Privacy Policy

Cameron Facilities Pty Ltd ("Cameron Facilities", "we", "us", "our") is committed to protecting your personal information in accordance with the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs). This policy explains how we collect, use, disclose, and protect your personal information.

1. Who We Are

Cameron Facilities Pty Ltd is a facilities management and commercial cleaning services company operating from Perth, Western Australia. We provide integrated FM services, building management, commercial cleaning, concierge services, and related property management services to clients across Western Australia.

Our SiteIQ platform (siteiq.cameronfacilities.com.au) is a proprietary operational platform used by Cameron Facilities staff and authorised clients. It is not a public service and access is restricted to authorised users only.

2. What Personal Information We Collect

The personal information we collect depends on your relationship with us:

• Clients and client representatives: Name, organisation name, email address, phone number, site address, service history, communications.
• Building residents and owners: Name, unit number, contact details, maintenance requests, booking history.
• Staff and contractors: Full name, contact details, employment history, tax file number (via payroll processor only), bank account details (via payroll processor only), police clearances, right-to-work documentation, GPS location data during working hours, training records.
• Portal users: Login credentials (encrypted), access logs, activity within the portal.

3. How We Collect Personal Information

• Directly from you when you contact us, request a service, or use our client portal
• From your employer or body corporate when they engage Cameron Facilities on your behalf
• Automatically through the FM platform (login logs, GPS clock-in records, portal activity)
• From employment application forms and onboarding documentation
• From contractors and suppliers during the engagement process

4. Why We Collect Personal Information

We collect personal information to:

• Deliver and manage facilities management and cleaning services
• Manage employment relationships and contractor engagements
• Operate the FM platform and client portals
• Record attendance, GPS clock-in/out, and work schedules
• Comply with legal and regulatory obligations (including WHS Act 2020 (WA), Fair Work Act 2009, WorkCover WA)
• Respond to maintenance requests, work orders, and complaints
• Send service notifications and operational communications
• Prepare inspection reports, compliance documentation, and quarterly reports
• Manage insurance cover and claims with our public liability and workers compensation insurers

5. Disclosure of Personal Information

We do not sell, rent, or trade your personal information. We may disclose personal information to:

• Authorised staff and managers within Cameron Facilities on a need-to-know basis
• Subcontractors and trade service providers only to the extent necessary to perform work at your property
• Our insurance brokers and insurers (Interlink Insurance Brokers, Berkley Insurance Australia, CGU) in connection with insurance coverage and claims
• Our accounting system (Xero) for financial and invoicing purposes
• Our HR platform (BrightHR / Peninsula) for employment and payroll administration
• SiteIQ Platform (our proprietary facilities management system) for operational data management, hosted on Microsoft Azure infrastructure
• Microsoft Azure (application hosting) · servers located in Australia (Australia Southeast region)
• Regulatory bodies including WorkCover WA, the ATO, or law enforcement where required by law

6. Cross-Border Disclosure

Some of our service providers (including Google) store data on servers located outside Australia. SiteIQ is hosted on Microsoft Azure Australia Southeast, with data stored in Australia. Before disclosing your information to overseas recipients, Cameron Facilities takes reasonable steps to ensure those recipients do not breach the Australian Privacy Principles.

7. GPS and Location Data

Cameron Facilities collects GPS location data from staff using the FM platform clock-in/out system. Location data is collected at the time of clocking in and out only, and is used to verify that staff are present at the correct work location, by comparing the reading with the site's boundary, and to build the timesheet for that shift. Location data is not tracked continuously, and your exact location is never shown to clients or third parties. A client's building manager, strata manager or council can see that you are signed in at their building (your name, company, work order and times) while you are working there. Staff are informed of GPS collection prior to use of the system.

7A. The SiteIQ Staff App

Cameron Facilities staff and contractors may use the SiteIQ app on iOS and Android. The app is for work use only and has no advertising, no tracking across other apps or websites, and no sale of personal information. It collects:

• Account details: your work email, name and role, to sign you in. Your password is checked by SiteIQ and is never stored on the phone; the sign in session is kept in the phone's secure storage (iOS Keychain or Android Keystore).
• Location (GPS clock in): one location reading when you tap check in and one when you tap check out, used as described in section 7. The app never reads your location in the background. You can decline and still check in; the record then shows it was made without a location, and your supervisor may follow it up.
• Camera photographs: the app uses the camera only when you choose to take a photo, during an inspection, a job or when reporting a defect, and records the time and location it was taken. They are stored in SiteIQ, not in your phone's photo gallery, and may show people or vehicles at a site.
• Work records and timesheets: inspections, defects, signatures, job updates and the timesheets built from your clock in and clock out times, including any note or correction you add.
• Device and notification details: a device identifier created for each installation of the app (it is not your phone's hardware or advertising identifier), the app version and phone type, and a push notification address so work, approvals and urgent notices can reach you. Push notifications are delivered through Expo, Apple and Google push services and can be turned off in your phone's settings.
• Crash reports: if the app fails, a technical report (the error, the screen, the app version and phone type) is sent to SiteIQ. It does not include your name, email or work records.
• Client portal accounts: building managers, strata managers, council members, owners and tenants can also sign in to the app with their portal account, including with Microsoft 365. The app then shows only what that account can see on the web portal, and collects the account details, device identifier and push notification address described above.

This information is stored on Microsoft Azure servers in Australia and is used only to run and support Cameron Facilities' services.

Deleting your account: you can ask for your account to be deleted inside the app (More, then Request account deletion) or at siteiq.cameronfacilities.com.au/app/delete-account. We delete your account and personal information and reply within 30 days, keeping only records the law requires us to keep, for the periods in section 9.

8. Security of Personal Information

We take reasonable steps to protect personal information from misuse, interference, loss, and unauthorised access. Our security measures include:

• Encrypted passwords (all user passwords are stored as cryptographic hashes · never in plain text)
• Role-based access control · each user can only access information relevant to their role
• HTTPS encryption on all platform communications (SSL/TLS)
• Secrets management through Azure App Service environment variables (not stored in code)
• Session-based authentication with automatic timeout
• Physical access to offices limited to authorised personnel

In the event of a data breach that is likely to result in serious harm to individuals, Cameron Facilities will comply with the Notifiable Data Breaches (NDB) scheme under the Privacy Act 1988 (Cth), including notifying affected individuals and the Office of the Australian Information Commissioner (OAIC) as required.

9. Data Retention

• Client service records: Retained for 7 years after the end of the service relationship (to comply with general statutory limitation periods)
• Employment records: Retained for 7 years after employment ends (Fair Work Act 2009)
• WHS and incident records: Retained for a minimum of 7 years (WHS Act 2020 (WA))
• GPS clock-in records: Retained for 2 years, then deleted
• Portal access logs: Retained for 12 months

10. Access and Correction

You have the right to request access to personal information Cameron Facilities holds about you, and to request corrections where the information is inaccurate, out of date, or incomplete. To make an access or correction request, contact our Privacy Officer using the details below.

We will respond to access requests within 30 days. In limited circumstances, we may decline an access request as permitted under the Privacy Act 1988 (Cth), and we will explain why in writing.

11. Complaints

If you believe Cameron Facilities has breached the Australian Privacy Principles in relation to your personal information, please contact our Privacy Officer in the first instance. We will investigate and respond within 30 days.

If you are not satisfied with our response, you may lodge a complaint with the Office of the Australian Information Commissioner (OAIC):

• Website: www.oaic.gov.au
• Phone: 1300 363 992

12. Direct Marketing

Cameron Facilities may use your contact details to send service-related communications, operational notifications, and (with your consent) information about our services. You may opt out of marketing communications at any time by contacting us. Service-related notifications (e.g. maintenance updates, work order status) cannot be opted out of while you remain a client of Cameron Facilities.

13. Updates to This Policy

This Privacy Policy may be updated from time to time to reflect changes in our operations or legal obligations. The current version will always be accessible via the client portal and at cameronfacilities.com.au. The effective date at the top of this policy indicates when it was last revised.

14. Contact · Privacy Officer