24 Moons Privacy Policy
Staff Portal, Admin Portal and Webmail
Operator: 24 Moons PTY LTD
ABN: 64 631 729 658
Effective date: 29 September 2026
Privacy contact: info@24moons.com.au — Attention: Privacy Officer
Version: 1.1
Contents: Scope · Information · Collection · Sensitive information · Uses · Access · Monitoring · Providers · Cookies · Security · Retention · Requests · Updates
1. About this policy
24 Moons PTY LTD ("24 Moons", "we", "us" or "our") respects your privacy. This policy explains how we collect, hold, use and disclose personal information connected with our Staff Portal, Admin Portal and business email accounts, including webmail and approved email applications ("Services").
It applies to employees, contractors, administrators and other authorised users, and personal information about others handled through the Services. It does not replace a specific collection notice provided when information is requested.
Our Website Privacy Policy separately addresses public browsing and enquiries. Our Newsletter Terms of Service and Privacy Policy is the primary notice for subscriptions, subscriber information, email delivery and engagement tracking, including when staff administer them through these Services. Internal account use is also subject to the Portal Terms of Service.
We comply with applicable privacy, employment and record-keeping laws. Some employee-record handling may fall within the Privacy Act's employee records exemption, but it does not automatically cover every person or use of information through these Services. OAIC guidance.
2. Information we collect
Depending on your relationship with us and the functions used, we collect:
- Account and security information: name, email, identifiers, roles, permissions, authentication information, verification status and relevant activity.
- Staff and contractor information: legal/preferred names, birth date, contact/address details, emergency contacts, engagement details, work areas, job types and relevant contractor business, ABN and invoicing details.
- Payment and compliance information: bank details, tax/super documents, RSA certificates, security licences, expiry dates and other documents reasonably needed for your role or legal obligations.
- Rostering and attendance: availability, shifts, open-shift requests, event allocations, clock records, notes, comments and related communications.
- Administration: content and uploads, publishing, account/permission changes, configuration and campaign activity, and audit records.
- Communications: email addresses, sender/recipient details, subjects, contents, attachments, contacts, mailbox settings and delivery information. Messages may concern customers, suppliers, performers, staff and other contacts.
- Technical information: IP addresses, browser/device details, session identifiers, access times, authentication events, errors and security logs processed by our systems or providers.
We do not require unrelated personal information merely because a field or upload function is available. Newsletter-specific data categories are detailed in the Newsletter Terms of Service and Privacy Policy.
3. How we collect information
We collect information when you use the Services, complete your profile, upload documents, submit availability, communicate or carry out administration. We also receive information from authorised managers, account administrators, email correspondents, authentication providers, approved timekeeping systems and other service providers.
If you provide someone else's details, such as an emergency contact, tell them and make this policy available where practicable. Where information is needed to establish access, administer an engagement, arrange payment or meet legal obligations, we will explain limitations resulting from withholding it and discuss alternatives where available.
4. Sensitive information and tax file numbers
We request sensitive information only where reasonably necessary and legally permitted. Where consent is required, we seek it separately. Using the Services is not blanket consent to collect sensitive information.
Use the approved process for tax and super information. Do not place tax file numbers, bank details or health information in shared notes, shift comments or general messages.
Tax file numbers are handled only for legally permitted purposes. Providing your TFN is voluntary, although withholding it can affect the tax deducted from payments. OAIC TFN guidance.
5. How we use information
We use information where reasonably necessary to establish accounts, verify identity, control access, administer engagements and payment/compliance information, organise staffing and attendance, send operational messages, operate the website and email, manage enquiries and business relationships, investigate errors or suspected misuse, and meet record-keeping and legal obligations.
An internal account does not subscribe you to promotional emails. Operational messages are separate from marketing. Newsletter administration and any subscriber engagement analysis must follow the Newsletter Terms of Service and Privacy Policy.
We do not sell staff personal information.
6. Who can access information
Access is assigned according to responsibilities and business need. Authorised managers and administrators may access relevant staff records, documents, rosters and administrative information. Owners have elevated access across the Services. Approved technical providers may need access for support or security.
Mailboxes may be shared: messages can be visible to all people granted access. Shared notes and published content are visible to the audience of that feature. Use the appropriate private process for confidential matters.
We may disclose relevant information to hosting, authentication, email, SMS, storage and technical providers; payroll providers, accountants, advisers and insurers where needed; banks, superannuation funds and authorities where authorised or required; emergency contacts/services where reasonably necessary; and courts or law enforcement where legally required or authorised. We limit disclosures to information reasonably necessary for the purpose.
7. Account activity and work email access
The Services generate account and selected-action records for security, troubleshooting, accountability and business administration.
Where lawful and reasonably necessary, specifically authorised personnel may access business mailboxes and relevant messages for continuity, security investigations, legal obligations or suspected misuse. Access must have a legitimate purpose and be proportionate; it must not be for curiosity, harassment or unrelated surveillance.
Work email is a business resource, not a private personal mailbox. Marking a message personal does not guarantee it will never be accessed, although unrelated personal material should be avoided where practicable.
This policy does not authorise unrestricted monitoring of personal devices or private accounts. Additional monitoring requiring a separate notice, consent or legal authority will be addressed before it begins. Applicable monitoring laws continue to apply. OAIC workplace monitoring guidance.
8. Service providers and overseas handling
The Services use WorkOS/AuthKit for authentication and approved hosting/email infrastructure. SMS functions may use Twilio when enabled. Newsletter integrations, including Mailchimp where used, are addressed in the Newsletter Terms of Service and Privacy Policy.
Providers may store data, maintain backups or provide support outside Australia. International email delivery can involve overseas recipients and infrastructure.
We take reasonable steps required by applicable law to protect information handled by providers. This policy does not ask you to waive applicable overseas-disclosure protections.
9. Cookies and browser storage
The Services use storage for sign-in, request security and preferences. Authentication and webmail providers may use necessary cookies; blocking them can prevent functions from working.
Optional analytics or advertising within these internal Services will be separately disclosed, with consent where required. Public website settings do not necessarily control separate authentication or email providers. Website cookies are explained in the Cookie Notice; newsletter email tracking is separately explained in the Newsletter Terms of Service and Privacy Policy.
10. Security and incidents
We take reasonable steps to protect information from loss, misuse and unauthorised access, alteration or disclosure. Measures include access controls, authentication safeguards, protected storage and encryption where implemented.
No system guarantees complete security. Protect credentials, use required multi-factor authentication, lock devices and report suspected compromise promptly. We will assess suspected breaches, take appropriate remedial action and notify people and regulators where required by law. OAIC breach notification guidance.
11. Retention and account closure
We retain information as long as reasonably necessary for its purpose and applicable legal, employment, accounting or dispute requirements. Employee time and wages records generally must be kept for seven years; other requirements can differ. Fair Work record-keeping guidance.
Closing an account does not automatically delete employment records, correspondence, audit information or backups. When no longer needed, information is securely destroyed or de-identified, subject to legal obligations and the backup cycle.
Subscriber retention and suppression are governed by the Newsletter Terms of Service and Privacy Policy. Closing a staff account does not erase required subscriber records or unsubscribe preferences.
12. Access, correction and complaints
Update available fields through your profile. For other requests, contact info@24moons.com.au, addressed to the Privacy Officer. We may verify identity and will consider requests under applicable law, explain lawful refusals and provide complaint options. Account closure does not remove statutory employment-record access rights.
Explain a complaint and the outcome sought without including unnecessary sensitive details. You can request a confidential alternative to the shared inbox. We aim to respond within 30 days, explain delays and provide an expected date, without extending a shorter legal deadline.
If dissatisfied, contact the OAIC where it has jurisdiction or another relevant regulator. For newsletter requests, see the Newsletter Terms of Service and Privacy Policy.
13. Policy updates
We may update this policy as practices, Services or law change, publish the new version and notify users of material changes appropriately. Updates do not retrospectively authorise processing requiring separate consent or another legal basis.
24 Moons Terms of Service and Acceptable Use
Staff Portal, Admin Portal and Webmail
Operator: 24 Moons PTY LTD
ABN: 64 631 729 658
Effective date: 29 September 2026
Contact: info@24moons.com.au
Version: 1.1
Contents: Scope · Accounts · Staff Portal · Admin Portal · Email · Confidentiality · Conduct · Security · Privacy · Working hours · Content · Availability · Access withdrawal · Updates · Law
1. Purpose and application
These terms govern authorised access to the 24 Moons Staff Portal, Admin Portal and business email accounts, including webmail and approved applications ("Services"). They apply to employees, contractors, administrators and other authorised users.
Access is for authorised work and business purposes. Follow these terms and relevant lawful, reasonable instructions. These terms do not replace employment or contractor agreements, awards, enterprise agreements or statutory rights, create an employment relationship or change your classification.
Our Portal Privacy Policy explains internal information handling. The Newsletter Terms of Service and Privacy Policy is the primary notice for newsletter subscriptions and subscriber information; authorised staff must follow it when administering lists or campaigns.
2. Accounts and permissions
Use only authorised accounts, portals, records and mailboxes. Keep account information current; use your assigned sign-in; protect passwords, verification/recovery codes; use required multi-factor authentication; lock unattended devices; sign out of shared devices; and report suspected unauthorised access promptly.
Do not share personal sign-in credentials, impersonate another user, bypass controls or use another person's session. Arrange shared mailbox access through approved permissions or an expressly approved process. Being able to open a record does not authorise an unrelated use.
3. Staff Portal use
Keep contact details, emergency contacts, availability and required documents reasonably current. Submit accurate information belonging to the correct person. Record attendance honestly; do not clock for another person, falsify hours or documents, or misrepresent qualifications.
Report missing or incorrect shifts, attendance and personal details promptly. Corrections must preserve required records. Availability or an open-shift request does not itself confirm an allocation: follow the approval process and confirmed roster.
Portal information or technical errors do not override legal entitlements to pay, breaks, leave, consultation or notice. If unavailable, use the agreed alternative for time worked and urgent roster matters.
4. Admin Portal and newsletter use
Act within your authority when publishing, managing accounts, changing settings, accessing personal information, exporting records or sending campaigns. Check the audience and effects of actions, publish only approved material, confirm usage rights and recipients, grant access only through approval processes, and preserve required records and audit trails.
All newsletter work must follow the Newsletter Terms of Service and Privacy Policy. In particular:
- establish and retain appropriate evidence of marketing consent before adding or importing recipients;
- do not use harvested addresses or treat list possession as consent;
- respect confirmation requirements, unsubscribes, complaints and suppression across delivery channels;
- include correct sender identification, contact details and a working unsubscribe option in every marketing email;
- meet the unsubscribe time limits stated in the newsletter policy;
- use subscriber records, engagement segments and automated follow-ups only for disclosed, authorised purposes;
- obtain any separately required tracking permission; do not treat marketing consent as unlimited tracking consent;
- do not export subscriber data to unapproved tools or upload it to advertising audiences without separately authorised, lawful arrangements and required disclosures or consent.
Do not inspect unrelated records, conceal activity or use administrative access for improper benefit. Newsletter subscribers' rights continue regardless of which internal account or sending provider is used.
5. Webmail and email accounts
Business email is provided and controlled by 24 Moons. Mailboxes may be shared or reassigned. Use email professionally, verify recipients and attachments, be cautious with links/credentials, and independently verify unusual payment-detail changes.
Do not automatically forward business email to personal/unapproved accounts, connect unapproved integrations, send unlawful or unsolicited bulk messages, impersonate others, misrepresent authority, establish unrelated personal accounts or conceal/delete required records. Sending from webmail does not bypass the Newsletter Terms of Service and Privacy Policy for newsletter marketing.
Incidental personal use requires management permission and must not interfere with work or create material risk. Work email is not a private personal correspondence service. Make business commitments only within your authority.
6. Confidentiality and personal information
Use, access, download and disclose confidential or personal information only for authorised purposes, through approved channels. Do not put it into personal cloud storage, public AI services or other unapproved tools. Approval must cover both tool and information type.
Do not place tax file numbers, bank details, health information or identity documents in shared notes. Apply the Newsletter Terms of Service and Privacy Policy when handling subscriber information.
Confidentiality continues after access ends, but does not prevent protected whistleblowing, lawful regulator disclosures, confidential legal advice, exercising workplace rights or other legally protected disclosures.
7. Prohibited conduct
Do not harass, bully, threaten, discriminate, distribute unlawful/malicious/deceptive material, introduce malware, disrupt systems, attempt unauthorised access/testing/extraction, circumvent controls, infringe intellectual property or privacy rights, falsify/destroy required records or conduct an unauthorised business through the Services.
Report vulnerabilities privately to an authorised manager or administrator. Do not continue probing or access further information without permission.
8. Devices and security incidents
Use devices meeting communicated security requirements, including supported software, current updates and screen locks. Avoid unnecessary local copies of sensitive records and separate work/personal information where practicable.
Report lost devices, phishing, misdirected messages, exposed documents or suspected compromise as soon as reasonably practicable. Preserve evidence and follow reasonable containment instructions; do not conceal incidents or conduct unauthorised investigations.
Using a personal device does not give 24 Moons unrestricted access to its personal contents. Device-management arrangements must be separately explained and authorised.
9. Privacy, logging and mailbox access
The Portal Privacy Policy describes logging, authorised reviews and business mailbox access. These terms do not authorise unrestricted surveillance or replace legally required notices. Newsletter engagement records are separately explained in the Newsletter Terms of Service and Privacy Policy.
10. Notifications and working hours
Operational emails, texts, verification codes and roster notifications may be sent. An account or notification does not create a general obligation to remain available outside working hours. Expectations must be consistent with law, role and lawful working arrangements. Nothing limits an employee's statutory right to disconnect. Fair Work guidance.
11. Content and intellectual property
Have the necessary authority to upload, publish or distribute material. Ownership of work product is determined by law and your employment/contractor agreement. Uploading does not itself transfer ownership of personal records or pre-existing intellectual property.
You authorise storage, copying and use reasonably necessary to operate the Services and fulfil the submission's authorised purpose. Do not reuse branding, confidential material or third-party content outside your authority.
12. Availability and support
We take reasonable steps to keep Services available but maintenance, faults, incidents or providers may interrupt them. We do not guarantee uninterrupted access or delivery of every notification.
Use agreed direct contact for urgent matters. If an outage prevents a required task, notify the responsible manager and use an approved alternative. Nothing excludes liability, guarantees or remedies that cannot lawfully be excluded.
13. Suspension and withdrawal of access
We may reasonably restrict, suspend or withdraw access for security, suspected misuse, changed responsibilities, an ended engagement or another legitimate business/legal reason. Immediate protective action may be needed. Where lawful and appropriate, we will explain the action and give a review contact.
Misuse may lead to action under applicable policies, agreements and law. Suspension alone is not a finding of misconduct or termination of employment.
On leaving or when reasonably directed, hand over records, stop using revoked access and remove unauthorised personal copies. Do not delete records subject to retention or legal hold, including required subscription and suppression records under the Newsletter Terms of Service and Privacy Policy.
We may retain correspondence, reassign mailboxes or arrange an appropriate automatic response, subject to privacy obligations and law. You may still request employment records to which you are legally entitled.
14. Changes to these terms
We may update these terms for service, security or legal changes and communicate material changes and commencement dates with reasonable notice where practicable. Urgent changes may take effect sooner where necessary. Updates do not retrospectively change accrued rights or amend an agreement without any legally required agreement.
15. Questions, disputes and governing law
Contact info@24moons.com.au or your authorised manager. Request a private contact method before sending confidential details.
Victorian and applicable Commonwealth laws govern these terms. Subject to mandatory rules, parties submit to the non-exclusive jurisdiction of Victorian courts. Nothing prevents approaching a regulator, tribunal, union or adviser or exercising legal rights. If a provision is unenforceable, the remainder applies to the extent legally possible.