Privacy & Confidentiality Policy

Concept Engineers Pty Ltd (“Concept Engineers”, “we”, “us” or “our”) is committed to protecting personal information and maintaining appropriate confidentiality in relation to information entrusted to us.

This Privacy & Confidentiality Policy explains how we collect, hold, use, disclose, protect and dispose of personal information in connection with our engineering, consulting, project management and related business activities.

We seek to comply with the Privacy Act 1988 (Cth), including the Australian Privacy Principles (APPs), where applicable, together with other privacy, surveillance, telecommunications, workplace, professional and information-handling laws that may apply to particular activities.

This Policy applies to personal information concerning clients, prospective clients, consultants, contractors, suppliers, project stakeholders, property owners, members of the public, job applicants, employees and other people with whom we interact.

It applies to information in any form, including written, oral, electronic, photographic, video and audio records.

From time to time, we may provide additional privacy or collection notices in relation to particular systems, services, forms, communications or activities. Those notices should be read together with this Policy.

Not all confidential information is legally considered “personal information”.

As an engineering consultancy, we routinely receive commercially, technically or otherwise confidential information relating to clients and projects, such as:

• drawings and design information;
• development proposals;
• tender and pricing information;
• contractual information;
• reports and investigations;
• project correspondence;
• construction information;
• commercially sensitive information; and
• information supplied to us subject to contractual or professional obligations of confidentiality.

Even where such information does not identify an individual and therefore falls outside the Privacy Act, Concept Engineers seeks to handle it in accordance with appropriate professional, contractual, security and confidentiality requirements.

Personnel, contractors and relevant service providers may be subject to confidentiality and information-security obligations appropriate to the nature of their access.

Personal information is information or an opinion about an identified individual, or an individual who is reasonably identifiable.

Depending on the circumstances, personal information we collect or hold may include:

• name, residential or postal address, email address and telephone number;
• date of birth or identity information where reasonably required;
• employer, business, position and professional contact details;
• business registration, licensing or professional-registration details;
• correspondence, instructions, enquiries and project communications;
• information contained in emails, SMS messages, instant messages and other communications;
• recordings and transcripts of telephone calls, meetings and voice messages;
• CRM records, file notes, contact history, meeting notes, tasks and follow-up records;
• project information identifying owners, applicants, consultants, contractors, neighbours or other individuals;
• property ownership and property-related information;
• photographs, video, audio and site records;
• information contained in engineering drawings, reports, submissions, applications and supporting documents;
• professional qualifications, registrations, licences and memberships;
• billing, invoicing and payment information;
• commercial credit or payment-history information where reasonably required;
• tender, proposal and contractual information;
• recruitment information, including employment history, qualifications, references and application material;
• staff, contractor and workplace information;
• emergency-contact information;
• information relating to incidents, complaints, insurance matters, disputes or legal claims;
• information provided for seminars, events, publications or newsletters;
• website and technology information such as IP address, browser, device, logs and analytics information; and
• other information provided to us or generated through our dealings with an individual.

The particular information collected will depend on the nature of the person's relationship and dealings with Concept Engineers.

Sensitive information has a particular meaning under Australian privacy law and may include information concerning a person's health, racial or ethnic origin, political opinions, religious beliefs, professional or trade associations, trade union membership, sexual orientation, criminal record and certain biometric or genetic information.

We do not ordinarily require sensitive information to provide engineering services.

However, we may collect sensitive information where it is reasonably necessary for our activities and:

• the individual has provided any consent required;
• collection is required or authorised by law; or
• another legal exception applies.

This could arise, for example, in relation to workplace health and safety, medical certificates, accessibility requirements, emergencies, insurance matters, workplace incidents, recruitment or employment matters.

We seek to minimise the collection and use of sensitive information.

When handling personal information, we seek to apply principles of:

• lawful and transparent handling;
• collection for legitimate business purposes;
• collecting only information reasonably necessary for those purposes;
• limiting access to people and systems that reasonably require it;
• maintaining reasonable accuracy;
• appropriate technical and organisational security;
• avoiding unnecessary retention; and
• appropriately destroying or de-identifying information when it is no longer reasonably required and there is no legal, contractual, professional or other reason requiring retention.

The safeguards applied may vary depending on the volume, sensitivity and nature of the information and the risks associated with its use.

We may collect personal information directly when an individual:

• contacts us by telephone, email, SMS, messaging service or through our website;
• requests a proposal, engineering advice or other service;
• engages us to undertake work;
• participates in a project, tender, meeting, site inspection, event or consultation;
• provides drawings, reports, correspondence or other documentation;
• enters into an agreement with us;
• makes or receives payments;
• deals with our personnel or contractors;
• subscribes to information or communications;
• makes a complaint or enquiry;
• applies for employment, contracting, work experience or graduate opportunities; or
• otherwise interacts with us.

We may also collect personal information from third parties where reasonably necessary, including:

• clients and prospective clients;
• developers, property owners and project proponents;
• architects, planners, surveyors, builders and consultants;
• contractors and subcontractors;
• councils, utilities and government authorities;
• referral partners and professional contacts;
• organisations with which the individual is associated;
• publicly available records and registers;
• professional directories, websites and social media;
• recruitment agencies and referees;
• insurers, lawyers and professional advisers; and
• other project participants.

Project documentation supplied to us may contain personal information concerning individuals other than the person supplying the document.

A person who provides Concept Engineers with personal information about another individual should, where appropriate, ensure that they are authorised or otherwise entitled to provide that information and that doing so does not breach any applicable obligation.

In many projects, Concept Engineers necessarily receives personal information indirectly through clients, consultants, government authorities, project documentation or correspondence.

Where required and reasonable in the circumstances, we may take steps to notify the affected individual or otherwise ensure that they are aware of the relevant matters concerning collection and handling.

We may sometimes receive personal information that we did not request, including through emails, project records, correspondence, attachments, referrals or information supplied by third parties.

Where Australian privacy law requires us to do so, we will consider whether the information could lawfully have been collected by us.

If it could not reasonably have been collected and there is no legal or other applicable basis requiring its retention, we may take reasonable steps to destroy or de-identify the information where it is lawful and reasonable to do so.

Where unsolicited information is retained, it will be handled in accordance with applicable privacy requirements.

Concept Engineers uses business communication systems that may integrate telephone calls, SMS messages, emails and other communications with our customer relationship management, project and business systems.

Recording, transcription and analysis

Telephone calls, meetings or other voice communications with Concept Engineers may be recorded, monitored, transcribed, summarised or analysed.

This may involve automated technology or artificial intelligence.

Recordings, transcripts and summaries may be used for:

• maintaining accurate project records;
• recording instructions and discussions;
• confirming decisions and actions;
• preparing file notes and correspondence;
• project administration;
• quality assurance;
• customer service;
• staff supervision and training;
• workflow automation;
• resolving discrepancies or disputes;
• protecting legal and commercial interests;
• compliance and risk management; and
• improving our services and internal processes.

Where required by applicable law, we will provide appropriate notice of recording or transcription and obtain any consent legally required.

A person who does not wish to participate in a recorded or transcribed communication may advise us. Where reasonably practicable, an alternative means of communication may be available.

Privacy, surveillance and recording laws can differ depending on the circumstances and jurisdiction. Our practices may therefore be adjusted where necessary.

SMS and other communications

SMS messages and communications sent to or from Concept Engineers business systems may automatically be retained and associated with the relevant contact, organisation, project, enquiry or opportunity.

This may include message content, attachments, delivery information and related metadata.

We use customer relationship management (“CRM”), project-management and related business systems.

Information stored or processed through these systems may include:

• contact information;
• business and employment information;
• projects and opportunities;
• correspondence;
• telephone and SMS history;
• call recordings and transcripts;
• meeting records;
• contact and relationship history;
• quotations and proposals;
• project instructions;
• tasks and follow-up actions; and
• other information relevant to our dealings with an individual or organisation.

Information may be processed automatically to assist with transcription, categorisation, searching, summarisation, task generation, contact management, workflow automation and administrative functions.

Concept Engineers uses artificial intelligence, machine-learning and automated technologies as part of its business operations.

These may include commercial or business artificial-intelligence platforms, transcription systems, document-processing tools, workflow systems and other AI-enabled applications.

How AI may be used

AI and automated systems may assist with activities including:

• summarising correspondence and project information;
• preparing draft emails and communications;
• reviewing and organising documents;
• extracting or classifying information;
• transcription and summarisation of calls and meetings;
• searching project records;
• preparing internal notes;
• proposals and project administration;
• research and technical support;
• software development and automation;
• quality-assurance activities;
• CRM management;
• workflow and task management; and
• improving internal business processes.

Information processed through these systems may therefore include personal or confidential information contained in correspondence, project records, meeting notes, transcripts, reports, drawings or other business information.

Our approach to AI

Where reasonably practicable, Concept Engineers seeks to:

• use appropriate commercial or business systems for business information;
• utilise available business, enterprise and privacy controls;
• provide only information reasonably relevant to the intended task;
• avoid unnecessary inclusion of personal or sensitive information;
• redact or de-identify information where reasonably appropriate;
• restrict access to authorised users;
• apply appropriate confidentiality and security requirements to providers;
• avoid intentionally opting confidential client or project information into general-purpose model-training programs without appropriate authority; and
• apply appropriate human oversight to material outputs.

AI-generated transcripts, summaries, classifications and other outputs may contain errors or omissions and should not automatically be treated as an authoritative record.

Material engineering, contractual, financial, employment or commercial decisions should be subject to appropriate human review.

We may use computer programs and automated tools to assist with administrative and operational activities such as:

• categorising information;
• summarising communications;
• identifying or allocating tasks;
• searching information;
• prioritising workflows;
• preparing draft material; and
• identifying information requiring attention.

We do not ordinarily rely solely on automated systems to make decisions reasonably expected to significantly affect an individual's rights or interests.

Where required by applicable law, we will provide additional information concerning automated decision-making systems that make or substantially assist in making decisions that significantly affect individuals.

We may collect, hold, use and process personal information for purposes including:

• verifying identity where reasonably required;
• responding to enquiries;
• preparing proposals and quotations;
• undertaking tendering and procurement activities;
• establishing and managing client relationships;
• understanding project requirements;
• providing civil, environmental and other engineering or consulting services;
• carrying out project administration;
• communicating with clients and stakeholders;
• coordinating consultants and contractors;
• preparing drawings, reports, models, applications and deliverables;
• dealing with councils, utilities and government authorities;
• construction-phase and contract-administration activities;
• maintaining project and professional records;
• invoicing and collecting payment;
• assessing or managing commercial payment risk;
• recovering amounts owing to us;
• managing suppliers and subcontractors;
• managing insurance and professional risk;
• complying with legal, contractual and regulatory requirements;
• handling complaints, claims, disputes and legal proceedings;
• maintaining professional-indemnity and project records;
• recruitment and employment;
• workplace health and safety;
• managing emergencies;
• internal administration;
• quality assurance;
• training;
• events, seminars and industry engagement;
• cybersecurity and fraud prevention;
• operating, securing and improving our technology systems;
• research and business improvement;
• business development and relationship management; and
• otherwise operating and administering our business.

We may also use or disclose personal information for related secondary purposes where an individual would reasonably expect us to do so or where otherwise authorised or permitted by law.

Individuals are generally not required to provide personal information unless required by law, contract or the circumstances of a particular service.

However, if reasonably requested information is not provided, we may be unable to:

• properly respond to an enquiry;
• verify identity or authority;
• provide a proposal;
• establish or administer an engagement;
• communicate effectively;
• undertake engineering work;
• obtain approvals;
• provide access to systems or sites;
• process an application;
• assess commercial arrangements; or
• otherwise provide the relevant service.

Where practicable, individuals may interact with us anonymously or using a pseudonym. In many professional, contractual and engineering contexts, identification is reasonably necessary.

Where we rely on consent to collect, use or disclose personal or sensitive information, the individual may be entitled to withdraw that consent.

Withdrawal of consent does not necessarily affect any collection, use or disclosure that lawfully occurred before withdrawal.

Depending on the circumstances, withdrawal may affect our ability to provide particular services or perform contractual, legal, professional or administrative activities.

Some uses and disclosures do not depend on consent and may be permitted or required by law.

We may disclose personal information where reasonably necessary for purposes described in this Policy.

Recipients may include:

• our officers, employees and authorised personnel;
• contractors, subcontractors and related entities;
• clients and project owners;
• consultants and project participants;
• builders and contractors;
• councils, utilities and government bodies;
• certifiers, authorities and regulators;
• insurers and insurance advisers;
• legal advisers;
• accountants, auditors and business advisers;
• banks and payment providers;
• debt-recovery and dispute-resolution providers;
• IT and cybersecurity providers;
• cloud-hosting and storage providers;
• email and productivity-system providers;
• CRM and project-management providers;
• telecommunications and messaging providers;
• transcription providers;
• artificial-intelligence and automated-processing providers;
• engineering and software-technology providers;
• document-management and backup providers;
• recruitment, payroll and employment-service providers; and
• other authorised service providers reasonably required to support our business.

Where appropriate to the nature of the service and information involved, service providers may be subject to contractual, confidentiality, security or privacy requirements.

We may also disclose information:

• where required or authorised by law;
• in response to a lawful request by a court, tribunal, regulator or law-enforcement authority;
• for legal proceedings or anticipated legal proceedings;
• to establish, exercise or defend legal rights;
• where reasonably necessary to protect the safety or lawful interests of an individual or organisation;
• in connection with insurance or professional-indemnity matters;
• in connection with an actual or proposed merger, financing, restructure, acquisition, business sale or transfer of assets; or
• with the individual's consent.

We do not sell lists of client personal information to third parties for their independent marketing purposes.

Concept Engineers uses cloud-based systems, technology providers, professional service providers, contractors and other authorised third parties in connection with its business operations.

As a result, personal information may from time to time be accessed, processed, stored or disclosed outside Australia, including through cloud infrastructure, telecommunications, software, artificial intelligence, transcription, document management and other business systems.

Overseas recipients and service infrastructure may be located across a range of jurisdictions, including Asia-Pacific, North America, Europe and other regions in which our service providers, contractors or their subprocessors operate.

The particular locations involved may vary from time to time as systems, providers, infrastructure and subprocessors change.

In some circumstances, the number and changing nature of overseas service-provider and subprocessor locations may make it impracticable to specify each individual jurisdiction in this Policy.

Where Australian privacy law applies to an overseas disclosure, Concept Engineers takes reasonable steps appropriate to the circumstances to address its cross-border privacy obligations.

Privacy and data-protection laws applicable in other jurisdictions may differ from Australian law.

We rely on third-party services and technology to operate efficiently and securely.

Personal or confidential information may be stored or processed using systems supporting:

• email and productivity;
• document management;
• cloud hosting and storage;
• CRM;
• accounting and payment;
• telecommunications;
• messaging and SMS;
• transcription;
• artificial intelligence;
• backup and disaster recovery;
• cybersecurity;
• project management;
• engineering and design applications; and
• general business administration.

In selecting and managing providers, we may have regard to factors including:

• the nature and sensitivity of information;
• security controls;
• access controls;
• contractual arrangements;
• confidentiality obligations;
• available privacy and enterprise controls;
• provider and subprocessor arrangements;
• data-location arrangements;
• retention practices; and
• the purpose for which the service is used.

Where appropriate and reasonably available, we may require providers to delete, return or cease processing information when their services are no longer required or when information is required to be disposed of.

Concept Engineers takes reasonable technical and organisational measures to protect personal information from misuse, interference and loss and from unauthorised access, modification or disclosure.

Depending on the systems and risks involved, measures may include:

• controlled user access;
• identity and authentication controls;
• multi-factor authentication;
• role-based or need-to-know access;
• secure cloud systems;
• encryption made available through our systems and providers;
• network and endpoint security;
• anti-malware and cybersecurity controls;
• backups and disaster-recovery measures;
• security updates and patching;
• monitoring and logging;
• confidentiality obligations;
• staff policies, guidance and training;
• supplier and service-provider controls;
• incident-response procedures;
• records-management controls; and
• secure destruction or de-identification practices.

The measures considered reasonable depend on factors including the sensitivity of information, foreseeable risks, available technology and the nature and size of our operations.

No internet, cloud, communications or electronic system can be guaranteed to be completely secure.

We retain personal and project information for as long as reasonably necessary having regard to:

• the purpose for which the information was collected;
• ongoing project requirements;
• contractual obligations;
• professional obligations;
• statutory and regulatory requirements;
• taxation and accounting requirements;
• insurance requirements;
• professional-indemnity considerations;
• applicable limitation periods;
• existing or reasonably anticipated claims or disputes;
• regulator or authority enquiries; and
• legitimate business and records-management requirements.

Engineering and project information may therefore be retained for extended periods.

We seek not to retain identifiable personal information for longer than reasonably necessary.

Where information is no longer required and there is no legal, contractual, insurance, professional or other proper reason requiring its retention, we may take reasonable steps to destroy or de-identify it.

Information may remain temporarily in secure backups, archives or disaster-recovery systems after removal from active systems where immediate deletion is not technically practicable.

We take reasonable steps appropriate to the circumstances to ensure personal information we collect, use or disclose is accurate, complete, current and relevant having regard to the purpose for which it is being used.

Individuals are encouraged to tell us if information held about them changes or appears incorrect.

Automated transcripts, AI summaries and machine-generated records may contain inaccuracies. Where material, original source information or appropriate human verification should be used.

Concept Engineers maintains processes for identifying, assessing and responding to suspected privacy and information-security incidents.

Where appropriate, our response may include:

• containing the incident;
• preserving relevant records and evidence;
• investigating what occurred;
• determining what information may have been affected;
• assessing potential harm;
• taking corrective or preventative action;
• obtaining legal, technical, insurance or cybersecurity advice;
• reviewing relevant controls; and
• making notifications required by law.

Where the Notifiable Data Breaches scheme under the Privacy Act applies and we have reasonable grounds to believe an eligible data breach has occurred, we will notify the Office of the Australian Information Commissioner and affected individuals as required by law.

Individuals may request access to personal information we hold about them.

Requests should be made using the contact details at the end of this Policy and should provide sufficient information to enable us to identify the individual and locate the requested information.

We may require reasonable evidence of identity or authority before providing access.

We will respond within a reasonable period and generally aim to deal with requests within 30 days.

Australian privacy law permits access to be refused in certain circumstances. These may include circumstances where access would be unlawful, would unreasonably affect another person's privacy, or another statutory exception applies.

Where required, we will provide reasons for refusing access and information concerning available complaint mechanisms.

We generally do not charge for making an access request. Where permitted by law, reasonable costs of providing access may apply and will be communicated beforehand.

An individual may ask us to correct information they believe is inaccurate, out of date, incomplete, irrelevant or misleading.

We may ask the individual to provide reasonable information supporting the requested correction.

Where required by applicable law, we will take reasonable steps to correct the information.

If we decline to make a requested correction, we will provide an explanation where required and advise the individual of relevant complaint options.

We may collect information concerning job applicants, current and former employees, contractors, prospective contractors, work-experience participants, students and graduates.

Depending on the circumstances, this may include:

• contact and identification details;
• residency or right-to-work information;
• employment history;
• qualifications;
• professional licences and registrations;
• curriculum vitae and application material;
• interview and assessment information;
• references and referee information;
• background-check information where lawful and appropriate;
• banking and payroll information;
• taxation and superannuation information;
• emergency contacts;
• training and professional-development information;
• performance and workplace records;
• leave records;
• workplace health and safety information;
• information relating to incidents, investigations or grievances; and
• other information reasonably required to administer the relationship.

Certain acts or practices involving employee records directly related to a current or former employment relationship may be exempt from some requirements of the Privacy Act.

Regardless of whether an exemption applies, Concept Engineers seeks to maintain appropriate confidentiality and security around employee information.

Where reasonably required for legitimate purposes, we may collect government-related identifiers such as tax file numbers, licence numbers or identification information.

We do not ordinarily adopt a government-related identifier as our own identifier for an individual and will only use or disclose such information as permitted or required by law.

We may use professional or business contact information to maintain relationships and communicate regarding:

• our services and capabilities;
• relevant projects;
• proposals and opportunities;
• industry information;
• newsletters and publications;
• seminars and events;
• company updates; and
• other professional matters that may reasonably be relevant.

We seek to comply with applicable privacy and spam legislation.

Where required, marketing communications will provide a means to opt out.

Individuals may request that we cease using their personal information for direct-marketing purposes.

Project communications, contractual notices, invoices, responses to enquiries, operational communications and other service-related messages are not ordinarily treated as direct marketing.

When a person accesses our website, our systems or service providers may automatically collect technical information such as:

• IP address;
• browser and device information;
• approximate geographic information;
• pages viewed;
• referring website;
• access dates and times;
• interaction and usage information; and
• security or diagnostic information.

We may use cookies and similar technologies to:

• operate the website;
• maintain security;
• understand how visitors use the website;
• analyse website traffic;
• remember preferences;
• improve functionality and performance;
• diagnose technical problems; and
• understand how people find or interact with our services.

Some cookies may be supplied by third-party analytics, hosting, security or technology services.

Users can generally control cookies through their browser settings, although disabling cookies may affect website functionality.

Information submitted through website forms may be entered into our CRM or other business systems and handled in accordance with this Policy.

Concept Engineers may maintain profiles and interact with individuals through social-media and professional-networking platforms.

If an individual interacts with us using such a service, the operator of that platform may separately collect, use and disclose information under its own terms and privacy policy.

We may also collect professional or business contact information from publicly available sources, including:

• business websites;
• government registers;
• professional registers;
• project and development records;
• corporate records;
• professional networking services; and
• other legitimate public sources,

where reasonably relevant to our activities.

Our website, emails or other communications may contain links to websites or services operated by third parties.

A link does not necessarily constitute endorsement of that third party or its privacy practices.

Independent third parties are responsible for their own privacy and information-handling practices and individuals should review those practices where relevant.

An individual who believes Concept Engineers has improperly handled their personal information may lodge a privacy complaint using the contact information below.

To help us investigate, the complaint should preferably provide:

• the complainant's name and contact details;
• a description of the concern;
• relevant dates, communications or documentation; and
• any outcome being sought.

We may request additional information where reasonably required.

We will assess the complaint, investigate where appropriate and seek to resolve it fairly.

We generally aim to provide a substantive response within 30 days, although complex matters may require additional time. If additional time is reasonably required, we will endeavour to advise the complainant.

Where appropriate, an investigation may involve reviewing records and systems, speaking with relevant personnel and considering corrective or preventative action.

If an individual is dissatisfied with our response, they may be entitled to lodge a complaint with the Office of the Australian Information Commissioner (OAIC).

Concept Engineers seeks to maintain reasonable administrative and organisational arrangements for managing privacy and confidentiality appropriate to its size, operations and information-handling activities.

These arrangements may include:

• assigning responsibility for privacy matters;
• maintaining policies and procedures;
• implementing security controls;
• limiting access to information;
• providing personnel with guidance or training;
• reviewing new or changed systems where privacy risks warrant consideration;
• maintaining incident-response procedures;
• reviewing service providers where appropriate; and
• periodically reviewing this Policy and associated practices.

Technology, business practices, services, service providers and legal requirements change over time.

Concept Engineers may amend this Policy to reflect changes to:

• our services;
• business practices;
• privacy laws;
• communications systems;
• CRM systems;
• artificial-intelligence and automated systems;
• technology providers;
• information-security practices;
• third-party providers; or
• other operational requirements.

The current version will be published on our website and identify the date on which it was last updated.

We intend to review this Policy periodically and when material changes occur.