Data Processing and Security Notice
How data handled through this website and inside the CAQA Projects platform is processed, secured and protected.
This Data Processing and Security Notice explains how CAQA Projects, part of CAQA Groups and Career Calling International Pty Ltd (ABN 53 162 651 238), processes, stores and protects the data handled through this website and within the CAQA Projects platform used by education and service organisations.
Scope of this notice
This notice covers two kinds of data. The first is information collected through this website itself, such as enquiry form submissions and newsletter subscriptions, which we handle as described in our Privacy Policy. The second is data that client organisations import into or generate within the CAQA Projects platform, including contact, lead, learner, employer and stakeholder records, communication logs, notes, tasks and campaign data.
Marketing and contact data
The platform is designed to hold relationship and marketing data: names, organisations, roles, email addresses, phone numbers, enquiry histories, communication preferences, consent records, engagement activity and related notes. Clients decide what data they collect and store. We encourage clients to limit records to what is necessary, keep them accurate and current, and avoid storing sensitive information in free-text fields unless genuinely required for the relationship being managed.
Client responsibility for consent
For data inside the platform, the client organisation is the collector and controller of its own records. The client remains responsible for having a lawful basis to collect each record, for providing any required privacy notices, for obtaining and recording consent where consent is relied upon for marketing, and for honouring unsubscribe and opt-out requests, including obligations under the Spam Act 2003 (Cth) and the Privacy Act 1988 (Cth). CAQA processes this data on the client's behalf and on its instructions.
Hosting and storage
Platform data is hosted in secure, professionally managed data-centre environments, with a preference for Australian-region hosting for client production data. Data in transit is protected with encryption (HTTPS/TLS), and storage environments are hardened, patched and monitored.
Access controls
Access to client data within our systems is restricted to authorised personnel who need it to deliver, support or maintain the platform, and is protected by unique credentials, role-based permissions and activity logging. Client-side access is controlled by the client's own administrators through user roles and permissions in the platform, as described in the Projects Platform Terms.
Backups and continuity
Platform data is backed up on a scheduled basis, and backups are retained to support recovery from technical failure. Backups are protected with the same care as production data. Clients should still maintain their own exports of critical records where their governance requirements demand an independent copy.
Incident reporting
If we become aware of a security incident affecting client data, we will assess it promptly, contain and remediate it, and notify affected clients without undue delay, providing enough information for the client to meet its own obligations, including any assessment required under the Notifiable Data Breaches scheme. Clients must promptly report suspected incidents, lost credentials or unusual account activity to us so that we can act quickly.
Data return and deletion
When a subscription ends, clients may export their data in a standard format within the period stated in their agreement or the Subscription Terms. After that period, client data is deleted or de-identified from production systems in the normal course, with residual copies in backups expiring on the routine backup cycle.
Payments and this website
No payments are processed through this website, and no cardholder or banking data is collected or stored by it. Subscription fees are invoiced directly under a written agreement, so there is no online transaction data for this site to secure beyond the enquiry and subscription information described above.
Limits of this notice
This notice is general information about our practices and is not legal advice. Clients should seek their own advice on their privacy, data-protection and record-keeping obligations.
Contact
For data or security questions, contact info@caqa.com.au, call 1800 266 160, or use our contact page.