National Assurance privacy collection notice

What we collect and where it comes from

The commissioning insurer or its authorised representative provides employer identity, ABN, policy, audit-period and verified-contact details. The employer contact then provides declarations, payroll exports, supporting official records and comments. Those records may identify workers and include employee identifiers, employment status, earnings and pay components, apprentice or JobCover status, and relevant contractor or director information. The portal also records authentication, security, workflow, audit-history and email-delivery events.

Do not provide

Tax file numbers, bank-account details, home addresses, dates of birth, passwords, medical or claim records, or unrelated employee documents. Use employee IDs instead of names where the payroll system allows it. Demo file contents are discarded, but filenames are retained, so do not select a file with a real person's name or other sensitive information in its filename.

Why we collect and use it

We use the information to authenticate authorised contacts, confirm the audit scope, request and reconcile evidence, assess declarable wages under the approved rule package, identify exceptions, prepare preliminary and final reports, obtain employer comments, support human review, communicate outcomes, protect the service and maintain an accountable audit history. We do not use payroll information for advertising or sell it.

Is providing it required?

The portal itself does not make information provision compulsory. Your insurer may separately require wage information under your policy, its audit instructions or applicable law. If relevant information is not provided, the audit may be delayed, further evidence may be requested, or the insurer may determine the outcome using the information available. Contact the privacy contact before uploading if you need another submission method or are unsure whether a field is necessary.

Who may receive it

Information may be disclosed to the commissioning insurer and its authorised audit, premium and review personnel; authorised National Assurance reviewers and service personnel; and contracted providers used for secure hosting, storage, authentication, email delivery and report production. It may also be disclosed to professional advisers, regulators, courts or law-enforcement bodies where authorised or required. Access is limited to the relevant audit role and purpose.

Overseas handling

National Assurance uses globally operated cloud, authentication and email services. Personal information and technical metadata may therefore be processed in Australia and overseas, including the United States. Provider routing and subprocessors can change. Contact the privacy contact before submission if you need current information about a particular provider or processing location.

AI and human review

Choose how this submission is prepared. AI-assisted preparation permits National Assurance to send payment descriptions, relevant audit facts and submitted supporting PDFs to OpenAI to suggest wage classifications, read documents and draft findings. PDF reading sends the complete selected PDF, including any personal information it contains. Processing may occur overseas. Do not include tax file numbers, bank details or unrelated personal information. An auditor checks the evidence, calculations and findings before any report is issued. Manual review does not send this submission to OpenAI. Your choice does not change the evidence required for the audit.

The portal uses the OpenAI API with response storage disabled. This is not a promise of zero retention: provider abuse-monitoring and safety processing may still apply. OpenAI states that API data is not used for model training unless the account explicitly opts in. See OpenAI data controls. National Assurance must verify its account settings and provider arrangements before processing real payroll information. Contact the privacy contact to change your preparation choice; information already sent cannot be recalled by changing the choice.

Storage, access and retention

Employer access uses single-use access codes and case-bound sessions. Staff access requires an explicitly provisioned Google identity, active tenant membership and an active role assignment for the case. Files and consequential records are stored with version and integrity controls. Information is retained only for the audit, contractual, insurance and legal requirements applying to the engagement; the commissioning insurer may set additional record-keeping requirements. Contact the privacy contact for the retention position applying to your audit.

Access, correction and complaints

Email support@nationalassurance.au to request access to or correction of personal information, ask a privacy question, request another submission method or make a privacy complaint. State the audit reference and your relationship to it, but do not email payroll files or one-time codes. We may need to verify identity and authority before responding. If a privacy complaint is not resolved, you may also have a right to contact the Office of the Australian Information Commissioner. Formal insurer-review and SIRA-escalation routes are separate and will be stated in the issued correspondence.