Privacy Policy

Yasso Transport Pty Ltd (ABN 85 682 428 404) · Queensland, Australia · Contact: privacy@yassotransport.com · Last updated: 6 July 2026

This policy explains how Yasso Transport (“we”, “us”) collects, uses, stores, and deletes personal information in our workforce transport service and software (the admin portal at admin.yassotransport.com, the driver app, and the worker sign-up form at join.yassotransport.com). We handle personal information in line with the Australian Privacy Principles (APPs) under the Privacy Act 1988 (Cth), and we structure our practices to also respect GDPR-style rights.

1. What we collect

Workers / passengers (people who ride our transport):

• Identity & contact: name, date of birth, mobile number, country of origin.
• Transport details: pickup address/area, roster/crew, shift start times, service history (dates you were on or off our service).
• Employment context: whether you’re employed under the PALM scheme (Pacific Australia Labour Mobility) — recorded because your employer’s workforce and transport arrangements can differ for PALM participants.
• Attendance: which runs you were on, check-ins (including QR check-in timestamps), and drop-off records.
• If you use the sign-up form: everything entered on that form, plus the submission record.

Drivers:

• Name, login PIN (stored only as a secure hash), run assignments.
• Location: a driver’s GPS position is captured and stored when a run starts (the starting point), and the live position during a run is used to show the vehicle on the run map and calculate ETAs. Live movements are not stored as a location history.

Administrators / staff:

Name, email address, password (secure hash only), and a security log of sign-in events.

Technical:

IP addresses in security and rate-limit logs, essential session cookies (no advertising or cross-site tracking cookies), and anonymised page analytics.

Sensitive information: we do not seek to collect sensitive information (such as health, biometric, or racial/ethnic data). Country of origin and PALM-scheme participation are collected solely as employment and transport context provided by you or your employer — not to infer anything else about you.

Anonymity: because we physically transport identified people and report attendance to your employer, using this service anonymously or under a pseudonym isn’t practicable (APP 2). You can, however, browse our public pages without identifying yourself.

2. How we collect it

• Directly from you — the worker sign-up form (with the consent notice shown there), or driver/admin account setup.
• From your employer or host company — when a client provides its workforce roster so we can run their transport. Where we receive your details this way, this policy is our notice to you of that collection (APP 5).
• Automatically — attendance events, security logs, and the driver location described above.

3. Why we collect it (purposes)

• To run the transport service: build daily runs, know who to pick up and where, and check people on and off vehicles safely.
• To report to your employer/host company: attendance and utilisation reports (your employer arranged this transport; attendance reporting to them is a core purpose of the service).
• Safety and security: contact tracing on shared vehicles, driver/vehicle assignment, account security logs.
• Billing and business records: run and attendance data supports invoicing between Yasso and its clients.

We do not sell personal information, use it for advertising, or share it with anyone outside the parties described here.

4. Who we share it with

• Your employer / host company — attendance and workforce transport reports about its own workforce only.
• Service providers (processors) that host or move our data:

Some providers are located overseas (APP 8) — principally the United States (Resend, Sentry, Slack) and the European Union (Make.com), with Google Maps operating globally. We choose Australian regions where offered (our database and compute are in Sydney) and configure overseas tools to minimise personal information sent to them.

No one else, unless required by law.

5. How we protect it

Access controls with per-person accounts and role restrictions; database-level row security; encryption in transit and at rest (provider-managed); security event logging and monitoring; secrets management and scanning; regular security testing. Drivers can only see the information needed for their own runs.

6. How long we keep it (retention)

We keep a retention period for every class of data we hold. Headlines:

• Worker profile details: while you’re on the service, then 12 months after departure, after which identifying details are permanently removed.
• Attendance and run records: retained longer as business/billing records (up to 7 years), but de-identified after 2 years — the numbers stay, your name doesn’t.
• Sign-up submissions: 90 days after a decision.
• Security logs: 12 months.
• Our own employees (drivers and staff): employment-related records — including run assignments and times — are kept for 7 years, as Australian employment law requires (Fair Work Act).
• Backups: our database backups are kept on a 7-day rolling window — data deleted from the system is gone from all backups within 7 days.

7. Your rights

You can ask us to:

• Access the personal information we hold about you (APP 12).
• Correct it (APP 13) — workers can also ask their site admin to update details.
• Delete it — we will permanently remove your identifying information, subject to records we’re legally required to keep (e.g. business/billing records, which we de-identify rather than keep in identifiable form).

Send requests to privacy@yassotransport.com. We verify identity, action requests, and respond within 30 days.

Complaints: if you believe we’ve mishandled your personal information, complain to privacy@yassotransport.com first — we’ll acknowledge your complaint promptly, investigate, and give you a written response within 30 days. If you’re not satisfied with our response, you can complain to the Office of the Australian Information Commissioner (oaic.gov.au, 1300 363 992).

Data breaches: if a data breach is likely to result in serious harm, we will notify affected individuals and the OAIC as required by the Notifiable Data Breaches scheme.

8. AI use

We use AI tools to help develop and operate our software. Details: see our AI-use disclosure. No decisions about individuals are made by automated systems.

9. Changes

We’ll post updates to this page and note the date above. Material changes affecting workers will also be notified through the client site admin.