Privacy Notice

DRAFT — not yet reviewed. Benn/legal sign-off required before go-live.

Version 2026-08-01

This notice explains what we do with personal information in the SolarHub Contractor Portal. It covers two different things:

information about you, the contractor; and
customer information you see through the portal, and what you have to do with it.

1. Who we are

TODO: legal entity name and ABN. TODO: registered address. TODO: privacy contact — name or role, email, and phone.

2. Information we hold about you

Your name, mobile number and email address.
The business you work for or trade as.
Your identifiers in our job systems, so we can match you to the right work orders.
The invoices you submit, and the documents you attach to them.
Records of your sign-ins: the date and time, your IP address, and your browser's user-agent string.
A record of which pages and documents you opened, and when.
A record of which version of our terms and this notice you accepted, when, and from what IP address.
Photos and notes you upload against a job.

TODO: confirm whether the portal will hold bank account details, licence numbers or insurance certificates. If it will, they need to be listed here before go-live.

3. Why we hold it

To give you access to the jobs assigned to you, and to no other jobs.
To send you a one-time code so you can sign in.
To schedule work and talk to you about it.
To process and pay your invoices.
To keep records we are required to keep, and to prove what happened if there is a dispute, a complaint, or a safety or compliance review.
To keep the portal secure and to investigate misuse.

We do not use your information for marketing.

4. The sign-in and access log

We log every sign-in and every job record you open. We do this so that if a customer complains — or if information goes somewhere it should not have — we can tell who saw what, and when.

You cannot switch this off while using the portal.

5. Customer information you see

To do a job you will see the customer's name, their home address, their mobile number, and photos of their property.

That information belongs to the customer, not to you and not to us. Under the Australian Privacy Principles we have to tell customers who we give their information to, and we have to limit what happens to it after that.

So, when you use the portal:

use customer information only to do the job we assigned you;
share it only with people working on that job;
do not use it to contact the customer about anything else;
delete it, or hand it back, when you no longer need it;
tell us straight away if you lose it, or send it to the wrong person.

Copying customer information into your own systems

Some contractors run their own job-management software — for example ServiceM8 — and want their jobs to appear there.

TODO: this needs to be resolved before any customer personal information is sent to a contractor's own system. Australian Privacy Principle 6 limits what we can disclose customer personal information for. Sending a customer's name, address and mobile number into a third-party system that a contractor controls is a disclosure, and it needs:

TODO: a decision on what we will and will not send;
TODO: wording in our customer-facing privacy policy that tells customers this happens;
TODO: the contractor's own obligations for information once it lands in their system;
TODO: a position on where that third-party system stores the information, including whether it leaves Australia (APP 8).

Until that is settled, do not copy customer details out of the portal into another system.

6. Who we share your information with

simPRO — our job management system. Your details and the jobs you are assigned to sit there.
Microsoft Azure — hosts the portal and our database, in the Australia East region.
The service that sends your one-time code — by SMS or email, depending on how you sign in.

TODO: confirm the full list of service providers before go-live, including any that store information outside Australia.

We will also disclose information if the law requires it.

7. How long we keep it

TODO: retention period for sign-in and access logs. TODO: retention period for invoices and job records. TODO: retention period for your contact details after you stop working with us.

We keep the record of your acceptance of our terms and of this notice for as long as we may need to rely on it. That record includes the exact text you were shown.

8. How we protect it

Sign-in is by a one-time code sent to you, not a password you might reuse.
You can only reach jobs that are assigned to you.
Traffic between your browser and the portal is encrypted.
Access is logged (see section 4).

No system is perfectly secure. If something goes wrong with your information we will tell you, and where the law requires it we will notify the Office of the Australian Information Commissioner.

9. Getting a copy, or correcting something

You can ask us for a copy of the personal information we hold about you, and you can ask us to correct it if it is wrong.

TODO: privacy contact to send those requests to, and how long we take to respond.

10. Complaints

If you think we have mishandled your personal information, tell us first and we will look into it.

TODO: complaint process — who to contact, what happens next, and the timeframe.

If you are not happy with our answer you can complain to the Office of the Australian Information Commissioner at oaic.gov.au.

11. Changes to this notice

If we change this notice we will publish a new version and ask you to read and accept it the next time you sign in.