Citation Group Privacy Policy

Last updated: 12 October 2026

This Privacy Policy relates to Citation Group Pty Ltd, foundU Solutions Pty Limited and other business in Australia and New Zealand that together form the Citation Group.

1. Your privacy

Your privacy is important to Citation Group, and we are committed to safeguarding your personal information. This Privacy Policy provides you with information about how we collect, use, disclose, and otherwise process personal information collected in connection with your use of our websites, software solutions and Citation Group services (collectively, the Services).

2. Application of this policy

This Privacy Policy relates to Personal Information collected by Citation Group. ‘Personal information’ means information or an opinion about an individual whose identity is apparent, or can reasonably be ascertained, from the information or opinion.

This policy does not apply to the storage, use or disclosure of employee records. Employee records may be held, used or disclosed by Citation Group in any way that is directly connected to the employment relationship, as permitted by law.

3. What information does Citation Group collect?

In general, Citation Group collects and process the following types of personal information (although the specific types of information that we collect and process about you will depend on how you interact with us and our Services, as explained further in section 3 below):

• Recruitment Data: if you are someone seeking employment with Citation Group, Citation Group may collect and hold information including your name, address, email address, contact telephone number, gender, age, employment history, references, resume, medical history, emergency contact, taxation details, qualifications and payment details. If you are a referee of a prospective employee, the Company may collect and hold information including your name, contact details, current employment information and professional opinion of the prospective employee.
• Contact Data: we may collect information you provide to us if you communicate with us by e-mail, telephone, in person, on social media, complete forms, or provide reviews and testimonials about us and our Services.
• Client Details: if you are a representative of a client of Citation Group, Citation Group may collect and hold information including your name (including name prefix or title), contact details (such as your postal address, email address and phone number(s)), nationality, identification, gender, organisation, business interests, employment, positions held, billing and financial information (such as billing address, bank account and payment information) and enquiry/complaint details.
• User Data: if you are an individual end user of our Services, then we may collect, store, and otherwise process information about you that you provide, upload to, input, or generate from your use of our Services. We may also collect or infer certain information from your use of our Services, such as the particular Services you access, features you use, time of access, login attempts, duration of each usage session, where you access our Services from, and your Service settings, preferences, and usage habits.
• Customer Data: customers of our Services have the ability to upload data into the platforms we use to perform those Services. As part of your employment or other relationship with one of our customers, we may collect, store and otherwise process information about you in the performance of our Services.
• Technical Data: if you interact with our websites or our SaaS Services, technical data such as your device types used to access our Services (e.g. mobile or desktop), your device’s operating system (e.g. iOS, Windows, or Android), application software, browser type and settings (e.g. language, time zone, location), Internet Protocol (IP) address, MAC address, and access times.
• Support Data: such as information you provide to us when you make a request for support in relation to our Services, and information we can see from your screen or account if we need to provide remote support using a ‘share-screen’ feature, or if we need to access your account remotely.
• Public and Third Party Data: such as information you make public on your social media profiles (e.g. LinkedIn), which is publicly available from third-party websites, or which is provided to us by third party (e.g. referrers).
• Marketing Data: such as your preferences for receiving marketing from us and the Citation Group, marketing lists you are part of, topics you are interested in receiving marketing communications about, and your communication preferences.
• Supplier Details: if you are a supplier of Citation Group, Citation Group may collect, hold, use and disclose information including your name, address, email address, contact telephone number, business records, billing information, information about goods and services supplied by you.

4. How we collect your personal information

We collect personal information directly from you when you interact with us or with our Services. The table below sets out some of the ways you may provide personal information to us, and the types of personal information we collect in these ways.

How you interact with us	Types of personal information we collect
You access our websites	Technical Data
You seek employment with us or provide a reference for a potential employee	Recruitment Data
You communicate with us by e-mail, telephone, in person, on social media, complete forms, or provide reviews and testimonials about us and our Services.	Contact Data Client Details
You order our Services, use our Services, or upload or generate documents using our Services.	Client Details User Data Technical Data
You contact our support representatives	Support Data
You sign-up to receive marketing communications, sign-up for a promotion or event, or participate in a referral program	Marketing Data
You supply goods or services to us	Supplier Details

We may also collect personal information about you from third party sources. The table below summarises some of the different third party sources we may use to collect your personal information, and the types of personal information we collect from these sources.

Source	Types of personal information we collect
Third party referrers.	Contact Data Recruitment Data
Social media profiles (e.g. LinkedIn) that are set to public, and public website profiles (including those created by your employer).	Contact Data Technical Data
Your employer (where you are an end user of a Service)	User Data Customer Data
Analytics providers and advertising networks	Marketing Data

5. How do we use and disclose your personal information?

We use and disclose the personal information that we collect only for the purposes described in this Privacy Policy or for purposes that we explain to you at the time of collection. This includes for the purpose of:

• offering and providing our Services;
• managing and administering our Services;
• developing and improving our Services;
• undertaking our recruitment, employment, procurement and vendor management processes;
• marketing and business development;
• meeting legal or other regulatory obligations imposed on us;
• auditing and managing the usage of our website and Services;
• our record keeping and customer management processes;
• to process and respond to any complaint made by you;
• direct marketing (for example, advising you of new goods and/or services being offered by Citation Group); and
• to protect and enforce our legal rights.

Depending on our purpose for collecting your personal information, we rely on one or more of the following legal bases:

• Performance of a contract: we require certain personal information in order to provide the Services you purchase or request from us, and which we have agreed to provide, under a contract.
• Consent: in certain circumstances, we may ask for your consent (separately from any contract between us) before we collect, use, or disclose your personal information, in which case you can voluntarily choose to give or deny your consent without any negative consequences to you.
• Compliance with our legal obligations: there may be instances where we must collect, store, process, or disclose your personal information to comply with our legal obligations.
• Legitimate interests: we may use or disclose your personal information for our legitimate business interests. Where we need to process your data to pursue our legitimate interests, it will be in a way which is reasonable for you to expect as part of the running of our business and which does not materially affect your rights and freedoms.

6. Who do we share your personal information with?

We may share your personal information as permitted by law, including to the following categories of recipients:

• Other members of the Citation Group, who provide services necessary to provide you with our Services, or who otherwise process personal information for purposes described in this Privacy Policy.
• Our customers, who may be a company, franchisor, association, or parent or group entity, with whom you are employed or engaged or otherwise have a relationship.
• Third party payment processors, who we use to process payments when you contract for our Services. The third party processor will need to collect and process your payment data (such as your payment card or bank account details) to process your payments.
• Third party service providers, who provide services to us as necessary to provide you with our Services, or who otherwise process personal information for purposes described in this Privacy Policy. We may also share personal information with providers of third party services that interface with or are integrated with our Services, if you request to use those third party services.
• Third party services and business partners – when you use third party and partner services linked through our website or online Services (for example, third party payment services) your personal information will be collected by the provider of such services. Please note that when you use third party services, their own terms and privacy notices will govern your use of their services.
• Any competent law enforcement body, regulatory, government agency, court or other third party (such as our professional advisers) where we believe disclosure is necessary (i) as a matter of applicable law or regulation, (ii) to exercise, establish or defend our legal rights, or (iii) to protect your vital interests or those of any other person.
• A buyer (and its agents and advisers) in connection with any actual or proposed purchase, merger or acquisition of any part of our business, provided that we inform the buyer it must use your personal information only for the purposes disclosed in this Privacy Policy.
• Any other person with your consent to the disclosure.

7. How do we keep your personal information secure?

Citation Group will take reasonable steps to protect the personal information from misuse, interference, loss and from unauthorised access, modification or disclosure.

Where you have an account with us that uses a unique password to enable you to access our Services, it is your responsibility to keep this password secure and confidential.

8. International data transfers

Our servers and the Citation Group companies are located in Australia.

We use a number of third-party providers to support our business and delivery of our Services, including cloud hosting and infrastructure, customer relationship management, communications, analytics and customer support tooling. Some of these providers may store, process or access personal information outside Australia. Our principal service providers handle personal information in Australia, the United States, the United Kingdom, the European Union, Singapore and New Zealand. We use a range of other technology services to support our operations, and it is not practicable to list every country in which those providers or their subcontractors may operate.

Privacy laws in those countries may differ from Australian laws. Before disclosing personal information to a third-party provider based outside Australia or New Zealand, we take reasonable steps to ensure the recipient does not breach the Australian Privacy Principles such as due diligence on the provider’s security and privacy practices, contractual obligations covering the handling, security and return or destruction of personal information, and periodic review of those arrangements.

We remain accountable under the Privacy Act 1988 (Cth) for personal information we disclose to overseas recipients.

9. Cookies

When you access our website or use any of our online Services, a number of cookies are used by us and by third parties to allow the website to function, to collect useful information about visitors, and to help to make your user experience better. Such information enables us to improve our products and services. The information that may be recorded includes information regarding your:

• server address;
• domain name;
• date and time of visit;
• previous websites visited; and
• browser type and operating system; and location data.

10. Data retention

We retain the personal information we collect from you where we have an ongoing legitimate business need to do so (for example, to provide you with a service you have requested or to comply with applicable legal, tax or accounting requirements).

In certain circumstances, we will need to keep your personal information for legal reasons after your contract for our Services has ended. The specific retention periods depend on the nature of the personal information and why it is collected and processed and the nature of the legal requirement.

When we have no ongoing legitimate business need or legal reason to process your personal information, we will either delete or anonymise it. If this is not possible (for example, because your personal information has been stored in backup archives), then we will securely store your personal information and isolate it from any further processing until deletion is possible.

11. How to access and correct your personal information?

You may ask to access any personal information that we hold about you at any time by contacting us using the details set out in section 14.

If you believe that any personal information that we hold about you is incorrect, incomplete or inaccurate, then you may ask that we correct that data. We will consider your request for correction, and if we do decide not to make the correction, then you can ask that we add a note to the personal information that we hold stating that you disagree with it.

We will try to provide you with suitable means of accessing the personal information (for example, by posting or emailing it to you), and may charge you a reasonable fee to cover our administrative and other reasonable costs in providing the data to you. We will not charge you for simply making the request and will not charge for us making any corrections to your personal information.

There may be instances where we cannot grant you access to the personal information we hold. For example, we may need to refuse access if granting access would interfere with the privacy of others or if it would result in a breach of confidentiality or legal professional privilege. If that happens, we will provide you with written reasons for our decision.

12. How to make a complaint?

If you believe that your privacy has been breached, please contact us using the details set out in section 14 and provide us with details of your concerns so that we can investigate the matter further. We will treat your complaint confidentially, and will try to investigate and resolve your complaint within a reasonable period of time.

You may also lodge a complaint with your local supervisory authority (in Australia with the Office of Australian Information Commissioner, by calling 1300 363 992 or sending an email to enquiries@oaic.gov.au).

More information about your rights and our obligations in relation to privacy, and information on making a privacy complaint is available at the Office of the Australian Information Commissioner, which can be contacted at www.oaic.gov.au, or by post to GPO Box 5218 Sydney NSW 2001, or by email to enquiries@oaic.gov.au.

13. Updates to this Privacy Policy

We may update this Privacy Policy from time to time in response to changing legal, regulatory, technical, or business developments. When we update our Privacy Policy, we will act appropriately to inform you, consistent with the significance of the changes we make. We will obtain your consent to any material Privacy Policy changes if, and where, required by applicable data protection laws.

You can see when this Privacy Policy was last updated by checking the “last updated” date displayed at the top of this Privacy Policy.

14. How to contact us

If you have any questions or concerns about how we use of your personal information, how long we retain your personal information, or the steps we take to protect your personal information, please contact us at: