Privacy Policy

1. About this Privacy Policy

This Privacy Policy explains how ToolboxFM Pty Ltd (ToolboxFM, we, us or our) collects, uses, stores, protects and discloses personal information.

ToolboxFM provides a technology platform designed to assist organisations with communication, planning, coordination, visibility, exclusion-zone management, high-risk activity coordination, operational record-keeping and related project activities.

This Privacy Policy applies to personal information we collect through:

• the ToolboxFM website;
• the ToolboxFM web application;
• the ToolboxFM mobile application, where applicable;
• customer accounts;
• user accounts;
• QR-code functionality;
• customer support;
• demonstrations and trials;
• sales and marketing activities;
• communications with us; and
• other interactions with ToolboxFM.

This Privacy Policy should be read together with our Terms & Conditions, Client Master Services Agreement and, where applicable, our Data Processing Agreement.

2. Who we are

ToolboxFM Pty Ltd

• ABN: 69 702 060 642
• ACN: 702 060 642
• Address: 34 Patrick Crescent, Saratoga, NSW, 2251
• Email: privacy@toolboxfm.com
• Privacy Contact: privacy@toolboxfm.com

ToolboxFM is an Australian company.

3. Our commitment to privacy

We recognise that personal information is important and that individuals have a right to understand how their information is handled.

We aim to:

• collect only information reasonably necessary for our functions and services;
• be transparent about how information is used;
• protect personal information using reasonable security measures;
• limit access to authorised persons;
• only disclose information where reasonably necessary or permitted;
• respond appropriately to privacy enquiries and complaints;
• comply with applicable privacy laws; and
• continually review our privacy and security practices as the ToolboxFM platform develops.

Where the Privacy Act 1988 (Cth) applies to ToolboxFM, we aim to handle personal information in accordance with the Australian Privacy Principles.

4. What is personal information?

Personal information is information or an opinion about an identified individual, or an individual who is reasonably identifiable.

Depending on how you interact with ToolboxFM, this may include:

• your name;
• contact details;
• email address;
• telephone number;
• employer;
• job title;
• username;
• account information;
• project information;
• activity allocations;
• work-area information;
• project access information;
• records of activity participation;
• supervisor or responsible-person information;
• photographs;
• documents;
• support communications;
• audit records;
• device information;
• IP address;
• browser information;
• login information;
• usage information; and
• other information you or a customer provide to us.

5. Sensitive information

Sensitive information can include information such as health information, biometric information, racial or ethnic information, religious beliefs and other categories defined by privacy law.

ToolboxFM is not designed to require sensitive information for ordinary use of the Platform.

Customers should avoid entering sensitive information unless it is reasonably necessary, legally permitted and appropriate for the particular use of the Platform.

Where sensitive information is provided to ToolboxFM, we will handle it in accordance with applicable privacy laws and our contractual obligations.

6. How we collect personal information

We may collect personal information:

6.1 Directly from you

For example, when you:

• create an account;
• request a demonstration;
• commence a trial;
• contact us;
• submit an enquiry;
• subscribe to services;
• communicate with support;
• complete a form;
• participate in training; or
• otherwise provide information to us.

6.2 From our customers

A ToolboxFM customer may create or manage accounts for its:

• employees;
• contractors;
• subcontractors;
• consultants;
• supervisors;
• workers;
• project personnel; or
• other authorised users.

In these circumstances, ToolboxFM may process information on behalf of the customer.

6.3 Automatically

When you use our website or Platform, we may automatically collect certain technical and usage information, such as:

• IP address;
• device type;
• browser type;
• operating system;
• login information;
• timestamps;
• pages or features accessed;
• system events;
• error information;
• security logs; and
• other technical information.

6.4 From third parties

Where reasonably necessary, we may receive information from:

• customers;
• employers;
• subcontractors;
• service providers;
• identity or authentication providers;
• business partners;
• professional advisers;
• publicly available sources; or
• other lawful sources.

7. QR codes and public project information

ToolboxFM may provide QR codes that allow people to access project information.

Depending on the customer's configuration, a person may be able to scan a QR code without creating a ToolboxFM account.

The information displayed through a QR code will depend on how the customer has configured its Platform.

Customers are responsible for determining what information is appropriate to make publicly or broadly accessible through their QR codes.

ToolboxFM recommends that customers avoid publishing unnecessary personal information through publicly accessible QR codes.

8. How we use personal information

We may use personal information for purposes including:

• providing the ToolboxFM Platform;
• creating and managing accounts;
• authenticating users;
• managing projects;
• facilitating activity planning;
• coordinating exclusion zones;
• managing high-risk activities;
• providing Day Board information;
• facilitating QR-code functionality;
• recording activity status;
• recording pauses and delays;
• facilitating close-out processes;
• maintaining project diary records;
• providing reporting functionality;
• providing customer support;
• troubleshooting;
• onboarding and training;
• communicating with customers and users;
• managing subscriptions;
• processing payments;
• administering trials;
• improving our Platform;
• monitoring system performance;
• maintaining cybersecurity;
• detecting fraud, misuse or unauthorised activity;
• maintaining backups;
• complying with legal obligations;
• responding to lawful requests;
• protecting our rights and property;
• conducting business administration; and
• other purposes reasonably related to the above.

9. Commercial and marketing communications

Where permitted by law, we may use business contact information to communicate with customers and prospective customers about:

• ToolboxFM products;
• platform updates;
• demonstrations;
• trials;
• new features;
• service announcements;
• events;
• industry information; and
• other relevant business communications.

You may unsubscribe from marketing communications using the unsubscribe mechanism provided or by contacting us.

Transactional, operational, security and service-related communications may still be sent where necessary to provide the Services.

10. Customer data

Where an organisation subscribes to ToolboxFM, that organisation may provide personal information relating to its employees, workers, contractors, subcontractors and other personnel.

In these circumstances, ToolboxFM generally processes that information on behalf of the customer.

The customer is generally responsible for:

• determining what personal information is collected;
• ensuring it has appropriate authority to collect the information;
• providing appropriate privacy notices;
• determining who receives access;
• ensuring information entered is accurate;
• determining appropriate retention requirements; and
• responding to individual privacy requests where appropriate.

Our Data Processing Agreement sets out additional obligations concerning personal information processed by ToolboxFM on behalf of customers.

11. Information about workers and project personnel

ToolboxFM may process information relating to workers and other project personnel where that information is entered into the Platform by a customer.

This may include:

• name;
• employer;
• role;
• project;
• work area;
• activity allocation;
• supervisor;
• spotter or other responsible-person information;
• activity participation;
• activity status;
• pause or delay records;
• close-out records;
• training or competency information where entered;
• photographs or documents; and
• other project information.

ToolboxFM provides technology to assist customers with communication, planning, coordination and record-keeping.

ToolboxFM does not independently determine whether a particular worker is competent, licensed, authorised or safe to undertake a particular activity merely because information about that person is recorded in the Platform.

12. Safety and operational information

Customers may use ToolboxFM to record information concerning:

• high-risk activities;
• exclusion zones;
• work areas;
• planned activities;
• activity status;
• pauses;
• delays;
• access restrictions;
• weather;
• plant breakdowns;
• design changes;
• RFIs;
• safety issues;
• close-out information;
• project diary information; and
• other operational information.

Some of this information may relate to an identifiable individual.

ToolboxFM processes this information for the purposes of providing the Platform and related services.

ToolboxFM does not independently verify every item of information entered by customers or users.

13. Legal bases and authorisation

Where required by applicable law, we will only collect, use or disclose personal information where we have an appropriate legal basis or authority.

Depending on the circumstances, this may include:

• your consent;
• performance of a contract;
• steps taken at your request before entering a contract;
• a legitimate business purpose;
• compliance with a legal obligation;
• protection of rights or property; or
• another basis permitted by applicable law.

For information processed on behalf of a customer, the customer is generally responsible for determining its lawful basis or authority for collecting the information.

14. Disclosure of personal information

We may disclose personal information to:

• our employees;
• directors and officers;
• contractors;
• professional advisers;
• cloud hosting providers;
• infrastructure providers;
• software service providers;
• authentication providers;
• communications providers;
• analytics providers;
• customer support providers;
• security service providers;
• payment providers;
• insurers;
• auditors;
• regulators;
• government authorities;
• law enforcement agencies where legally required or permitted;
• prospective purchasers or investors in connection with a business transaction; and
• other parties where authorised or permitted by law.

We do not sell personal information as a business model.

15. Service providers

ToolboxFM uses third-party technology and infrastructure providers to operate the Platform.

Depending on our technology architecture, these providers may provide:

• cloud hosting;
• database services;
• file storage;
• authentication;
• email;
• notifications;
• monitoring;
• cybersecurity;
• analytics;
• customer support;
• payment processing; or
• other technology services.

Where appropriate, we require relevant service providers to maintain reasonable confidentiality and security protections.

16. Overseas disclosure

Some service providers used by ToolboxFM may operate outside Australia or use infrastructure located outside Australia.

Where applicable, we will take reasonable steps required by Australian privacy law before disclosing personal information overseas.

If a customer requires Australian-only hosting or specific data sovereignty arrangements, those requirements must be separately agreed with ToolboxFM.

ToolboxFM will not represent that all information is stored exclusively in Australia unless expressly stated in the applicable service agreement.

17. Government and defence customers

Customers operating in government, defence, critical infrastructure or other regulated environments may have additional information-security and data-sovereignty requirements.

Customers should notify ToolboxFM of any specific requirements before providing information subject to those requirements.

Unless expressly agreed otherwise, ToolboxFM should not be used to store classified government or defence information.

Additional security and data-handling arrangements may be established through contractual schedules.

18. Cookies and similar technologies

Our website and Platform may use cookies or similar technologies.

These technologies may be used to:

• operate the website;
• maintain sessions;
• remember preferences;
• understand website usage;
• improve performance;
• maintain security;
• analyse traffic; and
• support relevant functionality.

You may be able to control cookies through your browser settings.

Disabling certain cookies may affect website functionality.

19. Analytics and de-identified information

ToolboxFM may analyse usage information to understand:

• Platform performance;
• feature usage;
• system reliability;
• customer requirements;
• user experience;
• operational trends; and
• opportunities for improvement.

Where reasonably possible, we may use aggregated or de-identified information for:

• product development;
• analytics;
• benchmarking;
• reporting;
• business planning;
• research; and
• improving the Platform.

We will take reasonable steps to ensure information described as de-identified is not reasonably capable of identifying an individual.

20. Artificial intelligence

ToolboxFM may introduce artificial intelligence or machine-learning functionality in the future.

Where AI functionality processes personal information, ToolboxFM will consider applicable privacy, security and data protection requirements.

ToolboxFM will not use identifiable customer personal information to train a general-purpose AI model without appropriate authority or agreement.

Where a particular AI feature involves material additional processing of personal information, ToolboxFM may provide additional information or controls.

21. Data security

We take reasonable steps to protect personal information against:

• loss;
• misuse;
• interference;
• unauthorised access;
• unauthorised disclosure;
• unauthorised modification; and
• destruction.

Depending on the system and service involved, security measures may include:

• authentication;
• access controls;
• role-based permissions;
• encryption;
• logging;
• monitoring;
• secure development practices;
• vulnerability management;
• backups;
• disaster recovery;
• incident response;
• restricted administrative access; and
• confidentiality obligations.

No online service can guarantee absolute security.

22. Data breaches

If we become aware of a data breach involving personal information, we will take reasonable steps to:

• identify and contain the incident;
• assess the nature and extent of the incident;
• mitigate potential harm;
• investigate the cause;
• remediate the issue where appropriate; and
• comply with applicable notification requirements.

Where ToolboxFM processes personal information on behalf of a customer, we will also comply with our contractual obligations to that customer.

Where required by law, we may notify affected individuals and/or the Office of the Australian Information Commissioner.

23. Data retention

We retain personal information only for as long as reasonably necessary for the purpose for which it was collected, unless a longer period is required or permitted by law.

Retention periods may depend on:

• the type of information;
• the purpose of processing;
• customer contractual requirements;
• legal obligations;
• dispute resolution requirements;
• security requirements;
• backup processes; and
• legitimate business requirements.

Customers may have separate contractual retention arrangements under their agreement with ToolboxFM.

24. Deletion of information

Where personal information is no longer reasonably required and there is no legal or legitimate reason to retain it, we will take reasonable steps to delete or de-identify it.

Deletion from active systems may not immediately result in deletion from backup systems.

Backup information may be removed through normal backup rotation processes.

25. Access to personal information

You may request access to personal information we hold about you, subject to applicable law.

We may need to verify your identity before providing access.

In some circumstances, we may refuse access where permitted or required by law.

If we refuse access, we will generally provide an explanation where legally permitted.

26. Correction of personal information

You may request that personal information we hold about you be corrected if it is inaccurate, incomplete, misleading or out of date.

Where the information is controlled by a ToolboxFM customer, you may need to direct the request to that customer.

ToolboxFM will provide reasonable assistance where appropriate.

27. Privacy requests relating to customer data

If you are a worker, employee, contractor, subcontractor or other individual whose information has been entered into ToolboxFM by a customer, the relevant customer may be the appropriate organisation to contact about:

• why your information was collected;
• how it is being used;
• access requests;
• correction requests;
• retention;
• deletion; or
• other privacy matters.

ToolboxFM may assist the customer where appropriate.

28. Identity verification

Before providing access to personal information or making certain changes to an account, we may require reasonable evidence of identity.

This is intended to prevent unauthorised disclosure or modification of personal information.

29. Privacy complaints

If you believe ToolboxFM has mishandled your personal information, please contact us first.

Privacy Officer, ToolboxFM Pty Ltd

• Email: privacy@toolboxfm.com
• Address: 34 Patrick Crescent, Saratoga, NSW, 2251

Please provide enough information for us to understand and investigate the complaint.

We will take reasonable steps to investigate and respond to privacy complaints within a reasonable timeframe.

If you are not satisfied with our response, you may be able to contact the Office of the Australian Information Commissioner (OAIC).

30. Children

ToolboxFM is primarily designed for use in professional and workplace environments.

Our services are not directed at children.

We do not knowingly seek to collect personal information from children for ordinary Platform use.

If you believe a child has provided personal information to ToolboxFM unnecessarily, please contact us.

31. Third-party websites

Our website or Platform may contain links to third-party websites, applications or services.

We are not responsible for the privacy practices of third parties.

You should review the privacy policy of any third-party service before providing personal information to it.

32. Business transfers

If ToolboxFM undergoes a:

• merger;
• acquisition;
• restructure;
• sale of assets;
• investment;
• financing transaction; or
• sale of all or part of the business,

personal information may be transferred as part of that transaction where permitted by law.

Any such transfer will remain subject to applicable confidentiality and privacy obligations.

33. Records and audit trails

ToolboxFM may maintain system records and audit trails showing events such as:

• account creation;
• login activity;
• user actions;
• activity changes;
• bookings;
• pauses;
• cancellations;
• close-outs;
• administrative changes;
• notifications;
• security events; and
• other Platform events.

These records may be retained for operational, security, audit, dispute resolution and legal purposes.

34. Accuracy of information

We rely on information provided by users and customers.

While we take reasonable steps to maintain the integrity of information within our systems, we cannot guarantee that information entered by customers or users will always be:

• accurate;
• complete;
• current; or
• suitable for every purpose.

Customers and users are responsible for ensuring information they enter is accurate and appropriately maintained.

35. Your responsibilities

When using ToolboxFM, you should:

• provide accurate information;
• keep login credentials secure;
• only access information you are authorised to access;
• avoid entering unnecessary sensitive information;
• notify the appropriate customer or ToolboxFM of suspected unauthorised access;
• use the Platform in accordance with applicable laws; and
• respect the privacy of other users and workers.

36. Changes to this Privacy Policy

We may update this Privacy Policy from time to time.

Changes may be made to reflect:

• changes to privacy law;
• changes to our business;
• new Platform features;
• changes to technology;
• changes to our service providers;
• security improvements; or
• changes to our privacy practices.

When we make material changes, we may provide additional notice where appropriate.

The current version will be made available through our website or Platform.

37. Contact us

If you have questions about this Privacy Policy or our privacy practices, contact:

ToolboxFM Pty Ltd — Privacy Officer

• Email: privacy@toolboxfm.com
• Phone: 0409 683 170
• Address: 34 Patrick Crescent, Saratoga, NSW, 2251

38. Governing law

This Privacy Policy is governed by the laws applicable in Australia and, to the extent relevant, the laws of New South Wales.

Nothing in this Privacy Policy limits any rights you may have under applicable privacy legislation.

39. Related documents

This Privacy Policy should be read together with applicable ToolboxFM documentation, including:

• ToolboxFM Website Terms & Conditions;
• ToolboxFM Client Master Services Agreement;
• ToolboxFM Data Processing Agreement;
• ToolboxFM Security & Data Protection Schedule;
• applicable Order Forms; and
• Trial Agreements.

Document control

• Document: ToolboxFM Privacy Policy
• Version: 1.0
• Owner: ToolboxFM Pty Ltd
• Effective date: 8 September 2026
• Last review: 8 September 2026