Privacy Policy

1. Introduction

Farrell Transport Group Pty Ltd (ABN 64 646 273 592) ("we", "us", "our") operates the Nexum transport management platform and related services. This is a single Privacy Policy covering our entire system:

• Our website — farrelltransport.com.au, including the contact, careers and WHS pages
• The Nexum Portal — nexum.net.au, our online portal for administrators, subcontractors, drivers, customers, sales staff and onboarding applicants
• The DriverX mobile application — our driver app for jobs, dockets, prestarts, fatigue management and shift tracking

Together these are "the Services". This Policy explains how we collect, use, disclose and protect personal information across all of them. We are committed to handling personal information in accordance with the Australian Privacy Principles (APPs) under the Privacy Act 1988 (Cth).

2. Who This Policy Applies To

We collect personal information about:

• Visitors to our website and people who contact us or apply for work
• Our employees and drivers who use the Services
• Subcontractors and their directors, drivers and staff, including applicants using our online onboarding process
• Customers and their staff who use the customer portal or deal with us
• Some third parties encountered in the course of our work — for example a person who signs for a delivery, an authorised officer who inspects a driver's work records at the roadside, or an emergency contact nominated by a driver

3. Information We Collect

Website

• Contact and enquiry form details — name, email, phone, company, message, and any attachment you choose to send (for example a resume)
• Technical data used to protect the site — your IP address is used for rate limiting and bot protection (Cloudflare Turnstile)
• Website analytics data collected through Google Analytics

Accounts

• Name, email address, username and phone number
• Login records, including login times, failed attempts, IP address and browser/device details
• Push notification tokens and device platform for the DriverX app

Subcontractor and Company Information

• Company details — legal name, trading name, ABN/ACN, GST status, addresses and contacts
• Insurance details — insurer, policy numbers, coverage amounts and expiry dates
• NHVAS accreditation details and expiry dates
• Bank account details (account name, BSB and account number) for payment of approved subcontractors

Driver Information

• Identity details — name, date of birth, address, phone and email
• Driver licence number, class, state, expiry and any restrictions
• Compliance details — medical certificate details, dangerous goods licences, fatigue management scheme, inductions, qualifications and cards (e.g. White Card)
• Emergency contact (next of kin) name, phone number and relationship
• Employment details — employer/contractor company, start date and role

Vehicle and Asset Information

• Registration, VIN, make, model, mass ratings and configuration details
• Registration, insurance, roadworthy, tare and permit documents
• Odometer readings recorded at prestarts, clock-ons and clock-offs

Documents and Photos

• Compliance documents uploaded to the portal or app — licences, insurance certificates, medical certificates, accreditations, inductions and similar
• Delivery dockets, daysheets and waste transport certificates captured through the app
• Vehicle prestart photos and defect photos
• Photos may be taken with the camera or selected from your device's photo library; location (EXIF) metadata is stripped from photos before upload

Location Data (DriverX)

The DriverX app collects location data continuously while you are clocked on to a shift, including while the app is in the background, your phone is locked, or the vehicle is stationary, and including during rest breaks. This supports delivery tracking, driver safety and fatigue compliance (including evidence that rest breaks were genuinely taken). Location tracking stops when you clock off or log out.

Each location record can include:

• GPS coordinates, accuracy, speed, heading and altitude
• Your shift status (active, driving, on break, idle) and the active job and vehicle
• Device battery level
• Entry, exit and dwell events for defined work areas (geofences)

Location tracking is a condition of using DriverX for shift work: the app will not let you clock on if location permissions are not granted, and there is no in-app switch to turn tracking off during a shift. Location is not collected when you are not clocked on. The app also records the state of your device's location permissions and battery settings so we can confirm tracking is working.

Work, Fatigue and Safety Records

• Clock-on, clock-off and break events, each with time, GPS location and odometer
• Work and rest hour records maintained for heavy vehicle fatigue compliance, including recorded fatigue breaches and your acknowledgements or stated reasons (for example where you could not stop safely)
• Prestart check responses, your inspection declaration, and reported defects with severity and photos
• Roadside interception records — where an authorised officer reviews your work and rest records in the app, we record the officer's name and badge number, the location, the result and any details entered. At the officer's request a copy of the displayed record may be emailed to an address the officer provides
• Incident, hazard and non-conformance reports

Timesheets, Leave and Pay-Related Information

• Timesheet data derived from clock events, including hours, overtime and allowance claims (e.g. overnight, truck wash)
• Timecard correction requests and the notes you provide
• Leave requests — leave type, dates, your stated reason and any supporting attachment. Where a medical certificate or similar is attached, this is health information (see Sensitive Information below)
• Leave balances and approved leave dates, which are visible to rostering and office staff

Messages and Communications

• Messages between drivers and the office through the app, including read receipts
• SMS conversations with our office number, including message content and delivery status
• Emails and phone contact details used for job notifications and reminders

Signatures

• Driver signatures captured at clock-off confirming shift records
• Signatures and names of people who sign for deliveries, captured on the driver's device and stored with the job record

Device and Technical Information

• Device type, operating system, app version and push notification tokens
• IP address and browser details in server, security and audit logs
• Audit trails of actions taken in the portal and office systems (who changed what and when), kept for security and compliance

4. Sensitive Information

Some information we collect is "sensitive information" under the Privacy Act — principally health information such as medical certificates supporting leave requests, driver medical (fitness-for-duty) certificate details, and health-related details in incident reports. We only collect sensitive information with your consent and where it is reasonably necessary — for example to process leave, meet heavy vehicle driver medical requirements, or manage a workplace incident. We use it only for those purposes.

5. How We Use Your Information

We use collected information to:

• Manage, assign and track transport jobs and deliveries
• Respond to enquiries, quotes, job applications and subcontractor applications
• Assess and verify subcontractor and driver compliance, including licence, insurance, medical and accreditation expiry tracking
• Meet our obligations under heavy vehicle, workplace safety and environmental law, including fatigue management and Chain of Responsibility duties
• Process dockets, invoices, RCTIs, timesheets, allowances and leave
• Communicate with you about jobs, compliance and operational matters
• Keep the Services secure, prevent fraud and investigate misuse
• Improve the Services and our operations

6. Workplace Monitoring

If you drive for us or for one of our subcontractors, you should understand that the Services monitor work activity. During a shift this includes continuous location tracking, geofence events, speed, fatigue hour tracking with automated alerts and breach recording, GPS checks that job steps happen at the right place, and aggregate performance statistics (such as tonnage leaderboards visible to other drivers in your company). This monitoring exists to keep drivers safe, meet our legal fatigue and Chain of Responsibility obligations, and run our operations — it is not used for any other purpose. Monitoring applies only while clocked on to a shift.

7. Who We Share Information With

We do not sell your personal information. We share information with:

• Your employer or contracting company — job, compliance, defect and timesheet records are visible to the company you drive for
• Our customers — limited job and delivery information (such as docket details and proof of delivery) relating to their own jobs
• Regulators and authorities — including the NHVR, police and authorised officers (for example roadside review of work and rest records), environmental regulators, and others where required or authorised by law
• Service providers who help us operate the Services (see below)

Service Providers We Use

• DigitalOcean — cloud hosting. Our databases and file storage are located in Sydney, Australia; some application processing occurs in DigitalOcean's Singapore region
• Expo, Apple and Google — delivery of push notifications and app updates for DriverX (Expo's infrastructure is in the United States)
• SMS providers (such as SMSGlobal) — SMS messages, job notifications and one-time verification codes
• Email providers (Resend for the website; SMTP2GO and similar for the platform) — transactional email delivery
• Cloudflare — website security, DNS and bot protection (Turnstile)
• Google — Maps and address lookup, website analytics, and AI services that assist our office staff with job data entry
• Microsoft — staff sign-in (Microsoft 365) and synchronisation of work contact details for our internal phone and Teams systems
• Xero — accounting and payroll, including invoices, RCTIs, subcontractor payment details, timesheets and leave
• Australian Business Register and NHVR — verification of ABN, vehicle registration and accreditation details you provide

Each provider is only given the information needed for its function and has its own privacy policy governing how it handles data.

8. Overseas Disclosure

Your personal information is primarily stored in Australia (Sydney). However, some processing occurs overseas: our application servers run partly in Singapore (DigitalOcean), push notifications for the DriverX app are routed through Expo, Apple and Google infrastructure (primarily in the United States), and some of the service providers listed above process data in their own overseas regions. We take reasonable steps to ensure overseas recipients handle personal information consistently with the Australian Privacy Principles.

9. Data Security

We implement technical and organisational measures to protect personal information, including:

• Encrypted data transmission (TLS/SSL) across all Services
• Passwords hashed with industry-standard algorithms (bcrypt); we never store your password in readable form
• Secure token-based authentication, account lockout after repeated failed logins, and rate limiting
• Two-factor authentication and single sign-on for staff accounts
• Role-based access controls — each user type (admin, contractor, driver, customer, applicant) can only access its own area and records
• Private file storage with short-lived, signed access links; uploaded files are never publicly accessible
• Encryption of stored credentials and integration secrets
• Audit logging of access and changes

If you enable biometric login in DriverX, your login credentials are stored only on your device in the operating system's secure storage (iOS Keychain / Android Keystore) and are cleared when you log out or disable biometric login. Your fingerprint or face data never leaves your device.

10. Data Retention

We retain personal information for as long as your account is active or as needed to provide the Services, and afterwards as required by law:

• Financial records (jobs, invoices, RCTIs, dockets) — at least 7 years, as required by Australian tax law
• Fatigue and work/rest records — at least 3 years, as required by heavy vehicle law
• Safety and compliance records — as required by transport and workplace safety regulations
• Messages and SMS conversations — deleted on a rolling schedule after a configured retention period

When retention periods expire, records are deleted or de-identified; deletions are logged.

11. Your Rights

Under the Australian Privacy Principles, you have the right to:

• Access the personal information we hold about you
• Request correction of inaccurate or out-of-date information
• Request deletion of your information (subject to the legal retention obligations above)
• Opt out of non-essential communications
• Complain about how we have handled your information

To exercise these rights, contact your company administrator or contact us directly using the details below. If you are not satisfied with our response, you can complain to the Office of the Australian Information Commissioner (oaic.gov.au).

12. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes through the Services or by other appropriate means. Continued use of the Services after changes constitutes acceptance of the updated policy.

13. Contact Us

If you have questions about this Privacy Policy or our data practices, contact us at: