Refari Pty Ltd (ACN 623 616 606) (Refari, we, us or our) facilitates referrals and job applications in the recruitment process, and provides related recruitment-marketing software, widgets, job boards, candidate-marketing tools, website design, build and hosting, and associated services via software and other technological means (Services).
This Privacy Policy governs how Refari deals with the Personal Information it collects in connection with the Services.
It also applies to Personal Information collected in connection with our website, social media accounts, applications, software, widgets and other technological means (Online Platforms), as well as any direct communication between you and Refari.
By accessing or using the Online Platforms and the Services, you acknowledge that your Personal Information will be handled in accordance with this Privacy Policy.
Refari uses third parties located both in Australia and overseas, in addition to its own resources, to provide the Services. Where we do, we take reasonable steps to protect your Personal Information.
Section 1
1. Scope of This Privacy Policy
1.1
We understand that the privacy and confidentiality of Personal Information (as defined under the Privacy Act) is important to you. We respect your right to privacy and are committed to protecting the personal and financial details you provide to us in line with this Privacy Policy. This Privacy Policy applies to the Services and to all individuals who use the Services or whose Personal Information is processed by Refari.
1.2
We are committed to protecting the privacy of everyone who uses our Online Platforms and Services, so that they understand what Personal Information we collect and store, why we do so, how we obtain it, and the rights they have in relation to their Personal Information. We comply with the Australian Privacy Principles set out in the Privacy Act 1988 (Cth) (Privacy Act) and, where they apply to you, with other data protection laws, including the EU and UK General Data Protection Regulation (GDPR), Canadian privacy law, and applicable United States state privacy laws.
1.3
Some parts of this Privacy Policy apply only to individuals in particular locations (for example, the location-specific rights in the 'Your privacy rights' section). Those parts apply only where the relevant law applies to you.
Section 2
2. Our Role: Controller and Processor
2.1
Refari provides the Services to recruitment agencies, employers and in-house talent teams (each a Client). Depending on the activity, Refari acts either as a controller of Personal Information or as a processor handling Personal Information on behalf of a Client.
2.2
As a processor (on behalf of a Client). When a Candidate applies to, registers with, or is referred to a Client through the Online Platforms, Refari generally handles that Personal Information on behalf of, and on the instructions of, that Client. The Client is responsible for that Personal Information as its controller, including for the lawfulness of the application forms, screening questions and communications it configures. If you wish to exercise your rights in relation to data held for a Client, you may contact us and we will assist or direct your request to the relevant Client.
2.3
As a controller (our own purposes). Refari acts as a controller where it determines how and why Personal Information is processed for its own purposes, including operating, securing, analysing and improving the Online Platforms and Services, recognising returning users across the Client websites that embed our widgets, and developing our products.
2.4
Where Refari acts as a processor, this Privacy Policy is provided for transparency and does not override the privacy policy or instructions of the relevant Client.
Section 3
3. The Information We Collect
3.1
We may collect the following categories of Personal Information:
3.1.1
Identity information, such as name, location, date of birth and nationality;
3.1.2
Contact information, such as email address, telephone number, third-party usernames, and residential, business or postal address;
3.1.3
Profile and career information, such as job title, current or previous employers, skills, links to professional profiles (for example LinkedIn), and the contents of your resume or CV and cover letter;
3.1.4
Application information, being the information you submit when you apply for, register interest in, or are referred to an opportunity, including your answers to screening or eligibility questions (which may be free text or uploaded files) and any message you provide;
3.1.5
Financial information, such as billing details and payment-method information used to transact with us (card payments are handled and tokenised by our payment provider, as described in the 'Third parties, sub-processors and overseas transfers' section);
3.1.6
Audio and media, being, where you use a feature that records audio (for example a voice note), the recording and any transcription of it; and links to video you choose to add (we store the link, not the video itself);
3.1.7
Technical and usage information, such as IP address, device and browser information, language settings, the website you came from, a device or browser identifier, and information about how you interact with the Online Platforms and with our widgets embedded on Client websites;
3.1.8
Statistical information, being behavioural and statistical information about individuals and businesses in connection with the Services and the Online Platforms.
3.2
We may also collect information about other people that you provide to us (for example when you refer a friend or contact). Please see the 'Referrals and information about other people' section.
3.3
We may disclose additional purposes for collection in a collection statement at the point of collection.
Section 4
4. How We Collect Your Information
4.1
We collect Personal Information in a number of ways, including:
4.1.1
directly from you, when you apply, register, create an account, subscribe to alerts, submit a review, contact us, or otherwise use the Online Platforms or Services;
4.1.2
from our Clients, for example when a Client uploads or syncs Candidate information to the Online Platforms;
4.1.3
from other people, for example when a referrer provides your details to refer you to an opportunity (see the 'Referrals and information about other people' section);
4.1.4
automatically, through cookies, device identifiers and similar technologies when you use the Online Platforms or visit a Client website that embeds our widgets (see the 'Cookies, tracking technologies and device identifiers' section); and
4.1.5
from third parties, such as applicant tracking systems we integrate with, and review or social platforms that publish reviews about a Client or that a Client connects.
Section 5
5. Why We Collect and How We Use Personal Information
5.1
We collect and use Personal Information so that we can:
5.1.1
enable you to use the Online Platforms and provide the Services;
5.1.2
process and manage applications, registrations, referrals and reviews;
5.1.3
send job alerts, talent alerts, notifications and other communications you have requested or that relate to the Services;
5.1.4
communicate with you, including about the Services and offers that may interest you;
5.1.5
process payments and produce accounts, tax invoices and receipts;
5.1.6
provide your Personal Information to a Client, or to third parties engaged to help deliver the Services to you;
5.1.7
generate content, suggestions and other outputs using artificial intelligence (see the 'Artificial intelligence and automated processing' section);
5.1.8
operate, secure, analyse and improve the Online Platforms and Services, and develop new features and products; and
5.1.9
consider and respond to your enquiries and complaints, and comply with our legal obligations.
5.2
We will only use Personal Information for the purpose for which it was collected, for a related purpose you would reasonably expect, with your consent, or as otherwise permitted or required by law.
Section 6
6. Artificial Intelligence and Automated Processing
6.1
We use artificial intelligence (AI) to provide and improve parts of the Services, for example to parse resumes, generate candidate advertisements and marketing content, suggest skills and content, prepare alert content, and transcribe audio you submit.
6.2
To do this, we may send the relevant content (which may include the text of your resume, your application, or other information you provide) to trusted third-party AI providers that process it on our behalf. We select these providers from time to time and may change them. A current list of our sub-processors, including our AI providers, is available on our Sub-processors page (https://privacy.refari.co/sub-processors/).
6.3
We do not sell your Personal Information, and we do not permit our AI providers to use your Personal Information to train their own models. Your information is processed only to return a result to us.
6.4
We may use Personal Information in de-identified or aggregated form to develop, train and improve our own models and Services (see the 'De-identified information' section). We will not use identifiable Personal Information to train our own models without your consent, or unless otherwise permitted by law.
6.5
Audio transcription. Where a feature allows you to submit a voice or audio recording, we send that recording to a third-party AI provider to transcribe it. This feature is currently available to Client users, and may be extended to other users in the future.
6.6
Automated decision-making. We may use automated processing, including AI, to assess, rank, or make or support decisions about applications or candidates. Where a decision that produces legal or similarly significant effects about you is based solely on automated processing, you have the right to request human review of that decision, to express your point of view, and to contest the decision, as described in the 'Your privacy rights' section.
6.7
We log the AI requests we make, including the content sent and the result returned. These logs are retained and deleted in accordance with the 'Data retention and the right to be forgotten' section.
Section 7
7. Cookies, Tracking Technologies and Device Identifiers
7.1
We and our service providers use cookies, device and browser identifiers (including device fingerprinting), pixels and similar technologies when you use the Online Platforms or visit a Client website that embeds our widgets.
7.2
We use these technologies to keep you signed in, to recognise your device and browser, to recognise returning users across the Client websites that embed our widgets, to measure and analyse usage, to attribute applications and referrals to their source, and to protect the Online Platforms against fraud and abuse (including through Google reCAPTCHA, which loads in your browser).
7.3
Because some of these technologies recognise the same device across different Client websites, activity associated with your device may be linked across the Clients you interact with through our widgets.
7.4
Where our widgets are embedded on a Client's website, the Client is responsible for obtaining any consent required from visitors to that website for cookies and similar technologies.
7.5
You can manage or disable cookies, including analytics cookies, through your browser settings, although some features may not work properly as a result.
Section 8
8. When Personal Information Is Used and Disclosed
8.1
We may disclose Personal Information:
8.1.1
to the relevant Client, where you apply to, register with, or are referred to that Client;
8.1.2
to third parties and service providers (sub-processors) engaged to help us provide the Services (see the 'Third parties, sub-processors and overseas transfers' section);
8.1.3
to an applicant tracking system or other system used by a Client, where the Services integrate with it;
8.1.4
where we reasonably believe an individual may be engaged in fraudulent, deceptive or unlawful activity that a governmental authority should be made aware of;
8.1.5
as required or authorised by any law (including the Privacy Act); and
8.1.6
in connection with a sale, merger or transfer of our business, in which case Personal Information may be transferred to a new owner.
8.2
Subject to the 'De-identified information' and 'Testimonials and reviews' sections, we do not sell Personal Information to unrelated third parties.
Section 9
9. Third Parties, Sub-processors and Overseas Transfers
9.1
We engage trusted third parties (sub-processors) to help us provide the Services. These include providers of cloud hosting and storage; AI and content generation; email and SMS delivery and verification; payment processing; applicant tracking system integrations; error monitoring and analytics; bot protection and security; and review and social platforms.
9.2
A current list of our sub-processors is available on our Sub-processors page (https://privacy.refari.co/sub-processors/).
9.3
Our Online Platforms and data are hosted in Australia. However, some of our sub-processors are located overseas, including in the United States. This means your Personal Information may be disclosed to, and processed in, locations outside your country of residence.
9.4
Where we disclose Personal Information to overseas recipients, we take reasonable steps to ensure they handle it in a manner consistent with this Privacy Policy and applicable law. By using the Services, you acknowledge that your Personal Information may be transferred and processed overseas as described.
9.5
Payment processing. Card payments are processed by a third-party payment provider. Refari does not store your full card or bank account numbers; these are handled and tokenised by the payment provider.
9.6
We are not responsible for the privacy or security practices of third parties that operate their own services (see the 'Links to other services' section). The collection and use of your information by a Client or other third party may be subject to that party's own privacy policy.
Section 10
10. Referrals and Information About Other People
10.1
The Services allow you to refer another person (for example a friend, candidate or business contact) to an opportunity or to a Client. If you provide us with another person's Personal Information (such as their name, email address or phone number) for this purpose, you confirm that you are authorised to provide it and that you have informed them, or have their consent, for their details to be shared with us and the relevant Client.
10.2
We use a referred person's details to facilitate the referral and to contact them about the opportunity. We may also contact a referred person to let them know that their details were provided to us, by whom, and how they can access or remove their information.
10.3
If you are a referred person and would like us to remove your details, you can contact us using the details in the 'Complaints and disputes' section.
Section 11
11. Sensitive Information
11.1
Sensitive information includes information about your racial or ethnic origin, political opinions, religious or philosophical beliefs or affiliations, membership of a professional or trade association or trade union, health, disability, sexual orientation, or criminal record.
11.2
We do not seek to collect sensitive information unless it is reasonably necessary for our functions or activities and either you have consented or we are required or authorised by law to collect it.
11.3
Some information you provide, such as the contents of a resume or your answers to a Client's screening or eligibility questions, may contain sensitive information. Clients are responsible for the screening and eligibility questions they configure and for ensuring those questions are lawful. Please do not provide sensitive information unless it is specifically requested and necessary.
Section 12
12. De-identified Information
12.1
We may use your Personal Information in de-identified form (de-identification being a process by which a collection of data or information is altered to remove or obscure personal identifiers and personal information) to assist us in running, analysing and improving our business, including to develop and train our own models and Services. We may also provide, including by way of sale, de-identified information in aggregated form to third parties. This information may include (but is not limited to):
12.1.1
recruitment statistics;
12.1.2
job availability statistics;
12.1.3
industry statistics;
12.1.4
advertisement and fulfilment timeframes; and
12.1.5
other industry-based statistics.
12.2
When your Personal Information is included in de-identified, aggregated data, it is not possible to identify you, or anything about you, from that data.
Section 13
13. Data Ownership and Usage
13.1
Candidates, referrers, and hiring managers own their applications, referrals, job alerts, and other personal data within the Refari platform. They retain ownership of the data they provide in these contexts, and we respect their rights in this regard. We collect and store this data solely to facilitate our Services and enhance the user experience.
13.2
Recruiting entities also own a copy of the application or registration data and notification data about saved jobs, job alerts, and other job-related information submitted to them through our platform. This ownership does not extend to sharing this data with other recruiting entities without the explicit consent of the candidate users.
13.3
We do not share user data between recruiting entities unless specifically authorised by the user. This ensures the privacy and control of our users over their personal data.
13.4
All data collection, storage, and processing activities are conducted in accordance with applicable data protection laws and regulations, including the General Data Protection Regulation (GDPR) where it applies. We maintain high standards of data privacy and security, ensuring that personal data is processed lawfully, fairly, and transparently, without adversely affecting your rights. We will ask for your consent before collecting or using personal data for a purpose other than those set out in this Privacy Policy, unless we reasonably consider that we need to use it for another reason and that reason is compatible with the original purpose.
Section 14
14. Testimonials and Reviews
14.1
Individuals who provide testimonials and reviews through our platform retain ownership of their content. However, by submitting a review or testimonial, the author grants Refari a perpetual, worldwide, non-exclusive, royalty-free licence to use, reproduce, modify, display, and distribute the content in connection with our services, marketing, and promotional activities. This includes displaying the reviews and testimonials on third-party platforms and in other marketing materials, with proper attribution to the original author.
14.2
We strive to ensure that reviews are correctly attributed to the appropriate users. However, due to the automation in sending review requests, this process relies on recruiters correctly populating their database systems.
14.3
If a client chooses to display a Ratings widget from Refari, all ratings will be shown, not just a selective subset.
14.4
Authors of testimonials and reviews retain control over their content and may request modification or deletion of their reviews at any time. Clients cannot demand changes, edits, or deletion of any reviews or testimonials left by third parties. However, Refari provides a "revision request" feature that allows clients to request that the author of a review or testimonial consider making changes. The decision to accept or decline such requests rests solely with the review or testimonial author.
14.5
Refari strictly prohibits the manipulation, modification, or misrepresentation of reviews and testimonials, including disguising reviews from one platform as originating from another (e.g., presenting a TopRec review as a review on another platform). Unauthorised copying, exporting, or importing of reviews from our platform to another platform without our explicit written consent is also prohibited. Any such actions are against our policy and may result in legal action, including but not limited to seeking injunctions, damages, or other remedies available under applicable law. Additionally, we reserve the right to inform other review platforms of any breaches of our terms to prevent the unauthorised use of reviews.
14.6
All activities related to the collection, display, and processing of testimonials and reviews are conducted in accordance with applicable data protection laws. Refari reserves the right to remove any content that violates our terms of service or applicable laws and to take appropriate action against users who engage in prohibited practices.
14.7
Where a Client connects a third-party review platform (for example Google), we may import reviews and associated information from that platform in order to display them through the Services.
Section 15
15. Public Profiles and the Talent Board
15.1
The Services include a Talent Board and candidate advertisements that may be published publicly. These are published anonymously and are not intended to identify the candidate.
15.2
We will not publish a candidate's profile in a way that identifies them unless that candidate has verified and consented to the identified publication.
Section 16
16. The Safety and Security of Personal Information
16.1
We may hold your Personal Information in either electronic or hard-copy form.
16.2
If you provide information to us electronically, we retain it in our computer systems and databases. If you provide information to us in hard copy (paper), it is normally retained in our files and a copy is made to our electronic files.
16.3
We use industry-standard security measures, including encryption in transit, access controls and secure hosting, to safeguard and protect your information. No method of transmission or storage is completely secure, however, and we cannot guarantee absolute security.
16.4
If you suspect any misuse or loss of, or unauthorised access to, your Personal Information, please let us know immediately. If we become aware of a data breach that is likely to result in serious harm, or in a breach of your rights, we will notify you and the relevant regulator as required by law, including under the Notifiable Data Breaches scheme of the Privacy Act.
16.5
We are not liable for any loss, damage or claim arising out of another person's use of Personal Information where we were authorised to provide that person with the Personal Information.
Section 17
17. How to Access and Update Your Information
17.1
If you would like us to update or amend your Personal Information, please contact us and we will make the requested amendments.
17.2
If you would like us to provide copies to you of the Personal Information we hold about you, please contact us and we will comply with your request to the extent required by law.
17.3
We may ask you to verify your identity to ensure that the Personal Information we hold is not improperly accessed.
Section 18
18. Your Privacy Rights
18.1
Subject to applicable law, you have rights in relation to your Personal Information. To exercise any of these rights, contact us using the details in the 'Complaints and disputes' section. We may need to verify your identity before responding, and we will respond within the timeframe required by law.
18.2
General. You may ask us to access, correct or delete your Personal Information, and you may ask questions about how we handle it.
18.3
European Union and United Kingdom (GDPR). If you are located in the EU or UK, you also have the right to access your Personal Information, to have it corrected or erased, to restrict or object to its processing, to data portability, and to withdraw consent at any time (without affecting processing already carried out). Where we rely on consent we will rely on your consent; otherwise we rely on the performance of a contract with you, our legitimate interests in operating and improving the Services, or compliance with a legal obligation, as the lawful basis for processing. You may lodge a complaint with your local supervisory authority. Where a decision producing legal or similarly significant effects is based solely on automated processing, you may request human review, express your view, and contest the decision.
18.4
United States. If you are a resident of a US state with applicable privacy laws, you may have the right to know what Personal Information we collect and how we use and disclose it; to access or receive a copy of it; to correct or delete it; and to opt out of any 'sale' or 'sharing' of Personal Information and of targeted advertising. We do not sell Personal Information for money. We will not discriminate against you for exercising your rights.
18.5
Canada. If you are located in Canada, you may request access to and correction of your Personal Information, and you may withdraw consent to its use, subject to legal and contractual restrictions.
18.6
If Refari handles your Personal Information on behalf of a Client (see the 'Our role: controller and processor' section), we may direct your request to that Client, or assist them in responding to it.
Section 19
19. Data Retention and the Right to Be Forgotten
19.1
We retain Personal Information for as long as it is needed to provide the Services and for the purposes set out in this Privacy Policy. We keep your information until you submit a data-erasure request, until you delete it yourself through your dashboard, or until we determine it is appropriate to remove historic data as part of a periodic review, unless we are required or permitted by law to retain it for longer.
19.2
If you no longer want us to hold your Personal Information, you may notify us in writing of your wish for us to delete it. We will use our best endeavours, and comply with all legal requirements, to delete your Personal Information within a reasonable timeframe, including from our records and, where applicable, our AI request logs, unless we are required by law to retain it.
Section 20
20. Children and Minors
20.1
The Online Platforms are not intended for, and must not be used by, anyone under 16 years of age. You must be at least 16 years old to provide Personal Information to us.
20.2
If you are aged 16 or 17, you confirm that you have the consent of a parent or guardian to use the Online Platforms and to provide your Personal Information to us.
20.3
If we become aware that we have collected Personal Information from a child under 16 without the required consent, we will take reasonable steps to delete it.
Section 21
21. Direct Marketing
21.1
We, and our carefully selected third-party business providers, may contact you with direct marketing communications and information about the Services or other products and services offered by us, by telephone, email, SMS, or post.
21.2
If you have indicated a preference for a method of communication, we will endeavour to use that method wherever practical to do so.
21.3
You may opt out of receiving marketing communications at any time by responding through the channel in which you received the communication, or by contacting us (see the 'Complaints and disputes' section). You can unsubscribe from emails by clicking the unsubscribe link in the footer of the email communication you have received.
Section 22
22. Links to Other Services
22.1
Links from our Online Platforms or via our Services to third-party services that we do not operate or control are provided for your convenience. We are not responsible for the privacy or security practices of services that are not covered by this Privacy Policy. Third-party services should have their own privacy and security policies, which we encourage you to read before supplying any Personal Information to them.
Section 23
23. Complaints and Disputes
23.1
If you need to contact us, or have a complaint about how we have handled your Personal Information, please address your communication in writing to the details below:
23.2
If we have a dispute regarding your Personal Information, we will both first attempt to resolve the issue directly between us.
23.3
If we become aware of any unauthorised access to your Personal Information, we will inform you at the earliest practical opportunity once we have established what was accessed and how it was accessed.
Section 24
24. Changes to This Privacy Policy
24.1
If we decide to change this Privacy Policy, we will post the updated version on our website and update the version and date shown below. Where the changes are material, we will take reasonable steps to notify you. Please refer back to this Privacy Policy to review any amendments.