Privacy policy

1. Who we are and what this policy covers

Marlow Services Group Pty Ltd, trading as Marlow Facility Services, provides commercial and residential cleaning services in two states: across Melbourne's northern suburbs from a base in Broadmeadows, Victoria, and across Perth's eastern corridor and wider metropolitan area from a base in South Guildford, Western Australia. This policy applies to both, and to every person we deal with in either. It explains what personal information we collect, why we collect it, how we hold it, who we disclose it to, and how you can access it or complain about how we have handled it.

It covers information collected through our website, by phone, by email, at a site inspection, during the provision of our services, and in the course of employing people.

In this policy, personal information means information or an opinion about an identified individual, or an individual who is reasonably identifiable.

3. What we collect, and why

3.1 Through the website quote form

We collect what is needed to produce a quote and nothing else. We do not ask for a date of birth, a licence number, a rental agreement, or any government identifier on the quote form. If a field is not needed to price the job, it is not on the form.

Cookies and analytics. Our website uses cookies for basic function and may use analytics to understand how the site is used. Analytics data is aggregated and is not used to identify individuals. You can block cookies in your browser; the site will still work.

3.2 When you become a client

• Billing name, address and contact details
• Payment details — see section 4
• Access information — see section 5, which is the part of this policy that matters most
• Site details: floor plans, room counts, surface types, alarm zones, special instructions
• Service history, quality inspection reports and photographs
• Complaints, damage reports and rectification records
• For commercial clients, the names, positions and contact details of your staff who deal with us

3.3 Photographs

We take photographs of work performed, for quality documentation, for the monthly written quality inspection issued to commercial clients, and to evidence the condition of a property before and after a bond clean.

• Photographs record surfaces and spaces, not people. We do not photograph people, and if a person appears incidentally the photograph is deleted and retaken
• We do not photograph documents, screens, whiteboards, patient or client records, or anything that could disclose the confidential information of a client's own customers — this matters particularly at medical, dental, allied health and legal premises
• Photographs are not used in marketing without the client's express written consent, obtained separately from the service agreement
• Photographs are stored in our job management system with access limited to the staff who need it

3.4 Employees and job applicants

We collect from applicants and employees: contact details, work history, right to work evidence, tax file number declaration data, superannuation fund details, bank account details, emergency contact, National Police Certificate results, Working With Children Check and NDIS Worker Screening details where applicable, licences and tickets, training records, timesheets, and injury and incident records.

Tax file numbers are handled under the Privacy (Tax File Number) Rule and are used only for the purposes for which they were provided.

Screening results are treated as the most sensitive employee information we hold. They are stored separately from general personnel files, access is limited to the director, and only a yes/no clearance status and expiry date — never the underlying result — is disclosed to a client who asks for evidence of screening.

Note on the employee records exemption. The Privacy Act contains an exemption for acts and practices directly related to a current or former employment relationship. We do not rely on it to justify poor handling. Employee records are held securely and used only for employment purposes.

5. Keys, access codes and premises information

This is the most sensitive information we hold and it is handled under a separate operational control, not just this policy.

Knowing a client's alarm code, key location and cleaning schedule is functionally equivalent to holding a key to their building and a timetable of when it is empty. We treat it accordingly.

5.1 What we hold

• Physical keys, swipe cards, fobs and remote controls
• Alarm codes and PINs
• Lock box codes and key safe locations
• After-hours access procedures and security company contacts
• The cleaning schedule itself — which, combined with the above, discloses when a building is unoccupied

5.2 How we handle it

• Every key, card and fob is recorded in the key and access register on issue, transfer and return, with signatures
• Keys are tagged with a code, never with the client's name or address. A lost key must not identify the building it opens
• Keys are held in a locked key cabinet at the business premises and signed out for each shift. They are not kept permanently in vehicles and not taken to a cleaner's home unless a specific written arrangement is in place with that client
• Alarm codes are stored encrypted, separately from the key register, and are disclosed only to the specific cleaners rostered to that site
• Access information is disclosed on a need-to-know basis — a cleaner receives the access details for their own sites only
• On termination of employment, every key is returned before the final pay is processed, and every code that the departing worker knew is changed at our cost. This is not a discretionary step
• On loss of a key, the client is notified immediately — the same day, not at the next service — and we meet the cost of re-keying in accordance with our terms of service and our insurance. Loss-of-keys cover is a specific item on our public liability policy
• On termination of a client contract, all keys, cards and fobs are returned to the client within 7 days, and access records are destroyed or securely archived
• Access information is never sent by unencrypted email or SMS, never written on a run sheet, and never stored in a shared spreadsheet

5.3 Confidential information seen at a client's premises

Cleaners work in medical practices, dental surgeries, allied health clinics, legal offices and childcare centres. They will inevitably see documents, screens and files.

Standing instruction to every worker: do not read it, do not photograph it, do not move it, do not discuss it. Every employee signs a confidentiality undertaking as part of their employment contract, and it survives the end of employment.

We report to the client, and to nobody else, if we find sensitive material left unsecured — a patient file on a reception desk, a screen left logged in. That is a courtesy to the client and it is also the only appropriate response.

7. Who we disclose information to

We disclose personal information only where it is necessary.

We do not sell, rent or trade personal information. We do not disclose personal information for another organisation's marketing.

Overseas disclosure. Some of our software providers may store data on servers outside Australia. We select providers who state that they hold Australian customer data in Australia where that option exists, and we will identify the countries concerned on request. The specific providers and their data locations are being confirmed as part of the legal review of this document and will be listed here before it is finalised.

9. How long we keep it, and how we destroy it

Destruction method. Paper is shredded. Electronic records are deleted from live systems and from backups at the next backup rotation. Destruction of screening records, CCTV footage and access codes is logged.

11. Accessing and correcting your information

You may ask for a copy of the personal information we hold about you, and ask us to correct it if it is wrong.

• Email hello@marlowfacility.com.au or write to us at the address below
• We will verify your identity before releasing anything — this is a protection for you
• We will respond within 30 days
• Access is free. If a request requires substantial work we may charge a reasonable cost, and we will tell you what it is before we do the work
• If we refuse access, we will tell you why in writing
• If we correct information we have already disclosed, we will tell the recipient where it is reasonable to do so

13. Changes to this policy, and how to contact us

We will update this policy when our practices change or when the law changes. The current version is always at marlowfacility.com.au and is dated. Material changes will be notified to current clients by email.

See also our terms of service.