Status: pre-launch. This evidence reflects implemented code and deployed infrastructure. Provii is not yet serving end-user production traffic, so production operational metrics and audit history are not yet available.

HR Privacy Notice - Evidence Documentation

Document Purpose: This document provides evidence that GAP-M015 has been closed through the creation of an Employment & HR Privacy Notice that meets GDPR Articles 13-14, ISO 27701 Annex A 7.2.9, and Australian Privacy Principles.

Gap Reference: GAP-M015 Use Case: UC-030 (Privacy for Employment and HR) Severity: MEDIUM Status: CLOSED Closure Date: 2025-11-08 Owner: Privacy Officer

1. Gap Analysis Summary

Original Gap (GAP-M015)

Finding: No formal HR privacy notice for contractors/employees

Current State (before remediation):

• Contracts include confidentiality clauses
• No dedicated privacy notice for employment/HR data
• Limited transparency about HR data processing
• Unclear rights for contractors regarding their personal data

Required State:

• HR privacy notice compliant with GDPR Articles 13-14
• Transparency about data collection, use, sharing, retention
• Clear explanation of contractor rights
• Alignment with ISO 27701 Annex A 7.2.9
• Contractor-focused approach (not traditional employee model)

Compliance Standards Affected:

• GDPR Articles 13-14 (Transparency and Information)
• ISO 27701:2019 Annex A 7.2.9 (Information for PII principals regarding processing)
• Australian Privacy Principles (APP 5 - Notification of collection)
• Use Case UC-030 (Privacy for Employment and HR)

2. Remediation Implementation

Document Created

File: /trust/legal/hr-privacy-notice.md

Creation Date: 2025-11-08

Version: 1.0

Effective Date: 2025-11-08

Classification: Internal (provided to all contractors)

Format: Markdown (MDX-compatible) with YAML frontmatter for documentation system integration

Document Characteristics

Word Count: Approximately 8,500 words

Sections: 12 main sections + subsections

Reading Time: Approximately 35-40 minutes for reading

Accessibility:

• Clear section headings and table of contents
• Tables for complex information
• Plain language explanations
• Contractor-focused terminology (not employee-centric)

3. GDPR Articles 13-14 Compliance Mapping

Article 13(1) - Mandatory Information

The HR Privacy Notice provides all required information when personal data is collected from the data subject (contractor):

Article 13(2) - Additional Information

The HR Privacy Notice provides all additional transparency information necessary for fair and transparent processing:

Article 14 - Information for Data Obtained from Other Sources

While most contractor data is obtained directly from contractors (Article 13), some information may be obtained from third parties (e.g., references, credential issuers). The notice covers this:

Compliance Summary - GDPR Articles 13-14

Status: ✅ Self-assessed as addressed

Evidence:

• All mandatory information (Article 13(1)) provided
• All additional transparency information (Article 13(2)) provided
• Information clear, concise, and easily accessible (Article 12)
• Contractor-friendly language (not legalese)
• Structured format with navigation

Gaps: None identified at time of self-assessment

4. ISO 27701:2019 Annex A 7.2.9 Compliance

Control A.7.2.9 - Information for PII Principals Regarding Processing

Control Statement: “The organisation shall provide PII principals with the information regarding the processing of their PII as required by applicable legislation and/or regulation.”

Implementation: The HR Privacy Notice implements this control for contractor (PII principal) information.

Mapping to ISO 27701 Requirements

ISO 27701 Annex A 7.2.9 - Additional Considerations

Language and Accessibility:

• ✅ Plain language used (avoiding excessive legal jargon)
• ✅ Structured format with clear headings
• ✅ Tables for complex information
• ✅ Appropriate for contractor audience (technical professionals)

Timing of Provision:

• ✅ Notice provided at or before contract signing
• ✅ Available for review during negotiation period

Updates and Changes:

• ✅ Section 10 covers change management (30-day notice, email notification)
• ✅ Version control and history maintained

Compliance Summary - ISO 27701 Annex A 7.2.9

Status: ✅ Self-assessed as addressed

Evidence:

• All required information elements provided
• Appropriate timing (at contract signing)
• Clear, accessible format
• Change management process documented

Gaps: None identified at time of self-assessment

5. Delivery Mechanism and Implementation

How the Notice is Provided to Contractors

5.1 Timing of Delivery

Prospective Contractors (during recruitment):

• HR Privacy Notice provided with contract offer
• Available for review before contract signing
• Opportunity to ask questions before commencing work

New Contractors (onboarding):

• HR Privacy Notice included in onboarding package
• Provided at or before contract signing (GDPR requirement)
• Acknowledgment obtained as part of contract execution

Existing Contractors (retrospective application):

• Email notification with link to notice
• Request for acknowledgment within 14 days
• Opportunity to ask questions or exercise rights

5.2 Format of Delivery

Primary Format: Digital (PDF or web-accessible link)

Accessibility:

• Available as downloadable PDF
• Web-accessible at internal documentation portal (when available)
• Searchable format for easy reference

Language: English (primary), translations available upon request for non-English speaking contractors

5.3 Acknowledgment Process

Acknowledgment Required:

• Contractors acknowledge receipt and understanding during contract signing
• Acknowledgment clause in contractor agreement

Sample Acknowledgment Clause:

“I acknowledge that I have received, read, and understood Maelstrom AI’s Employment & HR Privacy Notice (Version 1.0, Effective November 8, 2025). I understand what personal information Maelstrom AI collects about me, how it is used, and my privacy rights. I have had the opportunity to ask questions about this notice.”

Record of Acknowledgment:

• Signed contract with acknowledgment clause retained
• Date of acknowledgment recorded
• Version of notice acknowledged (for tracking updates)

5.4 Ongoing Access

Access for Current Contractors:

• Available on internal documentation portal (when established)
• Available via email request (privacy@maelstrom.au)
• Included in onboarding materials for reference

Updates:

• Contractors notified of material changes via email
• 30-day notice period before changes take effect
• Updated notice provided with change summary

Implementation Checklist

• ✅ HR Privacy Notice created and approved (Version 1.0)
• ⏳ Notice to be sent to existing contractors (within 30 days)
• ⏳ Acknowledgment process to be completed (within 60 days)
• ⏳ Contract template to be updated with acknowledgment clause
• ⏳ Onboarding process to be updated to include notice delivery
• ⏳ Internal documentation portal to host current version
• ⏳ Training for Privacy Officer on handling privacy requests

6. Use Case UC-030 Control Implementation

UC-030: Privacy for Employment and HR

Objective: Ensure contractor/employee privacy rights are respected and privacy obligations are met for employment and HR data processing.

Control Requirements (from Gap Analysis)

UC-030 Specific Considerations

Contractor-Based Business Model:

• ✅ Notice uses “contractor” terminology (not “employee”)
• ✅ Recognises independent contractor relationship
• ✅ Appropriate for minimal HR data collection model
• ✅ No employee-specific elements (benefits, leave, etc.) that don’t apply

No Intrusive Monitoring:

• ✅ Explicitly states NO monitoring (Section 2 “What We Do NOT Collect”)
• ✅ No keystroke logging, screen monitoring, location tracking
• ✅ Security measures proportionate (no surveillance)

Access Restricted to ISMS Owner:

• ✅ Documented in Section 5.2 - Access Controls
• ✅ Principle of least privilege applied
• ✅ Quarterly access reviews

No Third-Party Sharing (except as required):

• ✅ Only legitimate sharing documented (payment processors, tax authorities)
• ✅ No selling or renting of contractor data
• ✅ No marketing or advertising use

Compliance Summary - UC-030

Status: ✅ Self-assessed as addressed

Evidence:

• All control requirements addressed in notice
• Contractor-specific approach
• Minimal collection documented
• Strong privacy protections

Gaps: None identified at time of self-assessment

7. Alignment with Victorian Government HR Privacy Guidance

Reference Materials

Source: Victorian Government - Privacy in Human Resources (Office of the Victorian Information Commissioner)

Applicable Principles:

• Transparency in collection
• Privacy notices for staff
• Handling of sensitive information
• Rights of individuals

Alignment with VIC Government Guidance

Victorian Privacy Principles Addressed

Although Maelstrom AI is subject to Australian Privacy Principles (federal), not Victorian Privacy Principles (state), the notice aligns with VIC principles as best practice:

• ✅ Collection - Only collect what is necessary, transparent about collection
• ✅ Use and disclosure - Use only for stated purposes, limited sharing
• ✅ Data quality - Right to rectification available
• ✅ Data security - Strong technical and organisational measures
• ✅ Openness - Transparent privacy practices documented
• ✅ Access and correction - Rights available to contractors
• ✅ Unique identifiers - No unnecessary identifiers created
• ✅ Anonymity - N/A for employment relationship (identity necessary)
• ✅ Transborder data flows - Safeguards documented (SCCs, encryption)
• ✅ Sensitive information - Not collected (or with explicit consent only)

Compliance Summary - Victorian Guidance

Status: ✅ ALIGNED

Evidence:

• All Victorian guidance elements addressed
• Contractor-friendly presentation

8. Key Contractor-Specific Considerations

Differences from Traditional Employee Privacy Notices

The Maelstrom AI HR Privacy Notice is specifically tailored for a contractor-based business model:

Contractor-Specific Language

Terminology used:

• “Contractor” (not “employee”)
• “Contract” (not “employment”)
• “Services rendered” (not “work performed”)
• “Contract management” (not “HR management”)
• “Payment processing” (not “payroll”)
• “Engagement” and “termination” (not “hire” and “fire”)

Why this matters:

• Legal accuracy (contractors are not employees)
• Appropriate expectations (independent relationship)
• Avoids misclassification issues

Minimal Data Collection Documented

What is NOT collected (appropriately for contractor model):

• ❌ Health insurance or benefits information
• ❌ Leave or vacation tracking
• ❌ Time and attendance monitoring
• ❌ Location tracking or geofencing
• ❌ Biometric access controls
• ❌ Family or dependent information (except emergency contact)
• ❌ Background checks (beyond professional references)
• ❌ Medical information (except voluntary disclosure for accommodations)

What IS collected (minimal, necessary):

• ✅ Identity and contact information (for contract and payment)
• ✅ Financial details (for payment processing)
• ✅ Tax identifiers (for legal compliance)
• ✅ Work product (for IP management and business continuity)
• ✅ Professional information (for role assessment and performance)

9. Security and Access Controls for HR Data

Documented Security Measures

The HR Privacy Notice documents security measures (Section 5):

Technical Measures:

• AES-256 encryption at rest for HR data
• TLS 1.3 encryption in transit
• MFA required for system access
• Encrypted backups with 90-day retention + 7-year archive

Access Controls:

• ISMS Owner: Full access (necessary for small team management)
• Finance/Payroll (if outsourced): Limited to payment and tax information only
• Contractors: Access to own information via request

Organisational Measures:

• Confidentiality agreements for anyone handling HR data
• Security awareness training (annual)
• Clean desk/clear screen policy
• Incident response plan

Evidence of “ISMS Owner Only” Access

Access Model Documented:

• Section 5.2 - Access Controls: “Current Access Model” table specifies ISMS Owner has full access
• Principle of least privilege applied
• Quarterly access reviews planned

Justification:

• Small team size (contractor-based model)
• ISMS Owner responsible for all contractor relationships
• No HR department or administrative staff with HR data access

Future Considerations:

• As team grows, may delegate limited access (e.g., finance for payment processing)
• Access controls will be updated accordingly
• Notice will be updated to reflect changes

10. Gap Closure Evidence

Gap Analysis Requirements vs. Implementation

GAP-M015 Closure Criteria

Original Criteria:

1. ✅ HR privacy notice created
2. ✅ GDPR Articles 13-14 requirements addressed
3. ✅ ISO 27701 Annex A 7.2.9 control implemented
4. ✅ Contractor-appropriate approach (not employee-centric)
5. ✅ Documented data collection, use, retention, sharing, security
6. ✅ Contractor rights explained
7. ⏳ Notice delivered to all contractors (implementation in progress)

Status: ✅ GAP CLOSED (delivery to existing contractors in progress)

Residual Risks

Low Risk:

• Existing contractors not yet acknowledged notice (implementation in progress)
• Mitigation: Email campaign within 30 days, acknowledgment tracking

No Residual Risks for:

• Documentation completeness (notice created)
• Legal compliance (GDPR, ISO 27701, APPs addressed)
• Future contractors (notice will be provided at contract signing)

11. Next Steps and Recommendations

Immediate Actions (Within 30 Days)

1. Deliver Notice to Existing Contractors

• Action: Email notice to all active contractors
• Responsibility: Privacy Officer
• Timeline: Within 30 days of notice approval
• Deliverable: Email sent with acknowledgment request

2. Update Contract Template

• Action: Add acknowledgment clause to contractor agreement template
• Responsibility: ISMS Owner + Legal Counsel (if engaged)
• Timeline: Before next contractor engagement
• Deliverable: Updated contract template with clause

3. Track Acknowledgments

• Action: Create simple tracking spreadsheet for acknowledgments
• Responsibility: Privacy Officer
• Timeline: Set up within 14 days
• Deliverable: Spreadsheet with contractor names, email dates, acknowledgment dates

Short-Term Actions (Within 90 Days)

4. Establish Internal Documentation Portal

• Action: Make notice available on internal docs site (if established)
• Responsibility: ISMS Owner
• Timeline: When documentation portal set up
• Deliverable: Link to current version of notice

5. Training for Privacy Officer

• Action: Review procedures for handling Data Subject Access Requests (DSARs)
• Responsibility: Privacy Officer (self-training or external training)
• Timeline: Within 90 days
• Deliverable: Training completion, documented DSAR procedures

6. Test Deletion Procedures

• Action: Document and test procedures for contractor data deletion (upon request or retention expiry)
• Responsibility: Privacy Officer
• Timeline: Within 90 days
• Deliverable: Documented deletion procedure, test deletion completed

Medium-Term Actions (Within 6-12 Months)

7. Annual Review

• Action: Review HR Privacy Notice for accuracy and updates
• Responsibility: Privacy Officer
• Timeline: Annually (next review November 2026)
• Deliverable: Reviewed notice, change log if updates made

8. Legal Review

• Action: Engage legal counsel to review notice (if budget allows)
• Responsibility: ISMS Owner
• Timeline: Before Series A funding or significant growth
• Deliverable: Legal counsel sign-off, any recommended changes

9. Audit of HR Data Processing

• Action: Conduct audit to verify compliance with notice (data minimization, retention, security)
• Responsibility: Internal Auditor
• Timeline: 12 months after notice implementation
• Deliverable: Audit report, any corrective actions

Continuous Actions

10. Update Notice as Needed

• Trigger: New data processing activities, new third parties, law changes
• Action: Update notice and notify contractors (30-day notice)
• Responsibility: Privacy Officer
• Deliverable: Updated notice version, notification emails

11. Handle Privacy Requests

• Action: Respond to contractor Data Subject Access Requests, erasure requests, etc.
• Responsibility: Privacy Officer
• Timeline: 30 days (GDPR), 45 days (CCPA)
• Deliverable: Responses to requests, documentation of compliance

12. Legal Review Recommendations

Areas for Legal Counsel Review (Future)

When engaging legal counsel (recommended before significant growth or funding), request review of:

1. Contractor vs. Employee Classification

• Ensure notice language supports independent contractor relationship
• Verify no language creates employment relationship implications
• Confirm appropriate for Australian contractor law

2. Tax and Financial Compliance

• Verify TFN/ABN handling complies with Taxation Administration Act
• Confirm 7-year retention aligns with ATO requirements
• Review payment processor data sharing arrangements

3. Intellectual Property Language

• Ensure IP management purposes align with contractor IP assignment agreements
• Verify work product retention (1 year) is legally justified
• Confirm anonymization option for code contributions

4. International Transfer Safeguards

• Review Standard Contractual Clauses with third parties (Google, GitHub, Cloudflare)
• Verify Transfer Impact Assessment is adequate
• Confirm compliance with Schrems II (EU case law on international transfers)

5. Deletion and Retention

• Verify retention periods meet all Australian legal requirements
• Confirm deletion procedures are legally compliant
• Review exceptions to erasure requests

6. Consent Mechanisms

• Review consent language for emergency contact, references, voluntary disclosures
• Ensure consent is freely given, specific, informed, unambiguous
• Verify consent withdrawal procedures

Legal Sign-Off

Legal Review Status: Tracked under Planned Work Register item P-001 (external legal review of DPAs) and P-002 (external legal review of privacy notices). Both items are scheduled for completion before the first customer engagement. (maintained internally; available to auditors and enterprise customers on request)

Owner: ISMS Owner (P-001), Privacy Officer (P-002)

Current Status: Not started.

13. Monitoring and Continuous Compliance

Metrics to Track

Privacy Request Metrics (quarterly):

• Number of Data Subject Access Requests (DSARs)
• Average response time for DSARs
• Number of erasure requests
• Number of objections to processing
• Number of complaints (internal and to supervisory authorities)

Compliance Metrics (quarterly):

• Percentage of contractors who have acknowledged notice
• Number of contract templates with updated acknowledgment clause
• Number of privacy rights requests fulfilled within SLA (30 days)
• Number of data breaches involving contractor data (target: 0)

Audit Metrics (annually):

• Percentage compliance with retention periods (target: 100%)
• Number of access control reviews completed (target: 4 per year)
• Number of unauthorised accesses to HR data (target: 0)
• Completion of annual privacy training for Privacy Officer (target: 100%)

Continuous Improvement

Feedback Mechanisms:

• Contractor feedback on notice clarity (via surveys or direct feedback)
• Questions received about privacy (track themes for future clarification)
• Supervisory authority guidance updates (monitor for changes)

Trigger for Updates:

• New data processing activities
• New third-party service providers
• Changes to privacy laws (GDPR, Australian Privacy Act updates)
• Contractor feedback indicating confusion or concerns
• Supervisory authority guidance or enforcement actions
• Annual review findings

14. Document Summary

Evidence of Compliance

GAP-M015: ✅ CLOSED

Deliverables:

1. ✅ HR Privacy Notice created (8,500 words, 12 sections)
2. ✅ GDPR Articles 13-14 requirements mapped and self-assessed as addressed
3. ✅ ISO 27701 Annex A 7.2.9 control elements addressed (self-assessed)
4. ✅ UC-030 controls documented (requirements mapped)
5. ✅ Contractor-specific approach (appropriate for business model)
6. ✅ Delivery mechanism defined (contract signing, email for existing contractors)
7. ✅ Evidence documentation created (this document)

Next Steps:

• ⏳ Deliver notice to existing contractors (within 30 days)
• ⏳ Update contract template (before next engagement)
• ⏳ Track acknowledgments (ongoing)
• ⏳ Legal review (when counsel engaged)
• ⏳ Annual review (November 2026)

Files Created

Compliance Summary

Document Information

Document Title: HR Privacy Notice - Evidence Documentation Document Owner: Privacy Officer Approved By: ISMS Owner Creation Date: 2025-11-08 Last Reviewed: 2026-05-21 Next Review: 2026-11-21 (annually, or upon material change) Version: 1.0 Classification: Public Document Location: /trust/compliance/evidence/privacy-controls/hr-privacy-notice-evidence.md

Version History

Gap Closure Certification

I certify that:

• GAP-M015 has been remediated through creation of HR Privacy Notice
• The identified compliance requirements (GDPR, ISO 27701, APPs, UC-030) have been addressed
• Documentation is accurate and complete as of the date of this certification
• Implementation plan is in place for delivery to contractors

Certified By: ISMS Owner Date: November 8, 2025 Signature: [Digital signature - to be completed]

Document created: November 8, 2025 Status: GAP-M015 CLOSED (implementation in progress)

© 2026 Maelstrom AI Pty Ltd ATF Maelstrom AI Holding Trust. All rights reserved.