Privacy Policy

1. Scope, responsible entity, and our role

This Privacy Policy applies to Longitude6 websites and services, including Nexus6 and workplace technology or assessment services offered, administered, supported, or coordinated by Longitude6.

“Longitude6”, “we”, “us”, or “our” means the Longitude6 entity identified in the applicable contract, order form, assessment invitation, collection notice, or other service documentation. If you need to identify the Longitude6 entity responsible for a specific service, contact support@longitude6.com.

Our privacy role depends on the context:

• Website, sales, account, support, and direct business interactions: Longitude6 generally determines why and how the information is used and acts as the relevant controller/business/APP entity.
• Client- or employer-arranged workplace assessments: the client or employer may determine the purpose of the assessment and act as controller/business, while Longitude6 acts as a processor, service provider, contractor, or similar role.
• Technology partners: some services are delivered with third-party workplace technology providers. Their own privacy terms may also apply where they independently determine how information is processed.

2. Privacy laws

Depending on where individuals are located, where Longitude6 operates, and the nature of the service, applicable privacy laws may include the Australian Privacy Act 1988 (Cth) and Australian Privacy Principles, UK GDPR and Data Protection Act 2018, EU GDPR where applicable, Canadian privacy laws including PIPEDA and applicable provincial laws, and United States federal and state privacy laws. California-specific rights apply only where the California Consumer Privacy Act (CCPA) applies to the relevant entity and processing activity.

3. Personal information we collect

We apply data minimisation principles and seek to collect information that is reasonably necessary for the relevant service or business purpose.

Website and business information

• Name, work email, phone number, company, country, and job title.
• Demo requests, messages, support requests, meeting details, and business correspondence.
• Account, contract, billing, subscription, and customer-success information where applicable.
• Browser, device, network, IP address, page activity, referral information, and website analytics.

Workplace and assessment information

• Employer, department, role, work location, job tasks, equipment, work demands, and related job information.
• Video, images, or recordings of work tasks or movement where required by a selected assessment method.
• Movement, posture, physical-demand, ergonomic, functional, wellbeing, or other assessment measurements and results.
• Survey responses, feedback, incident or injury-risk information, and health or safety information where relevant and lawful.
• Notes or reports created by authorised professionals, consultants, employers, or technology providers.

Sensitive, health, and video-derived information

Some assessment information may be considered sensitive information, health information, special-category data, biometric information, or another protected category under applicable law. Where additional consent, authorisation, or legal conditions are required, we or the relevant client/controller will identify and document the appropriate basis before processing.

Some technologies may derive movement, posture, or other measurements from video or sensor data. Unless specifically disclosed for a service, Longitude6 does not use workplace task video for facial-recognition identity authentication.

4. How we collect information

We may collect information:

• directly from you;
• from your employer, client organisation, consultant, healthcare professional, or authorised representative;
• through our website, forms, software, surveys, support channels, and scheduling tools;
• through selected technology partners used to deliver the service; and
• from publicly available or lawful business sources where appropriate.

Where required, a collection notice or Participant Privacy Notice will provide additional information at or before the time information is collected.

5. How and why we use personal information

We do not use personal information for a materially different purpose without providing additional notice and obtaining consent where required.

6. Sensitive and special-category information

Where sensitive, health, or special-category information is processed, we apply additional safeguards. The applicable condition depends on the service and jurisdiction. This may include explicit consent where appropriate, an employment or workplace-safety basis authorised by law, health or social-care grounds where applicable, substantial public interest grounds, legal claims, or another lawful condition.

In employment settings, consent may not always be the most appropriate legal basis because of the relationship between an employer and worker. Where Longitude6 acts as a processor, the client/controller is responsible for selecting and documenting the lawful basis and providing required notices unless the contract assigns a specific obligation to Longitude6.

7. Automated analysis, AI, and decision support

Some Longitude6 services or technology-partner services use software, computer vision, algorithms, sensors, or automated analysis to generate measurements, classifications, scores, risk indicators, recommendations, or reports.

These outputs are intended to support workplace assessment and decision-making. Unless specifically disclosed, legally permitted, and appropriately safeguarded, Longitude6 does not intend automated outputs to be the sole basis for decisions that produce legal or similarly significant effects, such as hiring, termination, eligibility, or healthcare decisions. Clients and employers should apply qualified human review, consider the context of the job and individual, and follow applicable employment, disability, health, safety, and anti-discrimination laws.

Where applicable law requires additional notice, explanation, access, review, or opt-out rights for automated decision technology, those rights will be provided.

8. Website analytics, cookies, and similar technologies

Our website is hosted on Squarespace and uses necessary cookies and similar technologies required to securely operate the site. Depending on your choices and our current site configuration, analytics/performance cookies and cookies from embedded or integrated third-party services may also be used.

Non-essential cookies are managed through the website cookie-consent controls where required. For details, including cookie categories and how to change preferences, see our Cookie Policy.

9. How we share personal information

We disclose personal information only where reasonably necessary for the relevant purpose, subject to contracts, confidentiality obligations, and applicable law. Recipients may include:

• the client or employer that arranged a workplace service or assessment;
• authorised consultants, healthcare or safety professionals, and other representatives involved in the service;
• technology, cloud, hosting, analytics, communications, CRM, scheduling, and support providers;
• workplace technology partners selected for the relevant service;
• professional advisers, auditors, insurers, and legal advisers;
• regulators, law-enforcement agencies, courts, or other authorities where required or authorised by law; and
• a successor or transaction party in connection with a merger, financing, acquisition, sale, or restructuring, subject to appropriate confidentiality and privacy protections.

We do not sell personal information. We do not use or disclose workplace assessment or health information for cross-context behavioural advertising. If website practices ever constitute a “sale” or “sharing” under applicable privacy law, we will provide the legally required notice and opt-out mechanism.

10. Service providers and technology partners

Providers vary by service and client configuration. Categories may include website hosting and analytics providers (including Squarespace), CRM and scheduling providers, cloud infrastructure providers, video hosting or streaming providers, business intelligence tools, workplace assessment technology providers, communications tools, and professional service providers.

Where practicable and appropriate, providers are bound by contractual privacy, confidentiality, security, and data-processing obligations. Additional provider information may be available in the applicable contract, order form, service documentation, or on request.

11. International data transfers

Longitude6 operates internationally and uses providers in multiple countries. Depending on the service, personal information may be stored, accessed, or processed in Australia, the United States, the United Kingdom, Canada, and other countries in which Longitude6, a client, or an authorised provider operates.

We do not rely on a blanket statement that simply providing information constitutes consent to all international transfers. Where transfer rules apply, we use an appropriate legal transfer mechanism and safeguards. These may include contractual protections, standard contractual clauses, the UK International Data Transfer Agreement or UK Addendum, recognised adequacy mechanisms, transfer-risk assessments/data-protection tests, or other lawful safeguards.

For Australian cross-border disclosures, we take reasonable steps required by applicable law to address how overseas recipients handle personal information and identify likely destination countries in collection notices where practicable.

12. Data retention and deletion

We keep personal information only for as long as reasonably necessary for the purpose for which it was collected, to meet contractual commitments, to follow a client's documented instructions where we act as processor/service provider, to maintain appropriate business and security records, or to comply with legal, regulatory, insurance, dispute, and limitation-period requirements.

Retention varies by data type, service, client contract, sensitivity, and jurisdiction. Assessment videos and sensitive information may have different retention requirements from account, support, billing, or legal records. Where practicable, specific retention periods or criteria will be provided in contracts, collection notices, assessment instructions, or other service documentation.

When information is no longer required, we take reasonable steps to delete, destroy, or de-identify it. De-identified or aggregated information that can no longer reasonably identify an individual may be retained for analytics, quality, research, or service improvement where lawful.

13. Security

We use administrative, technical, and organisational measures appropriate to the nature and sensitivity of the information. Measures may include encryption, secure hosting, access controls, authentication, least-privilege access, monitoring, confidentiality obligations, vendor due diligence, backups, incident response, and secure deletion practices.

No system is completely secure. If a privacy or security incident occurs, we assess it and provide notifications to affected individuals, clients, regulators, or authorities where required by applicable law.

14. Your privacy rights

Depending on applicable law and our role, you may have rights to:

• access or obtain a copy of personal information;
• correct inaccurate or incomplete information;
• request deletion or erasure;
• object to or restrict certain processing;
• withdraw consent where processing relies on consent;
• receive portable information in certain circumstances;
• opt out of certain sale, sharing, targeted advertising, or automated processing where those rights apply;
• request information about automated processing where required; and
• complain to an applicable privacy regulator.

If Longitude6 processes your information only on behalf of your employer or another client, we may direct your request to that organisation or assist it in responding. We may need to verify your identity and authority before completing a request.

Submit requests to support@longitude6.com.

15. Regional information

Australia

Where the Australian Privacy Act and Australian Privacy Principles apply, you may request access to or correction of personal information and lodge a privacy complaint. Sensitive information is collected only where the applicable requirements are met. We also address cross-border disclosures and collection notices as required.

United Kingdom and European Economic Area

Where UK or EU data-protection law applies, we identify a lawful basis for each processing activity and, for special-category information, an additional applicable condition. You may have rights including access, rectification, erasure, restriction, objection, portability, withdrawal of consent, and complaint to the relevant supervisory authority. International transfers are made using an applicable adequacy mechanism, safeguard, or exception.

Canada

Where Canadian privacy law applies, we follow applicable requirements relating to accountability, identifying purposes, meaningful consent where required, limiting collection, limiting use/disclosure/retention, safeguards, openness, access, correction, and complaint handling.

California

The CCPA applies only where its statutory criteria are met. Where Longitude6 is subject to the CCPA for a particular activity, California residents may have rights to know/access, delete, correct, opt out of sale or sharing, limit certain uses of sensitive personal information, receive required notices, and receive non-discriminatory treatment for exercising their rights. Where Longitude6 acts as a service provider or contractor for a client, the client may be responsible for responding to consumer requests.

16. Children

Our website and general workplace services are not directed to children. We do not knowingly collect personal information from children through the website for general marketing purposes. If information about a minor is processed in a legally permitted workplace, health, training, or other authorised context, additional consent, notice, and safeguarding requirements may apply.

17. Changes to this Policy

We may update this Privacy Policy to reflect changes in our services, technology, providers, or legal obligations. The current version will be posted on this page with the date of the latest update. Where required, we will provide additional notice of material changes.