1.    ABOUT THIS POLICY

 

Anchovi Advisory Pty Ltd (ACN 676 175 830) (we, us, our, Anchovi) is committed to protecting the privacy of individuals and businesses who interact with our platform, engage our Services, or provide information to us in connection with an Assessment.

This Privacy Policy explains how we collect, use, hold, disclose, and protect Personal Information in accordance with the Privacy Act 1988 (Cth) (Privacy Act) and the Australian Privacy Principles (APPs).

By accessing our Platform, engaging our Services, or providing us with any Personal Information, you consent to the collection, use, and disclosure of your Personal Information in accordance with this Privacy Policy.

2.    WHO WE ARE

Anchovi Advisory Pty Ltd is an independent SaaS credentialing and assessment platform operating in Australia. We assess and credentialise product and material suppliers seeking access to infrastructure procurement registers across the building and construction, rail, road, civil, and utilities sectors.

Our registered details are:

Legal name: Anchovi Advisory Pty Ltd
ACN: 676 175 830
Email: support@anchovi.com.au
Website: www.anchovi.com.au

3.    WHAT IS PERSONAL INFORMATION

Personal Information means information or an opinion about an identified individual, or an individual who is reasonably identifiable, whether the information is true or not and whether recorded in a material form or not.

In the context of our Platform and Services, Personal Information may include information about individuals within a client business, such as directors, key contacts, authorised representatives, and supply chain personnel.

4.    WHAT INFORMATION WE COLLECT

We collect Personal Information that is reasonably necessary to provide our Services, conduct Assessments, and manage our platform and client relationships. The categories of information we may collect include:

(a)    Business identity and contact information: including business name, trading name, ACN/ABN, registered address, primary contact name, position, email address, and telephone number;

(b) Register profile information: including your logo and brand mark, website, LinkedIn page, sector and capability category tags, states, territories and countries of operation, workforce size band, year established, a self-declared scope of capability and product or service description, and self-declared credentials (including Supply Nation and Social Enterprise status where applicable) provided for display on the Anchovi Supplier Register;
(c)    Financial information: including financial statements, management accounts, payroll tax records, insurance certificates and policy details, and information relevant to financial stability and corporate governance criteria in the Anchovi Master Criteria Register;
(d)    Compliance and certification documentation: including but not limited to ISO 9001, ISO 14001, and ISO 45001 certificates; Environmental Product Declarations (EPDs); FSC Chain of Custody certifications; NABERS ratings; WHS records, incident reports, and audit histories; approved product register listings; and any other third-party verified compliance documentation submitted as evidence in support of an Assessment;
(e)    Modern slavery and supply chain information: including modern slavery statements, supply chain disclosure documents, Stage 1 and Stage 2 supplier lists, sourcing country information, and local industry development plan (LIDP) data and local workforce numbers;
(f)    Environmental credentials: including carbon intensity data, EPD source data, FSC certificates, and other environmental performance documentation;
(g)    Corporate governance documentation: including corporate structure information, ownership details, directorship records, and related governance materials;
(h)    Product and technical information: including product specifications, approved product register listings, product compliance documentation, and related technical materials provided for assessment purposes;
(i)    Assessment responses: including self-declared questionnaire responses, ratings, and supporting documentation;
(j)    Payment information: including bank account details and payment method information provided for the purposes of direct debit authorisation and fee processing; and
(k)    Platform usage information: including log data, IP addresses, browser type, device information, and usage activity on the Platform, collected automatically when you access and use the Platform.
(l)    Contractor and industry intelligence contact information: where contractors and other industry participants provide market intelligence to Anchovi through structured debriefs or otherwise, we collect the names, roles, and contact details of the participating individuals and records of the information they provide. This information is handled in accordance with this Privacy Policy and the terms of our Contractor Intelligence Agreement, including any attribution and anonymisation elections made by the contributing organisation.

5.    HOW WE COLLECT PERSONAL INFORMATION

We collect Personal Information in the following ways:

(a)    directly from you when you complete our Stage 1 onboarding form, submit a Stage 2 or Stage 3 Assessment, upload supporting documents through the Platform, contact us by email, phone, or other means, or enter into an agreement with us;
(b)    from third parties, including contracted assessors or analysts who conduct or assist with Assessments on our behalf;
(c)    from publicly available sources, including company registers, regulatory databases, adverse media, and publicly accessible procurement registers, where we conduct reactive monitoring of Anchovi Backed clients; and
(d)    automatically through the Platform, including through cookies, log files, and similar tracking technologies when you access or use the Platform.

Where it is lawful and practicable to do so, we will collect Personal Information directly from the individual concerned. Where we collect Personal Information about an individual from a third party or from publicly available sources, we will take reasonable steps to notify the individual of that collection where required by the APPs.

6.    WHY WE COLLECT AND USE PERSONAL INFORMATION

We collect, hold, and use Personal Information for the following primary purposes:

(a)    to conduct Stageed assessments, and to provide our credentialing and platform Services;
(b)    to verify the accuracy and currency of information and documents submitted in connection with an Assessment;
(c)    to issue, maintain, renew, suspend, or revoke the Anchovi-Backed™ designation and the Anchovi Backing;
(d)    to manage the Anchovi-Backed™ Public Register and make available to head contractors, project owners, and the broader infrastructure market the information described in clause 8 of this Privacy Policy;
(e)    to communicate with you about your Assessment, account, designation status, renewal obligations, and any material changes or issues affecting your Anchovi Backing;
(f)    to process payments and manage direct debit authorities;
(g)    to comply with our legal obligations, including obligations under the Privacy Act, the Modern Slavery Act 2018 (Cth), and any other applicable legislation;
(h)    to investigate and respond to complaints, disputes, or audit findings;
(i)    to improve and develop our Platform, assessment methodology, and Services, including through the use of anonymised, aggregated, and de-identified data for benchmarking and platform analysis; and
(j)    to produce and publish market intelligence briefings. Contractor-sourced intelligence is published only in accordance with the consent given by the contributing organisation. Signals derived from members are used in intelligence products only in anonymised and aggregated form that does not identify any member;
(k)    to deliver the Intelligence Briefings you subscribe to and to send you service communications about your account, subscription, Backing Queue position, Slot Availability Notices, and assessment pathway. These form part of the paid Services and continue for the life of your subscription; ending them means ending the subscription. 
(l)    for any other purpose for which you have provided your consent.

We will not use or disclose Personal Information for a purpose other than the primary purpose of collection, or a related secondary purpose that you would reasonably expect, without your consent, unless otherwise required or permitted by law.

7.    DISCLOSURE OF PERSONAL INFORMATION

We may disclose Personal Information to the following categories of recipients:

(a)    Contracted assessors and analysts: third-party assessors or analysts engaged by us to assist in conducting Stage 3 Verified Assessments. These parties are bound by confidentiality obligations no less stringent than those in our client agreements and this Privacy Policy;
(b)    Third-party payment processors: payment service providers engaged to process direct debit payments and manage fee transactions on our behalf. These providers handle payment information in accordance with their own privacy policies and applicable financial services regulation;
(c)    Platform and technology providers: cloud hosting, software, and technology service providers who support the operation of our Platform. These providers may have access to data stored on the Platform in the course of providing their services;
(d)    Legal and professional advisers: lawyers, accountants, and other professional advisers engaged by us in connection with the operation of our business or the resolution of disputes; 
(e)    Artificial intelligence platforms: we may use artificial intelligence platforms to assist with the generation of Determination Reports and assessment scoring. Personal Information and documentation submitted through the Platform may be processed by these platforms for this purpose. We take reasonable steps to ensure that any AI platforms used operate under appropriate data handling and confidentiality safeguards; and
(f)    Regulatory and government authorities: where we are required or authorised by law to disclose Personal Information, including to courts, tribunals, law enforcement agencies, or regulatory bodies.
We do not sell, rent, or trade Personal Information to third parties for marketing or commercial purposes.

Where we share information with contracted assessors, analysts, or platform providers, we take reasonable steps to ensure those parties handle the information in a manner consistent with the APPs.

8.    THE ANCHOVI SUPPLIER REGISTER

​

A core function of the Anchovi platform is the Anchovi Supplier Register, which is publicly accessible to head contractors, project owners, other suppliers, and the broader infrastructure market. 

By engaging our Services and progressing through the assessment pathway, you acknowledge and consent to the following categories of information being published on the Register, as set out in the Register Field Schedule current at the time: 

(a) your legal and trading name, ACN/ABN, and logo or brand mark; 

(b) your industry, sector and capability category tags; 

(c) the states, territories and countries in which you operate; 

(d) your workforce size band and year established; 

(e) a self-declared scope of capability and product or service description, and any self-declared credentials you elect to provide; 

(f) your website and LinkedIn page; 

(g) your current Stage status (including whether you are progressing through Stages 1, 2, 3, or 4); 

(h) your Anchovi-Backed™ designation status (active, suspended, or revoked); and 

(i) your Register reference and the dates of your Stage 1 commencement, most recent Assessment, next renewal, and most recent listing update. 

Your nominated contact person's name and business email address are displayed only where you have given separate express opt-in consent. That consent may be withdrawn at any time by written notice to support@anchovi.com.au, and the relevant details are removed from the listing within five (5) Business Days of withdrawal. 

We may add, remove, or otherwise change the categories of information published on the Register at any time, in our sole discretion, by publishing an updated Register Field Schedule on our website. Any such change takes effect on publication and does not require individual notice to you, except that we will never add a field disclosing the identity or contact details of a Client's own contractors, subcontractors, principals, or customers, whether disclosed by or derived from that Client's account. This does not prevent any business, including a contractor, subcontractor, principal, or customer of another Client, from being separately listed on the Register in its own right where it has itself completed Stage 1 onboarding and consented to its own listing. 

This information will be removed from the Register if your Anchovi-Backed™ designation is suspended or revoked, or upon termination of your agreement with us. 

We do not publish any financial, compliance, or other confidential documentation on the Register. All fields other than Stage status, designation status, Register reference and the dates above are self-declared by the Client and are not independently assessed by Anchovi for accuracy. 

9.    OVERSEAS DISCLOSURE

Some of our Platform infrastructure, cloud hosting, and third-party service providers may be located outside of Australia, and Personal Information may be transferred to, stored in, or processed in countries other than Australia.

Where we disclose Personal Information to overseas recipients, we take reasonable steps to ensure that the overseas recipient does not breach the APPs in relation to that information. This may include entering into data processing agreements or relying on contractual safeguards with overseas recipients.

By using our Platform or engaging our Services, you consent to the transfer of your Personal Information to overseas recipients in the circumstances described above. You acknowledge that such transfers may be to countries that do not have privacy laws equivalent to those in Australia.

10.    ANONYMISED AND AGGREGATED DATA

We may use anonymised, aggregated, and de-identified data derived from assessments and platform activity for the following purposes:

(a)    sector benchmarking and industry analysis;
(b)    improving and developing the Anchovi Master Criteria Register, assessment methodology, and scoring framework;
(c)    platform development and product improvement; and
(d)    research and reporting purposes.
(e)    production of market intelligence briefings, in which member-derived signals appear only in anonymised and aggregated form (combined with data from other members so that no individual member can be identified).

Anonymised and aggregated data does not identify any individual or specific business and is not Personal Information for the purposes of the Privacy Act. We may use and disclose such data without restriction.

11.    STORAGE AND SECURITY OF PERSONAL INFORMATION

We take reasonable steps to protect the Personal Information we hold from misuse, interference, loss, and unauthorised access, modification, or disclosure.

Personal Information is stored on secure cloud-based infrastructure. Access to Personal Information is restricted to authorised personnel and contracted assessors who require access for the purposes of providing the Services.

Notwithstanding the above, no data transmission over the internet or storage system can be guaranteed to be completely secure. We cannot guarantee the absolute security of Personal Information transmitted to or from our Platform and you provide information to us at your own risk.

We will take reasonable steps to destroy or de-identify Personal Information that is no longer required for any purpose for which it may be used or disclosed, and that we are not required by law to retain.

12.    RETENTION OF PERSONAL INFORMATION

We retain Personal Information for as long as is reasonably necessary to fulfil the purposes for which it was collected, to provide our Services, and to comply with our legal obligations.

In general:

(a)    assessment documentation and records are retained for a minimum of seven (7) years following the date of assessment or the end of the relevant Backing Period, whichever is later, to support audit trails and dispute resolution;
(b)    payment and financial records are retained in accordance with applicable taxation and financial record-keeping obligations; and
(c)    contact and account information is retained for the duration of the client relationship and for a reasonable period following termination.

Where you request deletion of your Personal Information, we will take reasonable steps to comply with that request, subject to any overriding legal obligation to retain the information.

13.    ACCESS AND CORRECTION

You have the right to request access to the Personal Information we hold about you and to request correction of that information if it is inaccurate, incomplete, or out of date.

To make an access or correction request, please contact us using the email address set out in clause 16 of this Privacy Policy. We will respond to your request within a reasonable timeframe and in accordance with the requirements of the Privacy Act.

We may refuse access or correction in circumstances permitted by the Privacy Act, including where providing access would be unlawful or would unreasonably impact the privacy of another individual. Where we refuse a request, we will provide written reasons for the refusal.

We may charge a reasonable fee for processing an access request, but we will not charge a fee for making the request itself or for correcting information.

14.    PRIVACY COMPLAINTS

If you believe that we have interfered with your privacy or handled your Personal Information in a manner inconsistent with the APPs or this Privacy Policy, you may make a complaint by contacting us using the details in clause 16.

We will acknowledge receipt of your complaint within five (5) Business Days and will endeavour to investigate and respond to your complaint within thirty (30) days. Where a complaint requires more time to investigate, we will notify you of the expected timeframe.

If you are not satisfied with our response to your complaint, you may refer the matter to the Office of the Australian Information Commissioner (OAIC) at www.oaic.gov.au.

15.    COOKIES AND TRACKING TECHNOLOGIES

Our Platform may use cookies, web beacons, and similar tracking technologies to collect usage information and improve the functionality of the Platform.

Cookies are small text files stored on your device when you visit our Platform. We may use cookies for the following purposes:

(a)    to enable the functionality of the Platform and maintain your session;
(b)    to analyse Platform usage and improve user experience; and
(c)    to remember your preferences and settings.

You may configure your browser to refuse cookies or to alert you when cookies are being sent. If you disable cookies, some features of the Platform may not function correctly.

We do not use cookies to collect sensitive Personal Information or to track your activity across third-party websites without your consent.

16.    CONTACT US

If you have any questions, concerns, or requests in relation to this Privacy Policy or our handling of your Personal Information, please contact us:

Anchovi Advisory Pty Ltd
ACN: 676 175 830
Email: support@anchovi.com.au

17.    CHANGES TO THIS PRIVACY POLICY

We may update this Privacy Policy from time to time to reflect changes in our business, legal obligations, or the way we handle Personal Information.

Where we make a material change to this Privacy Policy, we will notify you by posting the updated policy on our website and, where practicable, by notifying active clients directly. The updated policy will take effect from the date it is published on our website.

We encourage you to review this Privacy Policy periodically to stay informed about how we are protecting your Personal Information.