Privacy policy | Stormcrest

Last updated: 1 November 2026.

Privacy Officer: Ryan Walker · hello@stormcrest.com.au

1. About this policy

Stormcrest Pty Ltd ABN 65 703 410 084 ACN 703 410 084, trading as Stormcrest ("we", "us") is a recruitment consultancy based in Adelaide, South Australia. We handle personal information in line with the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs). Collecting and disclosing personal information is a core part of recruitment, so we comply with all 13 APPs and do not rely on any exemption from the Privacy Act.

2. Information we collect

Candidates: name, contact details, CV, employment history, qualifications, certifications and licences, referee details, salary or rate expectations, work rights, and security clearance level and status.
Clients: hiring managers' contact details, and information about roles and organisations.
Website visitors: whatever you choose to send us by email or form, and basic technical logs kept by our hosting provider.

Some information may be sensitive information under the Privacy Act, such as criminal history disclosed for a role's checks. We collect sensitive information only with your consent, and only where it is reasonably necessary.

3. How we collect it

We collect information directly from you (by email, forms, phone and interviews), from referees you nominate, from publicly available professional profiles and public licence registers, and from clients. If we collect information about you from someone else, we'll take reasonable steps to let you know.

4. Why we use it

To assess you for roles and, with your consent before each submission, to present you to a prospective employer.
To take reasonable steps to confirm clearance status (via the sponsoring agency or the client's security officer), and to check qualifications, licences, right to work and references.
To meet our legal obligations.
To communicate with clients and candidates about our services, including ProtectSMB GRC, a product we resell. You can opt out of marketing at any time.

5. Disclosure

We disclose candidate information to a prospective employer only with your consent for that specific role. We also disclose information to service providers who help us operate, such as email, hosting, applicant tracking, payroll and accounting providers, and to regulators where the law requires it. Clients may use candidate information only to assess the candidate for the role. If you ask about ProtectSMB GRC, we pass your contact details to ProtectSMB only when you ask us to introduce you. We do not sell personal information.

6. Overseas disclosure

We keep candidate and client records in Zoho Recruit, a recruitment system provided by Zoho Corporation Pty Ltd (Adelaide, South Australia). Our Zoho Recruit account is hosted in Zoho's Australian data centres, in Sydney (primary) and Melbourne (secondary). Zoho says other companies in the Zoho group may have access to data to provide technical support and during disaster recovery. Zoho lists its group companies at zoho.com/privacy/zoho-group.html; they include companies in the United States, the Netherlands, India, Singapore, China, Japan and Germany.

Some of our other service providers, including Google (our email, through Google Workspace) and Cloudflare (our website hosting), may store or process data outside Australia.

7. Security clearance information

We record clearance level, status and sponsoring organisation only to check your eligibility for roles, and only with your consent. We do not request, store or transmit classified information or vetting documentation. We share clearance details only with the hiring organisation's relevant security or recruitment staff.

8. Storage and security

We take reasonable steps to protect personal information from misuse, interference, loss, and unauthorised access, modification or disclosure. These include access controls, multi-factor authentication and encrypted storage on our systems.

9. Data breach response

We keep a data breach response plan. If we suspect a data breach, we will:

Contain it immediately to limit further access or disclosure.
Assess it promptly, and within 30 days, to decide whether it is likely to cause serious harm to anyone affected.
Notify the Office of the Australian Information Commissioner (OAIC) and affected individuals as soon as practicable if it is an eligible data breach under the Notifiable Data Breaches scheme. We'll explain what happened, what information was involved, and the steps you can take. We'll also notify clients where our contracts require it.
Review what happened and strengthen our controls.

Clients must tell us within 48 hours of any unauthorised access to, or disclosure of, candidate information we have given them.

10. Data retention

We keep personal information only for as long as we need it for the purposes above, or as the law requires. After that, we securely delete or de-identify it.

Candidate records: kept for 3 years after our last contact with you, unless you ask us to delete them sooner.
Enquiries and briefs that don't proceed: kept for 3 years after our last contact.
Financial and tax records, such as invoices and payments: kept for 5 years.
Identity and clearance documents: sighted to confirm details. We record the outcome rather than keeping copies, unless the law requires otherwise.

11. Automated decision-making

From 10 December 2026, the Privacy Act requires us to explain where a computer program uses your personal information to make, or substantially and directly inform, a decision that could reasonably be expected to significantly affect your rights or interests.

We don't currently use computer programs to make, or substantially and directly inform, decisions like that. For example, our systems don't automatically reject applications or rank candidates without a person reviewing them. Decisions about whether to put you forward for a role are made by a person.

If we start using tools like this, we'll update this policy before we do. It will describe the kinds of personal information used, the kinds of decisions made solely by a computer program, and the kinds of decisions a program substantially and directly informs.

12. This website

This website has no user accounts. Its forms currently open your own email app, so nothing is stored on the website. We keep what you send us in our recruitment system, Zoho Recruit (see section 6). If we add online forms run by Zoho Recruit, we'll update this policy before we do. Our fonts are hosted on our own site, so they don't make calls to third-party servers. The weather shown in the page header (Adelaide unless you choose another Australian location) is loaded by your browser directly from the Norwegian Meteorological Institute (MET Norway, api.met.no), so your IP address, your browser details and the chosen place's coordinates reach their servers, where they keep access logs in Norway. If you choose a location, that choice is stored only in your browser's local storage on your device and is not sent to us. The same applies if you choose the light or dark theme. The list of places used by the location search in our forms is loaded from our own website, and the search runs in your browser; what you type is only sent when you submit the form. No cookies are set and we send no other information about you; the latest readings are saved in local storage for about 20 minutes so they aren't fetched on every page. The search on our Help & answers page also runs in your browser; what you type there isn't sent to us or anyone else.

13. Access and correction

You can ask to access or correct the personal information we hold about you, ask us to stop contacting you, or ask us to delete your details, subject to any records we're legally required to keep. Use the contact details below.

14. Complaints and contact

Please contact our Privacy Officer, Ryan Walker, first at hello@stormcrest.com.au. We aim to respond within 30 days. If you're not satisfied with our response, you can complain to the OAIC at oaic.gov.au.