1. Introduction
1.1 Purpose & Scope
This Privacy Policy explains how Forged Consulting Pty Ltd (ABN 11 638 852 598) (Forged Consulting, we, us, our) collects, holds, uses and discloses personal information, and how you can access or correct your information or make a complaint.
This policy applies to personal information we handle about:
- candidates, applicants and people who register an expression of interest with us
- current and former employees, contractors and personnel placed with our clients
- referees and emergency contacts
- client, supplier and stakeholder representatives
- visitors to our website and people who contact us
This policy is made in accordance with:
- Privacy Act 1988 (Cth) (Privacy Act) and the Australian Privacy Principles (APPs)
- Privacy and Other Legislation Amendment Act 2024 (Cth)
- Office of the Australian Information Commissioner (OAIC) guidance, including Guidance on privacy and the use of commercially available AI products
- AS 4811:2022 Workforce Screening
- Protective Security Policy Framework (PSPF) and ASD Information Security Manual (ISM)
1.2 Policy Statement
Forged Consulting will manage personal information openly, lawfully and securely. We will collect only the information we need, use it only for the purposes we have told you about, protect it to the standard expected of a Defence Industry Security Program (DISP) participant, and give you control over your information wherever practicable.
Although some records may be exempt from the Privacy Act (for example, certain employee records), we apply the standards in this policy to all personal information we hold as a matter of good practice.
1.3 Policy Principles
Transparency – We tell you what we collect, why, and who we share it with.
Data Minimisation – We collect and retain only the minimum personal information necessary for an agreed purpose.
Consent – We seek your consent before collecting sensitive information and before disclosing your details to a client.
Need-to-Know – Access to personal information is limited to personnel who require it for their official duties.
Security by Design – Personal information is protected through layered technical, physical and procedural controls.
Human Accountability – Decisions that affect you are made by people, not by automated systems or artificial intelligence.
2. Personal Information We Collect
2.1 Candidates & Personnel
Depending on your relationship with us, we may collect:
- name, contact details, location and LinkedIn profile
- CV, employment history, qualifications, certifications and professional memberships
- role preferences, availability, engagement type and remuneration expectations
- security clearance level and status (clearance numbers and sponsor details are collected only during formal screening)
- citizenship, identity documents and right-to-work information
- referee details and reference check outcomes
- tax file number, bank, superannuation and payroll details (employees only)
- emergency contact details
- performance, conduct and training records
2.2 Sensitive Information
Some information is sensitive information under the Privacy Act. We collect it only where reasonably necessary for a role or required by law, and only with your consent. This may include:
- criminal history (through a police check, where determined by our risk assessment)
- information relevant to a security clearance or its maintenance
- health information, where required for a role or to support reasonable adjustments
- information you choose to provide, such as veteran status or Aboriginal and Torres Strait Islander identity, which is always optional
2.3 Clients, Suppliers & Stakeholders
We collect names, positions, organisations, business contact details and records of our dealings with client, supplier and stakeholder representatives.
2.4 Website Visitors
Our website does not require you to provide personal information. Our hosting provider may automatically record technical information such as IP address, browser type and pages visited for security and performance purposes. If we use cookies or analytics, we use them to understand website use in aggregate and not to identify individuals.
2.5 Anonymity & Pseudonymity
You may make general enquiries without identifying yourself or by using a pseudonym. However, we cannot assess you for a role, place you with a client or employ you without collecting identifying information.
2.6 Unsolicited Information
If we receive personal information we did not request, we will determine whether we could have lawfully collected it. If not, we will destroy or de-identify it as soon as practicable.
3. How We Collect Personal Information
3.1 Collection From You
We collect most personal information directly from you, including when you:
- submit an expression of interest form, CV or application
- respond to a job advertisement on a job board or professional networking platform
- email, call or meet with us
- complete onboarding, screening or consent forms
3.2 Collection From Third Parties
With your knowledge or consent, we may collect information from:
- referees and former employers
- third-party screening providers, including police check providers
- the Australian Government Security Vetting Agency (AGSVA) and clearance sponsors
- clients you are placed with (for example, performance feedback)
- people who refer you to us
- publicly available sources, such as professional networking profiles
3.3 Collection Notice
When we collect personal information, we will take reasonable steps to tell you who we are, why we are collecting it, who we may disclose it to, and how to access this policy. Candidates are provided a Personal Information Collection Consent Form in accordance with our Personnel Screening Policy.
4. Use & Disclosure
4.1 Purposes
We collect, hold and use personal information to:
- assess your suitability for current and future roles and maintain our talent pool
- conduct workforce screening in accordance with AS 4811:2022
- present you to clients for placement opportunities, with your consent
- sponsor, verify and support the maintenance of security clearances
- employ and engage personnel, including payroll, superannuation and tax obligations
- manage client and supplier relationships and deliver our services
- meet our obligations under the DISP, government panel arrangements and client contracts
- comply with the law and respond to lawful requests
- provide training, professional development and welfare support
We will not use personal information for a secondary purpose unless you would reasonably expect it, you have consented, or it is required or authorised by law.
4.2 Disclosure
We may disclose personal information to:
- clients – we will not submit your CV or details to a client without your consent for that specific opportunity
- AGSVA and the Department of Defence – for security clearance sponsorship, maintenance and DISP reporting obligations
- screening providers – for identity, qualification and criminal history checks
- service providers – including ICT, CRM, payroll, superannuation and professional advisers, who are bound by confidentiality obligations
- government bodies – including the Australian Taxation Office, or where required or authorised by law
We do not sell, rent or trade personal information.
4.3 Communications & Direct Marketing
With your consent, we may contact you about job opportunities, events and company updates. You can opt out at any time by replying to any message or contacting us. We do not use sensitive information for marketing.
5. Artificial Intelligence
5.1 Our Approach
Forged Consulting may use artificial intelligence (AI) tools to improve the efficiency and quality of our work. We follow the OAIC's Guidance on privacy and the use of commercially available AI products. The Privacy Act applies to personal information entered into, processed by or generated by an AI tool in the same way it applies to any other handling of personal information.
5.2 How We May Use AI
We may use approved AI tools to assist with:
- drafting and editing correspondence, documents and job advertisements
- formatting CVs into client-required templates, with your consent to submission
- summarising information you have provided to us
- research, administration and internal business tasks
5.3 Approved AI Tools
Personal information may only be entered into AI tools approved by the Chief Security Officer. Before approval, each tool is assessed to confirm that:
- it is an enterprise or business service governed by contractual privacy and security terms
- our inputs and outputs are not used to train the provider's AI models
- data retention by the provider is limited and defined
- access is controlled through our Microsoft 365 Entra ID identity and multi-factor authentication controls, where supported
- the location of data storage and processing is known and acceptable (see Section 6)
We do not enter personal information into free or publicly available AI tools.
5.4 Information We Will Not Enter Into AI Tools
Regardless of the tool, we will not enter the following into AI tools:
- sensitive information, including criminal history, health information and security clearance details such as clearance numbers or vetting information
- identity documents, tax file numbers or bank details
- security classified information of any kind
- client Official Information, unless the client has authorised it in writing and the tool meets the client's security requirements
5.5 Human Oversight
AI tools assist our people; they do not replace them. AI outputs are reviewed by a Forged Consulting Director or authorised staff member for accuracy and fairness before they are used or relied upon. We do not use AI to infer sensitive information about you.
5.6 Automated Decisions
Forged Consulting does not arrange for computer programs, including AI tools, to make decisions, or to do things substantially and directly related to making decisions, that could reasonably be expected to significantly affect your rights or interests.
Decisions about recruitment, shortlisting, screening outcomes, placement, security clearance sponsorship, remuneration, discipline and termination are made by a Forged Consulting Director.
If we introduce automated decision-making of this kind, we will update this policy before doing so to describe the kinds of personal information used and the kinds of decisions made, as required by APPs 1.7 to 1.9.
5.7 AI-Generated Information
Where an AI tool generates or infers information about an identifiable person, we treat it as a collection of personal information and handle it in accordance with this policy, including taking reasonable steps to ensure it is accurate, up to date and complete.
5.8 Your Choices
You may ask us not to use AI tools when handling your personal information by contacting us (see Section 14). We will respect your request and handle your information manually.
6. Cross-Border Disclosure
We configure our Microsoft 365 environment to store data in Australia where this option is available. Some service providers we use, including CRM, communication and approved AI tool providers, may store or process personal information outside Australia, including in the United States.
Before using an overseas provider, we take reasonable steps to ensure it handles personal information consistently with the APPs, including through contractual privacy and security commitments.
Information relating to security clearances, criminal history or client Official Information is not stored or processed outside Australia unless required by law or authorised by the client.
7. Storage, Security & Retention
7.1 Security
Personal information is held electronically in our Microsoft 365 environment and approved business systems. We protect it in accordance with our Access Control Policy, including:
- phishing-resistant multi-factor authentication for all accounts
- role-based access control and need-to-know restrictions
- encryption of information at rest and in transit
- sensitivity labelling and sharing restrictions
- access logging, monitoring and regular access reviews
- secure storage of any physical records in locked cabinets
- privacy and security awareness training for all personnel
7.2 Retention & Disposal
We keep personal information only for as long as it is needed for the purpose for which it was collected, or as required by law:
| Record Type | Retention Period |
|---|---|
| Expression of interest and talent pool records | 2 years from last contact, unless you renew your consent |
| Workforce screening records | Minimum 7 years, per our Personnel Screening Policy |
| Employee and payroll records | Minimum 7 years, per the Fair Work Act 2009 and taxation law |
| Client and supplier contact records | Duration of the relationship plus 7 years |
When information is no longer required, we destroy or de-identify it using IT-sanitisation processes and secure destruction in accordance with the ISM.
8. Access & Correction
You may request access to the personal information we hold about you, or ask us to correct it, by contacting the Privacy Officer in writing. We will:
- verify your identity before releasing any information
- respond within 30 days
- provide access free of charge
- explain our reasons in writing if we refuse access or correction, and tell you how to complain
You may also ask us to delete your information. We will do so unless we are required to retain it by law or under our screening and security obligations.
9. Data Breaches
If we suspect a data breach, we will contain it, assess it and take remedial action promptly. Where an eligible data breach is likely to result in serious harm, we will notify affected individuals and the OAIC under the Notifiable Data Breaches scheme.
Security incidents involving personal information may also be reported to the Defence Industry Security Branch (DISB) in accordance with our DISP obligations.
10. Complaints
If you have concerns about how we have handled your personal information, please contact our Privacy Officer in writing (see Section 14). We will acknowledge your complaint within 5 business days and aim to resolve it within 30 days.
If you are not satisfied with our response, you may lodge a complaint with the Office of the Australian Information Commissioner:
- Website: www.oaic.gov.au
- Phone: 1300 363 992
11. Roles & Responsibilities
11.1 Chief Security Officer (Privacy Officer)
- Overall responsibility for this policy and privacy compliance
- Approve AI tools for use with personal information
- Receive and respond to access, correction and deletion requests and complaints
- Manage data breach assessment and notification
11.2 Security Officer (SO)
- Assist the CSO with privacy requests, complaints and breach response
- Maintain records of privacy decisions and requests
- Monitor compliance with this policy
11.3 All Personnel
- Handle personal information only as required for official duties
- Use only approved AI tools, and never enter prohibited information into AI tools
- Complete required privacy and security training
- Report suspected privacy breaches to the CSO or SO immediately
13. Review & Maintenance
This policy will be reviewed:
- annually at minimum
- following a significant privacy incident or data breach
- when privacy legislation or OAIC guidance changes
- before introducing new AI tools or automated decision-making that uses personal information
The current version of this policy is published at forgedconsulting.com.au/privacy and is available free of charge on request.
14. Contact Us
Privacy Officer
Forged Consulting Pty Ltd
Email: info@forgedconsulting.com.au
Phone: 0407 484 603
Canberra, ACT
15. Definitions & Acronyms
| Term/Acronym | Definition |
|---|---|
| AGSVA | Australian Government Security Vetting Agency |
| AI | Artificial intelligence: computer systems that generate outputs such as text, summaries, predictions or recommendations from input data |
| APP | Australian Privacy Principle, as set out in Schedule 1 of the Privacy Act 1988 |
| Automated decision | A decision made, or substantially and directly assisted, by a computer program using personal information |
| CSO | Chief Security Officer |
| DISB | Defence Industry Security Branch |
| DISP | Defence Industry Security Program |
| Eligible data breach | Unauthorised access to, disclosure of, or loss of personal information that is likely to result in serious harm |
| Generative AI | AI that creates new content, such as text or images, in response to a prompt |
| ISM | Information Security Manual |
| OAIC | Office of the Australian Information Commissioner |
| Official Information | All information created, received, or held by the organisation or a client, regardless of classification or format |
| Personal information | Information or an opinion about an identified individual, or an individual who is reasonably identifiable |
| PSPF | Protective Security Policy Framework |
| Sensitive information | Personal information including criminal record, health, racial or ethnic origin, political opinions, religious beliefs, sexual orientation, and biometric information |
| SO | Security Officer |