punchcard

Legal

Privacy Policy

Nov 28, 2025

1. Introduction

Punchcard Operations Pty Ltd (ABN 69 688 081 781) (“we”, “us” or “our”) understands that your privacy is important. This policy sets out how we intend to handle your personal information. For clarity, this privacy policy applies generally to our operations, including to our website located at https://punchcard-web-seven.vercel.app/ (“our website”) and our ‘Punchcard’ mobile and web-based application (together “our applications”), as well associated applications and services (our “services”). Please note that our website and our applications are also governed by our additional terms of use as indicated on the relevant website or application.

You consent to the handling, collection, use and disclosure of your personal information, including sensitive information such as health information in accordance with this privacy policy and as otherwise permitted or required by law.

We may modify or amend this privacy policy from time to time by publishing an updated version on our website.

2. Collection of Personal Information

2.1 Circumstances of Collection

We may collect personal information and about you when we deal with each other, including when:

  • we supply our services;
  • you apply for a position with us;
  • you access, use or upload content to websites or applications operated or provided by us (including the website and applications referred to above);
  • you contact us by any method, such as telephone, email, post, facsimile or in person;
  • you communicate with any person using our website or applications, including the content of communications and communications metadata ingested from third parties via integrations with our applications as outlined further below (e.g. WhatsApp, Gmail, Slack, LinkedIn, Instagram);
  • you subscribe to any of our mailing or contact lists,

or otherwise as notified to you from time to time, including in any collection notice.

2.2 Collection via Third Parties

We will collect information from a third party where you have authorised our application to integrate with or access a service, application or tool provided by that third party (e.g. WhatsApp, Gmail, Slack, LinkedIn, Instagram), including the content of communications and communications metadata ingested from that third party service, application or tool.

There may be other occasions when we collect information about you from a third party, including where you have applied for a position with us, such as a recruitment agency, previous employers and references and otherwise from our service providers and contractors that perform services for us in connection with our business.

We may combine information that we hold about you with other information collected from or held by others (including our related entities, service providers and contractors). We do so as part of our normal business operations.

2.3 Automated Collection

We may also collect information through automated means, including through our website and our applications and other methods contemplated further by this privacy policy, including:

  • your IP address;
  • the date, time and duration of your visit;
  • the parts of our website or our applications that you accessed;
  • your actions on our website or our applications and associated navigation patterns; and
  • the browser, system or device you are using.

Cookies

Consistent with the above, your personal information may be collected through the use of cookies, identifiers or similar technologies used to collected data (Cookies). These are small files placed on your device or computer by our website or our applications which automatically collect information about you without you providing that information to us directly.

Most browsers are set by default to accept Cookies. However, if you do not wish to receive any Cookies you may set your browser to either prompt you whether you wish to accept Cookies on a particular site, or by default reject Cookies.

Please note that rejecting Cookies may mean that some or all of the functions on our website or our applications may not be available to you.

2.4 Analytics Information

We may also collect information about your use of our website and our applications, including by using third party services, such as Google Analytics. For further information about how Google Analytics works please refer to the following link “How Google uses data when you use our partners’ sites or apps”, (located at https://www.google.com/policies/privacy/partners/).

2.5 Third Party Services and Systems

Our website and our applications may contain links or APIs to other websites or third party services or systems. We are not responsible for the privacy practices of those other websites or third party services or systems. We recommend that you review the privacy policies of each website that you visit or third party service or system that you use or access.

2.6 Interacting with Us Anonymously or with a Pseudonym

We generally do not permit people to deal with us anonymously or using a pseudonym other than in the context of using our website. If you do not provide us with your personal information, we may not be able to deal with you.

3. Types of Personal Information We Collect

The personal information we collect may vary depending on the nature of your interaction with us, but may for example include your name, date of birth and contact details, information you upload to our website or applications or communications you make using our website or our applications. Where you apply for a position with us, we may also collect (including from third parties) sensitive information, including in the context of citizenship, professional history, reference and background checks. We may hold your information for future job opportunities, unless you tell us not to.

4. Using Your Personal Information

4.1 General Use

We collect and use your personal information for any purposes not prohibited by law. This includes for the purposes of carrying out the services and related functions and activities (as they are from time to time), as well as assisting entities within our corporate group to carry out their functions and activities.

4.2 Specific Use

Without limiting the above, we may use personal information for the purposes for which it was collected, for related purposes which we consider come within your personal expectations, for purposes outlined in this policy, for purposes which you otherwise consent or as otherwise permitted or required by law, including:

  • to provide, operate, maintain and support our website and applications, as well as related services and features;
  • to facilitate integrations between our services and third party services where enabled by subscribers as part of the services;
  • to create and manage accounts, authenticate users and administer user settings and permissions;
  • to provide customer service and technical support and to process transactions, invoicing and billing;
  • to enable and improve service functionality, including the development, training, testing and enhancement of features, algorithms (including large language models or agentic AI models) and user experience. For clarity, we only use personal information to enable and improve service functionality for you and not for our users or our business generally, and will always de-identify any personal information before we use it for any general enhancements to our algorithms for the benefit of all users or our business more broadly;
  • to communicate with you about our services, including operational notices, security alerts, updates and administrative messages;
  • for marketing and promotional purposes (including sending newsletters and information about features, content, events and offers) in accordance with applicable laws and your marketing preferences;
  • to personalise content, measure performance, and conduct analytics, research and reporting;
  • to monitor, detect, prevent and investigate fraud, abuse, security incidents and other harmful activity, and to enforce our terms and policies;
  • to create de-identified or anonymised data (which we may use for any purpose); and
  • to comply with our legal and regulatory obligations or as otherwise permitted or required by law.

4.3 Examples of Use

Some examples of how we may use your personal information are:

  • if you are an applicant for a position with us, your personal information is used to verify your identity, assess and manage your application and potentially consider your application in the context of any future opportunities. Of course, if you are successful in your application, your information will also be used for the conduct of our business and management of your engagement with us; and
  • if you provide your contact details to us in connection with the potential acquisition of our services, other inquiry or to subscribe to a mailing list, we may use those details (including to contact you) in connection with the provision of our products and services, your inquiry or as part of our mailing list (which may include marketing purposes).

5. Sharing Your Personal Information

5.1 Disclosure to Third Parties

We may disclose your personal information to other entities within our corporate group, for example, in the context of our shared or related interests and operations. We may also disclose information to our shareholders.

We may disclose information to third party service providers, such as those who help us conduct our business, for example, our technology providers.

If you are a job applicant, we may disclose your information to your referees and third parties that we use as part of our recruitment process, including recruitment agencies, organisations that conduct competency tests, background assessments or similar, recruitment platform providers and law enforcement agencies (for example, to verify whether or not you have a criminal record).

5.2 Offshoring

Some of our service providers are or may be located overseas. Given the number of third party service providers, it is not practical to list all of the countries in which they are located, however they include the United Kingdom, United States, Australia and New Zealand and your personal information may be disclosed to and stored in those locations in connection with our interactions those third parties and related entities.

5.3 Other Disclosures

We may also disclose your personal information to entities involved in connection with a potential or actual corporate merger, consolidation, restructuring, the sale of substantially all of our interests and/or assets, or other corporate change requiring the transfer of assets, including during the course of any due diligence process, to the purchaser or surviving entity.

We may also disclose your personal information as permitted or required by law.

6. Accessing Your Personal Information

You may contact us by using the details in section 8 below to request access to the information we hold about you, including for the purpose of correcting or updating that information (noting that take reasonable steps to ensure that your personal information is accurate, complete, and up-to-date whenever we collect or use it). We may provide this access where required under privacy law or where we otherwise agree.

7. Protecting Your Personal Information

7.1 Protection Measures

We understand the need to protect your personal information. We have put in place security measures designed to help protect your personal information from misuse, loss, and unauthorised access. This includes the use of technologies and processes adopted by our third party technology providers (who we select based on rigorous security standards). However, unfortunately, we cannot guarantee security.

7.2 Offshoring

We primarily store information in servers and facilities in Australia however information is also transferred and stored in servers and facilities in United Kingdom, United States, Australia and New Zealand.

You consent to the offshore disclosures contemplated by this privacy policy, and you understand that we may not be able to, and are not required to take steps to, monitor, control, prevent or determine whether the entities mentioned, as located in various countries, are able to handle your personal information in accordance with the Australian Privacy Principles in the Privacy Act and that you will not be able to seek any redress under the Privacy Act for any mishandling of your personal information by said entities located outside of Australia.

7.3 Retention of Your Personal Information

We take steps to ensure that we only keep your account information for as long as we require it for one or more purposes described in this policy, and that we delete all of the content of communications ingested or inputted into our applications as soon as it is more than 6 months old. When we no longer require your information, we take reasonable steps to ensure that your information is destroyed, de-identified, or rendered inaccessible.

8. Contact Information

If you have any queries or complaints with regards to our collection, use or management of your personal information, please contact us at info@punchcard.com. If you make a complaint, we will endeavour to respond within a reasonable time (usually 30 days).

If you are dissatisfied with our response, you may make a complaint to the Office of the Australian Information Commissioner by phoning 1300 363 992 or by email at enquiries@oaic.gov.au.