Privacy policy.

1. What is Personal Information?

Personal information is information or an opinion about an identified or reasonably identifiable individual, whether true or not, and whether recorded in a material form or not. Examples include names, contact details, employment history, financial details, health information, and identity documents.

Sensitive information is a subset of personal information that includes health information, racial or ethnic origin, religious or philosophical beliefs, political opinions, trade union membership, sexual orientation or gender identity, and criminal records. We handle sensitive information with a higher level of protection and will only collect, use or disclose it where permitted under the Privacy Act.

2. Personal Information We Collect

The type of personal information we collect depends on the service being provided. It may include:

• Candidates and placed workers: name, contact details, date of birth, employment history, qualifications, referee details, immigration and work rights documentation, bank and tax details, and in some cases health information relevant to a placement.
• Clients and client personnel: name, contact details, role and organisational information, and personal information shared during the delivery of consulting, advisory or training engagements.
• Employees and contractors: name, contact details, emergency contact details, employment records, remuneration details, performance information, training records, and health information relevant to workplace safety obligations.
• Business contacts and website visitors: name, contact details, and any information submitted via our website, forms or correspondence.

We collect personal information directly from you wherever practicable. In some circumstances we may collect it from third parties such as referees, background check providers, government agencies, or publicly available sources. Where we collect your information from a third party, we will take reasonable steps to notify you of that collection where required by law.

3. How We Use Personal Information

We collect and use personal information only for the purposes for which it was collected, or for directly related secondary purposes that you would reasonably expect. These include: Where we use personal information in any automated decision-making process that could significantly affect you, we will be transparent about that use consistent with the transparency requirements being phased in under the Privacy Act 1988 (Cth).

• providing talent, recruitment and placement services;
• delivering change management, customer experience, training and coaching services;
• managing employment and contractor relationships;
• complying with legal and regulatory obligations, including workplace safety and modern slavery obligations;
• corresponding with clients, candidates and business contacts;
• marketing our services (with a right to opt out at any time); and
• improving our services and internal operations.

We will not use personal information for a purpose unrelated to the original collection without first seeking your consent, unless required or authorised by law.

4. Disclosure of Personal Information

We may disclose personal information to third parties in the following circumstances:

• Prospective host employers and clients, for the purposes of placing candidates in roles.
• Third-party service providers who assist us in delivering our services, such as payroll processors, psychometric testing providers, background screening providers, and IT service providers. These parties are required to handle personal information in accordance with the Privacy Act.
• Referees nominated by candidates or employees.
• Government agencies, law enforcement bodies, and regulators where required or authorised by law.
• Professional advisors including legal counsel and insurers, where necessary.

We may disclose personal information to recipients outside Australia in connection with providing our services. Recipient locations may include countries in the Asia-Pacific, Europe, the United Kingdom, or the Americas. Before disclosing personal information overseas, we take reasonable steps to ensure the recipient handles the information in a manner consistent with the APPs, in accordance with our obligations under Australian Privacy Principle 8 (cross-border disclosure of personal information).

5. Data Quality

We take reasonable steps to ensure that the personal information we hold is accurate, up to date, complete, relevant and not misleading. If you believe your personal information is inaccurate or incomplete, please contact us using the details at section 10 and we will take reasonable steps to correct it.

6. Storage and Security

We take reasonable steps to protect personal information from misuse, loss, unauthorised access, modification and disclosure. Measures include physical security controls, password-protected systems, role-based access controls, encrypted file transfers, and staff training on data handling obligations.

Personal information may be stored in hard copy or electronically on our systems or those of our authorised service providers. We retain personal information only for as long as necessary to fulfil the purpose for which it was collected, or as required by law. When personal information is no longer required, it is destroyed or de-identified in a secure manner. Client files and employment records are generally retained for a minimum of seven years.

In the event of a data breach, we will respond in accordance with our Data Breach Notification Plan and our Cyber Security Policy, including notifying affected individuals and the OAIC where required under the NDB scheme.

7. Cookies and Website

When you visit our websites at www.exceedglobal.com or www.isabellavillani.com, we may collect non-personal aggregate information about your visit, such as pages accessed and services viewed. This information is used anonymously to improve our website.

Our website may contain links to third-party websites. We are not responsible for the privacy practices of those sites and encourage you to review their privacy policies separately.

Personal information submitted via online forms or email is treated in the same manner as personal information collected through other means.

8. Access and Correction

You have the right to request access to the personal information we hold about you and to request correction of that information. To make a request, contact us in writing using the details at section 10. We will respond within a reasonable time and at no charge for the access request itself, though we may apply an administrative fee for providing copies.

We may decline access in limited circumstances permitted under the Privacy Act, such as where access would unreasonably impact the privacy of another individual. Where we decline access, we will provide written reasons.

9. Complaints

If you have a complaint about how we have handled your personal information, please contact us in writing using the details at section 10. We will acknowledge your complaint promptly and aim to resolve it within 30 days. If we determine that a breach of privacy has occurred, we will take appropriate steps to rectify it and keep you informed.

If you are not satisfied with our response, you may lodge a complaint with the OAIC at www.oaic.gov.au or by telephone on 1300 363 992, or in Victoria with the Office of the Victorian Information Commissioner (OVIC) at www.ovic.vic.gov.au.

10. Contact Us

For any queries, access requests, correction requests or complaints relating to this policy, please contact:

Exceed Global Pty Ltd
Level 14, 330 Collins Street, Melbourne VIC 3000
Email: team@exceedglobal.com
Phone: 1300 44 88 88
Website: www.exceedglobal.com

11. Policy Updates

This policy may be updated from time to time to reflect changes in our practices or legal obligations. The current version will always be available on our website and upon request. We encourage you to review this policy periodically. This policy is version 3, issued in June 2026 following a review for legislative currency and to reflect the current reporting structure (Executive Chair and CEO). The next scheduled review is June 2027.