Privacy Policy

1. About This Notice

1.1 Scope. Thinking Mode has sought to adopt a rigorous and best practice approach to collecting, using, disclosing, managing, protecting and otherwise Processing Personal Data. This is necessarily subject to applicable Data Protection Laws and Regulations in relevant jurisdictions.

1.2 Non-binding. This Privacy Notice is not incorporated into the terms of engagement or employment of a person to whom it is intended to apply. It does not create contractual rights against Thinking Mode.

1.3 Data Protection Agreement. Nothing in this Privacy Notice affects the terms of any Data Protection Agreement or a Customer Agreement between us and a Customer or other relevant person concerning matters of data protection and privacy.

1.4 Amendment. Thinking Mode may change, vary or modify all or part of this Privacy Notice at any time in our sole discretion. It is your responsibility to check this Privacy Notice periodically for changes. If we issue a new Privacy Notice:

• we will post the new Privacy Notice on the Platform; and
• it will then apply to you through your acceptance of it by subsequent or continued use of the Platform and/or by being a Customer acquiring relevant goods and/or services from us or otherwise in respect of your relationship and dealings with us.

2. Purpose

2.1 Primary Purposes

We collect Personal Data from you and, subject to clause 3.3, you consent to us and our Related Bodies Corporate (and where relevant any Third Party Service Provider) collecting, using and otherwise Processing and allowing the Processing (as applicable) your Personal Data for the following Primary Purposes and you consent to all such use:

Purpose/Activity	Type of Personal Data	Basis for use
To deliver Services for you or a relevant Customer, including but not limited to: communicating User assessment results to the relevant Customer; preparing and delivering documents (including contractual documents); managing payments, fees and charges; collecting and recovering money owed to us	Identity Information Contact Information Financial Information Transaction Information Customer Information	Performance of a contract with you; Legal and regulatory requirement; Necessary for our legitimate interests (e.g., to recover debts due to us). This is in accordance with APP 3.2.
To operate, use and offer functionality of the Thinking Mode Platform and supply the Thinking Mode Service, including: to enable your use of the Platform and Service; to assess whether you are a permitted User; to make available personal information to a relevant Customer; to store in a relevant database; to personalise and customise your experiences with us; to help us review, manage and enhance the Service and Platform; to develop insights used in reports or other content developed by us; to communicate with you and any relevant Third Parties; to lawfully carry out our functions and activities	Identity Information Contact Information Customer Information Financial Information Transaction Information Marketing and Communications Information	Performance of a contract with you; Improvement of Services; Legal and regulatory requirement; Necessary for our legitimate interests. This is in accordance with APP 3.2.
To Process Personal Data, most usually as a data processor in respect of use of a relevant Service by a relevant Customer and/or User, but also as a Controller in some instances (e.g. in our own capacity as an employer and with respect to our own business activities)	Identity Information Contact Information Financial Information Transaction Information Customer Information	Performance of a contract with you; Legal and regulatory requirement; Necessary for our legitimate interests. This is in accordance with APP 3.2.
To provide you with information about the Services you requested or enquired about	Contact Information Customer Information Marketing and Communications Information	Performance of a contract with you; Necessary for our legitimate interests. This is in accordance with APP 3.2.
To help us assess an application submitted by you in relation to your employment with, or engagement by, us — including conducting visa, criminal and/or migration checks via Third Party Service Providers or a relevant governmental body	Identity Information Contact Information Technical Information Profile Information Financial Information	Performance of a contract with you; Legal and regulatory requirement; Necessary for our legitimate interests (e.g., to determine your suitability for employment); Arranging for payment to you. This is in accordance with APP 3.2.
To disclose to Third Parties engaged by us to perform functions related to the Platform or the Service, including: our professional advisors; persons authorised by you; a purchaser of all or any part of our business; any other persons as required or permitted by law	Identity Information Contact Information Transaction Information Customer Information	Performance of a contract with you; Legal and regulatory requirement; Necessary for our legitimate interests. This is in accordance with APP 3.2.
To investigate any complaints about, or made by you, or if we have reason to suspect you have breached any relevant terms or contract	Identity Information Contact Information Technical Information Profile Information Financial Information	Legal and regulatory requirement; Necessary for our legitimate interests. This is in accordance with APP 3.2.
For the purposes contemplated by a Customer Agreement	Identity Information Contact Information Customer Information Technical Information Marketing and Communications Information Profile Information	Performance of a contract with you. This is in accordance with APP 3.2.
To help us review, manage and enhance our Services as well as develop insights used in reports or other content developed by us	Identity Information Contact Information Customer Information Technical Information Marketing and Communications Information Profile Information	Necessary for our legitimate interests (e.g., to develop our Services, to grow our business, and to inform our marketing strategy). This is in accordance with APP 3.2.
To communicate with you, including by email, mobile and in-application notifications	Identity Information Contact Information Profile Information	Performance of a contract with you; Necessary for our legitimate interests. This is in accordance with APP 3.2.
To process payments and administer your account, including to send you account related reminders	Identity Information Contact Information Financial Information Transaction Information Customer Information	Legal and regulatory requirement; Necessary for our legitimate interests (e.g., to recover debts due to us). This is in accordance with APP 3.2.
To do anything else as required or permitted by any relevant law	Identity Information Contact Information Financial Information Transaction Information Customer Information Technical Information Marketing and Communications Information Profile Information	Legal and regulatory requirement; Necessary for our legitimate interests; Improvement of Services. This is in accordance with APP 3.2.

3. What We Collect

3.1 Personal Data. Personal Data we collect about you may include or be comprised within:

• personal contact information such as name, email address and encrypted password;
• documents and content uploaded to the Thinking Mode Platform;
• photographs and images;
• notes and communications using the Thinking Mode Platform, including chat logs;
• employment and engagement details including employer/engager name, job title and function, identity and contact details;
• geolocation data, unique IDs collected from mobile devices, network carriers or data providers; and
• authentication data, financial and payment information and such other information necessary or convenient for delivering or in connection with our Services.

3.2 We also may collect additional information as part of our collection of Identity Information, Contact Information, Financial Information, Transaction Information, Technical Information, Marketing and Communications Information, Customer Information and Profile information used for the Primary and Secondary Purposes.

3.3 Sensitive Personal Data. While we take steps to discourage, avoid and minimise the collection of Sensitive Personal Data, we acknowledge that Users may attempt to upload Sensitive Personal Data in the course of using the Thinking Mode Service. We will only collect, hold, use, disclose or otherwise Process any Sensitive Personal Data about you with your consent or if you volunteer such Sensitive Personal Data to us.

3.4 Minimising Personal Data collection. Thinking Mode has implemented technical features designed to detect and block the processing of Personal Data in content uploaded or otherwise disclosed on the Thinking Mode Platform by a User. These measures operate on a best-efforts basis only and cannot guarantee that all instances of Personal Data will be identified or prevented. Accordingly, Customers and Users remain primarily responsible for ensuring that unnecessary Personal Data is not uploaded to the Thinking Mode Platform in accordance with the applicable Platform Access Conditions and Customer Agreement.

3.5 Other information. We may collect, directly or through Google Analytics, and you consent to us collecting, information relating to you that is not Personal Data, such as data relating to your activity on the Thinking Mode Platform, including: Internet Protocol address or MAC (device) address; browser and operating system type; date, time and pages visited; files downloaded; information about your computer and Internet connections using cookies; information regarding your dealings with us including feedback and insights; and information regarding your past or current employment if you apply for employment with, or engagement by, us.

4. How We Collect

4.1 How we collect. Your Personal Data may be collected:

• when you complete a consent, purchase, account sign-up or similar form via the Thinking Mode Platform or otherwise;
• when you use the Thinking Mode Platform or the Thinking Mode Service;
• when you contact us to submit a query or request;
• when you post or upload information or otherwise interact with the Thinking Mode Platform;
• from you when you participate in one of our surveys;
• from you when you request a call back from us;
• from those who request our Services on your behalf;
• from publicly available sources of information;
• from you when you subscribe to a marketing list;
• from you when you request further information from us;
• from you at a conference or event;
• from you or a relevant Customer when we enter into a Customer Agreement for the provision of Services;
• from government regulators, law enforcement agencies and other government entities;
• from business contacts, external service providers and suppliers; or
• by other means reasonably necessary.

4.2 Third party collection. If we collect any Personal Data about you from someone other than you, we will inform you of the fact that we will collect, or have collected, such information and the circumstances of that collection before, at or as soon as reasonably practicable after we collect such Personal Data.

4.3 Authority. If you provide us with the Personal Data of another individual, you acknowledge and agree that the other individual has authorised you to provide their Personal Data to us and consents to us using their Personal Data for the purposes contemplated by this Privacy Notice.

4.4 Unsolicited information. If we receive unsolicited Personal Data about you that we could not have collected in accordance with this Privacy Notice and applicable Data Protection Laws and Regulations, we will, within a reasonable period or otherwise to the extent lawful, destroy or de-identify such Personal Data.

4.5 Anonymity. If you would like to access or use any of our Services on an anonymous or pseudonymous basis we will take reasonable steps to comply with your request. However, you may be precluded from taking advantage of some or all of our Services, and we will require you to identify yourself if required by law or if it is impracticable for us to deal with you otherwise.

4.6 Destruction. We will, within a reasonable period or otherwise to the extent lawful, destroy or de-identify your Personal Data if the purpose for which we collected it no longer exists or applies, or you request us to destroy it and we are not required by law to retain it.

4.7 Social Media Tools. We use LinkedIn, YouTube, Facebook and Instagram and may from time to time use other social media tools.

5. Use

5.1 Assurances. Subject to this clause 5, Thinking Mode will not:

• use Personal Data of Users who are students to train any artificial intelligence models;
• share User or Customer Personal Data for marketing purposes unless we collect that Personal Data in accordance with a collection notice; or
• sell your Personal Data to Third Parties.

5.2 Primary and secondary use. We will only use, disclose or otherwise Process your Personal Data for the Primary Purposes, but we may use your Personal Data for a secondary purpose if you would reasonably expect us to use or disclose the Personal Data for that secondary purpose, and: if the information is Sensitive Personal Data, the secondary purpose is directly related to the primary purpose of collection; or if the information is not Sensitive Personal Data, the secondary purpose is related to the primary purpose of collection; or if we otherwise get your consent to do so; or as may be permitted otherwise by applicable Data Protection Laws and Regulations.

5.3 Third parties. We will not sell, trade, rent or licence for use your Personal Data to Third Parties, although we may for clarity permit a Third Party Service Provider to use your Personal Data in the provision of a relevant service to us.

5.4 Direct marketing. We will offer you a choice as to whether you want to receive direct marketing communications about our Services. If you choose not to receive these communications, we will not use your Personal Data for this purpose.

5.5 We will otherwise only use or disclose your Personal Data for the purposes of direct marketing if: we collected the Personal Data from you; it is reasonable in the circumstances to expect that we would use or disclose the Personal Data for direct marketing purposes; we provide you with a simple means to opt-out of direct marketing communications from us; and you have not elected to opt-out from receiving such direct marketing communications from us.

5.6 Opt-out. You may opt out of receiving such communications by contacting us using our contact details set out at clause 11.

5.7 Artificial Intelligence. Thinking Mode uses secure artificial intelligence systems supplied by OpenAI, Anthropic and (for tenants on the Australian data-residency region) Amazon Web Services Bedrock to support the delivery of our Services. Where we do so, we will only input your Personal Data in a way which complies with this Privacy Notice. Thinking Mode has explicitly opted out of any use of Personal Data for the training or improvement of these providers' models or services through the relevant Sub-processor agreement and provider zero-data-retention settings where available. The relevant Sub-processor may Process and store Personal Data for purposes such as ensuring the safety and security of the service, or compliance with applicable laws.

5.8 AI Usage Metadata. Each interaction with an AI Sub-processor produces operational metadata that Thinking Mode records for billing reconciliation, usage-cap enforcement and abuse prevention. This metadata is limited to: the model identifier, the AI category routed to (e.g. conversational, summarisation, extraction), token counts (input, cached input, output and reasoning), the timestamp, and the internal identifiers of the relevant organisation, user (if any) and student session (if any). Prompt content, AI responses and user-supplied document text are not stored in the usage-metadata ledger. Raw usage events are retained for 180 days by default and aggregate daily counts are retained indefinitely so we can monitor longer-term trends. These windows are configurable from our administrative tooling.

6. Disclosure

6.1 How we disclose. We may disclose Personal Data and you expressly consent to us disclosing, for the purpose of use or other Processing, such Personal Data to:

• Third Parties engaged by us to perform functions related to the Thinking Mode Platform or the Thinking Mode Service;
• Third Party Service Providers who perform functions or provide Services on our behalf;
• relevant regulatory bodies in the industry in which we or you operate;
• credit agencies;
• our professional advisors, including our accountants, auditors and lawyers;
• our Related Bodies Corporate;
• a relevant person entitled to use or enjoying rights concerning the Thinking Mode Service;
• persons authorised by you to receive Personal Data or other data held by us;
• a government authority, law enforcement agency, pursuant to a court order or as otherwise required by law;
• a party to a transaction involving the sale of all or any part of the Thinking Mode business or any other part of our business; and
• any other persons as required or permitted by any law.

6.2 Artificial Intelligence. In particular, we use Third-Party service providers, including OpenAI, Anthropic and Amazon Web Services (for Bedrock-hosted models in our Australian region), to provide certain functionalities of the Thinking Mode Platform. This may involve the processing of your Personal Data by those providers' systems, which may be located outside Australia (see sections 6.3 and 6.4 below). We take reasonable steps to ensure that any such Third-Party service providers comply with applicable Data Protection Laws and Regulations. We do not send student identity information provided by Users to enable the use of the Thinking Mode Service to any AI Sub-processor.

6.3 Overseas disclosure. We primarily host and store Personal Data on servers located in Sydney, Australia. However, in some circumstances we may send your Personal Data to overseas recipients to enable us to provide our Services to you or as contemplated by clause 6.1 or to facilitate or ameliorate the provision of our Services to you or a Customer. This may be for the purposes of disclosure but commonly will be for the purposes of use or Processing (i.e. without releasing the subsequent handling of Personal Data from our effective control).

6.4 Overseas recipients. Overseas recipients that may handle or Process your Personal Data include (but are not limited to) OpenAI and Anthropic. The countries in which likely overseas recipients of personal information are located include the United States of America.

6.5 Reasonable protections. We consider that overseas recipients of Personal Data in such named jurisdictions are subject to a law, or binding scheme, that has the effect of protecting Personal Data in a way that, overall, is at least substantially similar to the way in which the APPs protect Personal Data and there are mechanisms that a relevant individual can access to take action to enforce that protection of the law or binding scheme. In any event, if we send or transmit your Personal Data to overseas recipients, we will take such steps as are reasonable in the circumstances to ensure there are arrangements in place to protect your Personal Data as required by the APPs and Data Protection Laws and Regulations.

6.6 Sub-processors. We currently use the following Sub-processors to deliver the Thinking Mode Service:

Sub-processor	Service	Location	Notes
Amazon Web Services (AWS)	Primary hosting	Sydney, Australia	Data encrypted at rest and in transit
OpenAI LLC	AI processing	United States of America	No model training on student data
Anthropic, PBC	AI processing and internal tooling	United States of America	No model training on customer data; zero-data-retention applied where the provider supports it
Amazon Web Services (Bedrock)	AI processing for tenants on the Australian data-residency region	Sydney, Australia	No model training on customer data; inference stays within the Sydney region
Storylane, Inc.	Interactive demo hosting and analytics for marketing	United States of America	Data encrypted in transit and at rest; uses cookies to track demo interactions
Sentry (Functional Software, Inc.)	Error and performance monitoring	United States of America	PII scrubbed on error and trace telemetry. The user-feedback widget additionally transmits user-submitted messages and optional screenshots, which are not scrubbed and may contain student work or Personal Data
Google LLC	Anonymous usage analytics (Google Analytics 4)	United States of America	Optional and consent-gated; loads only after the visitor accepts analytics cookies. IP anonymisation enabled; no advertising or remarketing features

6.7 Contractual protections. We customarily seek enforceable contractual arrangements (which may include Appropriate Safeguards) with overseas recipients that require the recipient and any Sub-processors to handle personal information in accordance with relevant Data Protection Laws and Regulations (including, as relevant, the APPs). Thinking Mode has taken reasonable steps to ensure that Appropriate Safeguards are in place through its data protection agreement with our relevant sub-processors.

6.8 EU & UK GDPR. If we become aware that you are a citizen of, or are located within, the European Economic Area or the United Kingdom at the time at which we collect Personal Data about you, or at the time at which we propose to transfer Personal Data about you overseas, we will take steps to ensure that we comply with Articles 45 to 49 of the EU GDPR or Articles 45 to 49 of the UK GDPR (as applicable), in relation to the transfer of your Personal Data overseas. However, you acknowledge that as we conduct our business from and predominantly within Australia, you are required to provide us with written notice of our need to comply with the EU GDPR or UK GDPR in relation to your Personal Data if you wish for us to take steps that are not already set out in this Privacy Notice.

7. Access + Correction

7.1 Access. If you require access to your Personal Data, please contact us using our contact details set out at clause 11. You may be required to put your request in writing and provide proof of identity.

7.2 Exceptions. We are not obliged to allow access to your Personal Data (subject to Data Protection Laws and Regulations) if it would pose a serious threat to the life, health or safety of any individual or to the public; it would have an unreasonable impact on the privacy of other individuals; the request is frivolous or vexatious; it relates to existing or anticipated legal proceedings between you and us and would not ordinarily be accessible by the discovery process; it would reveal our intentions in relation to negotiations with you in a way that would prejudice those negotiations; it would be unlawful; denying access is required or authorised by or under an Australian or other relevant law or a court/tribunal order; we have reason to suspect that unlawful activity or misconduct of a serious nature relating to our functions or activities has been, is being or may be engaged in; it would likely prejudice one or more enforcement related activities; it would reveal commercially sensitive information; or a relevant law provides that we are not obliged to allow access (e.g. under the Privacy Act or the GDPR, as applicable).

7.3 Response to access request. If you make a request for access to Personal Data, we will respond to your request within a reasonable period after the request is made; and if reasonable and practicable, give access to the Personal Data as requested.

7.4 Refusal of access. If we refuse to give access to the Personal Data, we will give you a written notice that sets out our reasons for the refusal (to the extent it is reasonable to do so); and the mechanisms available to complain about the refusal.

7.5 Correction. We request that you keep your Personal Data as current as possible. If you feel that information about you is not accurate or your details have or are about to change, you can contact us using our contact details set out at clause 11 and we will correct or update your Personal Data.

7.6 Response to correction request. If you make a request for us to correct your Personal Data, we will respond to your request within a reasonable period after the request is made; and if reasonable and practicable, correct the information as requested.

7.7 Refusal to correct. If we refuse a request to correct Personal Data, we will give you a written notice setting out the reasons for the refusal and how you may make a complaint; and take reasonable steps to include a note with your Personal Data of the fact that we refused to correct it.

7.8 Restriction. If you are a citizen of, or are located within, the European Union at the time at which we collect Personal Data about you, or at the time at which you make a relevant request, we will take steps to ensure that we comply with a request by you to restrict the use of your Personal Data pursuant to Article 18 of the GDPR. You acknowledge that, depending on the nature of the restriction you request, we may be unable to provide you with some or all of our Services if we comply with your request.

8. Security + Protection

8.1 Reasonable protections. In relation to all Personal Data, we will take all reasonable steps to: ensure that the Personal Data we collect is accurate, up to date and complete; ensure that the Personal Data we hold, use or disclose is, with regard to the relevant purpose, accurate, up to date, complete and relevant; and protect Personal Data from misuse, loss or unauthorised access and disclosure.

8.2 Security. We store your Personal Data on a secure server behind a firewall and use security software to protect your Personal Data from unauthorised access, destruction, use, modification or disclosure. Only Authorised Personnel may access your Personal Data for the purposes of disclosure set out in clause 6 above.

8.3 Obligation to notify. Please contact us immediately if you become aware of or suspect any misuse or loss of your Personal Data.

9. Data Breaches

9.1 Compliance. We are required to comply with the Notifiable Data Breaches scheme under Part IIIC of the Privacy Act.

9.2 Investigation and assessment. If we become aware that a Data Breach in respect of Personal Data held by us may have occurred, we will investigate the circumstances surrounding the potential Data Breach to determine whether a Data Breach has occurred; and if a Data Breach has occurred, carry out a reasonable and expeditious assessment of whether there are reasonable grounds to believe that the relevant circumstances amount to an eligible data breach.

9.3 Undertaking. If we become aware that there has been an eligible data breach in respect of Personal Data held by us, and the Personal Data relates to you or you are at risk from the eligible data breach, we will ensure that either we, or a relevant APP entity that is the subject of the same eligible data breach: prepare a statement that complies with subsection 26WK(3) of the Privacy Act; provide a copy of the statement to the Office of the Australian Information Commissioner (OAIC); and if practicable, notify you of the contents of the statement, or otherwise publish a copy of the statement on the Website and take reasonable steps to publicise the contents of the statement, as soon as practicable after the completion of the preparation of the statement.

10. Complaints

10.1 Complaint. If you have a complaint about how we collect, use, disclose, manage, otherwise Process or protect your Personal Data, or consider that we have breached applicable Data Protection Laws and Regulations or the APPs, please contact us using our contact details below. We will respond to your complaint within 14 days of receiving it.

10.2 Response and resolution. Once the complaint has been received, we may resolve the matter in a number of ways:

• Request for further information: We may request further information from you. Please provide us with as much information as possible, including details of any relevant dates and documentation.
• Discuss options: We will discuss options for resolution with you and if you have suggestions about how the matter might be resolved you should raise these with our Privacy Officer.
• Investigation: Where necessary, the complaint will be investigated. We will try to do so within a reasonable time frame.
• Conduct of our employees: If your complaint involves the conduct of our employees we will raise the matter with the employee concerned and seek their comment and input in the resolution of the complaint.

10.3 Notice of decision. After investigating the complaint, we will give you a written notice about our decision.

10.4 OAIC. You are free to lodge a complaint directly with the OAIC online, by mail, fax or email. For more information please visit the OAIC website at oaic.gov.au.