Privacy Policy | ARUS Works

Last updated: November 2026

1. Who we are

This Privacy Policy explains how ARUS Works (ABN 71 806 817 076) ("we", "us", "our") handles personal information. We supply managed remote office assistants based in Indonesia to Australian businesses. We are based in Western Australia and our operations team is in Bandung, Indonesia.

We aim to handle personal information consistently with the Australian Privacy Principles (APPs) in the Privacy Act 1988 (Cth), even where the law may not strictly require it of a small business. For candidates in Indonesia we also comply with Indonesia's Law No. 27 of 2022 on Personal Data Protection (UU PDP).

2. What personal information we collect

Clients and prospective clients - name, job title, business name, ABN, email, phone, business address - details of the role you want filled, and messages you send us - billing and payment details (payments are processed by our bank and payment providers, such as Wise; we do not store full card numbers) - records of calls, meetings and WhatsApp or chat messages with us

Website visitors - information you enter in our contact form or chat - technical data: IP address, browser and device type, pages visited, referring site, approximate location, collected through cookies or similar tools (see section 9)

Candidates and staff in our talent pool - name, contact details, date of birth, city of residence - CV, education, work history, references, skills test results, interview notes, recordings of interviews (only with notice) - identity documents and tax or social security numbers, only when an offer is made and only as required to engage and pay staff - portfolio samples, photos and video introductions, only with consent

We do not intentionally collect sensitive information (such as health, religion, ethnicity or criminal records). If a law or a specific role requires it, we will ask for express consent first. We do not need, and ask you not to send, sensitive information through the website.

You may contact us without giving your name where practicable, but we usually cannot provide services or consider an application anonymously.

3. How we collect it

Mostly directly from you: through our website, contact form, chat bubble, WhatsApp, email, calls, job platforms and application forms. Sometimes from third parties, such as referees you nominate, public professional profiles (for example LinkedIn) or recruitment platforms, and only where it is reasonably necessary.

4. Why we collect and use it

to answer enquiries and prepare proposals
to match clients with suitable staff and to provide, manage and invoice our services
to recruit, assess and keep candidates in our talent pool, and to share candidate profiles with prospective clients
to engage staff, directly or through an employment partner
to keep our systems and our clients' systems secure
to improve our website and services
to send you service messages and, with your consent, marketing (you can unsubscribe at any time)
to comply with Australian and Indonesian law

We will not use your information for an unrelated purpose without your consent, unless the law allows it.

5. Who we disclose it to

our coordinator and team in Bandung, Indonesia
an employment partner in Indonesia, if we use one to employ staff
staff assigned to a client, who see the client information needed to do the work
prospective clients, who receive candidate profiles (with candidate consent)
service providers we use to run the business, mostly located in the United States: Vercel (website hosting), PostHog (website analytics), Web3Forms (contact form delivery), Google (email), WhatsApp (messaging), and accounting and payment tools as we add them
our professional advisers and insurers
government bodies or courts where the law requires it

We do not sell personal information.

6. Disclosure overseas (APP 8)

Our operations and staff are in Indonesia, so client and candidate information will be disclosed to and accessed from Indonesia. Some service providers store data in the United States and Singapore. Before disclosing personal information overseas we take reasonable steps to make sure the recipient handles it consistently with the APPs, including written confidentiality and data protection terms with our coordinator, our staff and our employer-of-record partner.

Client business data (for example accounting files or drawings) stays inside the client's own systems. Our staff work on it through the client's accounts and are not permitted to download or keep local copies unless the client agrees in writing.

7. Storage and security

We take reasonable steps to protect personal information from misuse, interference, loss, and unauthorised access, change or disclosure. These include: - reputable cloud services with encryption in transit and at rest - two-factor authentication on all our accounts and on client systems our staff access - access limited to people who need it - confidentiality agreements with all staff and partners - password managers, device screen locks and up-to-date software on staff devices - deleting or de-identifying information we no longer need

Candidate information in our talent pool is kept for up to 24 months after the last contact, unless the candidate asks us to delete it sooner. Client records are kept for at least 5 years, or longer where tax or other law requires.

No method of transmission or storage is completely secure, but we will act promptly if something goes wrong (see section 10).

8. Access and correction

You may ask for access to the personal information we hold about you, or ask us to correct it, by emailing hello@arusworks.com. We will respond within 30 days. We do not charge for a request, but may charge a reasonable fee for providing access in some cases. If we refuse, we will explain why in writing and tell you how to complain.

9. Cookies and analytics

We use PostHog, an analytics service hosted in the United States, to understand how visitors use this website: which pages are viewed, which buttons are clicked, how far pages are scrolled, and technical errors. PostHog may set a cookie or use local storage to recognise a returning browser, and may record anonymised session replays of how the page is used. Anything you type into a form is masked and never recorded in a replay. We do not use advertising or retargeting tools, and we do not sell this data.

You can block or delete cookies in your browser settings at any time; the site still works without them. If you hide the chat message, your browser remembers that choice in its local storage on your device.

10. Data breaches

If we suspect a data breach, we will act quickly to contain it and assess it. If it is an "eligible data breach" under the Notifiable Data Breaches scheme in Part IIIC of the Privacy Act (likely to result in serious harm), we will notify affected individuals and the Office of the Australian Information Commissioner (OAIC) as soon as practicable. Where a breach affects client data, we will tell the client promptly as set out in our client agreement. For candidate data, we will also give the notice required under Indonesian law (see section 12).

11. Complaints

If you have a concern about how we handle your personal information, please contact our Privacy Officer at hello@arusworks.com or Western Australia. We will acknowledge your complaint within 7 days and aim to resolve it within 30 days.

If you are not satisfied, you may complain to the Office of the Australian Information Commissioner: www.oaic.gov.au, phone 1300 363 992.

12. Candidates in Indonesia (UU PDP)

For candidates and staff in Indonesia, we (and any employment partner we use) also process personal data under Law No. 27 of 2022 on Personal Data Protection. In particular: - Consent: we process candidate data on the basis of explicit, informed consent given when you apply (and for performing a contract once you are engaged). You can withdraw consent at any time. - Your rights: to be informed, to access and obtain a copy, to correct, to delete or destroy, to withdraw consent, to object to automated decision-making, to restrict processing, and to data portability, as provided in the law. - Cross-border transfer: your data is shared with prospective clients and our company in Australia. We transfer it only with your consent and with appropriate safeguards, as required by Article 56 of the law. - Breach notice: if your data is compromised, we will notify you and the relevant authority in writing within 3 x 24 hours (72 hours) of becoming aware, as required by Article 46. - Contact: hello@arusworks.com or our coordinator in Bandung through the same address.

13. Changes

We may update this policy. The current version is always on our website, with the date it was last updated.

14. Contact

Privacy Officer, ARUS Works, Western Australia, hello@arusworks.com, +61 493 340 987.