocessors or support services as described in this Privacy Policy.

12. Website Cookies and Technical Information

The Contracx website may use cookies or similar technologies necessary for website hosting, security, contact-form operation and basic functionality.

When someone visits the website, limited technical information may be generated automatically, including:

• IP address
• Browser type
• Device information
• Pages visited
• Date and time of access
• Referring website
• Routine hosting and security information

This information may be used to operate, secure, maintain and improve the website.

Contracx does not use website information for behavioural advertising. If analytics, marketing or other non-essential tracking technologies are introduced, this Privacy Policy and any applicable cookie notice will be updated.

Users can usually control or delete cookies through their browser settings. Disabling essential cookies may affect website functionality.

13. Disclosure of Information

Contracx may disclose information to:

• Authorised personnel and consultants
• Technology service providers
• Cloud and hosting providers
• Professional software providers
• Approved AI service providers where applicable
• Accountants, auditors, insurers and professional advisers
• Clients and authorised project participants where necessary
• Government agencies, regulators or law-enforcement bodies where required
• Other parties with appropriate authorisation or where permitted by law

Contracx does not sell personal information.

Where service providers handle information for Contracx, we seek to use reputable providers and apply appropriate privacy, confidentiality, access and security controls.

14. Overseas Processing and Disclosure

Contracx configures Australian data residency where available. However, some email, cloud, software, cybersecurity and AI providers may process information in Australia and overseas, including jurisdictions where their infrastructure, subprocessors or authorised support personnel are located.

Contracx takes reasonable steps to select reputable providers and apply appropriate privacy, confidentiality, access and security controls.

Clients must identify any requirements concerning Australian-only storage, restrictions on overseas processing, approved platforms or AI use before information is provided and before the engagement begins.

15. Information Security

Contracx takes reasonable technical and organisational measures to protect personal and client information from misuse, interference, loss and unauthorised access, modification or disclosure.

These measures may include:

• Access controls and authentication
• Encrypted communications
• Secure cloud and document-storage systems
• Controlled permissions
• Device and account security
• Confidentiality requirements
• Backup and recovery arrangements
• Service-provider assessments
• Secure deletion practices
• Internal information-handling procedures

No electronic transmission or storage system is completely secure. If Contracx becomes aware of a suspected data breach, it will assess and respond to the incident and make notifications where required by applicable law.

16. Information Quality

Contracx takes reasonable steps to ensure that personal information used or disclosed for its business activities is accurate, current, complete and relevant.

Individuals may contact Contracx to request correction of information they believe is inaccurate, out of date, incomplete, irrelevant or misleading.

17. Retention and Disposal

Contracx generally retains information associated with a client engagement for three years from completion of the relevant work.

Information may be retained for a longer or shorter period where required by law, a client agreement, insurance requirements, an active dispute, security requirements or another legitimate business need. Corporate, taxation and financial records may be subject to separate statutory retention periods.

When information is no longer required, Contracx takes reasonable steps to securely delete, destroy or de-identify it.

Client information may also be returned or deleted in accordance with the applicable engagement terms and agreed information-management arrangements.

18. Access and Correction

Individuals may request access to personal information Contracx holds about them or ask for it to be corrected.

Requests may be submitted through the Privacy Enquiry form on the Contracx website or sent by post. Contracx may need to verify the requester’s identity before providing access or making a correction.

We will respond within a reasonable period. Access or correction may be refused where permitted by law. If this occurs, we will generally provide written reasons and explain any available complaint process.

19. Privacy Enquiries and Complaints

Privacy enquiries, access requests, correction requests and complaints may be submitted through the General Enquiry Form at contracx.com.au or sent by post to:

Please do not include identity documents, confidential client information or sensitive personal information in an initial enquiry. If additional information or identity verification is required, Contracx will arrange an appropriate method for providing it.

Contracx will acknowledge and investigate privacy complaints and aims to respond within 30 business days. If additional time is required, we will advise the complainant.

If a complaint is not resolved satisfactorily and the Privacy Act applies, the individual may contact the Office of the Australian Information Commissioner.

20. Third-Party Websites

The Contracx website may contain links to third-party websites.

Contracx is not responsible for the content, privacy or security practices of third-party websites. Users should review the relevant third party’s privacy policy before providing personal information.

21. Changes to This Policy

Contracx may update this Privacy Policy when its services, systems, information-handling practices or legal obligations change.

The current version will be published at contracx.com.au and identified by its effective date and last-updated date.