On Track Recruitment Solutions – Privacy Policy

Version 1 – October 2026 | Effective date: 16 October 2026 | Last reviewed: October 2026

This policy has two layers. Part A is a short summary. Part B is our full privacy policy, with more detail on each topic. Each summary item below tells you where to read more. You can also ask us for a copy of the full policy.

Part A – Condensed Privacy Policy (summary)

About us

On Track Recruitment Solutions (OTRS) is a recruitment and labour hire business in Osborne Park, WA. We manage personal information as an APP entity under the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs). We only collect information that is reasonably necessary for our work, and we don’t collect information just in case it might be useful one day. Read more: Part B, sections 1–2.

Whose information we handle

We handle personal information about work-seekers (candidates and the workers we place), clients (contacts at businesses and host employers we work with), referees, and website visitors. Read more: Part B, section 3.

What we collect

For work-seekers this includes your resume, work history, licences and tickets, right-to-work details, references, and – once you’re placed – your TFN, bank, super and timesheet details. We also collect some sensitive information. Everyone must give us a National Police Certificate and do a drug and alcohol test before their first placement, and all workers are then subject to monthly random drug and alcohol testing. We may also ask you to do a pre-employment medical or fitness-for-work assessment where it’s needed to check you can safely do the inherent requirements of a role, or to meet a client’s site requirements. These checks are a condition of registering and being placed with us. We ask for your consent, but if you don’t consent, we can’t place you. Read more: Part B, section 3.

How we collect it and why

We collect information from you, job boards such as SEEK and LinkedIn, our website, our recruitment system (JobAdder), referees, clients and check providers. We use it to find you suitable work, place and pay you, meet our legal duties, and manage our client relationships. Read more: Part B, sections 4–6.

AI and automated tools

We use AI and automated tools to help match, tag and screen candidates and to draft communications. People make the final decisions. Read more: Part B, section 7.

When you give us your resume or register with us, you agree that we may send your resume or profile to current and prospective clients and host employers for the kind of work you’re seeking, without asking you each time. You can tell us about any businesses we shouldn’t send it to (such as your current employer), and you can withdraw your agreement at any time. We also share information with referees, check providers, our service providers (such as JobAdder, HubSpot, Microsoft 365 and Astute Payroll), and government agencies where the law requires. Some providers may store information overseas. We do not sell personal information. Read more: Part B, sections 11–12.

How we protect it

We hold information securely, mostly in cloud-based systems, and destroy or de-identify it when it’s no longer needed and it is lawful to do so. If a data breach is likely to cause serious harm, we will notify affected people and the OAIC as the law requires. Read more: Part B, sections 9–10.

Marketing

We may send you job alerts and information about our services. You can opt out at any time. Read more: Part B, section 13.

Your rights

You can ask to see and correct the information we hold about you, and you can complain if you think we have mishandled it. Read more: Part B, sections 14–15.

Contact us

Privacy Co-ordinator, On Track Recruitment Solutions – info@otrsolutions.com.au (subject “Privacy”) | 08 6444 7853 | 4/97 Hector St W, Osborne Park WA 6017. Read more: Part B, section 17.

Part B – Full Privacy Policy

1. Introduction

ON TRACK RAIL SOLUTIONS PTY LTD trading as On Track Recruitment Solutions, ABN 50 623 382 918 (OTRS, we, us, our), is a recruitment and labour hire business (an employment agency and on-hire firm) based at 4/97 Hector St W, Osborne Park WA 6017.

We manage personal information, as an APP entity, in line with the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs). This policy explains what personal information we collect, how we use and protect it, and your rights.

We only collect personal information that is reasonably necessary for our functions and activities. We don’t collect it just because it might be useful at some future time when we have no present need for it.

If we receive personal information we didn’t ask for (unsolicited information), we will check whether we could have collected it lawfully. If not, we may decline to keep it and will destroy or de-identify it where it is lawful and reasonable to do so.

If we work as a contractor to a Commonwealth, state or territory government agency, different privacy rules may apply to information we handle under that contract. Contact us if you want to know whether this applies to you.

2. How information flows through our business

When we collect your personal information, we:

check that it is reasonably necessary for our functions and activities as an employment agency and on-hire firm (see section 5)
check that it is current, complete and accurate – sometimes by cross-checking it with third parties, such as referees or licensing bodies
record and hold it in our information record system (see section 9). Some information may be disclosed to overseas recipients (see section 12)
check again that it is current, complete, accurate and relevant before we use or disclose it – especially if time has passed since we last checked
let you access it and ask us to correct it, subject to some exceptions (see section 14)
destroy or de-identify it when we no longer need it for any lawful purpose, provided it is lawful for us to do so (see section 9).

There may sometimes be departures from this usual flow – for example, where the law requires us to keep or disclose information.

3. Kinds of information we collect and hold

What we collect depends on whether you are a work-seeker, a client, a referee or a website visitor.

Work-seekers (candidates and workers)

Information we need to assess your interest in and availability for work, your suitability for placements, and to manage your work through us. This may include:

contact and identity details – name, address, phone, email, date of birth, and identity documents such as a driver’s licence or passport
work history and skills – resume, qualifications, work history, skills, availability, preferred roles, pay expectations, interview notes, and any test or assessment results
licences, tickets and checks – driver’s, machinery and high-risk work licences, site inductions and tickets (for example White Card, rail or mining tickets), and the results of licence and qualification checks
references – your referees’ details and what they tell us about you
right to work – citizenship, residency and visa details, including visa conditions and VEVO check results
police checks – a National Police Certificate, which everyone must give us before they work for us (see ‘Police checks’ below)
health information – drug and alcohol test results (see ‘Drug and alcohol testing’ below), pre-employment medicals and fitness-for-work assessments where it’s needed to check you can safely do the inherent requirements of a role, or to meet a client’s site requirements, and injury and rehabilitation information
payroll details – tax file number (TFN), bank account and superannuation fund details, timesheets, hours, pay rates, pay and tax records, and leave records
emergency contacts – the name and phone number of someone we can contact in an emergency
performance and safety information – client feedback, performance appraisals, workplace incidents and injuries, complaints and investigations.

Clients

Information we need to deliver and manage our services, such as:

your name, job title, employer, and work contact details
the roles you recruit for, reporting lines, site and safety requirements, and team or workplace culture
our dealings with you – job orders, timesheet approvals, feedback on workers, invoices and correspondence
your interests and preferred contact channels, if you choose to share them, so we can send you relevant news and information.

Referees

Information we need to help assess whether one of our work-seekers is suitable for a role, such as:

your name, position and contact details (for follow-up if needed)
confirmation of your identity and authority to give a reference
your relationship with the work-seeker, and your knowledge and opinions of their work, as relevant to the reference.

Website visitors

Your IP address, browser and device type, pages viewed, time on site, the site you came from, and anything you enter into our online forms (see section 8).

Sensitive information

Health information, criminal records and some other kinds of information are sensitive information under the Privacy Act. We only collect sensitive information with your consent and when it is reasonably necessary for our work – or when the law requires or allows it. Some checks are a condition of registering and being placed with us (see below). We ask for your consent to them when you register. You don’t have to consent, but if you don’t, we can’t place you in work. If we reasonably believe that you being in, or staying in, a role might be a risk to your health and safety or someone else’s, we may collect relevant information (including health information) so we can manage that risk – with your consent, or where the law allows it without consent (for example, to prevent a serious threat to someone’s health or safety).

Drug and alcohol testing

Every work-seeker must do a drug and alcohol test before their first placement. This is usually done at our office.

After that, all workers are subject to monthly random drug and alcohol testing. Random tests may be done at our office, at a clinic, or at your workplace or site, and may happen during or outside your working hours.

This is separate from, and in addition to, any other testing, such as:

testing after an incident or near miss, or as part of an investigation
testing under a host client’s drug and alcohol policy
any other testing the law requires or allows.

We use test results to check that you are fit for work, to keep you and others safe, and to meet our safety duties and our clients’ site rules. We only share results with a host client where their policy requires it.

Police checks

Everyone must give us a current National Police Certificate before they work for us.

We use it for our own purposes – to assess your suitability for work, to protect the safety of our workers, clients and others, and to protect our reputation. We may also disclose it to host clients where they require it.

A conviction does not automatically rule you out. We assess each person individually, looking at whether the offence is relevant to the inherent requirements of the role, how long ago it happened, and the circumstances.

We respect the Spent Convictions Act 1988 (WA). You don’t need to tell us about a spent conviction, and we won’t take one into account, unless an exemption applies.

Medicals

We may ask you to do a pre-employment medical or fitness-for-work assessment where it’s needed to check you can safely do the inherent requirements of a role, or to meet a client’s site requirements.

Photos and images

OTRS takes a photo of each work-seeker and keeps it on their JobAdder candidate profile. We use it internally to identify candidates, and we only share it with a host client when it is required, for example for site access or a site induction. OTRS also keeps copies of identity documents, such as your driver’s licence, passport, birth certificate or visa, to verify your identity and right to work and to meet legal and client requirements. Photos and ID copies are stored securely in JobAdder, access is limited to staff who need it, and they are destroyed or de-identified when no longer needed.

Workplace surveillance

OTRS has security cameras (CCTV) at our office for the safety and security of our staff, visitors and premises. The cameras only cover the stairs and entry leading into our office, and they record video only, not sound. Footage is kept for a limited period and is only viewed when needed, for example after a security or safety incident. Host clients may operate their own CCTV, security or other monitoring at their sites and workplaces. That is managed under the host client’s own policies, and you should follow any site rules they give you.

If you don’t give us information

You can make a general enquiry without giving your name. But if you are a work-seeker and you don’t give us all or part of the information we need, we may not be able to find suitable work for you or place you in work, and we may decline to represent you or put you forward for particular roles.

4. Laws that require us to collect information

Some laws require or authorise us to collect certain information, including evidence of your right to work and, for some roles, criminal history. These include:

Migration Act 1958 (Cth) and Migration Regulations 1994 (Cth) – right-to-work checks
taxation and superannuation laws, such as the Taxation Administration Act 1953 (Cth) and the Superannuation Guarantee (Administration) Act 1992 (Cth)
the Fair Work Act 2009 (Cth) – employee records
the Work Health and Safety Act 2020 (WA) and workers’ compensation laws in Western Australia
industry, site or client requirements under those laws, for example in rail, mining and construction.

When we ask for information of this kind for a particular job, we will tell you whether giving it is required or voluntary.

5. Purposes – why we collect, use and disclose information

We use and disclose personal information for the main purpose we collected it for, and for related purposes you would reasonably expect. We won’t use it for any other purpose unless you consent or the Privacy Act otherwise allows it – for example, where required by law, or to lessen a serious threat to someone’s life, health or safety.

Work-seekers

checking your identity and right to work in Australia
assessing your suitability for registration with us and for roles, and matching you to jobs
checking your resume, references, qualifications, licences and tickets – including with third parties (we will tell you how we plan to do this)
arranging the checks and tests in section 3 – your National Police Certificate, pre-placement and random drug and alcohol testing, any other drug and alcohol testing, and pre-employment medicals or fitness-for-work assessments where it’s needed to check you can safely do the inherent requirements of a role, or to meet a client’s site requirements
using your National Police Certificate to assess your suitability, protect the safety of our workers, clients and others, and protect our reputation
placing you in work, managing your placement, performance appraisals and ongoing prospects
identifying your training needs, and suggesting training while you are registered with us
paying you, withholding tax, paying super and keeping payroll records
work health and safety, incident management, workplace rehabilitation and workers’ compensation and insurance claims
managing complaints, investigations or inquiries you are involved in
giving references about your work, if asked and with your agreement
working out the fees payable by our clients for your placement, and our legal compliance and statistical reporting.

Clients

managing our client and business relationships
recruitment and labour hire services, including job orders, placements, timesheets and invoicing
marketing our services to you (see section 13)
statistical reporting and legal compliance.

Referees

confirming your identity and authority to give a reference
assessing a work-seeker’s suitability for roles
our recruitment functions.

Government identifiers

We don’t use your TFN or other government identifiers (such as a driver’s licence or Medicare number) as our own way of identifying you. We only use your TFN for tax and superannuation purposes allowed by law.

6. How we collect information

We sometimes collect information from third parties or publicly available sources when we need to – for example, to check information you have given us – or where you have consented or would reasonably expect it. Sometimes the technology we use to communicate with you gives us personal information (see section 8).

Work-seekers

directly from you – when you apply for a job or register with us, fill in our forms, attend an interview, send us your resume, call or email us, or submit timesheets
through job boards such as SEEK and LinkedIn, and through our website forms and our recruitment system, JobAdder
from people who refer you to us
from referees, previous employers, licensing and registration bodies, and education providers
from clients and host employers – for example feedback on your work, timesheet approvals and incident reports – which we use to manage the placement and our obligations to the client
from police check, medical, and drug and alcohol testing providers (including clinics and on-site testers), and licence and visa verification providers, with your consent
from publicly available sources such as professional networking sites (for example LinkedIn), social media and the internet.

Clients

when you give it to us for business purposes, such as a job order, phone call, email, meeting or event
through our website enquiry forms
from publicly available sources such as your company website, LinkedIn and business directories.

Referees

when you give a reference about a work-seeker, by phone or by electronic reference form
when we check information about a work-seeker with you.

When we collect information from publicly available sources, we manage it in line with the APPs and this policy.

7. AI and automated tools

OTRS uses, and may increasingly use, AI and automated tools to help us work efficiently. These include built-in features in our recruitment software, such as JobAdder, and other AI tools we may adopt.

What we may use them for: parsing and summarising resumes, tagging and sorting profiles by skills, licences, tickets and location, matching candidates to jobs, helping screen and shortlist applications against a role’s requirements, flagging missing or expired licences and tickets, and drafting emails, messages and job ads.
What information is used: the information in your resume, application and profile, such as your work history, skills, qualifications, licences and tickets (and their expiry dates), location, availability, pay expectations and your answers to screening questions.
Decisions they may help with: these tools may substantially help us decide which candidates to shortlist, contact or put forward for a role, and which applications are unlikely to meet a role’s essential requirements.
People make the decisions: we don’t make decisions about you solely by automated means. Our team reviews the results and makes the final decisions about who is shortlisted, put forward to a client or offered work.
Your information stays protected – we use tools from reputable providers under agreements that protect your information, and we don’t sell your personal information.

If you have questions about how these tools were used in relation to you, or you would like a person to review a decision, please contact us (see section 17).

8. Electronic transactions, cookies and analytics

We collect personal information that you choose to give us online or by email – for example when you:

join a job alert or email list
make an online enquiry or email us through our website
send us your resume by email, through a job board or through our website
use our online systems to upload identity documents, receive job offers, complete inductions or submit timesheets.

Online systems we often use include JobAdder (applications and candidate records) and Astute Payroll (timesheets and pay).

We may also use video calls (such as Microsoft Teams) for interviews, and keep call and message logs and emails in our systems.

There are risks in using the internet, and you should take appropriate steps to protect your personal information. If you’d rather not contact us online, you can phone us or write to us.

Cookies and analytics

Our website uses cookies (small files saved on your device) and similar technologies to make the site work, remember your preferences and understand how people use it.

We use Google Analytics to see things like which pages are visited and how long people stay. We also use HubSpot, our customer relationship management (CRM) system, to track how visitors use our website and interact with our emails. If you fill in a form on our website, HubSpot may link your browsing activity to the details you give us, so we can follow up your enquiry and understand what’s most useful to you. Google and HubSpot use cookies and may store and process data overseas, including in the United States.

You can block or delete cookies in your browser settings, opt out of Google Analytics using Google’s browser add-on, and unsubscribe from our emails at any time. Some parts of the website may not work properly if you block cookies.

Our website may link to other websites, such as job boards and the OAIC. We don’t control those sites and are not responsible for their content or privacy practices.

9. How your information is held

Our information record system

We hold most personal information electronically in cloud-based systems, including JobAdder, Microsoft 365, HubSpot and Astute Payroll. Some information may also be held on staff laptops and mobile phones, and in limited paper records.

Information security

We take reasonable steps to protect personal information from misuse, interference and loss, and from unauthorised access, change or disclosure. Without giving details that could weaken our security, these include:

access controls and need-to-know rules, so staff only see the information they need
password protection and multi-factor authentication
rules for securing laptops, mobile phones and portable storage devices
extra restrictions on sensitive information, such as police checks, medicals and TFNs
staff training, confidentiality obligations and clean-desk practices
only collecting information when we need it, and periodically reviewing inactive records and deleting information we no longer need
secure disposal, including shredding paper records and wiping old devices.

How long we keep it

We keep personal information only for as long as we need it for the purposes in this policy, or as long as the law requires. Then we take reasonable steps to destroy or de-identify it, provided it is lawful to do so. As a guide:

work-seekers who are not placed – we keep your details in our talent pool to contact you about future roles. You can ask us to delete them at any time, and we periodically review inactive records
workers we have placed – payroll, pay and employment records for at least 7 years, as required by workplace and tax laws
police check certificates, medicals and drug and alcohol results – only as long as needed for the role or as required by law or a client contract; we may keep a record that a check was done and its outcome
client and referee details – while we have a business relationship, or for as long as the related work-seeker record is kept
website analytics data – in line with the settings of our analytics provider.

10. Data breaches

We are covered by the Notifiable Data Breaches scheme. If we suspect a data breach, we will act quickly in line with the OAIC’s guidance – contain the breach, assess the risk, notify where required, and review what happened to prevent it happening again. If a data breach is likely to result in serious harm to you, we will notify you and the Office of the Australian Information Commissioner (OAIC) as the law requires, and tell you what steps you can take to protect yourself.

11. Who we disclose information to

We may disclose your personal information for the purposes it is held for (see section 5), for a lawful related purpose, or where we are legally required to. Depending on who you are, this may include:

clients and host employers – potential and actual employers and clients. We send your resume or profile to clients for the kind of work you’re seeking, as explained below. With your consent, we may disclose your National Police Certificate to a host client where they require it, and drug and alcohol or medical results only where the client’s policy requires it
Prospective employers and clients: by giving us your resume or registering with OTRS, you agree that OTRS may send your resume or profile to current and prospective clients for the kind of work you’re seeking, without asking you each time. This may include your name, resume, work history, skills, licences and tickets, general location and availability. We won’t send your contact details, identity documents, health information or criminal history unless they are needed for a particular role, and we only send your photo when a client requires it (for example, for site access or a site induction). You can tell us about any businesses we shouldn’t send your details to (such as your current employer), and you can withdraw your agreement at any time by contacting us.
referees, and people who ask us for a reference about you (with your agreement)
check and verification providers – police check providers, medical and drug and alcohol testing providers, and licence, qualification and visa verification services
our insurers, workers’ compensation insurers and WorkCover WA
professional associations or registration bodies with a proper interest in the information
a parent, guardian, person holding power of attorney, or next of kin – only where consent or notice is needed and it isn’t practicable to get it from, or give it to, you directly
government agencies, where the law requires or allows it – for example the Australian Taxation Office, the Department of Home Affairs, WorkSafe WA, and police or courts
superannuation funds, and any other person legally entitled to the information
our related entities, if any

We do not sell personal information.

Contracted service providers

We use contracted service providers to help run our business, and they may see some of your personal information. They include:

software providers – JobAdder (recruitment), HubSpot (client and contact management and email), Microsoft 365 (email, documents and storage) and Astute Payroll (timesheets and payroll)
IT support providers, website hosting and internet service providers
background checking and screening providers
accountants, lawyers and other professional advisers
insurance brokers, loss assessors and insurers.

We take reasonable steps to make sure our agreements with service providers recognise our privacy obligations, and that they won’t do anything that would cause us to breach them.

12. Overseas recipients

Some of the service providers we use to run our business may store, process or access your personal information outside Australia. These include our recruitment system, CRM, email and document storage, payroll software and website analytics tools. This may happen in the United States and other countries where those providers or their support teams operate. We may also contact overseas referees or former employers when checking your references. Before we use a provider, we take reasonable steps to make sure they handle your information in line with the Australian Privacy Principles and keep it secure.

If you give us details of an overseas referee or former employer, we’ll ask for your consent before contacting them. We’ll only send your name, identifying details and the kind of work you’re seeking. If you agree, we won’t be required to take steps to make sure the overseas recipient handles the information in line with the Australian Privacy Principles (APP 8.1 won’t apply). They may not be bound by Australian privacy law, and you may not be able to seek redress under it.

13. Direct marketing

We may use your personal information to send you job alerts, news and information about our services by email, SMS or phone. If you are a client contact, we may send you information about candidates and our services.

You can opt out at any time by using the unsubscribe link in our emails, replying STOP to an SMS, or telling us by phone, text or email. We will act on your request promptly and won’t charge you. We follow the Spam Act 2003 (Cth) and the Do Not Call Register Act 2006 (Cth).

14. Access and correction

Access

Subject to some exceptions in privacy law, you can ask to see the personal information we hold about you. To make a request, contact our Privacy Co-ordinator (see section 17). We will need to confirm your identity.

Important exceptions include:

confidential reference material – opinions given to us in confidence during reference checks. Referees are often entitled to expect us to keep their comments confidential, and we may refuse access where an exception in the Privacy Act applies, for example where giving access would unreasonably affect the referee’s privacy
where giving access would unreasonably affect someone else’s privacy, or another legal exception applies.

We won’t charge you for making a request. We may charge a reasonable fee for giving you access (never an excessive one), based on our staff time to find, review, copy and send the information and any postage or intermediary costs. In deciding whether to charge and how much, we will consider our relationship with you, any known financial hardship, and any harm to you if you don’t get access. We will tell you about any fee before we proceed.

We aim to respond within 30 days. If we refuse access, we will tell you why in writing and how to complain. Where appropriate, we may give access in another way – for example, through a summary or a mutually agreed intermediary.

Correction

If you think information we hold about you is inaccurate, out of date, incomplete, irrelevant or misleading, you can ask us to correct it. We will take reasonable steps to correct it, having regard to the purpose it is held for. There is no charge.

If we have disclosed the incorrect information to someone else, you can ask us to tell them about the correction, and we will do so unless it is impracticable or unlawful. If we decide not to correct the information, we will tell you why in writing, and you can ask us to attach a statement to the record saying you believe it is wrong. We aim to respond within 30 days.

15. Complaints

You have a right to complain if you think we have interfered with your privacy. Please make your complaint to our Privacy Co-ordinator in writing first (see section 17).

When we receive your complaint, we will:

confirm your identity and contact details, so we know we are dealing with you or someone you have authorised
write to you to acknowledge your complaint and explain how we will handle it
ask for more detail if we need it, and make inquiries to find out what happened and why
respond in writing within a reasonable time – usually 30 days
suggest a solution, such as access or correction, or another solution offered confidentially and on a without-prejudice basis.

If you are not satisfied with our response, or we haven’t responded within 30 days, you can complain to the Office of the Australian Information Commissioner (OAIC):

website: www.oaic.gov.au (online complaint form)
phone: 1300 363 992
post: GPO Box 5288, Sydney NSW 2001.

As a member of the Recruitment, Consulting and Staffing Association (RCSA) at the time of this policy, we are also bound by the RCSA Code for Professional Conduct, and you can raise a complaint about our conduct with the RCSA. The RCSA process is not an external dispute resolution scheme for privacy complaints.

16. Employee records

Under the Privacy Act, some records about our current and former employees are exempt when they are handled for purposes directly related to the employment relationship. This exemption does not apply to work-seekers, job applicants, contractors, clients or referees, and we handle their information in line with this policy. Even where the exemption may apply, we aim to protect our workers’ information to the same standard. Workers can also ask to see their time and wage records under Fair Work laws.

17. Contact us

For privacy questions, requests or complaints, contact our Privacy Co-ordinator, David O’Leary, during office hours (8.00 am – 4.30 pm AWST, Monday to Friday):

email: info@otrsolutions.com.au (subject line “Privacy”)
phone: 08 6444 7853
post: Privacy Co-ordinator, On Track Recruitment Solutions, 4/97 Hector St W, Osborne Park WA 6017
website: www.otrsolutions.com.au

18. Changes to this policy

We may update this policy from time to time. The latest version will always be on our website at https://www.otrsolutions.com.au/privacy-policy/, with the date it was last updated.

Version 1 – October 2026