How Daylight collects, uses, and protects your information — and the rights you have under Australian law.
Daylight Risk & Resilience ("Daylight", "we", "us", "our") is operated as a sole trader under ABN 90 296 738 135.
This Privacy Policy explains how we collect, use, store, disclose, and protect information in connection with:
This policy should be read alongside our Terms and Conditions, which govern the use of the Website and all Engagements.
Daylight is committed to handling personal information in accordance with the Australian Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs).
We collect different categories of information depending on how you interact with Daylight:
1. Client organisational data
When an organisation engages Daylight, we collect information necessary to conduct the Engagement, including:
2. Anonymous survey response data
As part of each Engagement, Daylight deploys an anonymous employee survey. We collect the survey responses only. We do not collect names, email addresses, IP addresses, or any other personally identifying information from survey participants. Responses are stored in non-identifying form and cannot be attributed to any individual.
The Survey includes optional open-text fields. While responses are anonymous, participants are advised that free-text comments describing unique personal circumstances could potentially be recognisable. Daylight treats all open-text responses with the same anonymity protections as structured responses.
3. Website visitor data
When you interact with the Website, we may collect:
4. Business Case Calculator data
The Business Case Calculator tool on the Website processes all inputs (organisation name, headcount, average salary, and other parameters) entirely within your browser using client-side JavaScript. No data entered into the Calculator is transmitted to Daylight's servers or stored in any database.
We collect information through the following methods:
We collect information only for the purposes set out below:
We do not use any personal information for purposes beyond those stated above without prior consent. We do not use personal information for direct marketing unless we have obtained explicit consent to do so.
Daylight collects and handles personal information in accordance with the following Australian Privacy Principles:
For Client organisational data, the lawful basis for processing is the legitimate interest of the Client in managing their work health and safety obligations under applicable Australian legislation.
Protecting the anonymity of survey participants is a foundational commitment of Daylight's service. The following safeguards are built into every Engagement:
Survey participants have no direct contractual relationship with Daylight. Their employment relationship is solely with the Client organisation. Any questions from survey participants regarding data handling should be directed to their employer in the first instance.
Daylight's analysis platform incorporates proprietary algorithmic and machine learning tools to identify patterns, generate risk scores, and produce Deliverables. The following principles govern their use:
Daylight regularly reviews its technology providers and their terms of service. If a provider changes its data handling practices in a way that is inconsistent with this policy, Daylight will migrate to an alternative provider.
Daylight shares personal information only with the following categories of third-party service providers, and only to the extent necessary for the purposes described in this policy:
If Daylight introduces an email marketing platform in the future, this section will be updated to name the provider and describe what data is shared before any marketing communications are sent.
Daylight does not sell, rent, or trade personal information to any third party.
Daylight may disclose personal information where required by law, regulation, or court order, or to its professional advisors who are bound by equivalent confidentiality obligations.
In accordance with APP 8, Daylight discloses the following cross-border data transfers:
Daylight takes reasonable steps to ensure that overseas recipients handle personal information in a manner consistent with the Australian Privacy Principles, including reviewing provider terms of service and selecting providers whose data handling practices are appropriate for the data being processed.
Client organisational data and all Deliverables remain hosted exclusively in Australia on Supabase infrastructure.
Daylight takes the security of your information seriously. The following measures are in place:
In the event of a data breach that is likely to result in serious harm to any individual, Daylight will:
Daylight retains data in accordance with the following schedule:
Platform access: Client stakeholders retain access to the Platform and their Deliverables for the duration of the retention period. For Clients with multiple Engagements, access is cumulative — all Deliverables from all Engagements remain accessible.
At the conclusion of the applicable retention period, all data is securely deleted and Platform access is deactivated.
The Client may request a copy of their aggregated data at any time during the retention period by contacting enquiries@daylightrisk.com.
First-party cookies: The Daylight Website does not currently set any first-party cookies.
Third-party cookies: The Daylight Website does not embed third-party widgets. When you follow the external Cal.com booking link, Cal.com may set cookies on their own domain in accordance with Cal.com's Privacy Policy.
Google Fonts: The Website loads typefaces from Google's font delivery network (fonts.googleapis.com). This causes your browser to make requests to Google's servers, which may process your IP address. Google does not set cookies via the Fonts API.
Analytics: Daylight does not currently use any website analytics or tracking tools (such as Google Analytics, Meta Pixel, or similar services). If analytics tools are introduced in the future, this section will be updated and an appropriate cookie consent mechanism will be implemented prior to deployment.
Business Case Calculator: The Calculator tool processes all data entirely within your browser. No information entered into the Calculator is transmitted to Daylight's servers, stored, or tracked.
Under the Australian Privacy Act 1988, you have the following rights in relation to personal information we hold about you:
To exercise any of these rights, contact us at enquiries@daylightrisk.com.
A note on survey participants: Because the survey collects no personally identifying information, Daylight does not hold personal information about individual survey participants. There is no data to access, correct, or delete at an individual level.
Daylight's services are directed at organisations, not at individuals under the age of 18. We do not knowingly collect personal information from children. If we become aware that personal information has been inadvertently collected from a child, we will take reasonable steps to delete it promptly.
Daylight may update this Privacy Policy from time to time to reflect changes in our practices, technology, or legal obligations. The "Last updated" date at the top of this page indicates when the most recent revision was published.
Material changes will be communicated to active Clients. Continued use of the Website or engagement of services after notification constitutes acceptance of the updated policy.
We recommend reviewing this page periodically to stay informed about how we protect your information.
If you have any questions about this Privacy Policy or wish to exercise your rights under the Privacy Act, please contact us:
If you are not satisfied with our response to a privacy complaint, you may contact the Office of the Australian Information Commissioner: