Privacy Policy

1. Information We Collect

When you create a Vettedmark account or Digital Compliance Passport, we may collect:

Business information: Australian Business Number (ABN), legal business name, trading name, industry or trade classification, business address (state), and business contact details.

Account information: Name, email address, and role within your organisation.

Compliance documentation: Documents you upload for verification, including but not limited to public liability insurance certificates, workers compensation certificates, and trade licences. These documents may contain policy numbers, expiry dates, coverage amounts, and insurer details.

Usage data: Log data, browser type, IP address, pages visited, and actions taken within the platform. This data is collected automatically to maintain security and improve the service.

Audit data: All status changes, verification results, document uploads, and system actions are recorded in an append-only audit log with timestamps.

2. How We Use Your Information

We use your information to:

Verify your business credentials. In the current phase, the documents you upload are assessed by the Vettedmark compliance team. Automated checks against public registers and issuing bodies, including the Australian Business Register, state licensing authorities, and insurance providers, are being introduced progressively and are not all in operation yet.

Compute and display your compliance status algorithmically from the state of your assessed documents.

Operate the Vettedmark Supplier Registry. Your profile is only visible when you have claimed your profile and are verified.

Send you service and compliance-related notifications about your account and your documents. Automated document expiry alerts are a paid-tier feature that is not yet in operation.

Maintain an immutable audit trail of all compliance status changes.

Improve and maintain the security of the platform.

Respond to your support requests.

Comply with legal obligations.

We do not use your information for advertising. We do not sell your personal information. Vettedmark is a neutral verification infrastructure. Your data is never monetised or shared for commercial purposes beyond operating the service.

3. Algorithmic Compliance Determination

Your compliance status on Vettedmark is determined algorithmically based on the state of your uploaded documents. No Vettedmark staff member can manually set, override, or adjust your compliance status. The system computes whether you are "verified" or "not verified". There are no provisional or conditional states.

If a document expires, your compliance status is automatically downgraded without manual intervention or grace periods.

4. Who We Share Your Information With

We may share your information with:

Verification bodies: Government registers and issuing authorities (for example, the Australian Business Register, state trade licensing bodies) for the purpose of verifying your credentials. Not all of these checks are automated yet. Where a check is not automated, verification is carried out by the Vettedmark compliance team from the documents you provide.

Procurement teams and buyers: Only if you have claimed your profile and your compliance status is "verified". Your Digital Compliance Passport is private by default. You control who receives your shareable compliance link.

Service providers: Third-party infrastructure providers that support the operation of Vettedmark, including database hosting (located in Sydney, Australia), authentication services, and transactional email delivery. These providers access your data solely to deliver their services and are bound by their own privacy obligations.

We do not share your information with any party for marketing, advertising, or data brokerage purposes.

5. Data Storage and Security

Your data is stored on servers hosted in Sydney, Australia (AWS ap-southeast-2 region). We use industry-standard security measures including Row Level Security (database-level access controls), encrypted connections (HTTPS/TLS), and role-based access controls.

Vettedmark is designed to meet Australian data sovereignty requirements. All supplier data is hosted within Australian jurisdiction.

6. Data Retention

We retain your personal information for as long as your account is active or as needed to provide the service. Audit log entries are retained indefinitely as part of Vettedmark's immutable compliance record. This is a core feature of the platform's audit trail integrity.

If you request account deletion, we will remove your profile and personal information within 30 days, except where retention is required by law or for the integrity of the audit trail. In those cases, personal identifiers will be anonymised.

7. Your Rights

Under the Privacy Act 1988 (Cth), you have the right to:

Access the personal information we hold about you.

Request correction of inaccurate information.

Request deletion of your account and personal information, subject to audit trail retention obligations.

Withdraw consent to the collection and use of your information, noting that this may affect your ability to use the service.

To exercise any of these rights, contact us at verify@vettedmark.au.

8. Cookies and Tracking

Vettedmark uses essential cookies for authentication and session management. We do not use third-party advertising cookies or tracking pixels. We may use analytics tools to understand how the platform is used. Any such tools will be disclosed in updates to this policy.

9. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be communicated via email to registered users and posted on this page with an updated effective date.

10. Contact

For privacy-related inquiries or complaints:

Vettedmark Pty Ltd

ABN 31 691 897 542

Email: verify@vettedmark.au

Website: vettedmark.au

If you are not satisfied with our response, you may lodge a complaint with the Office of the Australian Information Commissioner (OAIC) at www.oaic.gov.au.