Who we are
TRADePASS and Trident Trade Profiles are both trading names of Creative Nominees Pty Ltd, ABN 85 168 720 787. In this policy, "we", "us" and "our" mean Creative Nominees Pty Ltd under either name.
This policy covers tradepass.com.au, tridenttradeprofiles.com.au, the TRADePASS app, the emails we send, and anything you send us at hello@tradepass.com.au.
We handle personal information in line with the Australian Privacy Principles in the Privacy Act 1988 (Cth).
The short version
- We collect what you give us: your contact details, your trade, the licences, cards, insurance and qualifications you hold, and the work you log.
- We use it to run your subscription, build your trade profile and, if you ask for one, assess it.
- We never see your card number. Stripe takes the payment.
- We do not sell your information, and we do not use it for advertising.
- Your profile goes to an employer, an RTO or anyone else only when you choose to share it.
- Some of the services we use keep data outside Australia, in Singapore, the United States and Japan. We name each one below.
- You can ask to see, fix or delete what we hold. Email hello@tradepass.com.au.
What we collect
What we hold depends on what you do with us.
If you join the waitlist: your name, email address and trade, and your phone number if you give it.
If you contact Trident Trade Profiles through tridenttradeprofiles.com.au: your name, organisation, role, email address and your message.
If you subscribe: Stripe gives us your name and email address, the amount you paid and the GST in it, the date, and Stripe's reference numbers for the payment, the invoice and the subscription. We give you a member number. If you type a mate's member number at checkout, we keep that too. We never see or store your card number, expiry or security code. If you choose to save your details with Link on Stripe's payment page, that is between you and Stripe.
When you sign in: the email addresses on your account, when you last signed in, and a reference that links your account to our sign-in provider. If you sign in with Google or Facebook, see "Signing in with Google or Facebook" below.
In your profile (My Profile, or the applicant information form):
- your full name, phone, email, suburb, home state and trade
- an emergency contact: their name, their relationship to you and their phone number
- your work: employment status, role, employer, years in the trade and a short description
- your White Card: whether you hold one, the card number, the state and the year it was issued
- your licences and registrations: what each one is, its number, the issuing state, the classes it covers and its expiry
- your insurance: who carries the cover, and for each policy the type, insurer, policy number, cover amount and expiry
- your qualifications, short courses and tickets: the name, code, issuer, year and any expiry
If you apply for an assessment, we also collect:
- your referees: their name, company, role, phone, email, and how they know your work
- the declarations you tick, and your typed name and the date as your signature
- copies of your cards, licences, certificates and policies, when we ask for them as evidence. They reach us by email to hello@tradepass.com.au, so they are kept in our Microsoft 365 mailbox
In your logbook: your projects (name, suburb, builder, type of work, building classes, construction type, your role and employment status on the job, the dates and a description), up to three photos of each job if you add them, and your daily entries (the date, the component of work and the hours).
If you refer a mate: we record that their payment used your member number, and the credit it earns you. We do not tell you who they are.
If you show your pass: the link behind your QR code, and each time it is opened, the date and time and who you said it was for (an employer, an RTO, a regulator or a client). We do not record anything about the person who opened it.
If you email us: your email address and whatever you write or attach.
If you use the "Tell us" button in the app: what you write, the kind of comment you picked, the screen you were on, your browser and device and the size of your window, the time, and your name, email address and member number, so we know who it is from and can reply.
Technical information: our hosting provider keeps short-lived logs of requests to our sites, including the IP address and browser. We hold your IP address briefly in our server's memory to stop the same form being sent over and over, and we never store it. When you sign in, our sign-in provider, Clerk, records the device and IP address, so you can see in your account where you are signed in. We count page views with Vercel Analytics, which does not use cookies and does not identify you.
We do not ask for sensitive information, such as your health, criminal record or union membership. If an assessment ever needs it, we will ask you first and explain why.
Your member number is our own number for you. We do not use a government number, such as a licence or White Card number, to identify you.
How we collect it
Mostly from you, through our forms, your account and your emails. Some of it comes from others: Stripe tells us who paid; Google or Facebook tell our sign-in provider who you are, if you sign in that way; and your referees tell us about your work, if you apply for an assessment.
If you give us someone else's details, such as a referee or an emergency contact, please tell them you have, and point them to this policy. We use their details only to contact them for the reason you gave them to us.
You can look around our sites without telling us who you are. You cannot subscribe or hold a profile anonymously, because a verified profile has to belong to a real person.
Why we use it
- to take your subscription payment, give you a member number and send your tax invoice
- to send you the emails that come with your account: your welcome, your invitation when the app opens, sign-in codes, and notices about your subscription
- to let you sign in and keep your account yours
- to build your trade profile and show it to you
- to assess your experience, if you ask us to, including contacting your referees
- to work out and apply referral credits
- to keep our accounts and meet our tax obligations
- to answer your enquiries and the feedback you send from the app
- to keep our sites and your account secure, and to fix things that break
- to understand, in total numbers only, how our sites are used
We do not sell personal information. We do not use it for advertising, and we do not give it to anyone to market to you.
Who sees it
- Our staff at Trident Trade Profiles, to run your account and answer you.
- The developer who builds and maintains TRADePASS for us, who can see the database to keep it working. While the app is in its closed beta, the developer also gets a copy of each piece of feedback sent from the app, so problems are fixed quickly.
- Our assessors, if you apply for an assessment. They are contractors, and they see your profile, your logbook, your evidence and your referees' details for your assessment only.
- Your referees, if you apply for an assessment. We tell them your name and the work you said they can speak to.
- Our bookkeeper and our accountant, who see payment records (name, email, member number, amounts and invoice numbers) to keep our books and lodge our tax.
- Employers, RTOs, regulators, clients and anyone else, only when you choose to share your pass with them, by letting them scan its QR code or sending its link. Your pass shows your name, photo, trade, suburb and state, years in the trade, member number, your White Card and licences with their numbers, your tickets, qualifications and insurance with their expiry dates, totals of the work in your logbook, and the jobs you choose to show (each job's type, your role, its building class and construction type, and the years). It never shows your phone, email, home address, employer, referees, job names, builders, job addresses, job photos or insurance policy numbers. Anyone holding the link can open it until you turn the link off, which you can do at any time. TRADePASS does not choose an RTO for you, and does not pass your details to one unless you ask us to.
The mate whose member number you used is told a mate joined. They are not told your name, your email or anything else about you.
We may also disclose information when the law requires it, or where it is necessary to prevent a serious threat to someone's life, health or safety.
If the business is ever sold, your information would go to the new owner, who would have to handle it under this policy or tell you about any change first.
The services we use
We use other companies to run TRADePASS. Each one handles your information only to do its job for us, under its own terms and privacy policy.
| Who | What they do for us | What they hold | Where |
|---|---|---|---|
| Supabase | Our database | Everything listed under "What we collect", except card details, the copies of documents you send us, and your emails to us (those stay in our Microsoft 365 mailbox) | Singapore |
| Vercel | Hosts our sites and runs the app; counts page views | Everything you send through our sites passes through it; short-lived request logs | United States (servers in Washington DC), with a Sydney edge in front |
| Stripe | Takes subscription payments, sends receipts and renewal reminders | Your name, email, card details and billing details | United States and other countries where Stripe operates |
| Clerk | Signs you in: sends your one-time sign-in codes, and handles signing in with Google or Facebook | Your email addresses; when you signed in, on what device and from what IP address; and your name and profile picture if you sign in with Google or Facebook | United States |
| Resend | Sends our emails, except sign-in codes | Your email address and the content of each email we send you; and the notice we send ourselves when you join the waitlist, send Trident an enquiry or send feedback from the app, which carries what you entered | United States (stored); emails are sent from Japan (Tokyo) |
| Microsoft 365 | Our email inbox (hello@tradepass.com.au) and our documents | Anything you email us, including attachments, and the feedback you send from the app | Australia |
| Google (Gmail) | Our developer's email inbox, while the app is in its closed beta | A copy of the feedback you send from the app, with the details listed for it under "What we collect" | United States and other countries where Google operates |
| Xero | Our accounting: invoices for assessments, and the record of Stripe payouts | Your name, email and the amounts invoiced and paid | United States |
Apart from the beta feedback copy in the table, Google and Meta (Facebook) receive nothing from us. If you choose to sign in with one of them, they tell Clerk who you are; see "Signing in with Google or Facebook" below.
Cloudflare runs our domain names. It does not see what you send us.
Information kept outside Australia
As the table shows, some of your information is stored or processed outside Australia: in Singapore (our database), the United States (hosting, payments, sign-in, accounting, the record of the emails we send and, during the closed beta, our developer's copy of app feedback) and Japan (where our emails are sent from). Stripe may also process payment data in other countries where it operates.
We use well-established providers that publish their security and privacy commitments, and we give each one only what it needs. When we disclose your information to them, we remain responsible for it under the Privacy Act.
How we keep it safe
- Every connection to our sites is encrypted (HTTPS).
- Our database is reached only from our own server code. Your browser never holds a key to it.
- Your data is encrypted at rest by our database provider.
- There are no passwords to steal: we never ask you for one. Signing in is by a one-time code sent to your email, or, if you choose, through your Google or Facebook account, whose password we never see.
- Staff pages are protected by a password and are not open to the public.
- Card details never touch our systems.
No system is perfectly secure. If a data breach is likely to cause you serious harm, we will tell you and the Office of the Australian Information Commissioner, as the Notifiable Data Breaches scheme requires.
How long we keep it
We keep information only as long as we need it, then delete it or remove anything that identifies you.
- Your profile, logbook and projects: while your account is open, and for 12 months after it closes, so you can come back without starting again.
- Assessment records, including your evidence, your referees' answers and the outcome report: 7 years after the assessment.
- Payment records: 7 years, which covers what Australian tax and company law require.
- The waitlist: until you subscribe, or 12 months after the app opens if you do not.
- Enquiries to Trident Trade Profiles and emails to hello@: 2 years after the last message.
- Feedback you send from the app: 2 years after you send it, in our database. The copies emailed to us are kept like the rest of our email.
- The record of when your pass was opened and who you said it was for: while your account is open. You can see it in the app.
Seeing and fixing your information
Most of what we hold about you is on your profile, and you can change it there yourself. For anything else, email hello@tradepass.com.au and ask for a copy of what we hold, or for something to be corrected.
We will reply within 30 days. It is free. We will check it is really you before we send anything. If the law lets us refuse a request, we will tell you why in writing and how to complain about it.
Deleting your data
You can ask us to delete your TRADePASS account and everything we hold about you at any time. Email hello@tradepass.com.au from the address on your account, with "Delete my data" in the subject. If you no longer have that address, tell us your member number and we will find another way to check it is you.
Once we have confirmed it is you, within 30 days we will:
- delete your profile, logbook, projects, applicant form answers and referees
- delete your sign-in record with our sign-in provider, including anything Google or Facebook shared
- remove you from the waitlist and from any further emails
- email you to confirm it is done
Some things we have to keep, by law or to protect you and us:
- payment and tax records (your name, email, member number and what you paid), for as long as tax and company law require, in our records, Stripe and Xero
- a note that you asked us to delete your data, and when we did it
- an assessment outcome we have already issued, as part of the assessment record, because an RTO or regulator may be relying on it
Copies in our providers' backups are overwritten on their normal cycle and are not restored except to recover from a failure.
Deleting your data ends your subscription. Any unused part of it is dealt with under the terms you agreed to when you paid.
If you signed in with Facebook, you can also remove TRADePASS from your Facebook account under Settings and privacy, then Apps and websites. That stops Facebook sharing anything new with us. It does not delete what we already hold, so please email us as well.
Emails we send
Most of our emails are about your account: your welcome and member number, your invitation when the app opens, sign-in codes, notices about a mate joining with your number, and, from Stripe, your receipt and a reminder 30 days before your subscription renews. You will get these while you have an account with us.
If you joined the waitlist, we email you about early access and the launch, and nothing else. To stop them, email hello@tradepass.com.au with "Unsubscribe" and we will take you off within five working days.
We do not send newsletters or any other marketing.
Open and click tracking is switched off on the emails we send, so we do not know whether you opened one or which links you tapped.
Signing in with Google or Facebook
If you sign in with Google or Facebook instead of a code sent to your email, that service tells our sign-in provider, Clerk, your name, your email address and your profile picture. You approve that on Google's or Facebook's own screen before anything is shared.
We use your email address to match you to your subscription, and your name to greet you. Clerk keeps your name and picture; our own database keeps only your email addresses and Clerk's reference for you. We never see your Google or Facebook password, your friends, your posts or your messages, and we never post anything for you.
You can stop Google or Facebook sharing with us at any time in that account's settings. To delete what we already hold, see "Deleting your data" above.
Apprentices under 18
TRADePASS is for people working in the building trades, and that includes apprentices, some of whom are 16 or 17. You must be at least 16 to hold a TRADePASS account.
If you are under 18, we handle your information exactly as this policy says for everyone else, and we ask that a parent or guardian reads this policy with you before you sign up. A parent or guardian may pay for your subscription.
We do not knowingly collect information from anyone under 16. If we find we have, we will delete it.
Questions and complaints
If you have a question about your privacy, or think we have mishandled your information, email hello@tradepass.com.au with "Privacy" in the subject, or write to us at PO Box 5598, Studfield VIC 3152.
We will acknowledge your complaint within 5 working days and give you our answer within 30 days.
If you are not happy with our answer, you can complain to the Office of the Australian Information Commissioner: www.oaic.gov.au or 1300 363 992.
Changes to this policy
When TRADePASS changes what it collects or who it shares with, this policy changes too. The date at the top is the date of the current version. If a change matters to how we handle your information, we will email subscribers before it takes effect.