Privacy Policy

Business 4.0 Pty Ltd

Effective date: 10 September 2026

1. Who we are and what this policy covers

SignalStamp is operated by Business 4.0 Pty Ltd (ABN 87 645 316 696), based in Tasmania, Australia. In this policy, we, us and our mean Business 4.0 Pty Ltd in connection with SignalStamp.

This policy explains how we handle personal information when you visit our website, contact us, complete a Quick Check or use the SignalStamp assessment application. Personal information is information or an opinion about an identified person or someone who is reasonably identifiable.

Our approach is to collect information for a clear purpose, limit access to people who need it, protect the information we hold and provide a way to raise questions or request access and correction. We comply with Australian privacy laws that apply to us, including the Privacy Act 1988 (Cth) and Australian Privacy Principles where applicable.

2. Information we collect

The information depends on how you interact with SignalStamp.

• Website enquiries and support: your name, email address, optional organisation, subject, message, request reference and correspondence. A support request may also identify the help article from which it was sent.
• Quick Checks: your work email, organisation size band, industry where provided, answers, calculated results, content version, marketing preference and submission details. Session identifiers and campaign referral information help us understand how people reach and use the checks.
• Application accounts: names, work email addresses, organisation details, roles, account and authentication records and service preferences.
• Organisation workspaces: assessment responses, evidence descriptions and links, assigned responsibilities, comments, review records, KPI data and reports. These records may contain personal information supplied by your organisation or its authorised users.
• Billing: billing contact and organisation details, plan and transaction records. Where payment is processed through Stripe, the payment information requested at checkout is handled through that service.
• Technical and security information: IP addresses, browser and device information, request times, access records, cookies or similar identifiers and activity needed to operate, protect and understand use of our services.

Please avoid including sensitive personal information, such as health information, in assessment records unless it is necessary and your organisation has an appropriate lawful basis. Do not submit passwords, identity documents or confidential evidence through our public contact or support forms.

3. How we collect information and your choices

We collect information directly from forms, account registration, assessment activity and correspondence. Your organisation’s administrator or another authorised user may provide your name, work email or role when inviting you or assigning work. We also receive operational information from hosting, security and payment providers.

You can browse public information without creating a SignalStamp account. You can make a general privacy enquiry anonymously or using a pseudonym where practicable. We may need enough information to verify your identity before providing access to personal information or making an account change.

If you do not provide required information, we may be unable to respond, deliver a Quick Check result or provide an account. Optional marketing consent is separate from information needed to deliver a service.

4. Why we use information

We use information to respond to enquiries, deliver requested results, administer accounts and subscriptions, operate assessments and reports, support users, protect the service and meet applicable legal obligations. We also use relevant usage and referral information to understand and improve the website and Quick Check journey.

Quick Check calculations apply assessment rules to the answers supplied. They are intended to support organisational review, rather than make decisions about an individual’s employment, legal rights or eligibility for services.

Comparable Quick Check results may contribute to aggregated benchmarks. Identifying contact details are not displayed in these comparisons. We take steps to prevent published comparisons from identifying an individual or participating organisation. The underlying submission remains subject to this policy; removing a name from a displayed result does not by itself make the source record anonymous.

5. Organisation information and shared reports

If you use SignalStamp through your organisation, its authorised administrators and users may access information according to their permissions. Your organisation decides what information to enter and who should participate in its reviews. Its own privacy policies and obligations may also apply. Our responsibilities for information we hold continue to apply.

An authorised user may disclose report or scorecard information by exporting it or creating a sharing link. Anyone who receives an active link may be able to view the information available through it without signing in. Recipients may save or forward it. Expiring or revoking a link prevents future access through that link but does not recall copies already saved.

Assessment report sharing is designed to exclude customer evidence records from the public report view. Review the actual content before sharing because other report fields may still identify people or organisations.

6. Who receives information

Information may be accessed by our authorised personnel and service providers where needed for their work. Providers support hosting, storage, email, payments, security and website measurement. We may also disclose information to recipients you or your organisation authorise, or where required or permitted by law, including to respond to a lawful regulatory request.

We do not sell personal information. We do not use private assessment records to send marketing to the people mentioned in them.

7. Storage and overseas processing

Core SignalStamp application hosting and the managed application database are located in Sydney, Australia. This does not mean that all information connected with SignalStamp remains in Australia.

Website enquiry and support records are stored separately through the Sites hosting service. Google Workspace processes email correspondence, notifications and results. Google reCAPTCHA processes information for website spam checks. Stripe processes payments where used. These providers and their support arrangements may process information outside Australia.

We consider the privacy and security arrangements of providers and take steps required by applicable law when information is disclosed overseas. Using the website is not treated as consent to waive protections that apply to overseas disclosures.

Our website hosting and Google services may involve processing in the United States and other countries where those providers operate. Payment and support providers may also use overseas infrastructure. Provider locations can vary by service and configuration; the Australian location of our core application does not guarantee Australian processing for every connected service.

8. Cookies, tracking and spam protection

Cookies and similar technologies may support account sessions, security and website functions. The public website also supports Google Tag Manager, which can load measurement or advertising tags. Our website code records enquiry submission events and clicks to the assessment app without putting enquiry message text into those events.

The public website uses Google Analytics 4 through Google Tag Manager to measure visits and interactions. Measurement can include pages viewed, referring websites, browser and device details and interactions with website links. Analytics cookies distinguish visits and sessions. Cookie lifetimes depend on the current Google Analytics configuration and may be renewed on later visits. You can manage or delete cookies through your browser, or use Google’s Analytics opt-out browser add-on at Google Analytics opt-out browser add-on. These choices may affect measurement and some website functions.

Google reCAPTCHA helps protect public enquiry forms from automated spam, fraud and abuse. It processes browser and device information and uses a security cookie to provide this protection. Google provides this processing service to us under the applicable reCAPTCHA service and data processing terms. You can control or delete cookies through your browser, although blocking some technologies may affect forms or account access. Contact us if a security check prevents you making an enquiry.

9. Marketing communications

We send optional marketing updates when you have agreed to receive them or another lawful basis permits the communication. You can unsubscribe using the method in the message or contact us directly. We will action an unsubscribe request within five working days.

Completing a Quick Check or making an enquiry does not automatically subscribe you to marketing. Necessary service messages, such as a requested result, support reply or account security notice, are handled separately. We retain a limited suppression record where needed to respect your marketing preferences.

10. Security and retention

We take reasonable technical and organisational steps to protect personal information against misuse, loss, interference and unauthorised access, alteration or disclosure. These include account access controls, role permissions and operational security measures. No online service can guarantee that every security incident will be prevented.

We retain personal information only for as long as it is needed to provide our services or fulfil another lawful purpose, and for any period required by applicable Australian law or a court or tribunal order. When information is no longer needed and we are not required to retain it, we take reasonable steps to securely destroy or de-identify it. Backup copies are managed through the relevant backup retention and deletion process.

If an incident affects personal information, we will investigate and take appropriate containment and response steps. Where the Notifiable Data Breaches scheme or another notification obligation applies, we will notify affected people and the relevant regulator as required.

11. Access and correction

You may ask us for access to personal information we hold about you or request correction if it is inaccurate, out of date, incomplete, irrelevant or misleading. Contact the privacy contact below and provide enough detail to identify the relevant records. We may need to verify your identity using a proportionate method.

We aim to respond within 30 days. If we cannot grant a request, we will explain the reason, subject to any legal restrictions, and how you can complain. There is no fee to make a request or seek correction. If a lawful, reasonable access charge is proposed, we will explain it before proceeding.

For records managed by your organisation, we may need to work with its administrator to resolve the request. You may also ask about deletion. We will explain any lawful reason the information needs to be retained rather than promise an unconditional right to erasure.

12. Privacy questions and complaints

Contact: Privacy contact, Business 4.0 Pty Ltd

Email: admin@signalstamp.com

Location: Tasmania, Australia

Website: signalstamp.com.au/contact

Please describe your concern, any relevant request reference and the outcome you are seeking. We will acknowledge the complaint, investigate and aim to provide a substantive response within 30 days. If more time is needed, we will explain why and give you an expected response date.

If you are not satisfied, you may contact the Office of the Australian Information Commissioner at oaic.gov.au or on 1300 363 992. The OAIC can explain whether it can handle your complaint and generally expects you to raise it with the organisation first.

13. Updates and copies

We may update this policy when our services, practices or legal obligations change. The effective date will show the current version. Where required, we will give a separate notice or obtain consent for a new use of information. Publishing an updated policy does not itself authorise an unrelated use.

This policy is available free of charge. Contact us if you need a copy in another accessible format.