Privacy Policy

Last updated: May 2026

AEC Labs is committed to handling your personal information in accordance with the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs). This policy explains what we collect, how we use it, and your rights.

1. Who We Are

AEC Labs ("we", "us", "our") operates the platform at aeclabs.com.au. We provide training, assessment and placement services for offshore Architecture, Engineering and Construction (AEC) professionals.

We are an Australian-operated business. For all privacy enquiries, contact our Privacy Officer at hello@aeclabs.com.

2. What Personal Information We Collect

We collect personal information that is reasonably necessary for our functions (APP 3). This includes:

  • Account information: name, email address, password (stored as a one-way hash), country, specialisation.
  • Profile information: LinkedIn URL, avatar image, training history, assessment results, certificate status and certificate codes.
  • Contact form submissions: name, email address, organisation, role, subject and message content.
  • Usage data: pages visited, login timestamps, IP address (held in server logs for security and fraud prevention).
  • Certification records: assessment submissions, evidence materials, issued certificates.

We collect sensitive information (such as details about your professional qualifications) only where you voluntarily provide it and consent to its use for assessment purposes.

3. How We Collect Personal Information

We collect personal information directly from you when you:

  • Create an account or apply for certification.
  • Submit a contact form or email us.
  • Use the platform and generate usage data automatically.

We do not collect personal information from third parties without your knowledge, except where permitted by law (e.g. fraud detection cross-referencing).

4. How We Use Your Personal Information

We use your information for the primary purposes for which it was collected (APP 6), including:

  • Creating and managing your account.
  • Conducting assessments and issuing certificates.
  • Operating the public certificate verification service.
  • Responding to enquiries and providing support.
  • Sending transactional emails (certificate issued, password reset, service notices).
  • Maintaining platform security and preventing fraud or misuse.
  • Improving the platform and understanding usage patterns.

We will not use your personal information for secondary purposes unless you have consented, or as otherwise permitted under the APPs.

We do not sell, rent or trade your personal information to third parties.

5. Certificate Public Verification

As a core function of the certification service, the following information is publicly accessible on the certificate verification page at /validate: certificate holder name, certification level, issue date, and certificate status (current, expired, or revoked).

You consent to this public disclosure as part of the certification application process. If you wish to have your certificate record removed from public display, contact us at hello@aeclabs.com. Note that removal may affect the verifiability of your credential.

6. Disclosure to Third Parties

We may disclose your personal information to the following categories of recipients (APP 6):

  • Service providers: cloud hosting (Railway, USA), transactional email providers (Postmark / Brevo), where necessary to operate the platform. We take reasonable steps to ensure these providers handle information in accordance with the APPs.
  • Partner firms: only with your explicit written consent, when you apply to a listed firm's opportunity.
  • Legal and regulatory authorities: where required or authorised by Australian law, court order, or regulatory obligation.

We do not otherwise disclose your personal information without your consent.

7. Overseas Disclosure

Some of our service providers are located overseas, including in the United States (cloud hosting and email delivery infrastructure). Before disclosing personal information to an overseas recipient, we take reasonable steps to ensure that recipient does not breach the APPs in relation to that information (APP 8.1).

Where we cannot ensure APP-equivalent protection, we will seek your consent before disclosure, or rely on another permitted exception under APP 8.2.

8. Data Quality and Security

We take reasonable steps to ensure the personal information we hold is accurate, up-to-date, complete and relevant (APP 10). We use industry-standard security measures including HTTPS/TLS encryption, hashed passwords, access controls and activity logging to protect personal information from misuse, interference, loss, unauthorised access, modification or disclosure (APP 11).

No system is completely secure. In the event of an eligible data breach (as defined by the Notifiable Data Breaches scheme under Part IIIC of the Privacy Act 1988), we will notify affected individuals and the Office of the Australian Information Commissioner (OAIC) as required by law.

9. Data Retention

We retain personal information for as long as your account is active and for a reasonable period thereafter to fulfil the purposes for which it was collected. Certification records are retained for an extended period to support ongoing verification. When we no longer require personal information for a permitted purpose, we will take reasonable steps to de-identify or destroy it (APP 11.2).

10. Access and Correction

You have the right to request access to personal information we hold about you (APP 12) and to request correction of information that is inaccurate, out-of-date, incomplete, irrelevant or misleading (APP 13).

To make an access or correction request, email hello@aeclabs.com with "Privacy Request" in the subject line. We will respond within 30 days. We may need to verify your identity before processing the request. In some cases, access may be refused on grounds permitted under APP 12.3 (e.g. where disclosure would be unlawful or unreasonable).

Note: deletion of certification records may not be possible where they form part of the public verification record or where we are required to retain them by law.

11. Anonymity and Pseudonymity

Where lawful and practicable, you may interact with us anonymously or using a pseudonym (APP 2). However, to apply for certification or access candidate features you must provide your real name, as certification records are issued to identified individuals.

12. Cookies and Tracking

We use a session cookie to keep you logged in during your visit. We do not use third-party advertising, tracking or profiling cookies. Our server logs record IP addresses for security purposes. We do not use this data for advertising targeting.

13. Complaints

If you believe we have interfered with your privacy rights, you may make a complaint by emailing hello@aeclabs.com. We will acknowledge your complaint within 5 business days and attempt to resolve it within 30 days.

If you are not satisfied with our response, you may complain to the Office of the Australian Information Commissioner (OAIC) at www.oaic.gov.au or by calling 1300 363 992.

14. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or legal obligations. Material changes will be notified via email or a notice on the platform. The current version is always available at aeclabs.com.au/privacy. Your continued use of AEC Labs after changes take effect constitutes acceptance of the updated policy.

15. Contact Our Privacy Officer

For any privacy-related questions or concerns, please contact:
Privacy Officer — AEC Labs
Email: hello@aeclabs.com
Website: aeclabs.com.au