Last Updated: 5 August 2026 | Version: 2.1
This Privacy Policy applies to personal information collected by Cloud Assess Pty Ltd (ACN 164 642 684) (“Cloud Assess”, “we”, “us”) in connection with:
Cloud Assess is committed to handling personal information in accordance with the Privacy Act 1988 (Cth) and the Australian Privacy Principles.
This Policy applies to:
Where you access the Platform through an organisation with which you are affiliated, we refer to that organisation as your Organisation.
Please read this Privacy Policy carefully and contact us if you have questions about how we handle your personal information.
The current version of this Policy will be available at:
https://cloudassess.com/privacy-policy/
Where applicable privacy laws provide for exceptions or exemptions, we may rely on them in our information-handling practices.
We may collect personal information:
Because the Platform facilitates training, assessment and record keeping, it must generally be able to identify individual users. It is therefore not usually practical for Platform users to remain anonymous or use a pseudonym.
If you visit our Website, request a demonstration, register for a trial or otherwise contact us before becoming a Platform user or customer, we may collect:
We use this information to respond to your enquiry, provide the demonstration or trial you requested, manage our prospective customer relationship and, where permitted, send you marketing communications.
Depending on your relationship with Cloud Assess and how you use the Platform or Website, we may collect:
We collect sensitive information only where it is reasonably necessary for our functions and activities and with the individual’s consent, or where collection is otherwise permitted or required by law.
Your Organisation is responsible for obtaining any consent required before submitting sensitive information to the Platform.
If requested information is not provided, we may be unable to create or administer your account, provide particular functionality, respond to an enquiry or provide a demonstration or trial.
We may collect, hold, use and disclose personal information to:
We don’t use personal information for purposes beyond those described in this Policy unless you consent or the use is otherwise permitted or required by law.
We may use technical, usage and de-identified information to operate, analyse, develop and improve our products and services.
We don’t use identifiable assessment submissions, evidence, photographs, audio or video to train artificial-intelligence or machine-learning models.
Some Platform features may use:
to suggest a possible assessment outcome, highlight relevant evidence or flag items for an assessor’s attention.
These outputs support, but do not replace, human decision-making. Final decisions about competency, qualifications, credentials or employment are made by your Organisation and its authorised personnel.
Cloud Assess does not use facial-recognition or other biometric-matching technology. Photographs and videos submitted through the Platform may be reviewed by your Organisation’s authorised personnel for identity, assessment or evidence purposes.
We don’t sell personal information.
We may disclose personal information to:
We generally require service providers that receive personal information to be subject to appropriate privacy, confidentiality and security obligations.
Core Platform data is hosted using infrastructure located in Australia.
We may disclose limited personal information to service providers located in, or operating from, countries outside Australia, including the United States. These providers may support functions such as email, customer support and communications.
Where personal information is disclosed overseas, we take reasonable steps to ensure that it is handled consistently with the Australian Privacy Principles, as required by applicable law.
We take reasonable steps to protect personal information from:
These steps include technical, physical and administrative safeguards appropriate to the nature and sensitivity of the information. Our staff and contractors are required to respect the confidentiality of personal information they access.
No system can guarantee absolute security.
If a data breach occurs, we’ll assess and respond to it in accordance with applicable law. Where an eligible data breach occurs, we’ll notify affected individuals and the Office of the Australian Information Commissioner as required under the Notifiable Data Breaches scheme.
We retain personal information for as long as reasonably necessary to:
When your Organisation’s subscription ends, it may request its records within 30 days. After that period, we generally delete or de-identify personal information associated with the account, except where:
Information relating to Website enquiries, demonstrations and unsuccessful trials may be retained for up to 24 months after our last meaningful interaction with you, unless a longer period is reasonably required or permitted by law.
Marketing information may be retained until you opt out or following an appropriate period of inactivity. We may retain limited information necessary to ensure that we continue to honour an opt-out request.
Where we hold personal information that we no longer need and are not required or authorised to retain, we take reasonable steps to destroy it or de-identify it.
We use cookies and similar technologies on the Platform and Website for purposes including:
Some of these cookies are set by third-party advertising partners. They may be used to build a profile of your interests and show you relevant ads on other websites.
You can control cookies through your browser settings, although some parts of the Platform or Website may not function properly if cookies are disabled. You can also manage or opt out of personalised advertising directly through these third parties, including Google Ads Settings, Meta Ad Preferences, and the Digital Advertising Alliance’s opt-out tool.
The Platform, Website or content submitted by your Organisation or other users may contain links to third-party websites or resources.
This Policy does not apply to those third parties, and Cloud Assess is not responsible for their content or privacy practices.
We encourage you to review the privacy policy of any third-party site before providing personal information to it.
We may send marketing communications to prospective customers, customer representatives and other business contacts where they have consented or where we are otherwise permitted by law.
We don’t use learner assessment records, evidence or Platform activity for direct marketing.
You may ask us to stop sending marketing communications at any time by:
Opting out of marketing will not prevent us from sending operational communications relating to your account, use of the Platform, assessments, support requests, security or our customer relationship with your Organisation.
We will obtain any consent required before disclosing personal information to a third party for that third party’s own marketing purposes.
For personal information held as part of your Organisation’s account, you should contact your Organisation in the first instance because it administers the account and its content.
You may also contact Cloud Assess directly, and we’ll handle any access or correction request that we are required to consider under applicable privacy law.
We’ll respond within a reasonable time. There is no charge for making an access or correction request, although we may charge a reasonable amount for providing access where permitted by law.
In some circumstances, we may be permitted or required to refuse access or correction. Where required by law, we’ll explain the reason for our decision.
If you have a concern about how we’ve handled your personal information, contact us using the details in Section 17.
Please provide enough information for us to understand and investigate the issue.
We’ll investigate your complaint and respond within any timeframe required by law or otherwise within a reasonable time.
If you’re not satisfied with our response, you may lodge a complaint with the Office of the Australian Information Commissioner:
Office of the Australian Information Commissioner
GPO Box 5218
Sydney NSW 2001
Phone: 1300 363 992
Website: oaic.gov.au
If you are under 18, you should use the Platform only where your Organisation has authorised your access and any consent required by law has been obtained, in accordance with our End User Agreement.
We may update this Privacy Policy from time to time to reflect changes in:
Where changes are material, we’ll take reasonable steps to notify affected individuals.
The current version and “Last Updated” date will be published on our Website.
In this Policy:
If you have questions about this Privacy Policy, wish to request access or correction, or want to make a complaint about how we handle personal information, contact us here:
Last updated: 5 August 26 | Version: 2.0
Cloud Assess Pty Ltd (“Cloud Assess”, “we”, “us”) respects your privacy and is committed to protecting your personal data.
This Privacy Notice explains what personal data we collect through our website and the Cloud Assess platform (together, the “Services”), how and why we use it, who we share it with, how long we retain it, and the rights available to you.
This Notice applies when you:
Cloud Assess is an Australian provider of training, assessment and workforce-compliance software.
Our role depends on what data is involved
For personal data relating to your use of the Website, marketing preferences, or your account-level relationship with us (such as billing contacts or support communications you send us directly), Cloud Assess is the controller of that data, and this Notice describes our practices in full.
For personal data contained within your Organisation’s Cloud Assess account — such as learner records, assessment submissions, evidence, training records, or other content your Organisation or its authorised users have created or uploaded (Platform Content) — your Organisation is generally the controller, and Cloud Assess acts as its processor. We handle that information according to your Organisation’s instructions and our contract with it. If you have a question about how your Organisation manages your personal data, or wish to exercise a data-protection right in relation to Platform Content, you should generally contact your Organisation first. Cloud Assess will still assist directly, or handle a request itself, where we’re required to do so under applicable law.
This Notice describes how we handle both categories of data, and makes clear which role we’re acting in for each.
If you interact with our Website (as a visitor, prospective customer, or business contact), we may collect:
If you use the Platform as an authorised user of your Organisation’s account, we (acting on your Organisation’s instructions) may process:
We will identify what information is required at the point of collection. If you don’t provide required information, we may be unable to respond to your enquiry, arrange a demonstration or trial, or provide you with access to, or the full functionality of, the Platform.
Please don’t provide special category (sensitive) personal data through general Website forms unless we specifically request it. Where special category data is submitted as part of Platform Content, your Organisation is responsible for ensuring it has an appropriate basis for that collection.
Website and business contact data – where Cloud Assess is the controller, we use your personal data to:
Where we rely on legitimate interests, we consider whether those interests are proportionate and whether your rights override them. Where we rely on consent, you may withdraw it at any time – this won’t affect processing carried out before withdrawal.
Platform Content – where your Organisation is the controller, we process this data on your Organisation’s instructions and for the purposes set out in our agreement with it, including to:
Your Organisation determines the legal basis for this processing as controller. Cloud Assess doesn’t use Platform Content for its own separate purposes beyond providing and supporting the Platform, except as described in Section 4 (AI-Assisted Features) below.
We may use technical, usage and de-identified information to operate, analyse, develop and improve the Platform. We don’t use identifiable assessment submissions, evidence, photographs, audio or video to train artificial-intelligence or machine-learning models.
Some Platform features may use assessment responses, uploaded evidence, assessment criteria and related record information to suggest a possible assessment outcome, highlight relevant evidence, or flag items for an assessor’s attention. These outputs support, but do not replace, human decision-making – final decisions about competency, qualifications, credentials or employment are made by your Organisation and its authorised personnel, not by an automated system.
We don’t use facial recognition or other biometric-matching technology. Photographs and videos submitted through the Platform may be reviewed by your Organisation’s authorised personnel for identity, assessment or evidence purposes.
Because these features support rather than replace human decision-making, we don’t consider them to involve a decision based solely on automated processing. We’ll review this position as relevant guidance develops.
We may share personal data with:
We disclose only the information reasonably necessary for a recipient to perform its role, and require our service providers to apply appropriate privacy, confidentiality and security protections.
We do not sell your personal data.
We use necessary cookies and similar technologies to operate the Website and Platform, maintain security, manage sessions and remember your preferences. These cookies do not require your consent, as the Website cannot function properly without them.
We also use analytics and advertising cookies and similar technologies, including tools provided by Google, Meta, LinkedIn, Microsoft and Reddit, to understand Website use, measure performance and improve or promote our services. These cookies are only set after you give your consent through our cookie-preference tool. You can withdraw your consent at any time, just as easily as you gave it, without affecting the lawfulness of any processing carried out before withdrawal.
Disabling necessary cookies may affect the operation of parts of the Website or Platform.
Cloud Assess is headquartered in Australia. Personal data covered by this Notice may be transferred to or processed in countries outside the United Kingdom or European Economic Area.
Our infrastructure and service providers operate in locations including Australia, the United Kingdom, Ireland, and the United States. Some of these countries may have data-protection laws that differ from those applying where you live.
Where required, we rely on an applicable adequacy decision or regulation, or another legally recognised transfer mechanism, which may include:
Where required, we undertake relevant transfer assessments and implement supplementary contractual, technical or organisational protections. You may contact us for further information about the safeguards applying to a particular transfer.
We use appropriate technical and organisational measures designed to protect personal data against loss, misuse, unauthorised access, disclosure, alteration and destruction, including access controls, security monitoring and encryption where appropriate.
No method of electronic transmission or storage is completely secure, and we cannot guarantee absolute security.
We retain personal data only for as long as reasonably necessary for the purpose for which it was collected, including to meet legal, regulatory, tax, accounting and reporting requirements and to establish, exercise or defend legal claims.
As a general rule:
We review our retention periods periodically. When personal data is no longer required, we delete or anonymise it. Where immediate deletion isn’t possible, we isolate the information from ordinary use until it can be deleted through our normal processes.
Depending on the circumstances and applicable law, you may have the right to:
These rights are not absolute and may be subject to legal conditions, limitations or exemptions.
If your request relates to Platform Content, we’ll generally ask you to contact your Organisation first, since it’s the controller responsible for that data. We’ll still assist directly, or action a request ourselves, where required by applicable law.
To exercise a right, contact us using the details in Section 11. We may need to verify your identity and may request further information reasonably necessary to respond. We’ll respond without undue delay and within the period required by applicable law.
Contact us here: https://cloudassess.com/contact/ if you:
We’ll acknowledge complaints within 30 days, investigate them, and respond within a reasonable period.
You may also lodge a complaint with:
Users under 16: If you’re under 16 (or the relevant minimum age in your country), you should only use the Platform where your Organisation, or a parent or guardian, has authorised your access and any consent required by law has been obtained.
Changes to this Notice
We may update this Notice to reflect changes to our Website, Platform, information-handling practices, suppliers, international transfers, or legal obligations. We’ll publish the revised Notice on the Website and update the “Last updated” date. Where a change materially affects how we handle personal data, we’ll take reasonable steps to bring it to your attention and obtain consent where required by law.
