Privacy policy

This policy explains what personal information Work Safety QLD, operated by RJG Mediaworks Pty Ltd (ABN 25 637 433 455), a privately owned company based in Brisbane, Queensland, collects through worksafetyqld.com, how we use and protect it, and the choices you have. We handle personal information in line with the Australian Privacy Principles in the Privacy Act 1988 (Cth). In this policy, “we”, “us” and “our” mean Work Safety QLD.

What we collect

When you buy or download a template

When you buy: your name, email address and country, and anything else you choose to give us at checkout, such as a business name for your invoice or invoice notes. When you download a free template from its page: your first name, email address and, if you give it, your business name. For every order we keep a record of what you got, when, the amount paid, the files you’ve downloaded and the IP address the order came from. Our shop software, WooCommerce, also stores with the order where the visit came from (for example a search or a link on another website) and your browser and device type.

Your account

You don’t need an account to buy a template or to download a free one. When you place an order you can choose to create an account so you can download your templates again. If you do, your account holds your login details, your order history and your billing details. Passwords are stored in a scrambled (hashed) form, so we can’t see them.

Payments

Payments are processed by Stripe, including card, Apple Pay, Google Pay and Stripe Link payments. Your card details go straight to Stripe. We never see or store your full card number. If you choose to save a payment method for future orders, Stripe keeps it, not us.

When you contact us or request a template

The details you enter in our contact or template request forms, such as your name, email address, business name and message, and any emails you send us. These reach our email inbox, which runs on Google Workspace. When one of these forms is sent, our own enquiry-tracking tool also notes that it happened: which form and page, how you found the site, your device type and, if the form asks for it, your first name. The details you send (your name, contact details and your message) are also kept securely in our website systems for up to 24 months so we can reply and keep a record of enquiries. We do not sell or share them. You can ask us to see or delete them at any time. We also use these records to count enquiries and see which pages and sources lead to them.

Reviews

If you review a template, we collect your name, email address, star rating and comments. We check reviews before they appear. Your name, rating and comments are published, and your email address is not. If you have a Gravatar profile picture, it may show next to your review, which means a scrambled form of your email address is sent to Gravatar (run by Automattic in the United States).

Automatically, when you use the site

Technical information such as your IP address, browser and device type, the pages you visit and when, how you found the site, and download activity. We use it to keep the site secure, stop download links being misused, and understand how the site is used. See Cookies and analytics below.

You can browse the site and read our guides without telling us who you are. You don’t have to give us your details, but without your name and email address we can’t process an order, set up your account or reply to your enquiry.

How we use your information

• To process your order, deliver your downloads and send your order confirmation, invoice and download links.
• To give you access to your account so you can download your templates again.
• To answer your questions and consider your template requests.
• To send you our newsletter, if you’ve joined the mailing list.
• To prevent fraud, misuse of download links and other security problems.
• To understand how the site is used, where our visitors and orders come from, and to improve it.
• To meet our legal obligations, such as keeping records for tax purposes.

Our mailing list

We send occasional emails about new templates and WHS updates. You join the list by downloading a free template (we say so next to the download button), by ticking the box at checkout when you buy (it’s unticked until you tick it), or by entering your email address in a sign-up box on the site. We don’t send marketing emails to people who haven’t joined. Every marketing email has an unsubscribe link, and unsubscribing doesn’t affect your account, your downloads or your order emails. We use Brevo, an email marketing service, to keep the list and send these emails, so it holds the email address and name you gave us. If you’re on the list, we may also send you one email reminding you about templates you left in your cart.

Cookies and analytics

Cookies are small files stored by your browser. We and the services we use set these:

• Essential cookies that make the site work: your cart, checkout, login and security. The cookie that remembers your cart lasts about two days.
• Where you came from. WooCommerce’s order attribution cookies (their names start with sbjs_) and our own cookie rjg_ft record how you found the site, for example a search, a link on another website or an advertisement, and the first page you landed on. rjg_ft lasts 90 days and holds no personal information.
• Payment cookies set by Stripe, whose code loads on our product, cart, checkout and account pages, to process payments securely and prevent fraud. Stripe’s fraud checks can use hCaptcha, which may set its own cookies at checkout.
• Cloudflare services that protect and speed up the site, including a spam check (Cloudflare Turnstile) on our contact form, template request form and free download form, and basic, aggregate traffic measurement. The traffic measurement is designed to work without cookies, but the security checks may set a small cookie.
• Analytics cookies from Google Analytics, which tell us how visitors use the site (for example, which pages are viewed, how people found the site, their general location and device type, and when a form is sent, an email link is clicked or an order is completed). We don’t send your name, email address or payment details to Google Analytics, and we use this information in aggregate to improve the site. We have set Google Analytics to keep data linked to cookies and advertising identifiers for 14 months.
• Google advertising features: we’ve turned on Google signals and ads personalisation in Google Analytics. If you’re signed in to a Google account and have allowed personalised ads, Google may link your visits across devices to give us anonymous reports about our audience (such as age range and interests), and may use them to show you ads about Work Safety QLD on other websites if we advertise with Google.
• Meta Pixel (Facebook and Instagram): we use the Meta Pixel to measure whether our Facebook and Instagram ads lead to visits and purchases, and to show our ads to people likely to be interested. It records the pages you view, what you add to your cart and what you buy (the product and order value), and sends this with your browser and device details to Meta Platforms, which may link it to your Facebook or Instagram account. We don’t send your name, email address or phone number to Meta. If your browser sends a Global Privacy Control signal, the Meta Pixel doesn’t load. If you arrive from one of our ads with an offer code, a cookie named wsq_offer remembers the code for 14 days so it can be applied at checkout; it holds no personal information.
• Microsoft Clarity: we use Clarity to see how people use the site, so we can fix pages that are confusing or slow. It records how a visit unfolds (the pages viewed, clicks, scrolling and mouse movement), along with your device type and general location, and it sets cookies to tell one visit from another. What you type into a form is hidden from the recording, and on the checkout, order and account pages all text is hidden as well. Card details are entered in Stripe’s own fields, which Clarity can’t see. If your browser sends a Global Privacy Control signal, Clarity doesn’t load. Microsoft handles this information under its privacy statement.

You can block or delete cookies in your browser settings, control personalised ads in Google’s My Ad Center, and control how Meta uses your activity in your Facebook and Instagram ad preferences, and opt out of Google Analytics with Google’s opt-out browser add-on. If you block essential cookies, checkout and your account may not work.

Who we share it with

We don’t sell or rent your personal information. We share it only as needed to run the business:

• Stripe, to process payments.
• DigitalOcean, our hosting provider, which stores the website and its database on servers in Sydney, Australia.
• Brevo, which sends the site’s emails on our behalf (such as order emails, download links, account emails and form notifications) and stores our mailing list and sends our newsletters.
• Google, for website analytics and advertising features, and for the email inbox we use (Google Workspace).
• Meta Platforms, to measure and show our Facebook and Instagram ads (see Cookies and analytics above).
• Microsoft, for the visit recordings made by Microsoft Clarity (see Cookies and analytics above).
• Cloudflare, which protects and speeds up the website, checks that form submissions come from a person, measures traffic, and stores our encrypted backups.
• Gravatar, if you leave a review (see Reviews above).
• People who help us run the business, such as our web developer and accountant, and government authorities when the law requires it.

We only give each provider the information it needs to do its job. Stripe and Google also use some information for their own purposes, such as preventing fraud and improving their services, under their own privacy terms: see Stripe’s privacy policy and how Google uses information from sites that use its services.

Information stored overseas

Our website and its database are hosted in Australia, but some of the providers above store or process information outside Australia. Stripe, Google, Meta, Microsoft and Cloudflare may handle it in the United States and other countries where they operate (this includes our encrypted backups, which Cloudflare stores), Brevo stores it in the European Union, and Gravatar handles it in the United States. Before we share information with an overseas provider, we take reasonable steps to make sure it will handle your information in line with the Australian Privacy Principles, and we remain responsible for it.

How we protect it

The site uses an encrypted (HTTPS) connection, access to customer information is limited to the people who need it, and payments are handled by Stripe, a PCI DSS certified provider. No method of storing or sending information online is completely secure, but we take reasonable steps to protect your information from misuse, loss and unauthorised access.

How long we keep it

We keep order records for seven years after the sale. Australian tax law requires us to keep business records for at least five years, and we keep them a little longer so we can deal with tax, accounting and consumer-law questions. After seven years we remove the personal details from the order (your name, email address, address and IP address) and keep only the sale itself. Orders that were never paid (failed, cancelled or abandoned) are deleted after one year. We don’t delete accounts on a timer: we keep your account until you ask us to close it, so you can keep downloading your templates. We keep enquiries, including the details and message you send, for up to 24 months. We keep you on the mailing list until you unsubscribe. Google Analytics is set to keep data linked to cookies and advertising identifiers for 14 months.

Your choices

• See or correct your information: you can update your account details in My account. To get a copy of the information we hold about you, or to correct anything you can’t change yourself, email us at [email protected]. We may need to confirm your identity first. If we can’t give you access or make a change, we’ll tell you why.
• Close your account: email us and we’ll delete your account. We may need to keep order records we’re required to keep by law.
• Stop marketing emails: use the unsubscribe link in any marketing email, or email us and we’ll take you off the list.

We’ll respond to requests within 30 days.

Other websites

Some pages link to other businesses’ websites, including businesses we have a commercial relationship with. Their privacy practices are their own, so please read their policies.

Complaints

If you have a concern about how we’ve handled your personal information, email us at [email protected] with the details. We’ll look into it, may ask you for more information, and will reply in writing within 30 days to tell you what we found and what we’ll do about it. If you’re not satisfied with our response, you can contact the Office of the Australian Information Commissioner at oaic.gov.au.

Changes to this policy

We may update this policy from time to time, for example when we change how the site works. The current version will always be on this page, with the date it was last updated at the top.

Contact us

Email [email protected]. Work Safety QLD, operated by RJG Mediaworks Pty Ltd (ABN 25 637 433 455), Brisbane, Queensland.