Privacy Policy

1. Who We Are

TrustBook Pty Ltd (“TrustBook”, “we”, “us”, “our”) is committed to managing personal information in accordance with the Privacy Act 1988 (Cth) (“Privacy Act”) and the thirteen Australian Privacy Principles (“APPs”), as amended by the Privacy and Other Legislation Amendment Act 2024 (Cth).

TrustBook is a self-service NDIS compliance and registration platform. This Privacy Policy sets out how we collect, hold, use, and disclose personal information when delivering our services. It applies to NDIS providers and their staff who use our platform, visitors to our website at www.trustbook.com.au, and anyone else who provides personal information to us.

2. What Personal Information We Collect

The personal information we collect may include:

  • Your name, contact details (email address, phone number, billing and postal address), professional title, and organisation name;
  • Your NDIS provider registration number and registration status;
  • TrustBook account details and password;
  • Financial information such as payment and billing details (processed securely by third-party payment providers);
  • Compliance documentation, policies, procedures, worker screening records, and incident records entered into the platform;
  • Device and technical information such as your IP address, browser type, operating system, and pages visited; and
  • Any other information you choose to provide to us.

We may also handle sensitive information (as defined in the Privacy Act), including health information relating to NDIS participants entered by providers. Sensitive information is collected only with consent or as otherwise permitted by law. See Section 7 regarding Participant Data.

3. How We Collect Your Information

We collect personal information primarily through your use of the TrustBook platform and website. We may also collect information when you:

  • Register for an account or complete platform tools and checklists;
  • Submit forms, contact us by email or telephone, or engage with our support team;
  • Interact with our website, including through cookies and analytics tools (see Section 9); or
  • Are identified through publicly available sources such as the NDIS Commission provider register or the Australian Business Register.

Where practicable, we collect information directly from you. Where we collect your information from a third party, we will take reasonable steps to notify you.

4. How We Use Your Information

We use personal information only for the primary purpose for which it was collected, or a related secondary purpose you would reasonably expect. This includes:

  • Providing and operating the TrustBook platform and delivering our services;
  • Processing your NDIS registration and compliance workflows;
  • Communicating with you about your account, platform updates, and regulatory changes;
  • Processing payments and issuing invoices;
  • Improving our platform through research, testing, and development;
  • Preventing or investigating fraud, crime, or suspected misuse;
  • Sending you information about TrustBook products and services where you have consented or where permitted by law — you may opt out at any time (see Section 8); and
  • Complying with our legal obligations.

Where the platform uses automated tools to generate compliance assessments or readiness scores that may materially affect your registration standing, we will disclose this. You may request a human review of any automated outcome by contacting us at privacy@trustbook.com.au.

5. Who We Disclose Your Information To

We do not sell, rent, or trade your personal information. We may disclose it to:

  • Third-party service providers who assist us in operating the platform (including cloud hosting, payment processing, customer support, and analytics), who are contractually bound to handle information in accordance with our instructions and applicable law;
  • The NDIS Quality and Safeguards Commission, the NDIA, or other regulatory bodies as required or authorised by law;
  • Our professional advisers (lawyers, accountants, auditors) under obligations of confidentiality;
  • A successor entity in the event of a merger, acquisition, or sale of our business assets; and
  • Any party to whom you have given your consent.

6. Data Residency and Overseas Disclosure

Australian Data Residency All personal information and Participant Data entered into the TrustBook platform is stored exclusively on servers located in Australia. Your data is not disclosed to overseas recipients unless you are notified and have consented, or we are otherwise authorised by law.

Where we engage an overseas subprocessor, we take reasonable steps to ensure they are bound by contractual obligations equivalent to the APPs, or are subject to a comparable privacy law. Where we rely on contractual protections rather than individual consent, we accept accountability for any APP breach by that recipient as if we had committed it ourselves (APP 8.1).

7. Participant Data

Providers who use TrustBook may enter information about NDIS participants into the platform as part of their compliance activities. This information — which may include sensitive health and disability information — is referred to as “Participant Data”.

Roles and responsibilities

In relation to Participant Data, the Provider is the data controller and TrustBook acts as a data processor, processing information only on the Provider’s instructions. Providers are responsible for:

  • Ensuring they have lawful authority and appropriate participant consent to enter Participant Data into the platform;
  • Complying with the Privacy Act, NDIS Act, NDIS Code of Conduct, and any applicable state or territory health privacy legislation; and
  • Responding to participant requests for access to or correction of their information.

TrustBook’s obligations as processor

TrustBook will process Participant Data only as directed by the Provider, maintain appropriate security measures, notify Providers promptly of any suspected data breach involving Participant Data, and delete or return Participant Data upon termination of the Provider’s account (subject to legal retention obligations). Participant Data is stored on Australian servers and is not shared with third parties except as required to deliver the platform or as directed by the Provider.

8. Direct Marketing

We may use your contact details to send you information about TrustBook products, services, and regulatory updates where permitted under APP 7. You may opt out at any time by clicking the unsubscribe link in any marketing email, updating your preferences in account settings, or contacting us at support@trustbook.com.au. We will process opt-out requests within 5 business days. Essential account and service communications are not affected.

9. Cookies

Our website and platform use cookies to support session management, authentication, and analytics. Essential cookies are required for the platform to function. Analytics and functional cookies can be managed through your browser settings or our cookie preference centre. We do not use advertising or marketing cookies. Where cookies collect personal information, that information is handled in accordance with this Policy.

10. Security of Your Information

TrustBook takes reasonable steps to protect your personal information from loss, unauthorised access, modification, disclosure, or misuse. Our security measures include encryption of data in transit (TLS 1.2+) and at rest (AES-256), multi-factor authentication, role-based access controls, regular security assessments, and staff privacy training. We maintain an Incident Response Plan to ensure prompt action in the event of a security incident.

In accordance with the Privacy and Other Legislation Amendment Act 2024 (Cth), we regularly review our organisational and technical security measures in proportion to the volume and sensitivity of the information we hold.

11. Notifiable Data Breaches

TrustBook is subject to the Notifiable Data Breaches (NDB) scheme under Part IIIC of the Privacy Act. If we have reasonable grounds to believe an eligible data breach has occurred — one likely to result in serious harm to affected individuals — we will:

  • Complete an assessment within 30 days of becoming aware of the suspected breach;
  • Notify the Office of the Australian Information Commissioner (OAIC) as soon as practicable; and
  • Notify affected individuals, or if impracticable, publish a statement on our website, providing details of the breach and recommended steps individuals can take.

12. Accessing and Correcting Your Information

You may request access to the personal information we hold about you by contacting us at support@trustbook.com.au. We will respond within 30 days and will generally grant access unless an exception applies under law. We may charge a reasonable administrative fee and will advise you of any fee before proceeding.

If any information we hold about you is inaccurate, incomplete, or out of date, please contact us and we will update it. If we disagree that a correction is warranted, we will attach a notation of your request to the relevant record so it is always read alongside that information.

13. Retention and Destruction

We retain personal information only for as long as necessary for the purpose of collection or as required by law. Account information and compliance records are generally retained for 7 years after account closure to meet NDIS record-keeping and tax obligations. At the end of the applicable retention period, we take reasonable steps to destroy or permanently de-identify the information.

14. Complaints and Contact

Privacy Officer — TrustBook Pty Ltd
Email: support@trustbook.com.au
We will acknowledge your complaint within 5 business days and aim to resolve it within 30 days.

If you are not satisfied with our response, you may lodge a complaint with the OAIC at www.oaic.gov.au or by calling 1300 363 992. From 10 June 2025, individuals in Australia may also have the right to bring a claim for damages for a serious invasion of privacy under the statutory tort introduced by the Privacy and Other Legislation Amendment Act 2024 (Cth).

15. Changes to This Policy

We may update this Policy from time to time. When we make material changes, we will notify registered users by email or prominent platform notice at least 14 days before the change takes effect, and update the Effective Date above. Continued use of the platform following notification constitutes acceptance of the updated Policy. Previous versions are available on request.