Privacy Policy

Effective date: 24 June 2026
Last updated: 24 June 2026

1. Who we are

This Privacy Policy explains how Ximo Group Pty Ltd (“Ximo”, “we”, “us”, or “our”) collects, uses, stores, and discloses personal information when you use the Ximo platform, including our mobile apps (iOS and Android), web application, and related services (together, the “Service”).

Ximo is a workforce management platform for trade and labour businesses. It helps organisations manage people, jobs, allocations, timesheets, payroll-related workflows, documents, notifications, and integrations such as accounting systems.

Contact us
Ximo Group Pty Ltd
ACN:
Email: support@ximo.com.au
Website: www.ximo.com.au

If you use Ximo through your employer or another organisation (“Organisation”), that Organisation may control certain personal information about you. In those cases, the Organisation is usually the primary handler of your employment-related information, and Ximo processes it on the Organisation’s instructions as a service provider.

2. Scope

This policy applies to personal information we collect:

  • when you register for, access, or use the Service;
  • when you are invited to join an Organisation via email, SMS, or smart link;
  • when you complete onboarding or submit forms through the Service;
  • when we communicate with you about the Service; and
  • when you contact our support team.

This policy does not cover third-party websites, apps, or services linked from Ximo unless we state otherwise.

3. What personal information we collect

The information we collect depends on how you use Ximo and your role (for example, employee, supervisor, administrator, or external contact).

3.1 Account and identity information

  • name and preferred name
  • email address
  • mobile phone number
  • date of birth
  • gender
  • profile photo
  • login credentials and authentication records
  • role, permissions, and Organisation membership

3.2 Employment and workforce information

  • skills, qualifications, certifications, and related documents
  • job and allocation details
  • timesheets, approvals, and work history
  • pay-related settings and workflow outputs
  • activity/status information within the Service
  • digital ID or QR-related profile data where enabled

3.3 Contact and emergency information

  • residential or contact address
  • emergency contact name, phone number, and relationship

3.4 Financial and tax-related information

Where required for employment or payroll processes:

  • Tax File Number (TFN)
  • Australian Business Number (ABN)
  • Australian Company Number (ACN)
  • bank account details
  • superannuation details

This information is treated as sensitive under Australian privacy law and is handled with additional care and access controls.

3.5 Documents, files, and communications

  • uploaded documents and attachments
  • email/SMS/push notification content and delivery records
  • template content and notification preferences

3.6 Device and technical information

  • device identifiers and device metadata
  • push notification tokens
  • browser/app version, platform type, and log data
  • IP address and usage/security logs

3.7 Location information

Where job or allocation features use location or mapping services, we may process location-related information associated with jobs, sites, or user-entered addresses.

3.8 Integration data

If your Organisation connects third-party systems (for example, accounting or cloud storage integrations), we may process information needed to sync or export data in accordance with the Organisation’s configuration.

4. How we collect personal information

We collect personal information:

  • directly from you — for example when you create an account, complete onboarding, edit your profile, submit timesheets, upload documents, or change settings;
  • from your Organisation — for example when an administrator invites you, approves your application, or manages your profile;
  • automatically — for example through device tokens, logs, cookies or similar technologies on web, and security monitoring;
  • from third parties — for example SMS/email delivery providers, authentication services, cloud infrastructure providers, and integrations configured by your Organisation.

If you do not provide information we reasonably require, you may not be able to use some or all features of the Service.

5. Why we use personal information

We use personal information to:

  • provide, operate, maintain, and secure the Service;
  • authenticate users and manage access permissions;
  • support onboarding, invitations, approvals, and account management;
  • manage jobs, allocations, timesheets, payroll workflows, and related reporting;
  • send notifications by push, email, or SMS according to Organisation settings and your preferences;
  • process profile photos and related media features;
  • sync or export data with integrated third-party systems where enabled;
  • troubleshoot, monitor performance, prevent fraud, and protect users and the Service;
  • comply with legal obligations and respond to lawful requests; and
  • improve the Service, including through analytics and product development.

We only use personal information for purposes that are reasonably necessary for our functions or activities, or as otherwise permitted by law.

6. Disclosure of personal information

We may disclose personal information to:

  • your Organisation and authorised users within it, according to role-based permissions;
  • service providers that help us operate the Service, such as:
    • cloud hosting and database providers (including Firebase/Google Cloud);
    • email, SMS, and push notification providers;
    • mapping/location service providers;
    • customer support and monitoring tools;
    • integration partners configured by your Organisation;
  • professional advisers, insurers, auditors, or regulators where required;
  • law enforcement or government agencies where required or authorised by law; and
  • successors in connection with a merger, acquisition, or restructure, subject to appropriate safeguards.

We do not sell personal information.

7. Overseas disclosure

Some of our service providers may store or process personal information outside Australia, including in the United States and other countries where their infrastructure is located.

Where we disclose personal information overseas, we take reasonable steps to ensure recipients handle it in accordance with applicable privacy requirements, including contractual protections where appropriate.

8. Use of artificial intelligence (AI)

Ximo includes built-in and integrated AI features to improve usability, safety, and workforce operations. This section explains where AI may collect or use personal information.

8.1 What AI features may be used

Depending on your Organisation’s configuration and the features you use, AI or automated processing may be involved in:

a) Profile photo processing

When you upload a profile photo, the image may be processed using automated systems to:

  • detect whether a face is present and suitable for a profile photo;
  • check for inappropriate content;
  • centre or crop the image; and
  • remove the background.

This processing may use Google Cloud Vision and related image-processing services (including background-removal services operated as part of our infrastructure).

Information involved: the photo you upload, and limited technical metadata needed to process it.

b) Workforce search and matching features

Ximo may use automated search and matching capabilities to help Organisations find suitable workers based on factors such as skills, qualifications, availability, job requirements, and related profile information.

Where semantic or AI-assisted search is enabled, profile-related information (such as name, skills, qualification titles, and employment-related attributes permitted by your Organisation) may be converted into searchable representations and processed by our backend services and, where configured, third-party AI/search infrastructure.

Information involved: workforce profile data already stored in Ximo for legitimate business purposes, plus any search queries entered by authorised users.

c) Workflow, form, and business automation features

Some workflows, forms, payroll rules, and backend automation may use AI or large language model (LLM) services to interpret inputs, assist with processing, or support operational tasks configured by an Organisation.

Information involved: form responses, workflow inputs, and related business data submitted through the Service.

d) Optional document processing

If enabled, document-related AI services (such as OCR or document parsing tools) may process uploaded files to extract structured information.

Information involved: the content of uploaded documents and associated metadata.

8.2 What AI is used for

AI in Ximo is used to:

  • improve profile photo quality and safety;
  • help authorised users search and allocate workforce resources;
  • support configured business workflows and automation;
  • maintain service quality, reliability, and security; and
  • develop and improve features, subject to access controls and this policy.

We do not use your personal information to train public third-party AI models unless we clearly tell you otherwise and obtain any consent required by law.

8.3 Third-party AI providers

AI processing may involve third-party providers acting on our behalf, which may include providers such as:

  • Google Cloud (including Vision and related cloud services);
  • OpenAI or other LLM providers, where configured;
  • vector/search infrastructure used for semantic matching; and
  • monitoring/tracing tools used to operate and secure AI services.

These providers may process personal information only as needed to deliver the relevant service to us, under contractual and security requirements.

8.4 Automated decision-making

Some AI or automated processes may influence outcomes such as whether a photo is accepted, whether a worker appears in search results, or how a configured workflow step is processed.

Where required by law, you may request information about significant automated decisions that affect you and, where applicable, request human review.

8.5 Your choices

  • You can choose not to upload a profile photo, although some Organisations may require one.
  • Your Organisation controls many workforce and AI-enabled features.
  • You may contact us using the details in Section 1 to ask questions about AI processing or to exercise your privacy rights.

We will update this section as AI features change or as Australian AI and privacy requirements evolve.

9. Cookies and similar technologies

On web, we may use cookies, local storage, and similar technologies to:

  • keep you signed in;
  • remember preferences;
  • support security; and
  • understand how the Service is used.

You can manage cookies through your browser settings, but disabling them may affect functionality.

10. Data security

We use reasonable technical and organisational measures to protect personal information, including access controls, encryption in transit, tenant isolation, authentication, monitoring, and secure cloud infrastructure.

No method of transmission or storage is completely secure. You are responsible for keeping your login credentials confidential.

11. Data retention

We retain personal information for as long as necessary to:

  • provide the Service;
  • meet our legal, accounting, and reporting obligations;
  • resolve disputes; and
  • enforce our agreements.

Retention periods may vary depending on the type of information and your Organisation’s requirements. When information is no longer required, we take reasonable steps to delete or de-identify it.

12. Access, correction, and your rights

Under the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs), you may have the right to:

  • request access to personal information we hold about you;
  • request correction of inaccurate, out-of-date, incomplete, or misleading information;
  • make a complaint about how we handle your personal information; and
  • withdraw consent where we rely on consent and withdrawal is permitted by law.

If you use Ximo through an Organisation, some requests may need to be directed to that Organisation first, especially for employment records it controls.

To make a request, contact us by referring to Section 1. We may need to verify your identity before responding.

13. Complaints

If you believe we have breached the APPs or mishandled your personal information, contact us with sufficient detail for us to investigate.

We will acknowledge your complaint and aim to respond within a reasonable period. If you are not satisfied with our response, you may contact the Office of the Australian Information Commissioner (OAIC):

14. Children

The Service is intended for use in a workplace context and is not directed at children under 16. We do not knowingly collect personal information from children without appropriate authority.

15. Changes to this policy

We may update this Privacy Policy from time to time. When we do, we will publish the updated version on our website or within the Service and update the “Last updated” date above.

If changes are material, we will take reasonable steps to notify users or Organisations.

16. Additional information for Organisations

If you are an Organisation using Ximo, you are responsible for:

  • informing your workers and contacts about how you collect and use their information;
  • ensuring you have a lawful basis to provide personal information to Ximo;
  • configuring integrations, notifications, and AI-enabled features appropriately; and
  • responding to privacy requests relating to employment records you control.

We process personal information on your behalf in accordance with our service arrangements and this policy.