Privacy and Cookie Notice

Part A — Privacy Notice

1Who we are and what this Notice covers

1.1 SkillsNest Pty Ltd (SkillsNest, we, us, our) is an Australian company that helps organisations use artificial intelligence (AI). We provide AI training (AI Academy), consulting and advisory, AI Agency / Factory build services, Global Capability Centre services, technology and platform integration, and solutions including AI Agentic Automations, Marketeer, Listn, Accounts Receivable, Tele-Health for Clinics and Smart Facility Management. We also run an online store at www.skillsnest.store.

1.2 This Notice explains how we collect, hold, use and disclose personal information when:

1. (a) you visit or use our Websites, online store, chat or AI assistants, forms and accounts;
2. (b) you contact us, book a meeting, attend an event, webinar or course, or subscribe to updates;
3. (c) you or your organisation buy from us, or receive or evaluate our Services; and
4. (d) you are a supplier, partner or business contact.

1.3 When we act for our clients. When we provide Services, we often handle personal information on behalf of a client organisation (for example, a clinic's patients, a business's customers or debtors, or an organisation's staff). In that case the client decides why and how that information is used, and the client's own privacy policy applies. We handle it under our contract with the client, including our Data Processing Agreement. If you have a question about information we hold for a client, please contact that client first. We will help them respond.

1.4 Job applicants are covered by our separate Candidate Collection Notice.

1.5 Our global team. We deliver Services through SkillsNest staff, related entities, partners and contractors in Australia and other countries, including India, the Philippines, Vietnam, countries in Europe and the United States. Section 9 explains how we protect personal information sent to or accessed from those countries.

1.6 Which laws apply. We comply with the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs), and the health privacy laws of Australian states and territories where they apply to us. Where other laws apply to our handling of your personal information, such as the EU or UK General Data Protection Regulation, India's Digital Personal Data Protection Act 2023, or US state privacy laws, we also comply with them. Part C sets out extra information for people in particular regions.

2Personal information we collect

2.1 Personal information is information or an opinion about an identified individual, or an individual who is reasonably identifiable. The kinds we collect depend on how you deal with us and may include:

Category	Examples
Identity and contact details	Name, job title, organisation, email, phone, WhatsApp number, postal and billing address
Account details	Username, password (stored in protected form), preferences and settings
Enquiry and communication records	Messages, enquiry forms, emails, chat transcripts, meeting notes, call recordings and transcripts where we tell you a call is recorded
AI assistant and voice agent interactions	Prompts, questions, uploaded files, voice recordings and transcripts, and the AI output generated for you
Transaction details	Orders, invoices, payment status and history. Card details are handled by our payment providers
Event, course and training records	Registrations, attendance, assessments, certificates and feedback
Marketing preferences	Subscriptions, consents, opt-outs and how you engage with our emails
Technical and usage data	IP address, device and browser type, pages viewed, referring site, approximate location, cookie identifiers and log data
Business contact data	Details of client, supplier and partner staff we deal with
Information from public sources	Business profiles, such as company websites or professional networking sites, and public registers

2.2 Sensitive information. We do not usually collect sensitive information (such as health information, racial or ethnic origin, religious beliefs, sexual orientation, criminal record, or biometric information) about visitors to our Websites. We collect it only with your consent and where it is reasonably necessary, or where the law permits it. Where our Tele-Health, Accounts Receivable or other Services involve sensitive information, we handle it for our clients under clause 1.3 and extra security controls apply.

2.3 Government identifiers. We do not adopt government identifiers (such as a Tax File Number, Medicare number or passport number) as our own identifier for you. We collect them only where the law requires it or a Service needs it, for example identity verification, and we protect them accordingly.

2.4 Anonymity. You can browse the Websites and ask general questions without identifying yourself. You can also use a pseudonym where that is practical. We may need your name and contact details to answer an enquiry, provide Services or process an order.

3How we collect personal information

3.1 We collect personal information directly from you when you fill in a form, contact us, create an account, place an order, attend an event or course, use an AI assistant, or deal with us in the course of business.

3.2 We also collect it automatically through cookies and similar technologies (see Part B), and from third parties such as your employer or organisation, our partners and resellers, event co-hosts, booking and payment providers, social media platforms when you interact with our pages, and public sources.

3.3 If we receive personal information we did not ask for, we check whether we could have collected it lawfully. If not, we destroy or de-identify it where lawful and reasonable to do so.

3.4 If you give us personal information about someone else (for example, a colleague you invite to a workshop), please make sure they know you are doing so and have seen this Notice.

4Why we use personal information

4.1 We collect, hold, use and disclose personal information to:

1. (a) respond to enquiries, book meetings and provide quotes and proposals;
2. (b) provide, manage and support our Services, courses, events and online store, including delivery, invoicing and debt recovery;
3. (c) create and manage accounts, and verify identity;
4. (d) operate, secure and improve our Websites, AI assistants and Services, including by fixing errors and preventing fraud, misuse and security incidents;
5. (e) send service messages, such as order confirmations, security alerts and changes to terms;
6. (f) send marketing about our Services, events and insights, where permitted (see section 6);
7. (g) understand how people use our Websites and measure our marketing, using analytics (see Part B);
8. (h) manage our relationships with clients, suppliers and partners;
9. (i) comply with our legal obligations, respond to lawful requests from authorities, and establish, exercise or defend legal claims; and
10. (j) any other purpose we tell you about when we collect the information, or that is related to these purposes and that you would reasonably expect, or that is otherwise permitted by law.

4.2 If you do not give us the information we ask for, we may not be able to respond to you, provide Services or process your order.

5AI, automated processing and automated decisions

5.1 AI tools we use. We use AI tools, including AI models provided by third-party technology providers, to answer enquiries through chat and voice assistants, transcribe and summarise conversations, draft content, and support our staff in delivering Services. A person at SkillsNest reviews AI output before we rely on it for any significant purpose.

5.2 AI disclosure. When you interact with one of our AI assistants or voice agents, we tell you that you are dealing with an AI system.

5.3 No training of general models. We do not allow our AI technology providers to use your personal information to train or improve their general AI models. We choose provider settings and contract terms that prevent this. We may use de-identified or aggregated information to improve our own Services.

5.4 Automated decisions. From 10 December 2026, the Australian Privacy Act requires us to explain any use of computer programs to make, or substantially and directly help make, decisions that could significantly affect your rights or interests.

5.5 Where we build or run automated systems for a client (for example, enquiry triage, appointment booking or payment reminders), the client decides how those systems are used, and the client's privacy policy explains any automated decisions.

6Direct marketing

6.1 We may send you information about our Services, events and insights by email, SMS, WhatsApp, phone or post, where:

1. (a) you have consented, or the law allows us to infer consent (for example, an existing business relationship); and
2. (b) for electronic messages, we comply with the Spam Act 2003 (Cth). Each message identifies us and includes a working unsubscribe option.

6.2 We do not make telemarketing calls to numbers on the Australian Do Not Call Register unless the law allows it.

6.3 You can opt out at any time by using the unsubscribe link, replying STOP to an SMS, or contacting us. We act on opt-outs within 5 business days. We do not charge for opting out.

6.4 We do not sell your personal information. We do not give your personal information to other organisations for their own marketing.

7Who we disclose personal information to

7.1 We may disclose personal information to:

1. (a) our related entities and our staff, partners and contractors who help deliver Services, including our delivery teams in the countries listed in section 9;
2. (b) service providers that support our business, such as cloud hosting, website and e-commerce platforms, customer relationship management (CRM), email and messaging, telephony and voice, AI model providers, analytics, booking, payment, IT support and security services;
3. (c) your organisation, where you deal with us on its behalf;
4. (d) event and course co-hosts, venues and certification bodies, where relevant to your participation;
5. (e) professional advisers, such as lawyers, accountants, auditors and insurers;
6. (f) debt collection agencies, where an amount owed to us is overdue;
7. (g) government agencies, regulators, courts and law enforcement, where required or authorised by law;
8. (h) a buyer or potential buyer of all or part of our business, or a party to a merger or financing, under confidentiality obligations; and
9. (i) anyone else you authorise, or as otherwise permitted by law.

7.2 We require our service providers and delivery partners to protect personal information, to use it only for the work we give them and to comply with applicable privacy laws.

8How we protect personal information

8.1 We take reasonable steps to protect personal information from misuse, interference and loss, and from unauthorised access, modification or disclosure. Our measures include:

1. (a) access controls based on role and need-to-know, with multi-factor authentication;
2. (b) encryption of data in transit and, where supported, at rest;
3. (c) confidentiality and privacy obligations in staff, partner and contractor agreements, with training;
4. (d) security monitoring, logging, patching and backups;
5. (e) using masked or synthetic data to test AI solutions before connecting them to live systems, where practical; and
6. (f) assessing the security and privacy practices of key providers before we engage them.

8.2 Data breaches. If a data breach is likely to result in serious harm, we will notify affected individuals and the Office of the Australian Information Commissioner (OAIC) as required by the Notifiable Data Breaches scheme under Part IIIC of the Privacy Act. We will also meet breach notification duties under other laws that apply, such as the GDPR.

8.3 Retention. We keep personal information only for as long as we need it for the purposes in this Notice or to meet legal, tax, accounting and reporting obligations. Generally, we keep enquiry records for up to 2 years after our last contact, client and financial records for 7 years, and AI assistant transcripts for up to 12 months, unless a longer period is needed for a dispute or required by law. We then securely destroy or de-identify the information.

9Sending personal information overseas

9.1 We are based in Australia, but our team, partners and service providers work in several countries. Personal information may be stored in, accessed from or disclosed to recipients located in:

1. (a) India, the Philippines and Vietnam, where SkillsNest staff, related entities and delivery partners provide development, support, administration and operations services;
2. (b) the United States and countries in Europe (including the United Kingdom, Ireland, Germany), where team members and partners work and where many of our cloud, AI and software providers are based; and
3. (c) other countries where our cloud and software providers host data, including Indonesia, China, Japan and Singapore.

9.2 Before disclosing personal information to an overseas recipient, we take reasonable steps to ensure the recipient handles it consistently with the APPs. This includes binding contract terms on privacy, confidentiality and security, and limiting access to what is needed. Where we disclose personal information overseas, we remain accountable for its handling under the Privacy Act, except where an exception under APP 8 applies.

9.3 For information covered by the GDPR, we use the transfer safeguards described in Part C, such as the European Commission's standard contractual clauses.

10Accessing and correcting your personal information

10.1 You can ask for access to the personal information we hold about you, or ask us to correct it, by contacting our Privacy Officer. We may need to verify your identity first.

10.2 We will respond within a reasonable time, usually within 30 days. Access is free. We may charge a reasonable fee for the cost of giving access if the request is complex, and we will tell you about the fee first.

10.3 If we refuse access or correction, we will tell you why in writing (unless that would be unreasonable) and explain how to complain. If we refuse a correction, you may ask us to attach a statement to your information.

10.4 You can also ask us to delete personal information we no longer need. We will do so unless the law requires or allows us to keep it.

11Children

11.1 Our Websites and Services are designed for businesses and adults. They are not directed at children under 18, and we do not knowingly collect personal information from children under 18 through our Websites. If you believe we have collected a child's personal information, please contact us and we will delete it where appropriate.

11.2 Where a client's Service involves children's information (for example, an education or health client), we handle it for the client under clause 1.3 and will comply with the Children's Online Privacy Code once it takes effect, where it applies.

12Complaints

12.1 If you have a concern about how we handle your personal information, please contact our Privacy Officer in writing with details. We will acknowledge your complaint within 5 business days, investigate it, and give you a written response within 30 days.

12.2 If you are not satisfied with our response, you can complain to the Office of the Australian Information Commissioner (OAIC):

Website: www.oaic.gov.au

Phone: 1300 363 992

Post: GPO Box 5288, Sydney NSW 2001

12.3 If you are outside Australia, you can also complain to the privacy regulator in your country. Part C lists some of them.

13Changes to this Notice

13.1 We may update this Notice from time to time, for example to reflect new Services, new technology or changes in the law. We will publish the updated Notice on our Websites with a new effective date. If a change is significant, we will take reasonable steps to tell you, for example by email or a notice on our Websites. Previous versions are available on request.

14Contact us

Privacy Officer, SkillsNest Pty Ltd

Suite 37, 165–171 Hawkesbury Road, Westmead NSW 2145, Australia

Email: in**@************om.au (subject line: "Privacy")

Phone: +61 2 7820 1919 (02 7820 1919 within Australia)

Part B — Cookie Notice

15Cookies and similar technologies

15.1 Cookies are small files stored on your device when you visit a website. We also use similar technologies, such as pixels, tags, local storage and software development kits (together, cookies).

15.2 We use the following types of cookies:

Type	What it does	Consent needed?
Strictly necessary	Runs the Websites and online store: security, load balancing, sign-in, shopping cart, checkout and remembering your cookie choices	No. These are always on
Functional	Remembers preferences, such as language or region, and runs embedded features such as booking tools and chat	Yes, where required by law
Analytics	Helps us understand how visitors use the Websites so we can improve them, for example Google Analytics	Yes. Off until you agree
Marketing	Measures our advertising and shows relevant ads on other sites, for example Meta, Google and LinkedIn tags	Yes. Off until you agree

15.3 The cookies in use on skillsnest.com.au are listed below.

Cookie	Provider	Purpose	Typical duration
wordpress_logged_in_*, wordpress_sec_	SkillsNest (WordPress)	Keeps you signed in to the site and secure (website administrators and editors only)	Session, or up to 14 days if "remember me" is ticked
wp-settings-time-*	SkillsNest (WordPress)	Remembers display settings for signed-in users	Up to 1 year
apbct_antibot	CleanTalk (anti-spam)	Checks forms on this site for spam and bots	Session

15.4 Your choices. When you first visit, our cookie banner lets you accept or reject non-essential cookies. You can change your choice at any time using the "Cookie settings" link in the website footer. You can also block or delete cookies in your browser settings, but some parts of the Websites may not work properly if you do.

15.5 Privacy signals. We treat a Global Privacy Control (GPC) signal from your browser as a request to opt out of marketing cookies and any "sale" or "sharing" of personal information for targeted advertising, where the law requires it.

15.6 Emails. Our marketing emails may contain pixels that tell us whether an email was opened. You can block these by turning off automatic image loading in your email program.

15.7 Third-party tools. Some features, such as booking calendars, video players, payment pages, chat assistants and social media buttons, are provided by third parties who may set their own cookies. Their use is governed by their own privacy policies.

Part C — Additional information for people in particular regions

16European Economic Area, United Kingdom and Switzerland

16.1 This section applies when the EU General Data Protection Regulation (EU GDPR), the UK GDPR and Data Protection Act 2018, or the Swiss Federal Act on Data Protection (FADP) apply to our handling of your personal information. In this section, "personal data" has the same meaning as personal information.

16.2 Controller. SkillsNest Pty Ltd is the controller of personal data described in this Notice, except where we act for a client under clause 1.3, when we are a processor.

16.3 Representatives. We’re not aware if GDPR Artich 3(2) applies to Skillsnest, as the company does not service customers in that region at this stage.

16.4 Legal bases. We rely on the following legal bases:

Purpose (see section 4)

Legal basis

Respond to enquiries, provide Services and orders, manage accounts

Performance of a contract, or steps at your request before a contract

Operate, secure and improve the Websites and Services; prevent fraud

Legitimate interests in running a secure and effective business

Business-to-business relationship management

Legitimate interests in managing our client, supplier and partner relationships

Direct marketing by email or SMS

Consent, or legitimate interests where the law allows marketing to existing customers

Analytics and marketing cookies

Consent

Legal, tax and regulatory obligations

Compliance with a legal obligation

Legal claims

Legitimate interests in establishing, exercising or defending legal claims

16.5 Your rights. You have the right to access, correct, delete, restrict or object to processing of your personal data, to data portability, and to withdraw consent at any time (this does not affect processing before you withdraw). You can object at any time to direct marketing. We respond within one month, which may be extended by two months for complex requests.

16.6 International transfers. Australia does not currently have an adequacy decision from the European Commission. When we transfer personal data from the EEA, UK or Switzerland to Australia or other countries without adequate protection (including India, the Philippines, Vietnam and the United States), we use the European Commission's standard contractual clauses (with the UK Addendum or Swiss amendments where needed), or another lawful transfer mechanism, together with additional safeguards where required. You can ask us for a copy of the relevant safeguards.

16.7 Complaints. You can complain to the data protection authority where you live or work, or where an alleged breach happened. In the UK, this is the Information Commissioner's Office (ico.org.uk). In the EEA, see edpb.europa.eu for a list of authorities. In Switzerland, this is the Federal Data Protection and Information Commissioner (edoeb.admin.ch).

16.8 AI transparency. Our AI assistants tell you that you are interacting with an AI system, in line with the EU AI Act where it applies.

17India

17.1 This section applies where India's Digital Personal Data Protection Act 2023 and the Digital Personal Data Protection Rules 2025 (DPDP law) apply, including where we offer Services to people in India or our team in India processes personal data.

17.2 Where we are the data fiduciary, we process your digital personal data on the basis of your consent or a legitimate use permitted by the DPDP law. You may withdraw consent at any time, as easily as you gave it.

17.3 You may ask for a summary of your personal data and processing, and ask us to correct, complete, update or erase it. You may also nominate another person to exercise your rights if you die or become incapacitated.

17.4 Grievance officer. Contact our grievance contact at **@************om.au. We will respond within the time required by the DPDP law. If you are not satisfied, you can complain to the Data Protection Board of India once you have used our grievance process.

18United States

18.1 Some US states give residents privacy rights, such as rights to know, access, correct and delete personal information, and to opt out of targeted advertising, the "sale" of personal information and certain profiling. Where those laws apply to us, you can exercise these rights by contacting us. You may use an authorised agent. We will not discriminate against you for exercising your rights. You can appeal a decision by replying to our response.

18.2 We do not sell personal information for money. Some advertising cookies may be considered a "sale" or "sharing" under some state laws. You can opt out using the "Cookie settings" link or a GPC signal (see section 15.5).

18.3 We do not use or disclose sensitive personal information to infer characteristics about you.

19Philippines

19.1 Where the Data Privacy Act of 2012 (Republic Act No. 10173) applies, you have the right to be informed, to access, to object, to erasure or blocking, to rectification, to data portability and to damages, and the right to complain to the National Privacy Commission (privacy.gov.ph). Our team members and partners in the Philippines are bound by confidentiality and security obligations that meet that Act.

20Vietnam

20.1 Where Vietnam's Law on Personal Data Protection (Law No. 91/2025/QH15, in force from 1 January 2026) and its implementing decree apply, we process personal data with your consent or another legal basis allowed by that law, and you have the rights it provides, including to know, consent, access, withdraw consent, delete, restrict and object. Where required, we complete processing and cross-border transfer impact assessments.

21Other countries

21.1 If you live in another country with privacy laws that apply to our handling of your personal information (for example, New Zealand, Singapore or Canada), you have the rights those laws provide. Contact our Privacy Officer to exercise them. We will respond in line with the applicable law.