Privacy Policy

1. About this Policy

Nguma Pty Ltd (ABN 36 695 423 851) (Nguma, we, us, or our) operates the Nguma platform (the Platform), an Australian-hosted, AI-assisted service that enables organisations to schedule, conduct, record, transcribe, and produce structured outputs from meetings and interviews. The Platform is purpose-built for use by Australian Government Agencies, recruitment agencies, and other organisations that need a defensible, auditable record of their meetings.

We are committed to protecting the privacy of everyone whose personal information we handle.

This Privacy Policy explains:

• what personal information and sensitive information we collect, and why;
• how we collect, use, store, and disclose that information;
• how we use AI and automated processing in our services, and what that means for you;
• your rights to access, correct, and complain about the handling of your information; and
• how to contact our Privacy Officer.

This Policy covers two distinct contexts: our website at nguma.au (the Website); and the Platform, which is used by organisations and the individuals who participate in their meetings (whether those meetings are job interviews, inquiries, investigations, panel proceedings, or other matters). Different provisions apply to each context and are identified throughout this Policy.

In this Policy, the organisation that has convened or is hosting a meeting on the Platform, or that has otherwise invited an individual to use the Platform, is called a Convening Organisation. Depending on the context, the Convening Organisation may be a Government Agency, a recruitment agency engaged on behalf of a Government Agency or other body, or another organisation.

We comply with the Privacy Act 1988 (Cth) (Privacy Act) and the Australian Privacy Principles (APPs). We also comply with applicable privacy legislation in each Australian State and Territory in which we operate.

2. Who this Policy applies to

This Policy applies to all individuals whose personal information we handle. These individuals fall into the following categories:

If you use our Website only, sections 3(a), 4(a), 5, 8, 10, 11, 12, 13, and 14 are likely to be the most relevant to you. If you are a Meeting Participant, a Convening Organisation User, or an Administrator, the entire Policy may apply.

3. What information we collect

(a) Website Users

When you use our Website, we may collect:

• your name, email address, phone number, and the type of organisation you represent;
• any message, enquiry, or other information you choose to send us through the Website contact form; and
• technical information such as your IP address, browser type, device information, and pages visited, collected through cookies and analytics tools as described in section 5.

We use the Website contact form for general business enquiries. Please do not submit sensitive information through the Website unless it is reasonably necessary for your enquiry.

(b) Meeting Participants

When you participate in a meeting conducted through the Platform, we may collect:

• your name, contact details, and any other information provided to us by the Convening Organisation;
• audio recordings of the meeting (and, where applicable, video), which are transcribed using AI;
• written responses, notes, and other content generated during the meeting;
• AI-generated transcripts, summaries, audit-trail records, and other structured outputs produced from your participation in the meeting; and
• any personal information or sensitive information you disclose during the course of the meeting.

Meetings may involve the disclosure of sensitive information, such as information about your racial or ethnic origin, cultural background, religious or philosophical beliefs, political opinions, membership of a professional or trade association or trade union, sexual orientation, or criminal record. We treat such information as sensitive information under the Privacy Act and handle it with additional care.

(c) Convening Organisation Users

When you access the Platform as a Convening Organisation User, we may collect:

• your name, work email address, and other contact details;
• your organisation, organisational unit, role, and account details; and
• your activity on the Platform, including assessments, sign-offs, audit actions, and related usage records.

(d) Administrators

We collect names, contact details, role details, and access credentials for Nguma personnel and contractors who administer or support the Platform.

4. How we collect your information

(a) Website

We collect information you provide directly when you submit an enquiry through our Website contact form or otherwise contact us through the Website.

We also collect technical information automatically through cookies and analytics tools. See section 5 for further information.

Website enquiry information is handled through our business communications systems, including Microsoft 365. As a result, limited Website enquiry data may be processed or stored outside Australia. This applies to Website enquiry data only, not Platform data.

(b) Platform

We collect personal information used in connection with the Platform through the following means:

• from Convening Organisation systems, such as an applicant tracking system, case-management system, or other recruitment or meeting-management system;
• from emails and attachments provided by a Convening Organisation;
• through the upload of documents, including CVs, briefs, and related records, into the Platform;
• through information entered directly into the Platform by Meeting Participants, Convening Organisation Users, or Administrators;
• through audio recordings (and, where applicable, video) and the transcripts and outputs generated from those recordings; and
• through user activity, system access, and audit events recorded on the Platform.

5. Cookies and Website analytics

Our Website uses cookies and similar technologies to support its operation, maintain security, and improve user experience. We may use the following types of cookies:

• Essential cookies, which are necessary for core Website functionality;
• Performance and analytics cookies, which help us understand Website traffic, usage patterns, and performance; and
• Preference cookies, which remember user selections and improve usability.

Cookies may be retained for up to 90 days, depending on their purpose and configuration. You can manage or disable cookies through your browser settings, although doing so may affect Website functionality. We do not use marketing cookies on our Website.

6. How we use AI and automated processing

What our AI does

Our Platform uses AI to transcribe audio (and, where applicable, video) recordings of meetings into text; extract key information from meeting content; and generate draft transcripts, summaries, audit-trail records, and other structured outputs aligned to the purpose for which the meeting was convened.

What our AI does not do

Nguma does not make decisions about Meeting Participants, employment outcomes, or any other matter affecting an individual. Nguma’s AI does not make, recommend, or influence any hiring decision, shortlisting decision, merit assessment, employment outcome, or other decision affecting an individual. Every AI-generated output is a documentation aid only, produced solely to assist authorised human users in preparing and recording an accurate account of the meeting. No AI-generated output is acted on, relied on, or used as part of any decision unless and until it has been reviewed, verified, and signed off by an authorised human user.

No automated decisions

Nguma does not make automated decisions through the Platform. No Meeting Participant is assessed, scored, ranked, shortlisted, progressed, or excluded by AI at any point in any process conducted through the Platform.

AI inference, model training, and data sovereignty

All AI inference processing occurs on infrastructure located within Australia. Personal information processed through our AI workflow does not leave Australia as part of our AI inference pipeline. We do not use your personal information to train, fine-tune, or otherwise improve any general-purpose AI or machine-learning model, and we do not permit our AI service providers to do so. This prohibition is reflected in our contractual arrangements with Convening Organisations and with our service providers.

7. Why we collect and how we use your information

We collect and use personal information only for the purposes for which it was obtained, for directly related purposes where permitted by law, with consent where required, or as otherwise authorised or required by law.

For Website Users

We collect and use Website enquiry information to respond to enquiries submitted through our Website; communicate with you about your enquiry; administer and improve our Website; and maintain Website security and performance.

For Platform-related activities

In relation to meetings conducted through the Platform, Nguma collects and handles personal information on behalf of the relevant Convening Organisation to provide the Platform and related services, including: AI-assisted scribing and transcription; creation of draft transcripts, summaries, audit-trail records, and other outputs; maintenance of audit trails and compliance records; user authentication, access controls, and account administration; and system operation, support, monitoring, and troubleshooting.

8. Data sovereignty and storage

Platform data

All personal information processed through the Platform is stored on infrastructure located within Australia. Nguma uses Cloudflare as its primary hosting and edge-services provider for the Platform. We do not intentionally transfer Platform data offshore.

Website enquiry data

Personal information submitted through our Website contact form is handled through our business communications systems, including Microsoft 365. Depending on the configuration of those services and the location of provider infrastructure, Website enquiry data may be processed or stored outside Australia. This applies to Website enquiry data only — it does not apply to personal information processed through the Platform.

Where Website enquiry data is disclosed to, or handled by, an overseas recipient, we take reasonable steps to ensure that recipient handles the information in a manner consistent with the Australian Privacy Principles, including through contractual controls and vendor due diligence.

9. Disclosure of your information

We disclose personal information only in the following circumstances.

9.1 To the Convening Organisation

Where Nguma provides Platform services for a Convening Organisation, personal information collected or generated through the relevant meeting may be disclosed to that Convening Organisation for the purpose of administering, assessing, documenting, and finalising the matter for which the meeting was convened. This may include audio recordings, video recordings, transcripts, notes, responses, AI-generated draft summaries or reports, panel comments, assessment records, audit-trail records, and related documentation.

9.2 To technology and service providers

We engage third-party providers to operate, support, secure, and maintain the Platform and our business systems. These providers process personal information on our behalf only, under contractual terms that require them to handle it in accordance with applicable privacy obligations and prohibit any use beyond what is necessary to provide the relevant service to us.

9.3 In connection with a business sale or change of control

If Nguma is sold, merged with another entity, or undergoes a change of control, personal information held by Nguma may be transferred to the successor entity as part of that transaction. We will take reasonable steps to ensure any successor is bound by privacy obligations materially consistent with this Policy, and we will notify affected individuals where required by law.

9.4 As required or authorised by law

We may disclose personal information where required or authorised by law, including in response to a court order, law enforcement request, regulatory requirement, or other legal obligation. We will disclose only the information reasonably necessary to satisfy that requirement.

9.5 With consent

We may disclose personal information in any other circumstance with the express consent of the individual to whom it relates, for the specific purpose for which consent was given. We do not sell personal information to third parties. We do not use personal information for advertising or marketing profiling.

10. Security

We take reasonable technical, organisational, and administrative steps to protect personal information from misuse, interference, and loss, and from unauthorised access, modification, or disclosure. Our security measures include:

• storage of Platform data on Australian infrastructure hosted by Cloudflare;
• encryption of personal information in transit (TLS 1.2 or higher) and at rest (AES-256 or equivalent);
• multi-factor authentication for administrative and privileged access;
• role-based and least-privilege access controls;
• audit logging, monitoring, and access traceability for actions performed on Platform data;
• regular security reviews, vulnerability management, and risk assessments, including independent penetration testing at least annually;
• information security and AI management practices designed to align with ISO/IEC 27001, ISO/IEC 42001, and the Australian Cyber Security Centre Essential Eight at Maturity Level 2; and
• retention, destruction, and de-identification processes operated in accordance with section 11.

If a security incident constitutes an eligible data breach under the Privacy Act, we will notify the Office of the Australian Information Commissioner and affected individuals in accordance with the Notifiable Data Breaches scheme. We will also notify the relevant Convening Organisation of any eligible data breach affecting Platform data within 48 hours of becoming aware.

11. Retention and destruction

We retain personal information for the period directed by the relevant Convening Organisation, or for the period the Convening Organisation is required to retain it by law, whichever is the longer period. Nguma operates as a system of record for Convening Organisations and does not apply a fixed Nguma-imposed retention period to Platform data.

For Website enquiry data, we retain enquiry information for up to 12 months from the date of enquiry, unless a longer period is reasonably needed to respond to or resolve the matter. For Platform account data, we retain account information for the duration of the relevant engagement and for up to seven years afterwards where reasonably required for audit, security, legal, records-management, or service-administration purposes.

12. Your rights

Access

You may request access to the personal information we hold about you in accordance with APP 12. We will respond to access requests within a reasonable period and generally within 30 days. We may charge a reasonable fee for providing access where permitted by law.

Correction

If you believe personal information we hold about you is inaccurate, incomplete, out of date, irrelevant, or misleading, you may ask us to correct it in accordance with APP 13. We will respond within a reasonable period and generally within 30 days.

AI transparency

From the effective date of this Policy, you may request information about how AI was used in a meeting in which you participated, including the role of AI-generated outputs in creating the documented record of the meeting. Nguma does not use AI to assess, score, rank, shortlist, progress, or exclude individuals, and does not make automated decisions about employment outcomes or any other matter affecting an individual. Requests should be directed to our Privacy Officer.

Complaints

If you have a complaint about the way we have handled your personal information, please contact our Privacy Officer. We will acknowledge your complaint within five Business Days and aim to respond substantively within 30 days. If you are not satisfied with our response, you may refer the matter to the Office of the Australian Information Commissioner (OAIC) at www.oaic.gov.au or by calling 1300 363 992.

13. Changes to this Policy

We may update this Policy from time to time to reflect changes to our services, technology, legal obligations, or operational practices. When we do, we will update the version number and effective date at the top of this document and publish the revised Policy on our Website. Where a change is material, we will take reasonable steps to notify affected individuals directly or by other appropriate means where required by law.

14. How to contact us

For any privacy enquiry, access request, correction request, AI transparency request, or complaint, please contact our Privacy Officer:

Privacy Officer
Email: [email protected]
Address: Suite 11, 450 Elizabeth Street, Surry Hills NSW 2010
Phone: 1300 423 678