Privacy Policy

Effective Date: 12 September 2026

Cortex Project Management Solutions Pty Ltd ACN 688 164 098 ("we", "us", or "our") values and respects the privacy of the people we deal with. We are committed to protecting your privacy and complying with the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs).

This Privacy Policy (Policy) describes how we collect, hold, use and disclose your personal information, and how we maintain the quality and security of your personal information. It applies to the CortexPM website, the CortexPM web application, and the CortexPM mobile app for iOS and Android.

---

1. What Information Do We Collect About You?

This section covers information CortexPM collects in its own capacity — about our customers, the people who hold accounts with us, and visitors to our website. What we collect depends on the nature of your dealings with us and what you choose to share.

Information that a building company enters into its own workspace about other people is a different thing, and is dealt with in section 2.

Personal Information We Collect

The Personal information we collect about you may include:

• Name, job title, and company details
• Mailing or street address
• Email address and phone number
• Login credentials and account preferences
• Content you create in the platform, and any personal information about you that it contains
• Site attendance records, including sign-in and sign-out times and the location recorded at sign-in where location verification is used
• Time and labour allocation records where your company uses those features
• Emergency contact name and phone number, where a worker record includes one
• Photographs and files you upload, and any personal information contained in them
• Usage data and device information (via cookies, logs, or analytics)

We do not collect your date of birth, and we do not collect government identifiers such as driver licence, passport or tax file numbers, unless you choose to upload a document containing them as part of your project records.

Business Information We Collect

The Business information we collect about your business may include:

• Business name and ABN
• Business address and phone number
• Type of business and industry
• Number of employees
• Business structure and ownership details
• Billing and payment information

---

2. Information Customers Enter Into CortexPM

CortexPM is used by building companies to run their projects. In the course of that work, our customers enter information about people who are not our customers — their own employees and workers, their clients, their subcontractors and their suppliers. That information can include names, contact details, emergency contacts, site attendance and location records, hours worked, induction and toolbox talk records, safety observations, defect records and photographs.

We do not collect this information in our own capacity. We process it on behalf of the customer whose workspace it sits in.

For that information:

• Our customer decides what is collected, why, and how long it is kept. We hold it and process it on their instructions in order to provide the CortexPM service to them.
• We do not use it for our own purposes, we do not use it for advertising, and we do not sell it.
• Each customer's workspace is isolated from every other customer's workspace.

If you are a worker, client or subcontractor and you want to access, correct or delete information a building company holds about you in CortexPM, contact that company in the first instance — they control it. You can also contact us at privacy@cortexpm.com.au and we will help you identify the right contact and assist that company to respond.

Nothing in this section affects your rights under Australian privacy law, or the obligations our customer owes you as the entity that collected your information.

---

3. How Do We Collect Your Information?

We collect your Personal & Business information directly from you when you:

• Create an account or use our services
• Interact with us over the phone, email, or in person
• Visit our website (via cookies or analytics tools — see section 10)
• Subscribe to and use our platform, including the mobile app
• Participate in surveys or questionnaires
• Attend a CortexPM event or webinar
• Subscribe to our mailing list or newsletter
• Apply for a position with us as an employee, contractor, or volunteer
• Connect a third-party integration, such as your accounting software

Collecting Information from Third Parties

We may also collect your Personal & Business information from third parties or through publicly available sources, for example from relevant industry bodies, licensing registers or business directories. We collect your information from these sources so that we can improve our products and services and provide products tailored to our market.

We do not obtain or use credit reports or credit reporting information, and we do not conduct credit checks.

---

4. Why Do We Collect Your Information?

We use Personal & Business information for many purposes in connection with our functions and activities, including the following purposes:

• Provide you with information or services that you request from us
• Operate the CortexPM platform and the features your company has enabled
• Deliver to you a more personalised experience and service offering
• Improve the quality of the services we offer
• Internal administrative purposes, including billing and account management
• Marketing and research purposes, in accordance with section 12
• Comply with legal obligations and regulatory requirements
• Prevent fraud and ensure platform security
• Provide customer support and technical assistance

---

5. Sensitive Information

"Sensitive information" has a specific meaning under the Privacy Act and includes health information. We do not ask for sensitive information about you, and CortexPM has no field designed to record it.

However, free-text fields in features such as site diaries, safety observations and incident records can contain health information if a user types it in — for example a description of an injury on site. Where that happens:

• The company operating the workspace is responsible for collecting that information lawfully, including obtaining consent where the Privacy Act requires it.
• We hold it on that company's instructions, subject to the same security controls as the rest of their workspace, and we do not use it for any other purpose.

We encourage our customers to keep identifying health detail out of CortexPM and to record it in their own incident management processes instead.

---

6. Disclosure of Your Information

We do not sell your personal information. We may disclose your Personal & Business information to third parties in accordance with this Policy in circumstances where you would reasonably expect us to disclose your information. For example, we may disclose your information to:

• Our third-party service providers, including the hosting, storage, email, authentication and analytics providers listed below
• Our marketing and advertising providers, as described in sections 10 and 12
• Our professional services advisors (accountants, lawyers, consultants)
• Third-party services you choose to connect, such as Xero, when you authorise that connection
• Legal authorities if required by law or to protect our rights
• Business partners or contractors engaged under confidentiality obligations
• An acquirer, in connection with a sale or restructure of our business, subject to that party agreeing to handle the information consistently with this Policy

Our Service Providers and Where They Hold Information

The table below lists the providers we rely on to run CortexPM, and the country in which each is likely to hold information, as at the effective date of this Policy.

We may change providers from time to time. We will update this table when we do.

Transfer of Information Overseas

As the table above shows, some of the providers we disclose information to are located outside Australia, principally in the United States. We use them because they are necessary to run the platform and provide the service you have asked us for.

Where we disclose your information to an overseas recipient, we take steps that are reasonable in the circumstances to ensure that the recipient does not handle that information in a way that would breach the Australian Privacy Principles. In practice that means contracting with providers on terms that require them to keep the information secure, to use it only for the purposes we engage them for, and to notify us of any breach affecting it.

We do not ask you to waive anything in return. We remain accountable under the Privacy Act for the information we send to these providers, and you can raise a concern with us about any of it under section 16.

---

7. Artificial Intelligence and Automated Processing

Reading the Documents You Upload

CortexPM saves you re-typing by reading documents you upload and turning them into structured data. Wherever you see that happen in the platform — supplier invoices, contracts, specifications, and other documents we add this to over time — the document is sent to Google's Gemini API, which reads it and returns the fields we then present to you for review.

This applies to any document format you can upload, including digital PDFs, scanned pages, and photographs taken on a phone. The whole document is sent, not an extract of it, so anything in the document goes with it. Documents of this kind commonly contain personal information: names, addresses, contact details, bank and payment details, rates, signatures and handwriting.

The provider receives the document for one reason only: to perform the extraction we have asked for on that occasion and return the result. It is not permitted to use the document for any other purpose, to retain it beyond what that processing requires, or to make it available to anyone else. Your documents are not used to train any artificial intelligence model, whether ours or the provider's. Processing occurs outside Australia.

Nothing is read this way unless you upload it. Where you would prefer a particular document not be processed this way, enter the details manually instead, or contact us at privacy@cortexpm.com.au to discuss turning the feature off for your workspace.

Separately, we do not use the contents of your workspace — your projects, documents, financials or the personal information of your workers and clients — to train artificial intelligence models, and we do not make it available to any third party for that purpose.

Automated Decision-Making

CortexPM does not make decisions about you by automated means. The platform calculates, summarises, flags and recommends, but decisions that affect a person — approving a payment claim, accepting a variation, issuing a notice — are made by a user of the platform, not by the software.

---

8. How Do We Protect Your Information?

CortexPM will take reasonable steps to ensure that the Personal & Business information that we hold about you is kept confidential and secure, including by:

• Hosting the platform with established infrastructure providers, and storing uploaded documents and photographs in Australia
• Encrypting information in transit using TLS, and at rest in our database and file storage
• Isolating each customer's workspace at the database level, so one customer cannot access another customer's data
• Managing login and identity through a dedicated authentication provider, with support for single sign-on and multi-factor authentication
• Restricting internal access to the smallest number of people who need it to support you, and only for that purpose
• Storing authentication credentials on mobile devices in the device's secure keystore
• Keeping our software and dependencies patched, and applying security headers and content security policy on our web services

While we strive to protect your information, no method of transmission over the internet or electronic storage is 100% secure. We cannot guarantee absolute security but we are committed to maintaining appropriate safeguards.

---

9. Data Breaches

If we become aware of a suspected data breach involving personal information we hold, we will promptly assess whether it is an "eligible data breach" under the Notifiable Data Breaches scheme in Part IIIC of the Privacy Act.

Where an eligible data breach is likely to result in serious harm, we will notify the affected individuals and the Office of the Australian Information Commissioner as required by that scheme. Where the breach involves information held in a customer's workspace, we will also notify that customer so they can meet their own obligations.

---

10. Cookies, Analytics and Advertising Technology

Cookies

The CortexPM website and platform use cookies. A cookie is a small file of letters and numbers a website puts on your device. Some cookies are essential — they keep you signed in and protect forms against cross-site attacks, and the platform will not work without them. Others are set by the analytics and advertising tools described below.

Cookies used by the platform do identify you while you are signed in, because that is how a login session works. You can amend the settings on your internet browser so it will not automatically download cookies, but if you block cookies the platform will not function.

The Three Tools We Use

We use three, and only three. Each sets cookies or similar identifiers and sends information to the provider named in the table in section 6.

• Google Analytics 4 — website analytics. Records pages viewed, referral source, approximate location derived from IP address, and interactions such as clicking a trial or demo button.
• Meta Pixel — advertising measurement. Reports to Meta Platforms when a visitor takes an action such as requesting a demo or starting a trial, so that we can measure how our advertising performs and show advertisements to people who have visited our website.
• PostHog — product analytics and error reporting. Records pages viewed, clicks, form interactions and errors, so that we can support you and understand how the platform is used. Hosted in the United States.

Where Each One Runs

This matters more than the list, so we have set it out plainly.

• Our public website and sign-in pages — all three run in your browser.
• The signed-in CortexPM application — no advertising or analytics script runs in your browser at all. Google Analytics and the Meta Pixel are not present. What does happen is that our own servers send PostHog a record of the pages requested and any errors encountered, tagged with your user account and your workspace, so we can support you and keep the platform reliable. The contents of your projects, contracts, documents, photographs and site records are not sent.
• The mobile app — none of the three run. There is no analytics or advertising software in the app.

Managing These Tools

You can opt out of analytics and advertising cookies through your browser settings, through private browsing mode, through Google's Analytics opt-out browser add-on, or through your advertising preferences in your Meta account. Blocking them does not affect your ability to use the platform.

We do not allow any other party to place cookies or tracking technology on our website, and we do not buy or combine information about you from data brokers.

---

11. The CortexPM Mobile Application

The CortexPM mobile app (available for iOS and Android) collects some information that the website does not. This section describes what the app collects, why, and what it does not do. The rest of this policy applies to the app as well.

Location

Where you grant permission, the app collects your device's location to confirm that you are at a work site when you sign in or out of that site, and to verify site geofences. Location is only collected while the app is open and you are actively using it — the app does not collect location in the background, and does not track your movements between sites or outside working hours.

You may decline or later revoke location permission in your device settings. If you do, site sign-in and sign-out that rely on location verification will not be available, but the rest of the app continues to work.

Camera and Photos

Where you grant permission, the app can access your camera and photo library so you can attach photographs to defect reports, safety records and site documentation. Photos you attach are uploaded to your company's workspace and become part of that company's project records. The app does not access, scan or upload any other photos on your device.

Push Notifications

If you enable notifications, the app registers a push notification token and stores it against your user record so we can notify you about work assigned to you — for example a defect raised against you, a toolbox talk, or an approved site diary. Push notifications are delivered through Expo's push notification service, which passes the message to Apple or Google for delivery to your device. You can disable notifications at any time in your device settings.

Information Stored on Your Device

So that the app works in areas with poor reception, it stores a copy of the project information you have recently viewed, and any entries you make while offline, on your device until they can be synchronised. That copy can include personal information about other people, such as worker names and contact details. Your login credentials are held separately in your device's secure keystore.

This local copy is removed when you sign out or uninstall the app. Because it sits on your device, you should protect it the same way you protect the rest of your phone — with a device passcode or biometric lock.

Device Information

The app records basic device information (such as device type and operating system version) associated with your session, so we can support you and secure your account.

What the App Does Not Do

The mobile app contains no third-party advertising, analytics or tracking software. We do not use any information collected through the app for advertising, and we do not share it with third parties for advertising or tracking purposes. Information collected through the app is used to provide the CortexPM service to you and to your company's workspace, as described in sections 4 and 6 above.

Deleting Your Account

You can delete your CortexPM account from within the app, or request deletion at any time. See Delete your account for how to do this and what we remove or retain.

---

12. Direct Marketing

We may send you direct marketing communications about our services, opportunities or events where you have asked to receive them, or where you are an existing customer or enquirer and would reasonably expect to hear from us. These communications may be sent by email, SMS or post, in accordance with applicable marketing laws including the Spam Act 2003 (Cth).

Every commercial electronic message we send includes a functional unsubscribe facility. You may opt out at any time by using it, or by contacting us directly at privacy@cortexpm.com.au. We will action your request promptly and in any event within the period required by law.

We also advertise online. As described in section 10, we use advertising technology on our public website so that we can measure advertising performance and show advertisements to people who have visited our website. This is based on your interactions with our public website only. We do not use information from inside the CortexPM platform — your projects, contracts, documents, photographs, site records or the personal information of your workers or clients — for advertising, and we do not disclose it to advertising platforms.

---

13. Retention of Your Information

We will not keep your Personal & Business information for longer than we need to. In most cases that means we keep it for the duration of your relationship with us, unless we are required to retain it to comply with applicable laws, for example record-keeping obligations.

What "Delete My Account" Actually Reaches

CortexPM is used by companies, not only by individuals, so deleting your account is not the same as erasing everything connected to you. We act on a deletion request within approximately 30 days. Here is what it does and does not reach.

Deleted or de-identified:

• Your account and profile — your login, name, email, phone number, emergency contact, notification settings and device registrations. Your login stops working immediately.
• Your personal information in content you created, where removing or de-identifying it is reasonably practicable and does not defeat the record itself.

Retained, and why:

• Your employer's or client's project records — a site diary, defect, inspection, variation or payment claim you created is a record of that company's project, not a record about you. It stays in their workspace. Your name may remain on it where removing it would destroy the record's integrity as evidence of what happened on site and when. Your employer, not us, decides what happens to those records.
• Billing, tax and accounting records — retained for the period required by Australian law, typically five to seven years.
• Backups — residual copies in encrypted backups persist until those backups are rotated or overwritten, and are not restored into live use.
• Aggregated or de-identified data — statistics that cannot reasonably be used to identify you.

If you want a company's project records about you dealt with as well, that request goes to the company operating the workspace — see section 2. We will tell you who to contact and help them respond.

When we no longer need your information, we take reasonable steps to destroy it or permanently de-identify it. Full detail is set out on our Delete your account page.

---

14. How to Access, Correct and Delete Your Information

CortexPM will endeavour to keep your Personal & Business information accurate, complete and up to date.

If you wish to access or correct the information we hold about you, contact us at privacy@cortexpm.com.au. We will acknowledge your request within a few business days and respond within 30 days, unless a longer period is required by law or by the complexity of the request. We may require proof of your identity before we provide access.

To delete your account, see our Delete your account page.

If your information sits inside a building company's workspace and was entered by that company, see section 2 — contact that company in the first instance.

---

15. Links to Third Party Sites

CortexPM website(s) may contain links to websites operated by third parties. If you access a third-party website through our website(s), Personal & Business information may be collected by that third-party website.

We make no representations or warranties in relation to the privacy practices of any third-party provider or website and we are not responsible for the privacy policies or the content of any third-party provider or website. Third-party providers and websites are responsible for informing you about their own privacy practices and we encourage you to read their privacy policies.

---

16. Inquiries and Complaints

For complaints about how CortexPM handles, processes or manages your Personal & Business information, please contact privacy@cortexpm.com.au. Note we may require proof of your identity and full details of your request before we can process your complaint.

Please allow up to 30 days for CortexPM to respond to your complaint. It will not always be possible to resolve a complaint to everyone's satisfaction. If you are not satisfied with CortexPM's response to a complaint, you have the right to contact the Office of the Australian Information Commissioner (at www.oaic.gov.au) to lodge a complaint.

---

17. Changes to This Policy

We may update this Privacy Policy from time to time. When we do, we will revise the "Effective Date" above and notify users where appropriate. We will notify you of any material changes by email or by posting a notice on our website.

Your continued use of our services after any changes to this Policy constitutes acceptance of the updated Policy.

---

18. Contact Us

If you have questions or concerns about this Privacy Policy, please contact:

Privacy Officer
Cortex Project Management Solutions Pty Ltd
Email: privacy@cortexpm.com.au
Phone: 0421 823 326