Privacy and collection notice

EPiC Flex ("Flex", "we") is part of EPiC Agile Pty Ltd. We handle personal information in line with the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs). This notice explains what we collect and why (APP 5).

Who we collect from

• Candidates who join our network or apply for a role.
• Clients and their contacts who send us a brief or use the client portal.
• Referees, referrers and the people they refer.
• People who contact us, subscribe to updates, or download a resource.

What we collect

• Contact details: name, email, phone, LinkedIn profile, organisation.
• Career information: CV, skills, experience, availability, preferences, interview notes and references.
• Sensitive recruitment information, only where needed for a role: rate or salary expectations, work rights, and pre-start check results (for example a police check). Access to these is limited to the recruiter on your role and is logged.
• Basic technical data needed to protect our forms from abuse (IP address for rate limiting, a Cloudflare Turnstile check).

Why we collect it

• To match candidates with contract and permanent roles, and contact them about those roles.
• To share a candidate's profile with a client, only for roles the candidate has agreed to be put forward for.
• To respond to briefs, enquiries and referrals, and to run the referral programme.
• To send updates, articles and the weekly roundup, only if you've opted in. Every marketing email has an unsubscribe link.
• To meet our legal obligations, including record keeping and pre-employment checks.

Who we disclose it to

Clients you agree to be presented to; referees you nominate; and service providers who help us operate (Supabase for data storage, Cloudflare for hosting and security, Resend for email, HubSpot for client relationship management). We don't sell personal information.

Where it is stored

Your information is stored in Australia (Sydney region). Some providers may process limited data overseas to deliver their service; we choose providers with appropriate safeguards.

How long we keep it

We review candidate records after 24 months of inactivity and anonymise them after 36 months unless you ask us to keep them. Police check results are deleted 6 months after they're completed.

Your choices and rights

• You can access, correct, export or delete your profile at any time in the candidate portal, or by emailing us. We complete deletion within 30 days.
• You can withdraw marketing consent at any time using the unsubscribe link in any email.
• If you don't give us the information we ask for, we may not be able to put you forward for roles.

Questions and complaints

Contact our privacy officer at flex@epicagile.com.au. We'll respond within 30 days. If you're not satisfied, you can complain to the Office of the Australian Information Commissioner (oaic.gov.au).