foundU Privacy Policy

1. Purpose and objectives

foundU collects, stores, uses, discloses and otherwise manages your Personal Information in compliance with the Privacy Act 1988 (Cth).  This Privacy Policy outlines how We do that.

2. Definitions, terms, acronyms

In this Privacy Policy, unless the context otherwise requires:

foundU means foundU Holdings Limited (ABN 59 603 695 914).

foundU Platform means Our cloud-based HR technology solution developed by foundU, and which facilitates HR functions associated with the recruitment, engagement and payment of employees.

Personal Information and Sensitive Information have the same meanings as in the Privacy Act.

Privacy Act means the Privacy Act 1988 (Cth).

Privacy Complaint means a complaint by an individual about an act or practice of foundU in relation to the individual’s personal information that is a breach of foundU’s obligations under the Privacy Act.

Privacy Officer means Our person responsible for overseeing all matters relating to the development, implementation, maintenance of, and adherence to this Privacy Policy.

Our, Us or We means foundU and its subsidiaries.

3. Policy scope/coverage

3.1 Generally

This Privacy Policy applies to any individual in relation to whom We currently hold, or may in the future collect, Personal Information.

3.2 Our role in providing services to other employers

Where the foundU Platform is provided to Our customer but also to other employers who have a relationship with, but are not, Our customer (such as where Our customer is a franchisor operating through franchisees), Personal Information may be collected and processed in connection with:

• the customer;
• employers who are not Our customer (for example, franchisees of Our franchisor customer); and
• end users engaged by those employers.

• Our customer and/or the relevant employer is responsible for determining what Personal Information is collected and entered into the foundU Platform, including ensuring that appropriate notices are given and consents obtained where required;
• Personal Information may be accessed and managed by administrators appointed by Our customer or the relevant employer, who may have broad access and control over that information; and
• foundU processes that Personal Information for the purposes of providing, operating, supporting and improving the foundU Platform and related services.

4. Policy statement

We are committed to complying with the Privacy Act in relation to all Personal Information We collect.  The Privacy Act incorporates the Australian Privacy Principles, and We will treat all Personal Information We hold in accordance with those Principles.

This Privacy Policy sets out the way in which We collect, store, use, disclose and otherwise manage Personal Information and how individuals can access their Personal Information held by Us and what they can do if they have a concern with this Privacy Policy or their privacy.

5. Information collected

5.1 Personal information

The types of Personal Information We collect and hold depends on the type of dealings that the individual has with Our business. 

We must collect information about individuals for those individuals to be able to deal with Us. If We do not or cannot collect Personal Information about a given individual, We will be unable to offer any services to or for the benefit of that individual.

We collect the following types of Personal Information from or about individuals:

• name;
• contact information, including email address;
• date of birth;
• gender;
• Right to Work Information;
• demographic information, such as postcode and work preferences;
• banking and other financial information;
• Medical history and information;
• Identification;
• work experience and qualifications; and
• emergency contacts / next of kin.

We collect this Personal Information so that We can:

• provide services to, and receive services from, the individual or the organisation with which they are associated (including where they act as a representative, employee or contractor of that organisation);
• operate, administer and improve Our business; and
• where the individual is Our employee or contractor, establish, manage and maintain Our working relationship with them.

5.2 Sensitive information

We only collect Sensitive Information where it is reasonably necessary for Our business functions and either the use of Sensitive Information has been consented to, or the law requires Us to do so (such as for matters of individual or public health and safety).

5.3 Information other than Personal information (‘non-personal information’)

We may collect from visitors to Our website and users of the foundU Platform information that is not by itself Personal Information (in that it does not identify any given individual).  We collect such information to help Us operate or improve Our business.
 

5.4 Site visit information

foundU may collect an individual user’s server address, the date, time and duration of the visit, search terms used, pages viewed, documents downloaded and the type of device, browser and operating system used.

5.5 Cookies

A cookie is a small string of information that a website transfers to a visitor’s browser for identification purposes.  The cookies used do not identify individual users. 

Cookies can be used to hold anonymous session information, which can then be used to personalise the current visit to Our website or the foundU Platform.  This information may also be used as a basis for targeting online advertising.

Information on how to delete or reject cookies, and further general information about cookies can be found at www.allaboutcookies.org.

foundU employs cookies on its website. Visitors to the foundU website are tracked anonymously. If a visitor completes a form on the website, HubSpot (our CRM) will associate their previous page views based on the tracking cookie.

For other platforms used by foundU (such as foundU’s Google Ads, Facebook, Instagram, Linkedin and other marketing or social platforms), all tracking is done using Google Tag Manager, using beacons and tracking cookies to map the user’s views and behaviour.

foundU uses Google Analytics in foundU’s products and website to capture user views and behaviour (time spent on page, view counts and bounces).

We may use cookies to send your email address in a hashed form to third parties such as Google (and others who use only first party data) so they can perform ad measurement services on our behalf.

6. How we collect this information

We collect Personal Information:

• Directly from the relevant individual through processes such as online onboarding and application forms;
• Via third party integrations;
• From the individual’s employer (including where their employer is Our customer or a franchisee of Our customer); and
• From administrators appointed by Our customer and/or a relevant employer to administer the foundU Platform on their behalf.

Where Personal Information is provided to us by an employer, franchisor or franchisee in connection with use of the foundU Platform, that information is collected and entered into the foundU Platform by those parties.

7. How this information is stored

 
We have built Our organisation, culture and technology with security as a guiding principle. Please see Our Platform Security Whitepaper which highlights how information is stored and the systems which have been established to protect the stored information.

All information is stored in Amazon servers based in Australia only.

8. What we do with the information

8.1 General

The main purposes for which We collect, hold and use Personal Information are:

• to identify and verify individuals;
• to communicate with individuals about Our services; and
• to provide a better focussed service.

We use Personal Information collected from individuals to:

• identify employment opportunities;
• provide potential employers with candidate profiles;
• keep internal records in order;
• process payroll;
• recruitment;
• assist employers in managing their workforce;
• engage in workforce reporting;
• supply and improve Our various products and services; and
• ensure We comply with all laws.

We will not provide Personal Information to an organisation that is not covered by Australian laws or the Australian Privacy Principles without the relevant individual’s consent.  

We may create anonymised or de-identified data derived from Personal Information, which does not identify any individual. We may use and disclose this anonymised data for analytics, product improvement and other business purposes.

8.2 Third Party Disclosures

We may disclose Personal Information to Our customer (including where Our customer is a franchisor) and to the employer of the person to whom the Personal Information relates where this is reasonably necessary for the operation of the foundU Platform and associated services.

Personal Information may be accessed by administrators appointed by Our customer or the employer of the administrators to administer the foundU Platform on behalf of that customer or employer. Those administrators may have broad access and control over end user accounts and data.

We may disclose personal information to third parties for internal usage. Third parties may include:

• Flare HR:
• Department of Home Affairs;
• Australian Taxation Office; and
• Equifax.

We may share Personal information with a third party for functions such as:

• payroll processing functions;
• Visa checks;
• Payroll submission;
• A Customer having initiated an integration with a third party;
• Targeted ad delivery and measurement.

We may disclose Personal Information to third parties so they can use it for:

• Learning Management Systems;
• Business Intelligence Systems;
• Recruitment Systems; and
• Point of Sale Systems. 

Without limiting any of the foregoing, if you are a user of the foundU Platform or an employee of an employer where We provide Our services to the employer, your personal information may be disclosed to:

• your employer, a franchisor or franchisee (where you are working within a franchise);
• an entity related or connected to any of those parties or to the business for which you work;
• administrators and other authorised users;
• foundU and its related entities, contractors and service providers; and
• government authorities or other third parties where required by law.

8.3 Disclosure of personal information within our corporate group

We may disclose Personal Information to Citation Group and other related entities within Our corporate group to:

• deliver integrated services;
• respond to requests made by you or your organisation; or
• provide marketing communications relating to products and services offered by Us or Our Group to Our customers and authorised business contacts.

Where Personal Information is processed through the foundU Platform on behalf of Our customer or a relevant employer, we do not use that information for direct marketing to end users of that customer or employer.

You may opt out of receiving marketing communications at any time by contacting Us using the details set out below.




9. Security

We will take all reasonable steps to ensure that all Personal Information We hold is secure.  In order to prevent unauthorised access or disclosure, We have established suitable physical, electronic and managerial procedures to safeguard and secure information collected through the website and the foundU Platform.  Refer to Our Data Protection and Retention policy.

Our Information Security Management System is certified to ISO27001:2022.

10. Accessing personal information

A person may request access to Personal Information We hold about them.  Such a request is to be made in writing to the Privacy Officer  (privacy@foundu.com.au).

We will grant the applicant access to their Personal Information as soon as possible, subject to the circumstances of the request.

A request to Personal Information will be rejected if:

• the request is frivolous or vexatious;
• providing access would have an unreasonable impact on the privacy of another person;
• providing access would pose a serious and imminent threat to the life or health of any person;
• providing access would prejudice our legal rights; or
• there are other legal grounds to deny the request.

11. Correcting personal information

We will take reasonable steps to ensure the accuracy and completeness of the Personal Information We hold.  Where an individual believes a record of Personal Information We hold is inaccurate or out of date they should contact Us in writing to the Privacy Officer (privacy@foundu.com.au) or they can directly update their details from their employee portal in the foundU Platform.

12. Concerns

Last updated 20 August 2026

Previous version of the privacy policy