Data Processing and Security Notice
How CAQA Policies processes, stores and protects the data handled through this website and within the platform.
This Data Processing and Security Notice explains how CAQA Policies, part of CAQA Groups and Career Calling International Pty Ltd (ABN 53 162 651 238), processes, stores and protects the data handled through this website and within the CAQA Policies platform used by education and service organisations.
Scope of this notice
This notice covers two kinds of data. The first is information collected through this website itself, such as enquiry form submissions and newsletter subscriptions, which we handle as described in our Privacy Policy. The second is the content that client organisations import into or create within the CAQA Policies platform: policies, procedures, forms and other controlled documents, together with their version histories, approval records, acknowledgement records, review schedules and legislative mappings.
The document library
The platform is designed to hold governance documents and the records that surround them. Documents themselves are usually organisational rather than personal in nature, but workflow records necessarily identify the individuals who drafted, reviewed, approved or acknowledged each version - typically a name, role, date and action. Clients decide what they store, and we encourage clients to keep personal information inside documents to the minimum their governance obligations require.
Client responsibility for content
For content inside the platform, the client organisation is the owner and controller of its own library. The client remains responsible for the accuracy and lawfulness of its documents, for having a lawful basis to record workflow information about its own personnel, and for directing acknowledgement requests appropriately. CAQA processes this content on the client's behalf and on its instructions.
Hosting and storage
Platform data is hosted in secure, professionally managed data-centre environments, with a preference for Australian-region hosting for client production data. Data in transit is protected with encryption (HTTPS/TLS), and storage environments are hardened, patched and monitored.
Access controls
Access to client data within our systems is restricted to authorised personnel who need it to deliver, support or maintain the platform, and is protected by unique credentials, role-based permissions and activity logging. Client-side access is controlled by the client's own administrators through user roles and permissions in the platform, as described in the Platform Terms.
Backups and continuity
Platform data is backed up on a scheduled basis, and backups are retained to support recovery from technical failure. Backups are protected with the same care as production data. Clients should still maintain their own exports of critical documents where their governance requirements demand an independent copy.
Incident reporting
If we become aware of a security incident affecting client data, we will assess it promptly, contain and remediate it, and notify affected clients without undue delay, providing enough information for the client to meet its own obligations, including any assessment required under the Notifiable Data Breaches scheme. Clients must promptly report suspected incidents, lost credentials or unusual account activity to us so that we can act quickly.
Data return and deletion
When a subscription ends, clients may export their document library - including archived versions and workflow records - in a standard format within the period stated in their agreement or the Subscription Terms. After that period, client data is deleted or de-identified from production systems in the normal course, with residual copies in backups expiring on the routine backup cycle.
Payments and this website
No payments are processed through this website, and no cardholder or banking data is collected or stored by it. Subscription fees are invoiced directly under a written agreement, so there is no online transaction data for this site to secure beyond the enquiry and subscription information described above.
Limits of this notice
This notice is general information about our practices and is not legal advice. Clients should seek their own advice on their privacy, data-protection and record-keeping obligations.
Contact
For data or security questions, contact info@caqa.com.au, call 1800 266 160, or use our contact page.