Privacy Policy

Customer Workforce Data (Processed on Behalf of Customers)

When an organisation subscribes to Lattice Look, the customer uploads workforce data to the Platform. This data is provided by the customer, not collected by Lattice Labs directly from individuals. The customer is the data controller; Lattice Labs acts as a data processor.

This data may include: employee and worker names, identification numbers, and position titles; department, branch, site, or directorate assignments; employment type (full-time, part-time, casual, contractor, volunteer); work email addresses and contact numbers; training and certification records including course names, completion dates, expiry dates, and certification numbers; position-to-training matrix assignments (which certifications each position requires); compliance status (compliant, expiring, expired, not started); induction records and completion status; inspection records and checklist results; incident reports and investigation records; psychosocial health assessment data (hazard identifications, risk ratings, survey responses, control measures); document control records (document versions, review status, approval chains); site register entries (sign-in/sign-out records, visitor records, emergency roll call data); professional development records; and documents uploaded as evidence of certification (e.g., scanned certificates, statements of attainment).

Where a customer enables integration with an external HRIS, identity provider, or workforce management system (such as Chris21, TechnologyOne, Civica, SAP, or Azure AD), workforce data may be synchronised automatically from that system on a schedule configured by the customer. The customer authorises and controls this connection via the Platform’s integration settings. Lattice Labs does not initiate external data collection independently. Data received via integration is subject to the same storage, isolation, and security protections as manually uploaded data.

Where a customer enables bidirectional synchronisation, compliance data generated within the Platform (including training completion status, certification expiry dates, and compliance scores) may be written back to the customer’s connected external system. The customer controls which data fields are synchronised and may disable outbound synchronisation at any time. Lattice Labs does not control or have access to the customer’s external environment.

For contractor management, customer workforce data may also include contractor company details (business name, ABN, insurance certificates, prequalification status, and safety management system documentation) where the customer enables contractor tracking features.

Customer workforce data may also include information about volunteers and external learners, as described in the next section.

Volunteers and External Learners

A customer may use the Platform to manage its volunteers, and to deliver training to people it does not employ, such as members of the public enrolled in its courses (external learners). As with all customer workforce data, this information is provided by or collected at the direction of the customer, the customer is the data controller, and Lattice Labs acts as a data processor. The customer is responsible for giving these individuals any notice of collection required by Australian Privacy Principle 5 and for any consent its collection requires.

For volunteers, the Platform may hold: name and contact details; the unit, brigade, branch, group or site the volunteer belongs to; role or position; training and certification records, licences and inductions; site register entries; and, where the customer records it as a licence or certification, the number and expiry date of a clearance it requires, such as a Working with Children Check. The Platform does not hold criminal history or police check results.

For external learners, the Platform may hold: name and contact details; enrolment records, course progress and completion; assessment results; and certificates and statements of attainment issued. Where the customer is a registered training organisation, the Platform may also hold the information the customer must collect and report under AVETMISS, including the learner’s Unique Student Identifier, date of birth and answers to statistical questions (for example about Aboriginal and Torres Strait Islander status, disability, and language spoken at home). Some of that information is sensitive information under the Privacy Act, and disability information may also be health information under the Health Records Act 2001 (Vic). It is collected by the customer under its own obligations, held only within the customer’s tenant, and used only to provide the Platform service to that customer. Where a learner purchases a course through the Platform, the Platform holds a record of the purchase; Lattice Labs does not store payment card numbers.

Children and Young People

The Platform is designed for organisations, not for children. It holds information about individuals under 18 years of age only where a customer enrols them, for example junior members or junior volunteers of a volunteer organisation, or school-age learners enrolled in a customer’s courses.

Where it does, the customer is the data controller and is responsible for collecting that information lawfully, including obtaining consent from a parent or guardian where required, and for meeting any obligations that apply to it when working with children. Only the information the customer’s configuration requires is held. This includes any account and session data generated when a child uses the Platform. Lattice Labs does not use information about children for marketing, analytics or profiling, does not disclose it to any third party except as described in the Limited Disclosures section, and never includes it in benchmarking other than within organisation-level aggregates.

Psychosocial Health Data

Where a customer enables the Psychosocial Health module, the Platform may collect and process psychosocial hazard survey responses from the customer’s workers. This data may constitute health information within the meaning of the Health Records Act 2001 (Vic).

Psychosocial survey responses are: collected at the direction of the customer, not Lattice Labs; stored with the same encryption, RLS isolation, and access controls as all other customer data; accessible only to authorised users with appropriate role-based permissions as configured by the customer; not disclosed to any third party; not used by Lattice Labs for any purpose other than providing the Platform service; and included in anonymised benchmarking aggregates only at the organisation level (for example, overall psychosocial readiness scores), never at the individual response level.

Individual survey responses are never visible in benchmarking datasets. The customer is responsible for ensuring that its collection and use of psychosocial health data complies with the Health Records Act 2001 (Vic) and any applicable Health Privacy Principles.

Platform User Data (Collected Directly)

When a customer creates user accounts for staff who will access the Platform, we collect: full name and work email address; role designation within the Platform (Platform Admin, Super Tenant Admin, Organisation Admin, Department Manager, Viewer, Auditor, Gateway); login credentials (passwords are stored as Argon2id hashes; we never store plaintext passwords); WebAuthn passkey registration data (public key credential identifiers and attestation data; private keys never leave the user’s device); SSO federation data (OIDC subject identifiers and issuer URLs; we do not receive or store identity provider passwords); session data including login timestamps, IP addresses, and user agent strings; multi-factor authentication enrolment data (TOTP secret keys, encrypted at rest); and audit trail data recording every action taken within the Platform (timestamped, immutable).

Kiosk and Site Register Data

Where the customer deploys the Kiosk and Site Register module, the Platform collects: sign-in and sign-out timestamps for employees, contractors, and visitors; the site or location of each sign-in event; host selection for visitor sign-ins; device-bound kiosk authentication data (PIN hashes, kiosk identifiers); and badge printing records. Site register data is stored within the customer’s tenant and is subject to the same data isolation and security controls as all other Customer Data.

Where the Kiosk is deployed in offline or intermittent-connectivity mode, sign-in records may be captured and held on the kiosk device temporarily before syncing to the Platform. Locally cached data is encrypted at rest and is purged from the device once successfully synced to the Platform or after a customer-configurable retention window, whichever is sooner.

Edge Gateway Data

Where the customer deploys the edge gateway for on-premises printing, the gateway stores minimal operational data locally on the customer’s hardware: encrypted authentication tokens (rotated on each use), a local print job queue, and connection status logs. This data is encrypted at rest and is automatically purged when no longer needed. The gateway does not store workforce data, certification records, or personal information beyond what is required for print job processing.

The edge gateway may capture visitor photographs for badge printing where the customer has enabled visitor photo capture. Photographs are transmitted to the Platform’s tenant-scoped storage and are not retained on the gateway beyond the duration of the print job. All on-premise data is subject to the customer’s physical security controls.

Website and Enquiry Data

When you visit latticelook.au, book a demo, or contact us, we may collect: name, email address, phone number, and organisation name (provided via contact or demo booking forms); website analytics data (page views, referral source, browser type) collected via privacy-respecting analytics; and correspondence records (emails, form submissions).

Information We Do Not Collect

We do not collect: tax file numbers, bank account details, or payroll information; medical or health records (including WorkCover claim details), except where the customer enables the Psychosocial Health module, in which case the Platform may process psychosocial hazard survey responses as described in the Psychosocial Health Data section above, and, where the customer is a registered training organisation, the disability status a learner discloses for AVETMISS reporting, as described in the Volunteers and External Learners section above; criminal history or police check results; biometric data (WebAuthn passkeys use cryptographic key pairs, not biometric templates; biometric verification occurs entirely on the user’s device and no biometric data is transmitted to or stored by the Platform). Information about individuals under 18 years of age is held only where a customer enrols them, as described in the Children and Young People section above.

We do not initiate connections to external systems without the customer’s explicit authorisation via the Platform’s integration settings.

Customer Workforce Data

Customer workforce data is used solely for the purpose of providing the Lattice Look compliance management service to the subscribing customer. Specifically: mapping employees and workers to positions and required certifications; monitoring certification expiry dates and generating automated alerts; calculating and displaying compliance status at individual, departmental, and organisational levels; generating compliance reports, gap analyses, and audit trail records; managing induction workflows and tracking completion; recording and tracking inspections, incidents, and risk assessments; monitoring psychosocial health obligations and hazard controls; managing document lifecycles, reviews, and approvals; maintaining site registers and emergency roll call capability; delivering training to the customer’s employees, volunteers and learners, and recording their enrolments, progress, assessment and certification; and enabling the customer to fulfil its obligations under applicable workplace health and safety and training legislation.

We do not use customer workforce data for any purpose other than providing the Platform service to the customer that uploaded it. We do not use customer workforce data for marketing, analytics, profiling, or any secondary purpose.

Where the customer has enabled the Psychosocial Health module, customer workforce data is also used for calculating psychosocial health readiness scores and generating compliance reports aligned with the Occupational Health and Safety (Psychological Health) Regulations 2025 (Vic).

Benchmarking Data

Cross-organisation benchmarking is enabled by default for customers on applicable subscriptions. The Platform generates aggregated, anonymised compliance statistics for comparison purposes. No individual personal information is included in benchmarking data. No customer is identified to other customers through the benchmarking feature beyond the customer’s name and aggregate score. Customers may disable benchmarking participation at any time via Platform settings; disabling immediately removes the customer’s data from aggregate calculations and removes the customer’s access to benchmarking insights from other customers.

Platform User Data

Platform user data is used for: authenticating users and managing access control; maintaining the immutable audit trail (required for compliance integrity); detecting and preventing unauthorised access or security incidents; enforcing multi-factor authentication policies; and providing technical support when requested by the customer.

Website and Enquiry Data

Website and enquiry data is used for: responding to enquiries and demo requests; communicating about the Platform and related services; and improving our website and marketing materials.

Data Sovereignty

All personal information processed through the Platform is stored exclusively on infrastructure physically located in Australia. Our primary infrastructure is located in Melbourne, Victoria, with a live disaster recovery node in Wollongong, New South Wales.

We do not use third-party cloud hosting providers (such as AWS, Azure, or Google Cloud). We do not transmit, replicate, or store personal information outside Australia. There is no exposure to foreign government data access regimes, including the United States CLOUD Act.

Encryption

Data in transit is encrypted using TLS 1.2 or higher for all connections between users and the Platform, and between our primary and disaster recovery infrastructure. Data at rest is encrypted using AES-256 on all storage volumes. File attachments (uploaded certificates, documents, and evidence) are individually encrypted at rest using AES-256-GCM with per-file encryption keys.

Multi-Tenant Isolation

The Platform is multi-tenant, meaning multiple customers share the same infrastructure. Data isolation is enforced at two levels using PostgreSQL Row-Level Security (RLS). At the super-tenant level, each customer organisation’s data is completely isolated from every other customer organisation. At the tenant level, for enterprise customers with multiple branches or sites, each branch or site’s data is isolated from other branches within the same organisation according to the customer’s configured access controls.

This means: Organisation A’s data is structurally inaccessible to Organisation B’s users, even in the event of an application-level vulnerability; data isolation is enforced by the database engine, not by application logic alone; and each database query is automatically scoped to the authenticated user’s tenant and super-tenant.

Platform-Level Access

Lattice Labs maintains a platform-level view across all customer tenants. This access is used solely for: generating anonymised benchmarking aggregates; monitoring platform health and performance; providing technical support when requested by a customer; and detecting and responding to security incidents.

Individual customer tenants cannot access another customer’s data. The platform-level view is restricted to authorised Lattice Labs personnel and is subject to the same access controls, audit trail logging, and confidentiality obligations described in this policy.

Access Controls

User authentication is managed through Argon2id password hashing, JWT-based session management, optional WebAuthn passkey authentication, and OIDC-based Single Sign-On. Mandatory multi-factor authentication is enforced for all administrative roles. Role-based access control (RBAC) restricts what each user can see and do within the Platform based on their assigned role. All user actions are logged in an immutable audit trail with timestamps, user identification, IP address, and action details.

Security Testing

The Platform undergoes regular automated penetration testing using industry-standard tools, covering injection attacks, cross-site scripting (XSS), authentication bypass, server-side request forgery (SSRF), and other OWASP Top 10 vulnerability categories. Testing is conducted on a weekly cycle against the live production environment.

Physical Security

Server infrastructure is housed in secured, climate-controlled environments with uninterruptible power supply (UPS) and redundant power. Physical access is restricted to authorised Lattice Labs personnel only.

We Do Not Disclose Customer Workforce Data

We do not sell, rent, trade, or otherwise disclose identifiable customer workforce data to any third party for any purpose. We do not provide data to advertisers, data brokers, or analytics providers. We do not share identifiable data between customers. Anonymised aggregate metrics are shared via the benchmarking feature as described below.

Cross-Organisation Benchmarking

The Platform includes a cross-organisation benchmarking feature that is enabled by default for applicable subscriptions. Anonymised, aggregated compliance metrics derived from the customer’s data are included in benchmarking datasets visible to other participating customers.

Benchmarking datasets contain only organisation-level statistical aggregates, including but not limited to: overall compliance percentages, training completion rates, expiry distributions, and module adoption metrics.

The following data is never included in benchmarking datasets: individual worker names, identifiers, or personal information; raw records or individual certification data; sub-departmental breakdowns; or customer-identifiable data beyond the customer’s name and aggregate score.

The customer may disable benchmarking participation at any time via Platform settings. Disabling benchmarking immediately removes the customer’s data from aggregate calculations and removes the customer’s access to benchmarking insights from other customers.

Limited Disclosures

We may disclose personal information only in the following circumstances: to the subscribing customer, as Organisation Administrators can access, export, and manage all data within their tenant at any time; as required by Australian law, if compelled by a valid Australian court order, warrant, or statutory obligation (we will notify the affected customer before disclosure unless legally prohibited from doing so); to protect safety, if we reasonably believe disclosure is necessary to prevent a serious threat to the life, health, or safety of any individual, or to public health or public safety; and to professional advisors, including our legal advisors, accountants, or auditors, subject to professional confidentiality obligations, and only to the extent necessary.

No Overseas Disclosure

We do not disclose personal information to any recipient outside Australia. Our disaster recovery infrastructure is located in New South Wales, Australia.

During the Subscription

While a customer’s subscription is active, all data uploaded to the Platform is retained and available. The immutable audit trail is retained for the full duration of the subscription.

On Termination of Subscription

When a customer’s subscription ends (whether by non-renewal, termination, or any other reason): the customer may export all of its data at any time prior to or upon termination using the Platform’s built-in export function.

Following a 90-day grace period after termination (during which the customer may still export its data), all customer data including workforce records, certification data, uploaded documents, inspection records, incident records, psychosocial health data, document control records, site register data, configuration, and audit trail records will be permanently deleted from our primary and disaster recovery infrastructure.

We will provide written confirmation of deletion to the customer upon request.

Inactive and Dormant Records

When a volunteer, learner or other individual is no longer active, the customer may archive or deactivate their record rather than delete it. An archived record remains in the customer’s tenant, under the customer’s control, with the same storage, isolation, encryption and access protections as all other customer data. How archived records are treated for fees is set out in the definition of Dormant Record in the Terms of Service.

The customer decides how long archived records are kept, so that it can meet its own record-keeping obligations (for example, the records a registered training organisation must retain). The customer may delete an archived record at any time. On termination of the subscription, archived records may be exported by the customer and are then deleted in the same way as all other customer data, as described above.

Backup Retention

Encrypted backups that may contain customer data are retained on a rolling cycle and are permanently purged no later than 90 days after deletion from the primary systems.

Employees, Workers, Volunteers and Learners

If you are an employee, worker or volunteer of an organisation that uses Lattice Look, or a learner enrolled by one, and you wish to access or correct your personal information held in the Platform, please contact your organisation’s People and Culture, Human Resources, or Safety department, or the team that manages its volunteers or its training. Your organisation is the data controller and manages access to and correction of your records. A parent or guardian may make a request on behalf of a child in the same way.

Organisation Administrators

Organisation Administrators can access, correct, and manage all personal information within their organisation’s tenant directly through the Platform.

Enquiries to Lattice Labs

If you have questions about this Privacy Policy or wish to make a privacy-related enquiry or complaint, contact: Privacy Officer, Lattice Labs Pty Ltd, Email: privacy@latticelook.au, Address: Melbourne, Victoria, Australia.

We will acknowledge your enquiry within 5 business days and respond substantively within 30 business days.

Office of the Australian Information Commissioner

If you are not satisfied with our response, you may lodge a complaint with the Office of the Australian Information Commissioner (OAIC): Website: www.oaic.gov.au, Phone: 1300 363 992, Post: GPO Box 5218, Sydney NSW 2001.