Privacy Policy

This Privacy Policy explains how New Horizon Code PTY LTD (ABN 61 634 659 804) ("New Horizon Code", "we", "us", or "our") collects, uses, discloses, and protects personal information across our websites, products, and services.

This Policy applies to all New Horizon Code services except Diversity Sync'd, which is governed by its own Privacy Policy available at https://www.diversitysync.com/privacy.

This Policy covers data collected through:

• Corporate websites and web applications (including Carey, TobyHR, Profile Dock, Syrup, and other platforms developed or maintained by New Horizon Code);
• Support and communication channels (email, chat, phone, ticketing); and
• Marketing, analytics, and social-media interactions.

We comply with:

• The Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs);

Controller: We act as controller for our websites, billing, marketing, analytics, and support records.

Processor: For customer-submitted data stored within our hosted products (excluding Diversity Sync'd), we act as processor on the customer's instructions.

Our Data Processing Addendum (DPA) (including EU SCCs / UK IDTA) is available on request.

We may collect:

• Identity & contact data – name, email, phone, company, address.
• Account & billing data – login IDs, invoices, payment records (handled via secure third parties).
• Technical & usage data – IP address, device/browser details, session logs, performance metrics, cookies/local storage.
• Communications & support data – emails, chat logs, call recordings/transcripts, feedback.
• Platform content (processor context) – information entered by customers and users within our apps.

Sensitive information (e.g. health/disability data) is only processed under customer direction and subject to explicit consent and lawful purpose under the APPs and GDPR Art. 9.

We use:

• Essential cookies – for core functionality and security.
• Analytics & marketing cookies – only with your consent.

You can manage preferences via our cookie banner or browser settings.

All electronic marketing complies with the Spam Act 2003 (Cth) and includes an unsubscribe link.

Some services include AI-assisted tools (e.g. summarisation or text analysis).

AI outputs are assistive only and not a substitute for professional judgment.

We do not use customer content to train external AI models.

See our AI Usage Statement.

We do not sell personal information.

We may share data with:

• Authorised sub-processors under written agreements;
• Professional advisers (legal, accounting, audit) under confidentiality;
• Regulators or law-enforcement where legally required; and
• Successor entities in case of merger or acquisition.

Current sub-processors and infrastructure partners

An up-to-date list is available upon request.

We notify customers of material sub-processor changes where required.

Personal information may be processed outside Australia.

We apply appropriate safeguards – Standard Contractual Clauses, UK IDTA, adequacy decisions – and take reasonable steps under APP 8 to ensure overseas recipients handle data lawfully and securely.

We use administrative, technical and physical safeguards, including:

• Encryption in transit (TLS) and at rest;
• Multi-factor authentication and role-based access controls;
• Logging and monitoring;
• Regular vulnerability testing and vendor assessments.

No system is completely secure, but we maintain industry-standard protections.

When data is no longer required, it is securely deleted or de-identified.

When you contact our support number (1300 980 034):

• Calls may be recorded or transcribed for quality and compliance;
• You receive a pre-call notice and can opt out via email support;
• Recordings are securely stored and retained per § 12.

You may request access, correction, deletion, restriction or data portability (subject to law).

Requests: privacy@newhorizoncode.io

We verify identity and respond within 30 days.

If you are an end user of a customer organisation, please contact that organisation first; we will assist under our DPA.

Our services are not directed to individuals under 18.

We do not knowingly collect personal information from children directly.

Customers handling child data must obtain lawful consent and authority.

We promptly assess any suspected breach and within 30 days determine if serious harm is likely.

If so, we notify affected individuals and the OAIC as soon as practicable and take remedial action.

Our websites and apps may link to external sites not controlled by us.

We are not responsible for their content or privacy practices; please review their policies.

We may revise this Policy to reflect legal or operational changes.

Material updates will be communicated via email or in-app notice.

Continued use after changes signifies acceptance.

This Policy is governed by the laws of Queensland, Australia, and any dispute arises under the exclusive jurisdiction of Queensland courts.