Privacy Policy

Credential Systems Pty Ltd (ABN 94 697 225 157), trading as CredPass ("we", "us", "our"), is committed to protecting your privacy. We handle personal information in accordance with the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs). This policy explains what we collect, why, and how we look after it.

1. What personal information we collect

Depending on how you use CredPass:

• Educators: name and any previous names, date of birth, photo, home and postal address, email, mobile number, emergency contact; the credential documents you upload and the details within them (for example Working with Children Check, National Police Check, First Aid, qualifications); optional health information; and your employment connections and self-reported work history.
• Centre directors: your name, email and phone; your centre's details (name, address, ABN, type); and billing information (payment card details are handled by Stripe, not stored by us).
• Visitors: your name and email (via the contact form); and usage information through analytics cookies, if you accept them.

Sensitive information. Some information is "sensitive information" under the Privacy Act – for example health information and details from a Working with Children Check. We only collect sensitive information with your consent and where it is reasonably necessary to provide the service. By adding these credentials, you consent to us collecting and handling that information for that purpose.

You may withdraw this consent at any time by deleting the relevant credential from your account. Please note that withdrawing consent for certain sensitive credentials (for example, a Working with Children Check) may mean you are unable to use features that rely on that information, such as compliance tracking or centre verification, and a connected centre may no longer be able to confirm your eligibility to work.

2. How we collect your information

We collect information directly from you (when you sign up, add credentials, manage a centre, or contact us); automatically (usage information via cookies, if accepted); and from the documents you upload, which we read to extract their details. If you are an educator connected to a centre, that centre sees the credential information relevant to your role.

3. Why we collect, hold and use your information

To create and manage your account; to read and verify uploaded documents; to track expiries and send reminders; to provide compliance features and reporting to centres; to process subscription payments; to respond to your enquiries; to improve CredPass; and to meet our legal obligations.

Automated processing (AI). We use artificial intelligence to read uploaded documents and extract their details, so you don't have to enter them manually. This processing is limited to providing the service, and uploaded documents are not used to train AI models.

4. Who we disclose your information to

• Connected centres – for educators, a centre you connect with sees the credential information relevant to your role there. It does not see your CV unless you choose to share it, nor your private identity details beyond what is needed for compliance.
• Service providers – trusted third parties who help us operate CredPass (hosting, document processing, email, payments and analytics), only as needed to provide the service.
• Regulators or authorities – where required or authorised by law.

We do not sell your personal information.

5. Storage, hosting and overseas disclosure

Your information is primarily stored in Australia. Some of our service providers are located overseas, or may process limited information overseas, which means some information may be disclosed to or processed in other countries:

• Application hosting: DigitalOcean (Sydney, Australia) – hosts the CredPass web application.
• Public pages, content delivery & DNS: Cloudflare – primary data location in Australia.
• Business email & support: Microsoft 365 – some diagnostic, backup or support data may be processed outside Australia.
• Document reading (AI): Anthropic (United States) – reads uploaded documents via their API to extract their details; does not retain or use them to train AI models.
• Service emails: Resend (United States) – sends service emails such as reminders and confirmations.
• Payments: Stripe (United States and other countries) – processes subscription payments.
• Analytics: Google (United States) – analytics cookies, only if you accept them.

We take reasonable steps to ensure these providers protect your information consistently with the Australian Privacy Principles.

6. Data quality and security

We take reasonable steps to keep your information accurate, up to date and secure. Traffic between your device and CredPass is encrypted in transit using TLS 1.2 or 1.3. Uploaded documents are held on encrypted storage (AES-256), and account passwords are hashed, never stored in plain text. We apply role-based access controls so information is only available to those who need it, and back up key data securely. No method of electronic storage or transmission is completely secure, but we work to protect your information and to strengthen our safeguards over time.

7. Data breach notification

If a data breach is likely to result in serious harm, we will notify affected individuals and the Office of the Australian Information Commissioner (OAIC) in line with the Notifiable Data Breaches scheme. We maintain a data breach response plan.

8. Data retention

We keep your information only for as long as needed to provide the service or as required by law:

• Account and profile data – retained while your account is active. If you delete your account, we permanently delete your personal information within 30 days, except where we are required to retain certain records by law (for example, billing records for tax purposes, see below).
• Credential documents and details – while held in your account; you can delete individual credentials at any time.
• Centre compliance snapshots – retained for up to 3 years for the centre's compliance records.
• Billing records – kept as required by tax and accounting law.

You can delete your account at any time from your account settings.

9. Access, correction and your rights

You can access and update most of your information directly in CredPass. You may also request access to, or correction of, your personal information by contacting us, and we will respond in line with the Australian Privacy Principles.

10. Direct marketing

With your agreement, we may send you updates about CredPass. You can opt out at any time via the unsubscribe link or by contacting us. We do not use sensitive information for marketing.

11. Cookies

We use cookies as described in our Cookie Policy, including Google Analytics cookies (set only if you accept them).

12. Children's information

CredPass is used by adults (educators and centre staff). We do not knowingly collect children's personal information through the service; credential information relates to the educator, not to children.

13. Complaints

If you have a privacy concern, please contact us and we will work to resolve it. If you are not satisfied, you can contact the OAIC at oaic.gov.au.

14. Contact us

15. Changes to this policy

We may update this policy from time to time. We will notify you of material changes. The latest version is always available at credpass.com.au/privacy.