Privacy Policy

Effective Date: 9 October 2026

TradesField Pty Ltd (ABN 41 686 483 536) ("TradesField", "we", "us", or "our") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and protect your personal information in connection with our platform for the construction industry: vendor onboarding and verification, ongoing monitoring, Construction Background Reports and the TradesField Rating, TradesField Insights, and our public company directory (the "Services"). By using our Services, you agree to this Privacy Policy and our Terms of Service. This policy applies to Client Users (staff or representatives of businesses using our platform), Vendor Users (suppliers, subcontractors, or vendors who either are invited by a Client User or sign up directly on the TradesField platform), people who buy a Report from us, and the businesses we report on (see section 1.4).

1. Personal Information We Collect

We collect personal information to provide our Services, which help businesses onboard and monitor their subcontractors and suppliers, and assess the businesses they deal with. The types of information we collect depend on whether you are a Client User or a Vendor User.

1.1 Client Users

We collect the following personal information from Client Users (staff or representatives of businesses):

• Full name, email address, and password.
• Date of birth and certification identifiers (if provided).
• Billing information (e.g., organisation’s payment details for subscriptions).
• IP addresses and device information for audit and legal purposes.
• Additional fields as configured by your organisation’s admin (e.g., job titles or custom data).

1.2 Vendor Users

We collect the following personal information from Vendor Users (suppliers, subcontractors, or vendors), whether invited by a Client User or signed up directly on the TradesField platform:

• Names, email addresses, ABN, ACN, and addresses.
• Banking information (e.g., BSB, account number, bank statements).
• Certificate documents (e.g., insurances, licences), including certificate numbers and expiry dates.
• IP addresses and device information for audit and legal purposes.
• Additional information as configured by the Client User’s organisation admin.

The same categories of information are collected regardless of entry path, and the same retention and security rules apply.

1.3 Report Buyers

When you buy a single Construction Background Report, we collect your email address, and your name and payment details through our payment provider. When you subscribe to TradesField Insights, we also collect your business details. Payments are processed by Stripe; we do not store full card details.

1.4 Businesses We Report On

TradesField prepares Construction Background Reports and the TradesField Rating on Australian businesses, for other businesses deciding whether to deal with them. Reports cover companies and trusts, and sole traders in respect of their business.

• What we hold. Information from public registers and records: the Australian Business Register, ASIC (including company status and published insolvency notices), court and tribunal records, Security of Payment adjudication decisions, and construction licensing registers in Queensland, New South Wales and Victoria. Where a company is reported on, this can include the names of its directors and licence nominees as they appear on those registers.
• Business information only. For sole traders and the people named in company records, we hold only information about their business dealings, and use it only for business purposes. We do not collect personal financial or credit information, and reports do not assess any individual's personal creditworthiness.
• Who receives reports. Reports are provided to businesses assessing a business they are dealing with or considering dealing with, for that purpose only, under terms that prohibit resale, publication and marketing use. Public company profile pages show only licence and company registration details.
• Your access and correction rights. If your business is reported on, you can ask what we hold about it and ask us to correct anything inaccurate, out of date or incomplete. See section 8.

1.5 Other Data

We collect additional data to improve our Services:

• Website Analytics: IP addresses, device information, and user activity (e.g., platform interactions) via analytics tools like PostHog.
• Feedback: Full name and email address when you provide feedback or reviews, though email addresses are not disclosed publicly.

2. How We Collect Personal Information

• Client Users: We collect information directly during signup, through platform use, or when accounts are created on your behalf by TradesField or another Client User. Additional data (e.g., IP addresses) is collected automatically via analytics tools.
• Vendor Users: We collect information when you (a) submit data via an email invitation from a Client User, (b) sign up directly on the TradesField platform and opt into the TradesField ID (see Terms of Service Section 4A), or (c) have your data imported from an external integration (e.g., an ERP system).
• Report Buyers: We collect information directly when you place an order or subscribe.
• Businesses We Report On: We collect information from the public registers and records listed in section 1.4, directly or through licensed data providers, rather than from the business itself.
• Anonymity: Due to the compliance-focused nature of our Services, Vendor Users cannot remain anonymous or use a pseudonym. Client Users may use an alias where practicable, but full identification is typically required for account management and billing.

3. Consent

• Client Users: You consent to this Privacy Policy by:
  • Clicking a checkbox during signup.
  • Paying an invoice referencing this policy (for accounts created on your behalf).
  • Using the platform (implied consent for onboarded users).
• Vendor Users: You consent by:
  • Completing a submission via an email invitation.
  • Having your data imported by a Client User, who warrants they have obtained your consent as per our Terms of Service.
  • Signing up directly on the TradesField platform and accepting this Privacy Policy and our Terms of Service via a checkbox at signup (clickwrap).
  • Opting into the TradesField ID, either on the opt-in screen at the end of an invited submission or during direct signup. Network opt-in is separate consent from the default consent to share information with the inviting Client User.
  • Optionally opting into "auto-approve" for Client User access requests on the Network. Auto-approve is off by default and may be revoked at any time from the vendor portal.
• Withdrawal from the Network: A Vendor User may withdraw from the Network at any time. Withdrawal stops the discovery profile, prevents new Client User access requests, and stops future updates flowing to previously approved Client Users. Withdrawal does not retract information already legitimately disclosed. See Terms of Service Section 4A for the full mechanics.
• Ensuring Consent: Client Users are responsible for obtaining consent from Vendor Users before sharing their information (e.g., email addresses) with us, as outlined in our Terms of Service.

4. Purposes of Collection

We collect personal information for the following primary purposes:

• Onboarding vendors and integrating data with your ERP system.
• Verifying vendor information against external sources (e.g., ASIC, ABR, trade licence regulators like QBCC).
• Preparing Construction Background Reports and the TradesField Rating, and alerting Client Users when the records of a business they monitor change.
• Operating our public company directory, which shows licence and company registration details only.
• Communicating with users (e.g., sending onboarding emails or alerts about issues).
• Managing billing and accounts.
• Improving our Services through analytics tools (e.g., PostHog).
• Maintaining audit logs for legal and compliance purposes.
• For Vendor Users who have opted into the TradesField ID, making a limited discovery profile (e.g., trading name, ABN, trade categories, general service areas) discoverable to verified Network participants.
• Facilitating per-Client-User approval workflows for full-record disclosure on the TradesField ID, so that detailed vendor information (including insurance certificates, licences, and bank details) is shared only with Client Users that a Vendor User has specifically approved.

Marketing and identification as a User. Where you have accepted our Terms of Service, we may use your organisation's name, trading name, logo, and brand marks to identify your organisation as a TradesField customer, Vendor User, or Network participant in our marketing and promotional material, in accordance with Section 15 of our Terms of Service. For individuals and sole traders, this is limited to the business name and any associated brand marks, not to personal photographs or likenesses, which require separate consent.

Beyond this identification use, we do not use personal information for other marketing or promotional activities (such as attributed quotes, testimonials, or case studies) without your separate explicit consent. If we send product updates to select Client Users, you can opt out by contacting [email protected]. You may also opt out of identification use in marketing material at any time by emailing [email protected], as described in Section 15 of our Terms of Service.

5. Disclosure of Personal Information

We may disclose personal information as follows:

• Default (Non-Network) Sharing: By default, a Vendor User's information is shared only with the Client User organisation that invited them, based on configuration and permissions within that organisation. Not all Client Users inside that organisation may have access, depending on settings. Information a Vendor User submits to us (for example bank details, insurance certificates and contact details) is not shared with other Client User organisations, and is not shared with competitors. This is separate from information about a business that comes from public registers and records, which may appear in Reports provided to other businesses as described in section 1.4.
• TradesField ID (Opt-In): Where a Vendor User has opted into the TradesField ID, an additional layer of sharing applies in two distinct tiers:
  • Discovery layer: A limited set of business identity information (for example, trading name, ABN, trade categories, and general service areas) is visible to verified Network participants, so that Client Users can find and request access to vendors relevant to their projects.
  • Full record: Detailed vendor information — including insurance certificates, licence records, supporting documents, and bank account details — is disclosed to a specific Client User only after the Vendor User approves that Client User's access request for that specific record. Once approved, future updates to the record flow to that Client User until approval is withdrawn.
  • Withdrawal from the Network stops future updates and prevents new access requests, but does not retract information already legitimately disclosed. See Terms of Service Section 4A for the full mechanics.
  • Network membership is opt-in and does not change the default sharing behaviour described above for vendors who have not opted in.
• Report Recipients: Reports on a business, containing information from public registers and records, are provided to businesses assessing that business, as described in section 1.4.
• Third-Party Providers: We share personal information with third parties to provide our Services, including:
  • Stripe (USA) for payment processing.
  • AWS and Digital Ocean (Sydney, Australia) for data hosting.
  • Cloudflare for document storage and WAF services.
  • Australian courts, tribunals and government agencies (e.g., ASIC, ABR, trade licence regulators like QBCC, NSW Fair Trading, the NSW Building Commission, the Victorian Building and Plumbing Commission, ESV, CBS, DMIRS, CBOS, Access Canberra, BPB), directly or through licensed data providers, for verification and reporting.
  • OpenAI (USA) for reading documents, such as licence records and adjudication decisions, and for sentiment analysis.
  • OpenRouter (USA) for automated quality checks on information read from documents.
  • PostHog (USA) for anonymised analytics.
  • Other government agencies for compliance checks, as needed.
• De-Identified Data: Where possible, we share only de-identified data (e.g., company legal name, ABN) with third parties for verification.
• Legal Requirements: We may disclose information to government bodies if required by Australian law (e.g., for investigations) or to maintain access logs.
• Analytics: Anonymised data is shared with Facebook and LinkedIn Pixel for analytics purposes.

6. Cross-Border Data Transfers

Some personal information is transferred to third parties in the USA, including:

• Stripe for payment processing.
• PostHog for product analytics.
• OpenAI for reading documents and sentiment analysis.
• OpenRouter for automated quality checks on information read from documents.

We ensure these providers comply with standards equivalent to the Australian Privacy Principles (APPs) through contractual agreements. Our databases and servers are hosted in Australia (Sydney region) via AWS and Digital Ocean. Documents (for example certificates, licence records and Report files) are stored with Cloudflare.

7. Data Storage and Security

• Storage: Personal information is stored on secure servers in Sydney, Australia, via AWS and Digital Ocean, with documents stored with Cloudflare.
• Security: Data is encrypted at rest and in transit using AES-256 encryption. We take reasonable steps to protect data from unauthorised access, misuse, or loss.
• Retention: We retain personal information for 7 years for legal, audit, and tax purposes, unless you request deletion earlier.
• Network Withdrawal vs Retention: Withdrawing from the TradesField ID is not the same as requesting deletion. Withdrawal removes a Vendor User's discovery profile from the Network and stops future updates flowing to previously approved Client Users, but the underlying submission record is retained on the TradesField platform under the 7-year retention policy above, unless the Vendor User separately requests deletion. Client Users who received information legitimately before withdrawal retain the copy of the record they received, subject to their own retention obligations.
• Deletion: To have your data deleted or anonymised, contact [email protected]. We will process requests in accordance with Australian law.

8. Access and Correction

• Platform users: Client Users can access and update their information in the platform. Vendor Users can do so through their submission link or the vendor portal. There is no fee.
• Businesses we report on, and anyone else: to ask what we hold about you or your business, or to correct information that is inaccurate, out of date or incomplete, email [email protected]. We respond within 30 days. If the error is in a public register, we will tell you which authority to contact.

9. Complaints and Data Breaches

• Complaints: If you have a privacy concern or a complaint about how we have handled your information, including information in a Report, email [email protected]. We will acknowledge your complaint within 2 business days and respond within 30 days. If you are not satisfied with our response, you may complain to the Office of the Australian Information Commissioner (OAIC) at www.oaic.gov.au. Our full complaints and dispute resolution process is at www.tradesfield.com/complaints.
• Impersonation on the Network: If a Vendor User believes another party is impersonating their business on the TradesField ID, they should report it to [email protected]. TradesField may suspend a suspect profile pending verification.
• Data Breaches: If we suspect a data breach, we will assess it promptly and within 30 days. If we have reasonable grounds to believe an eligible data breach has occurred, one likely to result in serious harm, we will notify the affected individuals and the OAIC as soon as practicable, as required by the Notifiable Data Breaches scheme under the Privacy Act 1988 (Cth).

10. Children’s Privacy

Our Services are designed for business-to-business use and are not intended for individuals under 16. We do not knowingly collect personal information from children.

11. Feedback

If you provide feedback or reviews, we may associate it with your full name and email address to follow up for more information. Email addresses are not disclosed publicly, but we may quote feedback and reference your organisation’s name with your consent.

12. Disclaimer

While we take all reasonable efforts to ensure the accuracy and currency of data, we are not liable for inaccuracies in compliance data (e.g., from third-party sources like ASIC, ABR, or trade licence regulators). Users are responsible for verifying the accuracy of their data and ensuring compliance with relevant regulations.

13. Updates to This Policy

We may update this Privacy Policy to reflect changes in our Services or legal requirements. Updates will be posted at www.tradesfield.com/privacy, and we will notify you when you next access our platform. Continued use of the Services constitutes acceptance of the updated policy.

14. Contact Us

For questions, concerns, or requests regarding your personal information, contact us at:

• Privacy and access or correction requests: [email protected]
• Complaints: [email protected]
• General support: [email protected]
• Website: www.tradesfield.com

You can download or save a copy of this Privacy Policy from our website. Thank you for trusting TradesField with your personal information.