1. About This Policy

This Privacy Policy explains how MGN Civil Pty Ltd ("MGN Civil", "we", "us" or "our") collects, holds, uses and discloses personal information through the MGN Civil Contractor Portal ("the Portal") at portal.mgncivil.com.au.

We are committed to protecting the privacy of individuals whose personal information we hold. We comply with the Privacy Act 1988 (Cth) and the 13 Australian Privacy Principles (APPs) as amended by the Privacy and Other Legislation Amendment Act 2024.

This Policy should be read together with any Collection Notice presented to you at the time your information is collected.

2. Who We Are

MGN Civil Pty Ltd is a civil construction company based in Queensland, Australia. We operate the Contractor Portal to manage the onboarding, induction and compliance of contractors working on our construction projects.

For privacy enquiries, contact our Privacy Officer at [email protected].

3. What Personal Information We Collect

3.1 Contractor Personal Information

When a contractor completes the site induction form, we collect:

• Full name and date of birth
• Mobile phone number and email address
• Residential address (street, suburb, state, postcode)
• Driver's licence number, issuing state and expiry date
• Construction White Card number and issuing state
• Other trade licences, tickets or certifications held
• Emergency contact name, relationship and phone number
• Typed signature (declaration)
• Uploaded copies of driver's licence and White Card (image/PDF)
• Project name and induction date
• Acknowledgement of site safety rules and induction materials

3.2 Company Representative Information

When a company registers on the Portal, we collect from its authorised representative:

• First name, last name and email address
• Company name and ABN
• Business address
• Contact person name, phone number and email address
• Finance contact person name, phone number and email address
• Insurance certificate details: type, insurer, policy number, expiry dates
• Vehicle details: registration, state, make, model, year, expiry
• Plant and equipment details: type, ID/serial number, expiry
• Uploaded insurance certificates (PDFs)

3.3 Technical Information

The Portal may collect certain technical information automatically, including browser type, device type and IP address, for security and error monitoring purposes. This information is not used to identify individuals and is managed by our error tracking service (Bugsink).

4. How We Collect Personal Information

4.1 Directly from you

Most personal information is collected directly from you when you:

• Create a company account on the Portal
• Complete the company profile and insurance forms
• Complete the contractor site induction form via a secure token link sent to your email
• Upload documents through the Portal

4.2 From your employer or principal contractor

A company registered on the Portal may provide your name and email address to generate a contractor invitation. In that case, we will collect your remaining personal information directly from you when you complete the induction form.

4.3 Address verification

When you type an address into the Portal, we use the AWS Location Service (Amazon Web Services) to suggest and verify Australian address details. Partial address text you type may be transmitted to AWS for this purpose. AWS processes this data in Australia (Sydney region) in accordance with their data processing agreement.

5. Why We Collect Personal Information

We collect personal information for the following primary purposes:

Purpose	Legal basis / requirement
Verify identity and qualifications before granting site access	Work Health and Safety Act 2011 (Qld); contractual obligation
Maintain induction records as required by law	WHS Act 2011 (Qld) and associated Regulations; industry codes of practice
Manage insurance currency and contractor compliance	Contractual obligation; MGN Civil's duty of care
Issue and manage site access credentials (wallet passes)	Contractual obligation; site safety management
Process company payments and manage invoicing	Contractual obligation
Contact emergency contacts in the event of a workplace incident	WHS Act 2011 (Qld); duty of care
Communicate with you about your induction, approvals and site access status	Contractual obligation; direct notification

We only collect personal information that is reasonably necessary for one or more of these purposes. We do not collect information beyond what is necessary (APP 3).

6. How We Use Personal Information

We use your personal information only for the primary purpose for which it was collected, or for a directly related secondary purpose you would reasonably expect. Specifically:

• Contractor personal information is used to assess and record site induction completion, verify qualifications, and maintain compliance records.
• Company information is used to assess insurance currency, manage approvals, and administer the commercial relationship including payments.
• Emergency contact information is used only in the event of a workplace incident.
• Government identifiers (driver's licence, White Card) are used only for identity and qualification verification.

We do not use your personal information for direct marketing. We do not sell, rent or trade your personal information to any third party.

7. Disclosure of Personal Information

We may disclose your personal information to the following categories of recipients:

Recipient	What is shared	Purpose
MGN Civil authorised personnel (project managers, administrators)	All induction data; company profile; approval status	Site access management and compliance
Amazon Web Services (AWS) — Sydney, Australia	All Portal data (stored and processed)	Cloud hosting and storage infrastructure
PassCreator — Germany (see Section 8)	Contractor name, company name, project name, approval dates only	Generation of Apple/Google Wallet site access passes
Your employer company (if you are a contractor)	Name, email, induction completion status, approval status	Employer notification of contractor status
Regulatory authorities	As required by law	Legal compliance (e.g. SafeWork Queensland, QBCC)

We do not disclose personal information to third parties for their own use or for marketing purposes.

8. Overseas Disclosure

The Portal uses PassCreator (operated by TBO Software GmbH, Germany) to generate Apple Wallet and Google Wallet site access passes. When a contractor is approved, the following limited information is transmitted to PassCreator: contractor's full name, company name, project name, approval date and pass expiry date. No government identifiers, financial information, address details or emergency contacts are transmitted.

PassCreator is located in Germany, which is subject to the European Union General Data Protection Regulation (GDPR) — a privacy framework recognised as providing at least equivalent protections to the Australian Privacy Principles. We have entered into a data processing agreement with PassCreator.

By using the Portal and proceeding with site access approval, you consent to this limited overseas disclosure under APP 8.

All other personal information is processed and stored within Australia (AWS Sydney region) and is not disclosed overseas.

9. Storage and Security

We take reasonable steps to protect personal information from misuse, interference, loss, unauthorised access, modification or disclosure (APP 11). Our security measures include:

• Encryption in transit: All data transmitted to and from the Portal is encrypted using TLS (HTTPS).
• Encryption at rest: All data stored in Amazon S3 is encrypted using AES-256 by default.
• Access controls: Company representatives can only access their own company data. Contractors access forms via unique single-use token links. Only authorised MGN Civil administrators have access to all company and contractor data.
• Authentication: Company accounts require email verification via Amazon Cognito. Administrator accounts require multi-factor authentication (MFA).
• Infrastructure: The Portal is hosted on Amazon Web Services (AWS) in the ap-southeast-2 (Sydney) region, subject to AWS's ISO 27001-certified security controls.
• Audit logging: Access to stored data is logged for security monitoring purposes.
• Error monitoring: Runtime errors are monitored via Bugsink (self-hosted at mgncivil.bugsink.com) to detect and address security-relevant issues.

Despite these measures, no internet transmission or electronic storage is completely secure. If you believe a security breach has occurred, please contact us immediately at [email protected].

10. Data Retention

We retain personal information only for as long as necessary for the purposes for which it was collected, and as required by law:

Information type	Retention period	Basis
Contractor induction records (including licence details, acknowledgements, signature)	7 years from date of induction	WHS Regulations (Qld); industry best practice for construction records
Uploaded identity documents (licence, White Card images)	7 years from date of induction	WHS Regulations (Qld)
Company profile and insurance records	7 years from date of last active project	Construction Contracts Act 2004 (Qld); tax record obligations
7 years from last transaction	Tax Administration Act obligations; accounting records
Contractor invitation tokens (pending, not completed)	90 days after expiry	Operational requirement
Deleted/deactivated records	12 months after deletion, then permanently purged	Recovery period, then APP 11.2 destruction obligation

After the applicable retention period, personal information is securely destroyed or permanently de-identified in accordance with APP 11.2.

11. Government Identifiers

We collect driver's licence numbers and Construction White Card numbers from contractors. These are government-issued identifiers.

In accordance with APP 9, we:

• Collect government identifiers only because it is reasonably necessary to verify a contractor's identity and qualifications for the purposes of site safety and compliance
• Do not use government identifiers as a general personal identifier for our own purposes
• Do not disclose government identifiers to any third party except where required by law
• Apply additional access controls to records containing government identifiers

12. Financial Information

13. Your Rights

13.1 Access (APP 12)

You have the right to request access to the personal information we hold about you. You can access and update much of your information directly through the Portal. For information not accessible through the Portal, or if you are no longer an active Portal user, contact us at [email protected]. We will respond within 30 days.

13.2 Correction (APP 13)

If you believe personal information we hold about you is inaccurate, out of date, incomplete or misleading, you may request correction. Many fields can be corrected directly through the Portal. Otherwise, contact us at [email protected].

13.3 Complaints (APP 1)

If you have a concern about how we have handled your personal information, please contact our Privacy Officer first. We will acknowledge your complaint within 5 business days and provide a substantive response within 30 days. See Section 14 for details.

13.4 Statutory Tort (from June 2025)

Under the Privacy and Other Legislation Amendment Act 2024, from 10 June 2025 individuals have the right to bring a legal action in court for a serious invasion of privacy, including misuse of personal information. This right is in addition to the complaints process described in Section 14.

14. Complaints

If you have a complaint about our handling of your personal information:

1. Contact our Privacy Officer at [email protected] or by post to: Privacy Officer, MGN Civil Pty Ltd, Queensland, Australia.
2. We will acknowledge receipt within 5 business days and aim to resolve your complaint within 30 days.
3. If you are not satisfied with our response, you may lodge a complaint with the Office of the Australian Information Commissioner (OAIC):
   • Website: oaic.gov.au
   • Phone: 1300 363 992
   • Post: GPO Box 5218, Sydney NSW 2001

15. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology or legal obligations. When we make material changes, we will post the updated Policy on the Portal and update the effective date above.

We recommend you review this Policy periodically. Continued use of the Portal after a revised Policy is posted constitutes acceptance of the revised Policy.

16. Contact Us