Privacy Policy

We collect the following types of information:

We use the information we collect to:

• Provide, operate, and maintain our platform and services
• Process payroll, superannuation, and other employment-related transactions on behalf of our customers
• Send you service-related communications, including updates, security alerts, and support messages
• Respond to your enquiries and provide customer support
• Analyse usage patterns to improve our platform and develop new features
• Detect, prevent, and address technical issues and security threats
• Comply with legal obligations, including Australian tax and employment law requirements
• Send marketing communications where you have opted in (you can unsubscribe at any time)

We do not sell your personal information. We may share your information in the following circumstances:

We take the security of your data seriously and implement industry-standard measures to protect it, including:

• 256-bit AES encryption for data at rest
• TLS 1.3 encryption for all data in transit
• Multi-factor authentication (MFA) support
• Role-based access controls
• Regular penetration testing and security audits
• Australian-hosted infrastructure (AWS Sydney region)
• Comprehensive audit logging

For more details about our security practices, visit our Security page.

Tax file numbers. We collect and store tax file numbers solely for the purpose of meeting our customers' obligations under Australian tax and superannuation law. TFNs are handled in accordance with the Privacy (Tax File Number) Rule 2015 — they are access-controlled, never used as a general identifier, never disclosed except as authorised under taxation, superannuation or assistance-agency law, and destroyed or de-identified once no longer required for those purposes.

Notifiable Data Breach scheme. We comply with the Notifiable Data Breaches scheme under Part IIIC of the Privacy Act 1988. If we become aware of an eligible data breach that is likely to result in serious harm, we will notify the Office of the Australian Information Commissioner and any affected individuals as soon as practicable, in accordance with our internal incident-response procedures.

We retain your personal information for as long as your account is active or as needed to provide you with our services. We also retain information as necessary to comply with legal obligations, resolve disputes, and enforce our agreements.

Payroll and employment records are retained in accordance with Australian legal requirements, including the Fair Work Regulations 2009 (which require employee records to be kept for 7 years) and Australian tax law requirements.

When you close your account, we will delete or anonymise your personal information within 90 days, except where retention is required by law.

Under the Australian Privacy Act 1988 and the Australian Privacy Principles (APPs), you have the following rights:

• Access: You can request access to the personal information we hold about you.
• Correction: You can request that we correct any inaccurate or incomplete personal information.
• Deletion: You can request that we delete your personal information, subject to legal retention requirements.
• Data Portability: You can request a copy of your data in a structured, commonly used format.
• Complaint: You have the right to lodge a complaint with the Office of the Australian Information Commissioner (OAIC) if you believe your privacy has been breached.

To exercise any of these rights, please contact us at privacy@mployr.com.au. We will respond to your request within 30 days.

We use the following types of cookies:

• Essential Cookies: Required for the platform to function, including session management and authentication.
• Analytics Cookies: Help us understand how visitors interact with our platform so we can improve the user experience.
• Preference Cookies: Remember your settings and preferences for a better experience.

You can control cookie preferences through your browser settings. Disabling essential cookies may affect the functionality of our platform. For a detailed breakdown of every cookie we set, including its purpose, provider, and lifetime, see our Cookie Policy.

Our platform may integrate with third-party services at your direction, including accounting software, job boards, email providers, and cloud storage services. When you enable these integrations, data may be shared with those third-party services in accordance with their own privacy policies.

We encourage you to review the privacy policies of any third-party services you connect to our platform. We are not responsible for the privacy practices of these third-party services.

Mployr applies a tiered minimum age depending on how a person uses the platform:

• Self-registering an account: you must be at least 18, because creating an account binds you (or the business you act for) to our Terms of Service and gives you administrator-level privileges.
• Self-service employee onboarding: if your employer has already enrolled you, you must be at least 16 to complete onboarding yourself. Mployr verifies this via your date of birth. Employees under 16 cannot self-onboard — their employer completes onboarding on their behalf.
• Employer-provisioned employees: there is no minimum age. Employers may enrol employees of any lawfully employable age. The employer, as the data controller for their workforce, is responsible for obtaining any parental or guardian consent required under applicable law.

We apply additional safeguards to records we hold about employees under 16, including restricted internal access, minimum-necessary collection, and prompt deletion on offboarding (subject to the retention obligations in Section 5).

If you believe a minor's data is held in Mployr without an appropriate employment basis or required consent, contact us at privacy@mployr.com.au and we will investigate and act promptly.

Your data is stored in Australia on AWS infrastructure in the Sydney region (ap-southeast-2). In limited circumstances, some data may be processed by third-party service providers located outside Australia — most commonly in the United States (for example, payment processing, transactional email delivery, and product analytics) and, where you enable specific integrations, in the country where that integration's vendor operates. Where this occurs, we take reasonable steps to ensure that your information receives an equivalent level of protection as required under Australian Privacy Principle 8, including by contractually binding overseas recipients to handle the information consistently with the APPs.

Parts of our platform use automated processing to assist you and your administrators — for example, suggested rosters, award rate interpretation for payroll, leave-approval routing, and risk flags raised by our review workflows. These outputs are used to inform decisions made by your organisation's authorised users; they are not used to make decisions about individuals without human oversight.

We will continue to update this section ahead of the automated decision-making transparency obligations that commence on 10 December 2026 under the Privacy and Other Legislation Amendment Act 2024. If you would like to know whether a specific decision involves automated processing, or to request human review of a decision that affects you, please contact us at privacy@mployr.com.au.

We may update this Privacy Policy from time to time to reflect changes in our practices or for legal, operational, or regulatory reasons. We will notify you of any material changes by posting the updated policy on our platform and updating the "Last updated" date. We encourage you to review this policy periodically.

If you have any questions about this Privacy Policy or our privacy practices, please contact us: