NORWEST EXPLORATION AND MINING

NORGEO

Version 2.1 16 August 2026

1. About This Privacy Policy

This Privacy Policy explains how Norwest Exploration Pty Ltd (ACN 664 934 598) trading as Norwest Exploration and Mining and NORGEO ("Norwest", "we", "us" or "our") collects, holds, uses, and discloses your personal information in accordance with the Privacy Act 1988 (Cth) (the "Privacy Act") and the 13 Australian Privacy Principles ("APPs").

Norwest is a specialist contractor services business supplying skilled geologists and field technicians to the Australian mining and exploration industry. We are based in Mount Isa, Queensland and hold a labour hire licence under the Labour Hire Licensing Act 2017 (Qld).

This Privacy Policy applies to all personal information we collect through our websites, the NORGEO recruitment platform, and in the course of providing our services. It covers:

Candidates : individuals who register on our platform, apply for opportunities, or otherwise engage with us as prospective workers;
Clients : companies and organisations that engage Norwest to source skilled personnel; and
Website visitors : anyone who browses our websites without registering.

We recommend reading this Privacy Policy together with our Website Terms of Use, which governs your use of our websites and the NORGEO platform.

2. Our Websites and Platforms

This Privacy Policy applies to personal information collected through the following websites and platforms operated or used by Norwest:

norwestexploration.com.au
norgeo.com.au
norgeo.norwestexploration.com.au (the NORGEO Platform)

We also collect personal information through the following third-party platforms in the course of our recruitment operations:

seek.com.au
indeed.com.au
LinkedIn and other professional networking platforms

We may use additional recruitment platforms or job boards from time to time. Where we do, collection through those platforms will be subject to this Privacy Policy.

3. What Is Personal Information?

Under the Privacy Act 1988 (Cth), personal information means information or an opinion about an identified individual, or an individual who is reasonably identifiable, whether the information or opinion is true or not and whether it is recorded in a material form or not.

Sensitive information is a subset of personal information that receives additional protection under the Privacy Act. It includes information or opinions about an individual's racial or ethnic origin, political opinions, membership of a political association, religious beliefs or affiliations, philosophical beliefs, membership of a professional or trade association, membership of a trade union, sexual orientation or practices, criminal record, health information, genetic information, and biometric information.

4. What Personal Information Do We Collect?

The categories of personal information we collect depend on how you interact with us and whether you are a Candidate, Client, or general website visitor.

All Website Visitors

When you browse our websites, we may automatically collect technical and usage data, including:

IP address and general location data derived from it
browser type and version, operating system, and device type
pages visited, time spent on pages, and navigation paths
referring website or source
cookies and similar tracking technologies (see Section 11)

Candidates

If you register on the NORGEO Platform, apply for an opportunity, or otherwise engage with us as a prospective worker, we may collect the following personal information:

Identification and contact details

full name, title, date of birth
email address, phone number, residential address
photograph (if provided)

Professional and qualifications data

CV/resume and cover letters
educational qualifications, professional certifications, and licences
work history, skills, and competencies
professional memberships and registrations
references and recommendations
results of technical, behavioural, or psychological assessments (where applicable)

Employment-related data

tax file number and superannuation details (upon engagement)
bank account details (upon engagement)
immigration status and right-to-work documentation (including passport copies)
emergency contact details

Sensitive information (Candidates)

We may collect the following sensitive information where it is reasonably necessary for our functions or activities and with your consent:

health and medical information, including fitness-for-work declarations, pre-employment medical assessments, drug and alcohol testing results, and disability information relevant to workplace accommodations
details of workplace injuries, incidents, or rehabilitation programs
criminal history information (where required for specific roles or by applicable legislation)
racial or ethnic origin (where collected for equal opportunity monitoring or as required by law)
trade union membership

We will only collect sensitive information with your consent, or where the collection is required or authorised by law (APP 3.3). Sensitive information is collected for specific, identified purposes and is handled with additional safeguards. We will not use sensitive information in connection with any artificial intelligence or automated decision-making features.

Clients

If you engage with us as a Client (or prospective Client), we may collect:

business contact details of key personnel (name, title, email, phone number)
company name, ABN/ACN, and registered address
details of your personnel requirements and site-specific information
billing and payment information
correspondence and communications with Norwest

5. How We Collect Personal Information

We collect personal information in the following ways:

Directly from you: when you register on the NORGEO Platform, create a profile, submit an application, upload documents, complete forms, correspond with us by email or phone, attend interviews, or visit our offices.
Through the NORGEO Platform: when you interact with the Platform, including when automated tools process your CV or profile information (see Section 7).
From third-party platforms: when you apply for an opportunity through SEEK, Indeed, LinkedIn, or other job boards, or when a recruiter or referral source provides your information to us.
From publicly available sources: such as your LinkedIn profile or other professional networking platforms, where the information is publicly accessible.
From Clients and host employers: who may provide us with feedback, performance information, or incident reports relating to your engagement.
Automatically: through cookies and similar technologies when you visit our websites (see Section 11).

Where it is reasonable and practicable to do so, we will collect personal information directly from you (APP 3.5). We will notify you of certain matters at or before the time of collection, or as soon as practicable afterwards, as required by APP 5.

6. Why We Collect, Use, and Disclose Personal Information

We only collect personal information that is reasonably necessary for one or more of our functions or activities (APP 3.2). We will not use or disclose your personal information for a purpose other than the primary purpose for which it was collected, except where:

you would reasonably expect us to use or disclose it for a related secondary purpose;
you have consented;
it is required or authorised by or under an Australian law or a court/tribunal order; or
a permitted general situation or permitted health situation exists (as defined in the Privacy Act).

Purposes for Candidates

We collect and use Candidate personal information for the following primary purposes:

assessing your suitability for current and future opportunities with our Clients
operating the NORGEO Platform and managing your account and profile
matching your qualifications, skills, and preferences against available opportunities (including through AI-assisted tools see Section 7)
facilitating introductions and placements with Clients and host employers
managing your engagement, including onboarding, payroll, superannuation, and work health and safety compliance
complying with our obligations under applicable legislation, including the Work Health and Safety Act 2011, Fair Work Act 2009, and Labour Hire Licensing Act 2017 (Qld)
conducting pre-employment checks, including verification of qualifications, right-to-work status, medical fitness, and criminal history (where required)
managing workers' compensation claims and workplace health and safety incidents
communicating with you about your application, engagement, or opportunities
improving our services and the Platform experience

Purposes for Clients

We collect and use Client personal information for the following primary purposes:

managing the commercial relationship between Norwest and the Client
providing specialist contractor services, including sourcing and placing personnel
communicating about available candidates, engagements, and service delivery
issuing invoices and managing payments
complying with contractual and legal obligations

General Purposes (All Users)

We may also use personal information for the following general purposes:

administering and improving our websites, Platform, and services
responding to enquiries, feedback, and complaints
conducting analytics and research to improve our services
direct marketing (see Section 10)
complying with legal obligations and cooperating with regulators or law enforcement
protecting our legal rights, property, or safety, or the rights, property, or safety of our users or third parties

7. Artificial Intelligence and Automated Decision-Making

This section provides transparency about Norwest's use of artificial intelligence ("AI") and automated decision-making tools, including the disclosures required by Australian Privacy Principles 1.7, 1.8, and 1.9 as introduced by the Privacy and Other Legislation Amendment Act 2024 (Cth).

How We Use AI and Automated Tools

Norwest uses AI and automated tools in connection with the following activities:

CV and document parsing: Automated tools extract, organise, and structure information from CVs, resumes, and qualification documents submitted by Candidates, to facilitate review by Norwest personnel and presentation to Clients. Extracted information is presented to the Candidate for review and confirmation before it is saved to their profile.
Candidate–opportunity matching: Automated tools may analyse Candidate profile information (including qualifications, experience, competencies, and location preferences) against the requirements of available opportunities to generate suggested matches or rankings.
Communications: AI tools may assist in drafting, personalising, or preparing communications including emails, notifications, and recruitment correspondence.
Content generation: AI tools may assist in creating job descriptions, marketing materials, website content, and business documents.
Platform development: AI tools may assist in the design, development, and improvement of the NORGEO Platform.

Kinds of Personal Information Used in Automated Decision-Making (APP 1.8)

Where automated tools are used to make, or do things substantially and directly related to making, decisions that could reasonably be expected to significantly affect an individual's rights or interests, the following kinds of personal information may be used:

professional qualifications, certifications, and licences
work history and professional experience
skills, competencies, and technical expertise
location and mobility preferences
CV/resume content and uploaded documents
job preferences and role criteria

We do not use sensitive information (including health, racial, ethnic, or criminal history data) in any AI or automated decision-making process.

Kinds of Decisions Made or Supported by Automated Means (APP 1.8)

The kinds of decisions that are made, or for which automated tools perform functions substantially and directly related to making, include:

generating suggested matches between Candidate profiles and available opportunities
ranking or prioritising Candidates based on the relevance of their profile to an opportunity's requirements
extracting and structuring information from CVs and documents for profile creation

These automated processes assist Norwest personnel in decision-making. They do not make final decisions about whether a Candidate is placed, engaged, or excluded from consideration for any opportunity. Human oversight is maintained at every stage where a decision could significantly affect an individual's rights or interests.

Human Oversight

No Candidate will be excluded from consideration for an opportunity solely on the basis of an automated process without human review by Norwest personnel. All automated outputs (including match recommendations and rankings) are reviewed by a human decision-maker before any material decision is communicated to a Candidate or Client.

Your Right to Request Human Review

If you believe that an automated process has been used in a way that has materially affected your application or candidacy, you may request a human review by contacting us at [email protected]. We will acknowledge your request promptly and provide you with the outcome within a reasonable timeframe.

AI Sub-Processors

In connection with our AI features, we may engage third-party AI service providers as sub-processors. Where we do so, we take reasonable steps to ensure that the provider handles personal information in accordance with the APPs, including by entering into contractual arrangements that address data security, use limitations, and prohibitions on using your data to train the provider's general models. Details of our current AI sub-processors are available on request.

Limitations of AI-Generated Content

Content generated or assisted by AI tools may contain errors, inaccuracies, or omissions. We take reasonable steps to review AI-assisted outputs for accuracy, but do not warrant that all AI-generated content is complete, current, or error-free.

8. Disclosure of Personal Information

We may disclose your personal information to the following categories of recipients for the purposes described in Section 6:

Clients and host employers: We share Candidate information with Clients and host employers to facilitate the matching, engagement, and management of personnel. This is a core function of our business.
Service providers: Third-party providers who assist us in operating our business, including cloud hosting and storage providers (e.g. Microsoft 365, SharePoint), payroll and accounting platforms (e.g. Xero), recruitment platforms (e.g. SEEK, Indeed), AI service providers, and IT support.
Insurers and workers' compensation bodies: Including WorkCover Queensland and relevant insurers, for the purposes of managing workplace incidents, claims, and coverage.
Professional advisers: Including lawyers, accountants, and auditors who provide professional services to Norwest.
Government agencies and regulators: Where required by law, including the Australian Taxation Office, Fair Work Ombudsman, WorkSafe regulators, Queensland Labour Hire Licensing Compliance Unit, and law enforcement agencies.
Referees and background check providers: To verify qualifications, employment history, and conduct pre-employment checks where authorised by you or required by law.

We will not sell your personal information to third parties. We will not disclose your personal information to any person or entity other than as described in this Policy, except with your consent or as required or authorised by law.

9. Cross-Border Disclosure of Personal Information

Norwest is an Australian business and our operations are primarily domestic. We do not routinely disclose personal information to overseas recipients. However, some of the third-party service providers we use may store or process data in overseas locations, including:

Cloud hosting providers (e.g. Microsoft 365) may store data in data centres located in Australia, the United States, and other jurisdictions.
AI service providers may process data in the United States or other jurisdictions where their servers are located.
Recruitment platforms (e.g. SEEK, Indeed) may have international infrastructure.

Before disclosing personal information to an overseas recipient, we will take reasonable steps to ensure that the recipient does not breach the APPs in relation to that information, as required by APP 8. Where we cannot ensure APP-equivalent protections, we will either obtain your informed consent to the disclosure (after informing you that APP 8.1 will not apply) or decline to make the disclosure.

If you would like to know the specific countries to which your personal information may be disclosed, please contact us.

10. Direct Marketing

We may use your personal information to send you direct marketing communications about our services, opportunities, and industry updates, where:

we collected the information directly from you;
you would reasonably expect us to use or disclose the information for that purpose; and
we provide a simple means for you to opt out.

We will not use sensitive information for direct marketing purposes.

You may opt out of receiving direct marketing communications at any time by using the unsubscribe mechanism included in our communications, adjusting your preferences in your NORGEO Platform account, or contacting us at [email protected]. We will action your opt-out request within a reasonable period and at no cost to you, as required by APP 7.

11. Cookies and Website Analytics

Our websites may use cookies and similar technologies to collect technical and usage data. Cookies are small text files stored on your device that help us recognise returning visitors, analyse usage patterns, and improve your experience.

We may use:

Essential cookies: necessary for the website to function (e.g. session management, security).
Analytics cookies: to understand how visitors use our websites (e.g. Google Analytics or similar services). These cookies collect aggregated, anonymised data about page views, traffic sources, and navigation behaviour.
Functional cookies: to remember your preferences and settings.

You can manage your cookie preferences through your browser settings. Most browsers allow you to refuse or delete cookies. Disabling cookies may affect the functionality of our websites.

We do not currently use advertising or targeting cookies. If this changes, we will update this Policy and, where required, implement a cookie consent mechanism in accordance with applicable law.

12. Data Retention

We retain personal information only for as long as is reasonably necessary for the purposes for which it was collected, or as required by law. Our general retention periods are:

Candidate profiles and application data: Retained for the duration of your active engagement with us. If you are not placed or engaged, we will retain your profile for up to [24 months / specify period] to match you against future opportunities, unless you request earlier deletion.
Engaged worker records: Retained for the duration of your engagement and for a minimum of 7 years after the engagement ends, as required by employment, taxation, and work health and safety legislation.
Workers' compensation and incident records: Retained in accordance with the applicable limitation periods under workers' compensation and workplace health and safety legislation (which may be longer than 7 years in some circumstances).
Client records: Retained for the duration of the commercial relationship and for 7 years after the relationship ends, as required by taxation and commercial law.
Website analytics data: Retained in aggregated, anonymised form. IP addresses and identifiable browsing data are retained for no longer than [specify period, e.g. 12 months].

When personal information is no longer required, we will take reasonable steps to destroy it or ensure that it is de-identified, in accordance with APP 11.2.

13. Data Security

We take reasonable steps to protect personal information from misuse, interference, loss, and from unauthorised access, modification, or disclosure, as required by APP 11.1. Our security measures include:

access controls and role-based permissions limiting who can access personal information within Norwest
encryption of data in transit (TLS/SSL) and, where applicable, at rest
secure cloud hosting with reputable providers that maintain industry-standard security certifications
regular review of our information handling practices and security measures
contractual security obligations imposed on third-party service providers

No data transmission over the internet or electronic storage method is completely secure. While we take reasonable steps to protect your personal information, we cannot guarantee its absolute security.

14. Your Rights

Access to Your Personal Information (APP 12)

You have the right to request access to the personal information we hold about you. We will respond to your request within a reasonable period (generally within 30 days). We may charge a reasonable fee for providing access where permitted by the Privacy Act, but will not charge for the making of the request itself.

We may refuse access in certain circumstances permitted by the Privacy Act, including where providing access would pose a serious threat to the life, health, or safety of any individual, or would unreasonably impact the privacy of another individual. If we refuse access, we will provide you with written reasons for the refusal.

Correction of Personal Information (APP 13)

You have the right to request correction of personal information we hold about you if you believe it is inaccurate, out-of-date, incomplete, irrelevant, or misleading. We will respond to your request within a reasonable period. If we correct information that we have previously disclosed to a third party, we will take reasonable steps to notify that third party of the correction (unless it is impracticable or unlawful to do so), upon your request.

Candidates with a NORGEO Platform account can update much of their personal information directly through their account settings at any time.

Complaints

If you believe that we have breached the APPs or otherwise mishandled your personal information, you may lodge a complaint with us by contacting [Insert Email Address]. We will:

acknowledge your complaint within 5 business days;
investigate the complaint and provide you with a written response within 30 days; and
take appropriate steps to rectify the situation, in consultation with you, if the complaint is well-founded.

If you are not satisfied with our response, you may refer the matter to the Office of the Australian Information Commissioner (OAIC):

Website: www.oaic.gov.au

Phone: 1300 363 992

Email: [email protected]

Mail: GPO Box 5288, Sydney NSW 2001

15. Notifiable Data Breaches

Norwest takes its obligations under the Notifiable Data Breaches scheme (Part IIIC of the Privacy Act 1988) seriously. If we become aware of an eligible data breach that is, unauthorised access to, disclosure of, or loss of personal information that is likely to result in serious harm to affected individuals we will:

take immediate steps to contain the breach and mitigate any potential harm;
conduct an assessment within 30 days (or sooner if practicable) to determine whether the breach is an eligible data breach;
if the breach is eligible, notify the OAIC and affected individuals as soon as practicable, including a description of the breach, the kinds of information involved, and recommendations for steps individuals can take to protect themselves; and
keep a record of the breach and our response, regardless of whether notification is required.

If you believe your personal information held by Norwest has been compromised, please contact us immediately at [email protected].

16. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or for other operational reasons. The date of the most recent revision will be shown at the top of this document.

Where we make material changes, we will take reasonable steps to notify you, including by posting a notice on our websites or sending an email to registered users. We encourage you to review this Privacy Policy periodically.

17. Contact Us

If you have any questions about this Privacy Policy, wish to access or correct your personal information, make a complaint, or request information about our AI sub-processors or cross-border disclosures, please contact us:

Norwest Exploration Pty Ltd

Trading as Norwest Exploration and Mining / NORGEO

80 Transmission Street

Mount Isa, Queensland 4825