SkillsNest Privacy Policy
1. Overview and Our Commitment
SkillsNest Pty Ltd (‘SkillsNest’, ‘we’, ‘us’, ‘our’) sources and supplies skilled workers — including overseas sponsored workers — for Australian employers, predominantly in regional Australia. In doing so, we collect and handle personal information that is often highly sensitive: passport and identity details, qualifications and work history, visa and migration status, and in some cases health information relevant to roles in aged care, disability and NDIS services.
This Privacy Policy explains what personal information we collect, why we collect it, how we use, store, and disclose it (including overseas), and the rights you have over your own information. It applies to candidates, employer clients, website visitors, job applicants to SkillsNest itself, and anyone else whose personal information we handle.
Our commitment, in one paragraph
We handle personal information in accordance with the Privacy Act 1988 (Cth) and the 13 Australian Privacy Principles (APPs) set out in Schedule 1 to that Act. We apply the APPs as a matter of policy and good practice, regardless of whether SkillsNest’s annual turnover currently places it within the small business exemption in section 6D of the Privacy Act. We do not believe the people whose data we hold — many of whom are relocating across the world for work — should receive a lower standard of privacy protection because of our company’s size.
1.1 Who this Policy covers
- Candidates: individuals who register with SkillsNest, or whose details we hold, in connection with sourcing, sponsorship support, or pre-arrival and settlement services.
- Employer clients: Australian businesses engaging SkillsNest, and the individuals at those businesses (contact persons, decision-makers) whose business contact details we hold.
- Website visitors: anyone browsing www.skillsnest.com.au, whether or not they register or make an enquiry.
- Job applicants to SkillsNest: individuals applying to work at SkillsNest itself, as distinct from candidates SkillsNest places with employer clients.
- Partners and suppliers: contact details of individuals at overseas sourcing partners, RTOs, and other suppliers, held for the purpose of the business relationship.
2. What Personal Information We Collect
2.1 Personal information we collect from candidates
Category | Examples |
Identity information | Full name, date of birth, gender, nationality, passport details, photographs, other government-issued identity documents. |
Contact information | Address, email, phone number, emergency contact details. |
Employment and qualification information | CV/resume, work history, references, qualifications, transcripts, skills assessment results, professional registration details (e.g. AHPRA, trade licences), English-language test results. |
Migration information | Visa status, visa application details, sponsorship and nomination information, immigration history, where shared by the candidate or, with consent, by an engaged Registered Migration Agent. |
Financial information | Bank account details for the purpose of fee refunds, payment records relating to Services under the Candidate Services Agreement. We do not collect or store full payment card numbers (see Section 6.4). |
Communications | Records of emails, calls, messages, and meeting notes between the candidate and SkillsNest. |
2.2 Sensitive information
Some of the information we collect is ‘sensitive information’ under the Privacy Act, which receives a higher standard of protection. This may include:
- Health information — relevant to placements in aged care, disability, NDIS, and similar roles, including pre-employment medical or vaccination records where required by the employer or by law
- Criminal record information — including police clearances, Working with Children Checks, and NDIS Worker Screening, where required for a particular role
- Racial or ethnic origin, or religious belief — only where voluntarily disclosed by the candidate, or where directly relevant to a documented, lawful occupational requirement
We only collect sensitive information with your consent
Under Australian Privacy Principle 3, we collect sensitive information only with your express consent, and only where it is reasonably necessary for a specific purpose we have explained to you — most commonly, meeting a screening or registration requirement of a particular role or employer (for example, NDIS Worker Screening for a disability-support role). We do not collect sensitive information as a default part of registration.
2.3 Personal information we collect from employer clients
Business contact details (name, role, email, phone) of individuals at employer clients; details of the roles an employer wishes to fill; and, in the course of an engagement, information the employer shares about a placed worker’s employment (for compliance and post-placement support purposes only).
2.4 Personal information we collect from website visitors
When you visit our website, we may collect technical information including your IP address, browser type, device information, pages visited, and referring website, typically through cookies and similar technologies. We do not use this information to identify you personally except where you have also submitted an enquiry or registration form. See Section 9 for our approach to cookies and tracking.
2.5 Personal information we collect from third parties
We sometimes collect personal information about a candidate from sources other than the candidate directly, including:
- Overseas sourcing partners, where the candidate has consented to that partner sharing their details with SkillsNest
- Referees nominated by the candidate
- Registered Migration Agents, RTOs, or skills-assessment authorities engaged in connection with the candidate’s application, where the candidate has authorised that information sharing
- Publicly available sources, such as LinkedIn or professional registration databases, where reasonably necessary to verify a candidate’s stated qualifications
2.6 What happens if you don't provide information we request
Where we ask for personal information, we will tell you whether providing it is mandatory or optional, and the consequence if you choose not to provide it. In general, if you do not provide the information reasonably necessary to assess your candidacy for a role or to deliver a Service you have requested, we may not be able to process your registration, present you to an employer, or provide that Service.
3. Why We Collect, Hold, and Use Personal Information
We collect, hold, and use personal information only for purposes connected with our functions and activities as a sourcing and workforce-services business, and for directly related secondary purposes you would reasonably expect. These purposes include:
Purpose | Examples |
Assessing and presenting candidates | Matching candidates to suitable roles; preparing and presenting candidate profiles to employer clients (with consent); conducting reference and qualification checks. |
Delivering Services under the Candidate Services Agreement | Career coaching, pre-arrival relocation and credentialing support, settlement support, as described in that Agreement. |
Supporting (not providing) migration processes | Coordinating with independently engaged Registered Migration Agents, where the candidate or employer has authorised SkillsNest to share relevant information with that RMA. SkillsNest itself does not give migration advice — see our website disclosure on this point. |
Compliance and risk management | Verifying identity and right-to-work status; conducting due diligence consistent with our Ethical Recruitment Policy and Anti-Bribery and Corruption Policy; investigating and responding to complaints. |
Communicating with you | Sending role-match alerts, service updates, invoices and receipts, and responding to enquiries. |
Legal and regulatory obligations | Retaining records as required by tax law, the Migration Act 1958 (Cth), and other applicable law; responding to lawful requests from regulators. |
Improving our services | Understanding how our website and services are used, in aggregated or de-identified form wherever practicable. |
3.1 We do not use your information for unrelated marketing without consent
We do not use a candidate’s personal information to market unrelated third-party products or services, and we do not sell personal information to data brokers or advertisers. Where we send role-match alerts or service-related communications, you can opt out at any time (Section 8.4).
4. Automated Processing and AI Tools
We use technology, including AI-assisted tools, to support parts of our work — for example, helping match a candidate’s stated skills and qualifications against occupations on the Core Skills Occupation List, or drafting first-pass communications for staff review. This section explains how we use these tools and the limits we place on them.
4.1 What we use AI for
- Matching candidate qualifications and experience against relevant occupation classifications, to help identify suitable roles for human review
- Drafting first-pass candidate communications, role descriptions, or compliance documentation, which is always reviewed by a staff member before being sent or relied upon
- General website and operational analytics
4.2 What we do not use AI for
Limits on automated decision-making
We do not use AI or any other automated tool to make a final decision, without meaningful human review, about whether to present a candidate to an employer, whether to decline a candidate’s registration, or any matter materially affecting a candidate’s prospects.
We do not use AI to screen candidates by reference to a protected attribute (race, sex, age, disability, and similar), consistent with our Ethical Recruitment Policy’s non-discrimination commitment.
We do not input personally identifiable candidate documents (passports, qualification certificates, health information) into general-purpose, consumer-grade AI tools. Where AI tools are used in connection with candidate data, we use enterprise services with contractual terms confirming the data is not used to train the provider’s models.
4.3 Future automated decision-making transparency
From December 2026, amendments to the Privacy Act 1988 (Cth) will require entities to provide meaningful information, in their privacy policy, about automated decision-making that could reasonably be expected to significantly affect an individual’s rights or interests. We will update this Policy ahead of that date to reflect our specific automated decision-making practices in more detail, and we describe our current position above in anticipation of that requirement.
5. Who We Disclose Personal Information To
5.1 Employer clients
We disclose candidate information to prospective employer clients only with the candidate’s consent — typically, when the candidate agrees to be presented for a specific role. We do not disclose a candidate’s full profile to multiple employers simultaneously without the candidate’s knowledge.
5.2 Registered Migration Agents
Where a candidate or employer has authorised it, we share relevant information with an independently engaged Registered Migration Agent for the purpose of that RMA providing immigration advice. The RMA is independently responsible for its own handling of that information under its own professional and privacy obligations.
5.3 Overseas sourcing partners
Where a candidate was sourced through, or is being supported by, an overseas sourcing partner, we share information with that partner to the extent necessary to coordinate the candidate’s engagement. Our partner contracts require the partner to apply privacy and security standards no lower than the Australian Privacy Principles, restrict onward transfer, and require deletion of the candidate’s data at the end of the engagement (see Section 7).
5.4 Service providers
We engage third-party service providers to support our operations, including:
- Cloud hosting and case-management / CRM software providers
- Payment processing providers
- Email and communications platforms
- Accounting and bookkeeping services
These providers are contractually required to protect personal information consistent with this Policy and to use it only for the purpose of providing services to SkillsNest.
5.5 Skills assessment authorities, training providers, and test bodies
Where a candidate engages SkillsNest’s pre-arrival support services, we may, with consent, share information with the relevant skills assessment authority (e.g. TRA, VETASSESS, ANMAC, EA, ACS, AHPRA, ACECQA), English-language test provider, or RTO, for the purpose of supporting that application or enrolment.
5.6 Government and regulatory bodies
We may disclose personal information to government bodies — including the Department of Home Affairs, the Australian Border Force, the Fair Work Ombudsman, the Office of the Migration Agents Registration Authority (OMARA), or a relevant state labour-hire licensing authority — where required or authorised by law, or where the individual has consented.
5.7 We do not sell personal information
We do not sell, rent, or trade personal information to third parties for their own marketing purposes, under any circumstances.
6. How We Store and Protect Personal Information
6.1 Where information is stored
Personal information is stored in encrypted, access-controlled cloud systems. Some of our service providers may store or process data outside Australia (see Section 7, Overseas Disclosure).
6.2 Security measures
- Access to personal information is restricted to staff and contractors who need it to perform their role
- Multi-factor authentication is required for systems holding candidate and employer data
- Data is encrypted in transit and at rest
- Staff and contractors with access to personal information receive privacy and security training, consistent with our Ethical Recruitment Policy and Anti-Bribery and Corruption Policy
- We maintain a Data Breach Response Plan, consistent with the Notifiable Data Breaches scheme under Part IIIC of the Privacy Act 1988 (Cth)
6.3 Data breach notification
If we experience a data breach that is likely to result in serious harm to an individual whose personal information is involved, we will notify the Office of the Australian Information Commissioner (OAIC) and affected individuals as required by the Notifiable Data Breaches scheme, and take reasonable steps to mitigate the harm.
6.4 Payment information
We do not store full payment card numbers. Payments are processed through PCI-DSS-compliant third-party payment processors, and we retain only the transaction reference and last four digits of a card where necessary for reconciliation and refund purposes.
6.5 Document handling — identity and qualification documents
Consistent with our Ethical Recruitment Policy, we do not retain a candidate’s original passport, identity documents, or original qualification certificates. Where copies are required, copies are securely stored and the originals are returned to the candidate.
7. Overseas Disclosure of Personal Information
Because SkillsNest sources candidates internationally and engages overseas partners, personal information is sometimes disclosed to recipients outside Australia. Australian Privacy Principle 8 requires us to take reasonable steps to ensure an overseas recipient does not breach the APPs in relation to that information, and we explain how we do this below.
7.1 Likely overseas recipients
Recipient | Likely location | Purpose |
Overseas sourcing partners | Philippines, India | Candidate sourcing and pre-screening coordination. |
Cloud hosting / software providers | May process or store data in the United States, Singapore, or other jurisdictions depending on the provider’s infrastructure | Case management, email, and CRM systems. |
Offshore back-office subcontractors | Philippines, India | Where SkillsNest facilitates an offshore back-office placement, limited information necessary to establish that placement. |
7.2 Steps we take before disclosing overseas
- We require, by contract, that overseas sourcing partners apply privacy and security standards no lower than the Australian Privacy Principles
- We restrict onward transfer of personal information by overseas partners without our consent
- We require contracted deletion of candidate data by overseas partners at the end of the relevant engagement
- Where practicable, we select cloud and software providers with recognised security certifications and data-processing agreements consistent with Australian and comparable international standards
Important — consent to overseas disclosure
By registering with SkillsNest as a candidate sourced through, or supported by, an overseas partner, or by using cloud-based services that may process data outside Australia, you consent to the overseas disclosure of your personal information for the purposes described in this Policy. If you do not consent, please contact us before registering so we can discuss alternative arrangements where practicable.
8. Your Rights
8.1 Access
You may request access to the personal information we hold about you. We will respond within a reasonable period (we aim for 30 days) and will provide access unless an exception applies (for example, where giving access would have an unreasonable impact on another person’s privacy, or where access is restricted by law). If we refuse access, we will explain why and, where reasonable, identify alternative means of access.
8.2 Correction
You may ask us to correct personal information you believe is inaccurate, out of date, incomplete, irrelevant, or misleading. We will take reasonable steps to correct it, or, where we disagree, will add a statement to the information noting your view.
8.3 Deletion
You may ask us to delete personal information we hold about you. We will action this request unless we are required to retain the information by law (for example, tax or migration-related record-keeping obligations — see Section 10), or unless retention is necessary for an ongoing legitimate purpose we will explain to you.
8.4 Opting out of communications
You can opt out of role-match alerts, newsletters, or other non-essential communications at any time, using the unsubscribe link in any email or by contacting us directly. We will still need to send essential service communications (for example, confirming a payment or a scheduled appointment) for as long as you have an active engagement with us.
8.5 Withdrawing consent
Where we rely on your consent to collect or use particular information (for example, sensitive information, or disclosure to an overseas partner), you may withdraw that consent at any time. Withdrawing consent may affect our ability to continue providing certain Services, and we will explain any such effect before you decide.
8.6 How to exercise these rights
Contact us using the details in Section 13. We may need to verify your identity before actioning a request, and there is no charge for making a request, though we may charge a reasonable amount for the cost of providing access in some circumstances, as permitted by APP 12.
9. Cookies and Website Tracking
9.1 What we use
Our website may use cookies and similar technologies for: essential site functionality (for example, keeping you logged in to a candidate portal); analytics, to understand how visitors use the site; and, where used, marketing or remarketing pixels for our own advertising — never for selling your data to third parties.
9.2 Your choices
Most browsers allow you to block or delete cookies. Doing so may affect some website functionality, including candidate portal log-in. Where we use a cookie consent banner, we present genuine choices (accept, decline non-essential, or manage preferences) and do not use pre-ticked boxes or dark patterns to obtain consent, consistent with the direction of current Australian privacy reform.
9.3 Third-party analytics and advertising tools
Where we use third-party analytics or advertising tools (for example, website analytics or social media pixels), those providers may collect technical information under their own privacy policies. We select providers with reasonable privacy and security standards and do not knowingly permit them to re-identify individuals from data shared for analytics purposes.
10. How Long We Keep Personal Information
We keep personal information only for as long as it is needed for the purpose it was collected, or as required by law. Indicative retention periods are set out below; specific circumstances may require longer or shorter retention, which we will explain on request.
Category | Typical retention | Basis |
Candidate registration and engagement records (where a Service was delivered) | 7 years from last engagement | Migration-related and tax record-keeping obligations; limitation periods for contractual claims. |
Candidate registration where no Service was ultimately delivered and the candidate is inactive | 2 years from last contact, then deleted or de-identified | No ongoing legal basis for further retention. |
Financial and tax records | 7 years | Taxation Administration Act 1953 (Cth) and related obligations. |
Website analytics (aggregated/de-identified) | Up to 26 months | Standard analytics retention; no individual identification. |
Complaint and grievance records | 7 years from resolution | Consistent with our Ethical Recruitment Policy and potential regulatory inquiry. |
Job applications to SkillsNest (unsuccessful) | 12 months, then deleted unless the applicant consents to longer retention for future opportunities | Reasonable period for potential future roles; otherwise no ongoing purpose. |
At the end of the applicable retention period, personal information is securely deleted or de-identified such that it can no longer reasonably be used to identify an individual.
11. Children's Privacy
SkillsNest’s services are directed at adults seeking employment opportunities and are not intended for use by children. We do not knowingly collect personal information from individuals under 18 years of age, except where a candidate’s accompanying dependent children are mentioned in the course of pre-arrival or settlement support (for example, schooling information), in which case only the minimum necessary information is collected and only with the parent or guardian’s involvement.
Ahead of the Children’s Online Privacy Code anticipated under recent Australian privacy reforms, we will review this section and update our practices as further guidance becomes available.
12. Complaints
12.1 How to make a complaint
If you believe we have breached the Australian Privacy Principles or mishandled your personal information, please contact us using the details in Section 13. We will acknowledge your complaint within 5 business days and aim to provide a substantive response within 30 days.
12.2 If you are not satisfied with our response
If you are not satisfied with how we have handled your complaint, you may lodge a complaint with the Office of the Australian Information Commissioner (OAIC):
- Website: www.oaic.gov.au
- Phone: 1300 363 992
- Post: GPO Box 5288, Sydney NSW 2001
A note on serious privacy harms
Since 10 June 2025, individuals in Australia have a statutory right to bring a civil claim for a serious invasion of privacy, including misuse of personal information, under the Privacy and Other Legislation Amendment Act 2024 (Cth). This is in addition to, not instead of, your right to complain to the OAIC. We take this seriously, and we would always rather resolve a concern directly and quickly than have it escalate to either avenue.
13. Contact Us
Privacy contact details
Email: info@skillsnest.com.au
Post: Privacy Officer, SkillsNest Pty Ltd, Level 3, 87 Marsden Street, Parramatta NSW 2150.
Phone: +61 2 7820 1919
We aim to acknowledge all privacy enquiries and requests within 5 business days.
14. Changes to This Policy
We may update this Privacy Policy from time to time, including to reflect changes in law (such as the automated decision-making transparency obligations commencing December 2026, and any further tranches of Privacy Act reform) or changes in our practices. The current version will always be available on our website, with the effective date stated on the cover page. Material changes will be highlighted on our website for a reasonable period following the update. This Policy does not retrospectively reduce the protections that applied to information collected before an update, except where required by law.
Plain-English summary
We collect what we need to help you find work or help an employer find staff — never more than that, and never sensitive information without asking first.
We never sell your information, and we don’t use it for unrelated advertising.
If your information goes overseas — to a sourcing partner, or because of where our software is hosted — we require that partner to protect it to the same standard as Australian law requires.
You can ask to see what we hold about you, ask us to fix it, or ask us to delete it, at any time.
If something goes wrong, you can complain to us directly, or to the Office of the Australian Information Commissioner.