Privacy Policy

1. Introduction

Candoo Culture PTY LTD ("we", "us", "our") is committed to protecting personal information and handling data with transparency, accountability and care. This Privacy Policy explains how we collect, use, store, disclose and protect personal information in accordance with:

Where services are provided to individuals or organisations in the United Arab Emirates, processing is conducted in accordance with UAE PDPL requirements.

Candoo Culture PTY LTD acts as a Data Controller or Data Processor depending on the service arrangement and applicable commercial agreement. In most organisational deployments, Candoo Culture processes data on behalf of the Client organisation, which remains responsible for internal employment or operational decisions.

• The Privacy Act 1988 (Cth) and Australian Privacy Principles (APPs)
• UAE Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data (UAE PDPL)
• The General Data Protection Regulation (GDPR), where applicable
• Other relevant international data protection laws

2. What Personal Information We Collect

We may collect personal information including:

• Name, email, phone number, job title and company information
• Industry and business characteristics
• Responses to surveys, diagnostics or feedback forms
• Platform usage information and interaction history
• Technical data (IP address, device type, browser version, approximate location)

Sensitive information

In some cases, we may collect sensitive personal data, including:

Sensitive information is collected only where necessary, with explicit consent and subject to additional safeguards, purpose limitation and restricted access controls.

• Wellbeing or mental health indicators
• Cultural background or identity information
• Views on workplace behaviour or emotional responses

3. How We Collect Your Information

We collect personal and sensitive information through:

Information provided through surveys or diagnostics may be included in organisational reports shared with authorised leaders or administrators as part of the services agreed with your organisation.

Candoo Culture processes information primarily at an organisational level. Individual responses are used to generate aggregated insights unless identifiable reporting is expressly agreed as part of a service arrangement.

• Direct interactions (surveys, interviews, onboarding forms)
• Use of our website or Platform (cookies, analytics tools)
• Third-party sources such as business directories or publicly available data where permitted by law

4. Lawful Basis for Processing

Depending on the context, we process personal information based on one or more lawful grounds, including:

You may withdraw consent at any time where processing relies on consent.

• Your explicit consent
• Performance of a contract or delivery of requested services
• Legitimate business interests that do not override individual rights
• Compliance with legal or regulatory obligations

5. How We Use Personal Information

We may use personal information for the following purposes:

Reports may be delivered to authorised organisational leaders, administrators or nominated contacts as part of agreed diagnostic services.

AI-assisted tools are used only to support drafting, analysis or quality assurance under human supervision. No fully automated decision-making is performed. AI tools are used to support analysis and insight generation. Automated processing does not make independent legal, employment or disciplinary decisions.

We will not use personal information for unrelated purposes without consent or a lawful basis.

Reports and insights generated through our services are designed to support organisational understanding and leadership awareness. These outputs are interpretive tools and do not constitute automated employment, disciplinary or legal decisions. Human review and organisational judgement remain central to how insights are used.

Internal drafting or analysis tools may be used under strict access controls and anonymisation or redaction practices to support report preparation and quality assurance. Draft preparation or analytical support tools operate under controlled access conditions and do not independently make employment, behavioural or organisational decisions.

• Delivering consultancy services, reports, diagnostics and cultural insights
• Producing aggregated survey analytics and organisational metrics
• Research, analytics and internal product development
• AI and machine learning improvements using anonymised or de-identified data only
• Marketing communications (you may opt out at any time)
• Legal compliance, fraud prevention and risk management

6. Personalised Reports and Survey Insights

When you participate in surveys through our Platform, we may generate reports that:

Reports may include indicators, ratings or comparative scoring designed to support organisational understanding. These indicators are interpretive tools only and are not intended to evaluate individual suitability, performance outcomes or employment status. All insights remain subject to human interpretation by the organisation.

Where agreed by the organisation, identifiable reports may be made available to authorised leaders or to the individual participant upon request. Reports do not display raw written responses to third parties.

By submitting responses, you consent to the collection, analysis and summarisation of your data as described in this Policy. If you do not wish to be identified in reporting, you may contact us at admin@candooculture.com.

• Include your name and role where agreed with your organisation
• Summarise response trends (e.g. positive or negative indicators)
• Present aggregated team or group-level insights

7. Data Retention and Security

We implement encryption, access controls and secure cloud-based protections to safeguard data.

• Personal information is generally retained for up to seven (7) years or as required for legal or compliance purposes unless a shorter retention period is appropriate based on service requirements or lawful deletion requests.
• After this period, data is permanently deleted or de-identified.
• You may request deletion at any time, subject to legal obligations.

8. Disclosure and Third-Party Sharing

We do not sell personal information.

We may share information with trusted third parties where necessary, including:

Where data is transferred outside Australia or the UAE, we implement appropriate safeguards, including contractual protections and internationally recognised transfer mechanisms to ensure adequate protection.

• Secure cloud infrastructure providers used for platform hosting, encrypted storage and operational delivery
• Analytics and insights tools (with anonymisation where possible)
• Research collaborators using de-identified datasets
• Legal or regulatory authorities where required by law

9. Cross-Border Data Transfers

Because our services operate globally, personal information may be processed in jurisdictions outside your country.

Where data is transferred internationally, we ensure transfers comply with:

• UAE PDPL cross-border transfer requirements
• Applicable Australian privacy obligations
• Appropriate contractual and security safeguards

10. Your Rights and Choices

Depending on your jurisdiction, you may have the right to:

To exercise these rights, contact us at admin@candooculture.com. Requests relating to identifiable reports may be coordinated through the relevant organisation where services are delivered under a commercial agreement.

• Access your personal information
• Correct inaccurate data
• Request deletion or erasure
• Object to or restrict certain processing activities
• Request a copy of your data (data portability)
• Withdraw consent at any time
• Request review of automated processing outcomes where applicable

11. Cookies and Tracking Technologies

We use cookies and similar technologies to improve platform performance, understand usage patterns and enhance user experience. You can manage cookie preferences through your browser settings.

12. Data Protection Contact

For privacy enquiries, requests or concerns, contact:

Email: aaron@candooculture.com

Business Name: Candoo Culture PTY LTD

We will respond within a reasonable timeframe and in accordance with applicable data protection laws.

13. Data Breach Notification

If a data breach occurs that is likely to result in serious harm, we will notify affected individuals and relevant regulatory authorities where required under applicable data protection laws, including Australian and UAE requirements.

14. Updates to This Policy

We may update this Privacy Policy periodically. Where significant changes occur, we will notify users via email or through our website.

The latest version is available at www.candooculture.com.