ComPassport is committed to protecting your privacy. This policy explains what personal information we collect, why we collect it, how we use it, and your rights under Australian privacy law. We comply with the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs).
ComPassport is a digital competency licensing platform operated by Dion Porter (ABN: 45642791533) as a sole trader, trading as ComPassport, based in Victoria, Australia.
ComPassport provides a platform that allows construction workers to store and share their competency licences digitally, allows anyone presented with a worker's QR code to verify those credentials without an account, and allows Registered Training Organisations to issue verified credentials directly into a worker's wallet. ComPassport is not a workforce compliance management system and does not track, monitor or report on a business's workforce. References to "ComPassport", "we", "us" or "our" in this policy refer to this business.
When you register as a worker and use ComPassport, we may collect:
When an RTO registers to issue credentials through ComPassport, we may collect:
We automatically collect certain technical information when you use our platform:
We collect information in the following ways:
Where an RTO issues you a credential — individually or as part of a bulk upload — we collect your name, email address and credential details from that RTO rather than from you directly. We require RTOs to tell the workers they train that their details will be provided to ComPassport for this purpose, and to only submit details of workers they have actually trained and assessed.
If an RTO issues a credential to an email address that does not yet have a ComPassport account, we hold the credential and the email address so the credential can be placed in the wallet if and when that person registers. If the credential remains unclaimed for 12 months, we delete the record and notify the issuing RTO. If you receive a notification about a credential you did not expect, or you would like the record removed sooner, contact us at compassportsupport@gmail.com and we will delete it.
We use the information we collect to:
We do not sell your personal information to third parties. We do not use your data for advertising purposes. Your competency data belongs to you.
When a site supervisor scans your ComPassport QR code, they will see your name, trade, and the details of your competency licenses including license numbers, expiry dates and issuing bodies. You control when and to whom you show your QR code.
Your public verification page shows your name, trade, state, profile photo and competency licence details to anyone who scans your QR code or opens your verify link — in the same way a physical licence card can be shown to anyone on request. Do not share your QR code or link with anyone you do not want to see this information.
Anyone viewing your verification page can also send a timestamped record of it to an email address of their choosing, or download it as a PDF, so that a site can keep a record of the induction. That record may include your name, credential details and profile photograph. Our terms require the person sending it to use it only for a legitimate site induction, compliance or record-keeping purpose, but once a record has been sent or downloaded we have no control over it. You can invalidate an existing QR code and generate a new one at any time from your account.
If an RTO issues a credential directly to your wallet, they keep a record that they have done so, and they can see the status of the credentials they issued you — including when one is approaching its expiry date.
An RTO that has issued you a credential can also retrieve your email address in order to contact you about renewing or rebooking that training. This is limited to RTOs that have actually issued you a credential — no other RTO can look you up, and an RTO cannot browse or search workers it has not trained.
An RTO cannot see credentials you added yourself, or credentials issued to you by a different RTO. If you do not want to be contacted about renewals, see section 5.6 below.
We use a small number of trusted third-party services to operate the platform. These providers only access your data to perform services on our behalf and are bound by confidentiality obligations:
Several of the providers listed above are located outside Australia, and your personal information is stored and processed overseas — principally in South Korea, where our database is hosted, and in the United States.
Where we disclose personal information to an overseas recipient, we take reasonable steps to ensure it is handled consistently with the Australian Privacy Principles. We select established providers that publish binding privacy and security commitments, we enter into their data processing terms, and we limit each provider to the minimum information it needs to perform its function. We remain accountable to you under Australian law for how these providers handle your information, and you can complain to us or to the OAIC about an overseas recipient's handling of your data in the same way as for our own.
We send you reminders when a credential in your wallet is approaching its expiry date. Where the credential was issued by an RTO, that reminder may include a link to that RTO's booking or renewal page, so you can rebook the training if you choose to. RTOs that have issued you a credential may also contact you directly about renewal, as described in section 5.3.
Every reminder we send includes a link to turn these emails off. You can also turn them off at any time in your account settings, or by emailing us. Turning them off stops the reminders and any renewal messaging in them — it does not affect essential account emails such as password resets or security notices, and it does not delete your credentials or their expiry dates.
We may disclose your information if required to do so by law, court order or a regulatory authority, or if we believe disclosure is necessary to protect the safety of any person.
We will not use or disclose your personal information for any other purpose without your consent, unless we are permitted or required to do so by law.
Your data is stored securely using industry-standard encryption both in transit (SSL/TLS) and at rest. Our database is hosted by Supabase in Seoul, South Korea data centres. We use Supabase's Row Level Security (RLS) to ensure that users can only access their own data. Uploaded license documents are stored in a private, encrypted storage bucket and are not publicly accessible.
We take reasonable steps to protect your personal information from misuse, interference, loss, and unauthorised access. However, no method of internet transmission or electronic storage is 100% secure, and we cannot guarantee absolute security.
If we become aware of a data breach that is likely to result in serious harm to you, we will notify you and the Office of the Australian Information Commissioner as required by the Notifiable Data Breaches scheme under the Privacy Act 1988 (Cth). We will tell you what happened, what information was involved, and what steps you can take in response.
We retain your personal information for as long as your account is active or as needed to provide you with our services. Specifically:
Under the Australian Privacy Principles you have the right to:
Beyond what the law requires, we also let you delete your account and its data at any time from your account settings, and export your credential data in a standard format. These are features we choose to provide.
To exercise any of these rights, contact us at compassportsupport@gmail.com. We will respond within 30 days.
ComPassport uses essential cookies to keep you logged into your account and to maintain your session. We do not use advertising cookies, tracking pixels or third-party analytics that share your data with advertisers.
You can disable cookies in your browser settings, but this may prevent you from logging in or using certain features of the platform.
Our platform may contain links to third-party websites such as WorkSafe Victoria, the Building and Plumbing Commission (BPC, formerly the VBA), or VicRoads for reference purposes. These sites have their own privacy policies and we are not responsible for their content or practices. We encourage you to review their privacy policies before providing any personal information.
ComPassport accounts are currently available only to people aged 18 and over, and we do not knowingly allow anyone under 18 to register.
We recognise that some construction credentials — including the General Construction Induction (White Card) — can lawfully be obtained in Victoria before the age of 18. An RTO issuing credentials in bulk could therefore submit details of a worker under 18. We require RTOs not to submit details of workers under 18, and if we become aware that we hold information about someone under 18 we will delete it promptly and notify the issuing RTO.
If you believe we hold information about a person under 18, contact us at compassportsupport@gmail.com.
We may update this privacy policy from time to time to reflect changes in our practices, technology or legal requirements. When we make material changes, we will notify you by email or by displaying a prominent notice on the platform. The updated policy will take effect from the date shown at the top of this page.
We encourage you to review this policy periodically.
If you have any questions, concerns or complaints about this privacy policy or how we handle your personal information, please contact us:
If you are not satisfied with our response, you may contact the Office of the Australian Information Commissioner (OAIC) at oaic.gov.au or by calling 1300 363 992.