Privacy Policy

ICAM Australia Pty Ltd ACN 151 945 498 · Last updated February 2026

1. ICAM commitment to privacy

(a) In this "Privacy Policy", ICAM Australia Pty Ltd ACN 151 945 498, its subsidiaries and affiliates mean ICAM (ICAM, we, our). We are committed to respecting your privacy and understand your need for security and confidentiality. Our Privacy Policy sets out how we collect, use, store and disclose your "Personal Information" in accordance with the Australian Privacy Principles (APPs) under the Privacy Act 1988 (Cth) (Privacy Act) and other applicable privacy laws.

(b) References to "you" in this Privacy Policy refers to the individual reading the policy or any individual whose Personal Information has been collected by us. It also includes:

• (i) a person who interacts with our website; and
• (ii) a person who interacts with any web-accessible components of the ICAM Platform to submit information.

(c) By using our services, website and the ICAM mobile applications, including the SafetyPulse application and the ICAM Quick Reference Guide (QRG) App (collectively the "ICAM Platform"), you confirm you have agreed to our Terms and Conditions and read and understood this Privacy Policy. This Privacy Policy applies to Personal Information collected, used and disclosed by ICAM about its clients, suppliers, job applicants and contractors.

2. What information does ICAM collect about you?

(a) References to the terms "Personal Information" and "Sensitive Information" have the meanings given under the Privacy Act.

(b) A number of different types of information are explicitly recognised as constituting Personal Information and Sensitive Information. For example, where we refer to:

• 'Personal Information', this means information which identifies an individual or from which an individual's identity can be reasonably ascertained. In some circumstances, including where it is necessary for the conduct of our Services, we may need to collect sensitive information.
• 'Sensitive Information', this means information or opinion about an individual's health information (as defined in section 6FA of the Privacy Act), racial or ethnic origin, political opinion, religious beliefs, sexual orientation or criminal record, provided the information or opinion otherwise meets the definition of Personal Information.

2.1 Clients and prospective clients

(a) When you enquire about our ICAM Platform or when you become a client of ICAM, a record is made which includes your Personal Information.

(b) The type of Personal Information that we collect will vary depending on the circumstances of collection and the kind of service that you request from us, but will typically include:

• (i) contact name, e-mail, postal address and other contact details;
• (ii) company telephone numbers, ACN, ABN and office addresses;
• (iii) information about your organisation and employees;
• (iv) work health and safety information; and
• (v) any additional Personal Information or Sensitive Information you provide to us, or authorise us to collect, as part of your interaction with the ICAM Platform.

(c) We may collect information about how you access, use and interact with the website and the ICAM Platform. We do this by using a range of tools such as Google Analytics. This information may include:

• (i) the location from which you have come to the site and the pages you have visited and other information about how you interact with our services, including page views, bytes transferred, hyperlinks clicked and other actions you take; and
• (ii) technical data, which may include IP address, the types of devices you are using to access the website or ICAM Platform, device attributes, browser type, language, operating system and inferred location.

2.2 WHS Investigations

(a) We will only collect Sensitive Information where you consent to the collection of the information, or your employer has provided that consent (unless one of the exceptions to the APPs apply) and the information is reasonably necessary for one or more of our functions or activities.

(b) By providing this information to us or consenting to a third party (such as your employer) providing that information to us, you consent to our collection and use of that information as set out in this Privacy Policy.

3. Why does ICAM collect and use your Personal Information?

(a) ICAM collects Personal Information reasonably necessary to carry out our business, to assess and manage our clients' needs, and to provide the functionality of the ICAM Platform. We may also collect information to fulfil administrative functions associated with these services, for example, billing, entering contracts with you or third parties and managing client relationships.

(b) We use information collected from and about participants in investigations for the purpose of conducting and advising on investigations and associated matters. When we conduct interviews with participants in investigations, we may ask participants follow up questions, request documents through the ICAM Platform or otherwise communicate with you. We may also be required to collect Personal Information (including Sensitive Information) about you from other people for the purposes of conducting and advising on the investigation and associated matters.

(c) The purposes for which ICAM generally collects and uses Personal Information and Sensitive Information depend on the nature of your interaction with us, but may include:

• (i) provide the functionality of the ICAM Platform to you, where you are the end user or are interacting with the ICAM Platform;
• (ii) work health and safety investigations;
• (iii) the services offered through the ICAM Platform;
• (iv) responding to requests for information and other general inquiries;
• (v) researching, developing and expanding our facilities and services;
• (vi) informing you of our activities, events, facilities and services;
• (vii) recruitment processes (including for volunteers, internships and work experience);
• (viii) responding to enquires and complaints;
• (ix) comply with our legal obligations and assist government and law enforcement agencies or regulators.

4. How does ICAM collect your Personal Information?

(a) ICAM will collect your Personal Information by lawful and appropriate means. We will collect Personal Information directly from you if it is reasonable or practicable to do so. We and our related entities may collect Personal Information in a number of ways, including:

• (i) through application forms and digital platform inputs (i.e., the ICAM Platform);
• (ii) by email, written mechanisms, or technology used to support our communications;
• (iii) over telephone calls or via video conferences, which may be recorded for security, training, and quality assurance purposes;
• (iv) from third-party software integrated into the ICAM Platform; and
• (v) in person or through surveillance cameras located at the subject site relevant to the ICAM Platform.

(b) When ICAM collects Personal Information about you through third parties, we manage such information in accordance with the APPs.

(c) If ICAM receives unsolicited Personal Information (information the ICAM Platform did not request), we will determine within a reasonable period whether we could have lawfully collected that information under the APPs. If not, and the information is not contained in a Commonwealth record, we will take steps to destroy or de-identify the information as soon as practicable, provided it is lawful and reasonable to do so.

(d) ICAM may also collect and use Personal Information for market research purposes and to innovate our delivery of products and services.

5. How does ICAM use and disclose Personal Information and/or Sensitive Information?

5.1 For clients, contractors and other service providers

(a) The purposes for which we may use and disclose your Personal Information and/or Sensitive Information will depend on the services we are providing you. For example, if you have engaged us to deliver a service such as providing access to the ICAM Platform, we may disclose information about you to service providers where this is relevant to our services.

(b) ICAM may disclose information to third parties we engage in order to provide the ICAM Platform, including contractors and service providers used for data processing, data analysis, customer satisfaction surveys, information technology services and support, website maintenance/development, printing, archiving, mail-outs, market research, archival, auditing, accounting, customer contact, legal, business consulting, banking, payment, debt collection, delivery, information broking, research, investigation, and insurance services.

(c) ICAM may disclose your Personal Information to:

• (i) IT system administrators who assist us, including those who maintain our IT systems and websites and store our data;
• (ii) the Australian Taxation Office, superannuation fund trustees and administrators;
• (iii) Credit reference agencies or debt collection agencies in accordance with the Privacy Act 1988 and the Privacy (Credit Reporting) Code 2014, for example if you default on payments due or to obtain payment from you; and/or
• (iv) Related and affiliated companies of ICAM, located in Australia and overseas, but in all such cases in accordance with the APPs.

5.2 Use and disclosure for administration and management

ICAM will also use and disclose Personal Information for a range of administrative, management and operational purposes. This may include:

• (a) administering billing and payments and debt recovery;
• (b) planning, managing, monitoring and evaluating the ICAM Platform;
• (c) quality improvement activities;
• (d) statistical analysis and reporting;
• (e) training staff, contractors and other workers;
• (f) risk management and management of legal liabilities and claims (for example, liaising with insurers and legal representatives);
• (g) responding to enquiries and complaints regarding our services;
• (h) obtaining advice from consultants and other professional advisers; and
• (i) responding to subpoenas and other legal orders and obligations.

5.3 Other uses and disclosures

We may use and disclose your Personal Information for other purposes explained at the time of collection or otherwise as set out in this Privacy Policy.

5.4 For participants in WHS investigations

(a) We may provide your Personal Information and/or Sensitive Information to other entities for the purpose of conducting or advising on a WHS investigation or any associated matters through the use of the ICAM Platform.

(b) Any Sensitive Information, such as health and injury information that is collected for the purpose of WHS investigations and related regulatory compliance, is collected with the consent of the individual or on the basis that it is reasonably necessary for one or more of the entity's (such as the individual's employer) functions directly related to the purposes of the investigation.

6. How does ICAM interact with you via the internet?

(a) You may visit our website (https://icamaustralia.com.au) without identifying yourself. If you identify yourself (for example, by providing your contact details in an enquiry), any Personal Information you provide to ICAM will be managed in accordance with this Privacy Policy.

(b) ICAM's websites use cookies. A "cookie" is a small file stored in your web browser that helps manage the website's customised settings and deliver content. We collect certain information, such as your device type, browser type, IP address, and the pages you have accessed on our websites and on third-party websites. You are not identifiable from such information.

(c) You can use the settings in your browser to control how your browser deals with cookies. However, you may be unable to access certain pages or content on our website.

(d) ICAM's websites may contain links to third-party websites. ICAM is not responsible for the content or privacy practices of websites that are linked to our website.

7. Can you deal with ICAM anonymously?

(a) Generally, ICAM will not provide individuals with the opportunity of remaining anonymous or using a pseudonym in their dealings with us unless specifically requested within the ICAM Platform. This is because the ICAM Services involve work health and safety investigations, which, by their very nature, involve Personal Information.

(b) Additionally, it is not practicable for ICAM to deal with individuals anonymously or pseudonymously on an ongoing basis. If we do not collect your Personal Information, you may be unable to utilise the ICAM Platform.

8. How does ICAM hold information?

(a) ICAM stores information in paper-based files or other electronic record-keeping methods in secure databases (including trusted third-party storage providers based in Australia and overseas). Personal Information may be collected in paper-based documents and converted to electronic form for use or storage (with the original paper-based documents either archived or securely destroyed). We take reasonable steps to protect your Personal Information from misuse, interference and loss and from unauthorised access, modification or disclosure.

(b) ICAM maintains physical security over paper and electronic data stores, such as through locks and security systems at our premises. We also maintain computer and network security. For example, we use firewalls (security measures for the internet) and other security systems, such as user identifiers and passwords, to control access to our computer systems.

(c) The ICAM Platform does use encryption or other technologies to ensure the reasonably secure transmission of information via the internet and the mobile application. However, users of the ICAM Platform are encouraged to exercise caution when sending Personal Information over the internet.

(d) We take steps to destroy or de-identify information that we no longer require.

9. Data Breaches

The following clause 9 applies if ICAM is classified as an 'APP entity' pursuant to the Privacy Act. In circumstances where it is not defined as an APP entity, ICAM will take reasonable steps to follow this clause 9.

9.1 Notifiable Data Breach

A 'Notifiable Data Breach' occurs when Personal Information of an individual held by us is accessed by, or is disclosed to, an unauthorised person, or is lost, and:

• (a) the unauthorised access or disclosure is likely to cause serious harm to the individual; or
• (b) in the case of lost information, unauthorised access or disclosure is likely to happen and would result in serious harm.

9.2 In the event of a Data Breach

(a) In the event of an actual Data Breach, ICAM Australia:

• (i) will notify you as soon as reasonably practicable of an actual Data Breach once we become aware of it, or an earlier time pursuant to the Privacy Act;
• (ii) comply with your directions regarding the event to the extent reasonably possible in the circumstances; and
• (iii) provide you with all information requested subject to any law or privacy obligations.

9.3 Assessment of a suspected breach

If we suspect a Notifiable Data Breach has occurred, we will promptly investigate to confirm whether a breach has occurred. We will take all reasonable steps to complete this assessment within 30 days of discovering the potential issue.

10. Collection of Personal Information

10.1 Prospective employees or applicants

(a) We collect Personal Information when recruiting personnel, such as your name, address, date of birth, contact details, photographic and/or live image of your face, job title, immigration status details, education and qualifications, licences or accreditations, work history, references and information relating to employment. Generally, we will collect this information directly from you.

(b) We may also collect Personal Information from third parties in ways which you would expect (for example, from recruitment agencies or referees you have nominated). Before offering you a position, we may collect additional details such as your tax file number and superannuation information and other information necessary to conduct background checks to determine your suitability for certain positions (for example, positions which involve working with children).

10.2 Other individuals

(a) ICAM may collect Personal Information about other individuals who are not direct clients of ICAM. This includes clients' employees, subcontractors and members of the public who are involved with or connected in any way whatsoever with the ICAM Platform. The kinds of Personal Information we collect will depend on the capacity in which you are dealing with the ICAM Platform. Generally, it would include:

• (i) descriptions of workplace events, GPS location data at the time of an event, and metadata (such as time, date, and device type) associated with uploaded photographs, video, or voice recordings;
• (ii) information regarding an individual's physical or mental health, including the nature of injuries, clinical observations, medical figures, and details of treatment or medication administered;
• (iii) witness statements, interview transcripts, and opinions expressed by individuals during the course of an investigation.

(b) If you are injured at work and an investigation is conducted with the assistance of the ICAM Platform, we may collect Sensitive Information, such as health or medical information about you, or otherwise, with your consent.

(c) You can always decline to give ICAM any Personal Information we request, but that may mean we cannot provide you with some or all of the services through the ICAM Platform. If you have any concerns about the Personal Information we have requested, please let us know.

11. Does ICAM use or disclose your Personal Information for direct marketing?

(a) ICAM and its related entities may use or disclose your Personal Information for the purpose of informing you about our services, upcoming promotions and events, or other opportunities that may interest you. If you do not want to receive direct marketing communications, you can opt out at any time by contacting us using the contact details below.

(b) If you opt out of receiving marketing material from us, ICAM may still contact you in relation to its ongoing relationship with you.

(c) For the avoidance of doubt, information collected through the WHS applications (including SafetyPulse and the QRG App) or specific WHS investigations will not be used for direct marketing without separate consent by ICAM or its related entities.

12. Does ICAM disclose your Personal Information overseas?

(a) ICAM is an Australian organisation and works with clients, service providers, sponsors, AI agents and commercial interests across the globe. It is likely that your Personal Information and certain Sensitive Information will be disclosed to overseas recipients.

(b) Unless we have your consent, or an exception under the APPs apply, we will only disclose your Personal Information and/or Sensitive Information to overseas recipients where we have taken reasonable steps to ensure that the overseas recipient does not breach the APPs in relation to your Personal Information and/or Sensitive Information.

13. Does ICAM disclose your Personal Information and/or Sensitive Information to AI Models?

(a) ICAM and its related entities may likely use or disclose your Personal Information and/or Sensitive Information to AI-assisted processing models, which require information submitted to the ICAM Platform to be transmitted to overseas technology providers, including AI model services.

(b) Where possible, ICAM will take reasonable steps to ensure overseas recipients comply with the APPs.

14. How can you access or seek correction of your Personal Information?

(a) You are entitled to access your Personal Information held by ICAM on request. To request access to your Personal Information, please contact our privacy officer using the contact details set out below.

(b) If you consider any Personal Information we hold about you is inaccurate, out-of-date, incomplete, irrelevant or misleading, you are entitled to request correction of the information. Upon receiving your request, we will take reasonable steps to respond and correct your information within 30 days (or as soon as practicable).

(c) We may decline your request to access or correct your Personal Information in certain circumstances in accordance with the APPs. If we do refuse your request, we will provide you with a reason for our decision and, in the case of a request for correction, we will include a statement with your Personal Information about the requested correction.

15. How can you request deletion of your account and data?

(a) If you hold an account on the SafetyPulse application or the ICAM Quick Reference Guide (QRG) App, you may request deletion of your account and the Personal Information associated with it at any time.

(b) To make a deletion request, email info@icamaustralia.com.au with the subject line "Account Deletion Request", or contact our privacy officer using the details below. We will verify and action your request within a reasonable period.

(c) We may be required to retain certain information to comply with our legal, regulatory, tax or record-keeping obligations, or where the information forms part of a work health and safety investigation record. Where information cannot be deleted, we will take reasonable steps to de-identify it or restrict its further use. Where investigation data has been provided by, or relates to, your employer or another organisation, deletion may be subject to that organisation's instructions and retention obligations.

16. What should you do if you have a complaint about the handling of your Personal Information?

(a) You may contact ICAM at any time if you have any questions or concerns about this Privacy Policy or about the way in which your Personal Information has been handled.

(b) You may make a complaint about privacy to the privacy officer at the contact details set out below.

(c) The privacy officer will first consider your complaint to determine whether there are simple or immediate steps which can be taken to resolve the complaint. We will generally respond to your complaint within a week.

(d) If your complaint requires more detailed consideration or investigation, we will acknowledge receipt of your complaint within a week and endeavour to complete our investigation into your complaint promptly. We may ask you to provide further information about your complaint and the outcome you are seeking. We will then typically gather relevant facts, locate and review relevant documents and speak with individuals involved.

(e) In most cases, we will investigate and respond to a complaint within 30 days of receipt of the complaint. If the matter is more complex or our investigation may take longer, we will let you know.

(f) If you are not satisfied with our response to your complaint, or you consider that ICAM may have breached the APPs or the Privacy Act, a complaint may be made to the Office of the Australian Information Commissioner. The Office of the Australian Information Commissioner can be contacted by telephone on 1300 363 992 or via the contact details on the website at www.oaic.gov.au.

17. How are changes made to this Privacy Policy?

ICAM may amend this Privacy Policy from time to time, with or without notice to you. We recommend that you visit our website regularly to keep up to date with any changes.

18. How can you contact ICAM?

This Privacy Policy was last updated in February 2026.