Privacy
180D Compliance is compliance training and inspection software operated by 180 Degrees IT Solutions. Organisations use it to assign training to their staff, run site inspections, and keep the evidence an auditor or insurer asks for.
Who is responsible for what
Your employer decides what goes into this system and why. They are responsible for that information. We hold and process it on their instructions and do not decide what to do with it ourselves.
So if you want to see, correct or remove your own records, ask your employer first. If you cannot get an answer from them, contact us at [email protected] and we will help.
What we hold
Identity and workplace details
Name, work email address, job title, department, who somebody reports to, and their Microsoft account identifier.
Why: To show a person the training assigned to them, and to tell their manager when it is overdue.
Training and competency records
Courses assigned and completed, quiz answers and scores, sign-offs, certificates and their expiry dates.
Why: This is the compliance evidence the product exists to produce.
Inspection and audit records
Answers recorded on site, photographs taken during an inspection, handwritten signatures, the location and time of the inspection.
Why: To evidence that a physical inspection happened, by whom, and what was found.
Form submissions
Whatever a client chooses to collect on their own forms, which may include details about people who are not their staff.
Why: The client decides what their forms ask. They control this content.
Activity and audit trail
Who signed in, what they changed, and when. IP address and browser details on sign-in.
Why: So a client can answer 'who did what' during an audit or an investigation.
What we do not do
- We do not sell anyone's information, and never will.
- We do not use it for advertising, and we run no advertising trackers.
- We do not use one client's records to build anything for another client, and we do not use them to train AI models.
- We do not read your content except when you ask us to help with a support problem, or where the law requires it.
Who else is involved
Running the service means using a small number of other companies. Each one below is genuinely in use, or is marked as conditional where it only applies to a feature you may not turn on.
Microsoft
Australia and global Microsoft regionsSign-in (Entra ID). Also holds the encryption keys and application secrets in Azure Key Vault.
Cloudflare
Global edge networkPuts the service on the internet, filters abusive traffic, and controls access to internal areas.
The hosting provider
AustraliaRuns the application servers and the database.
Backblaze
United StatesStores uploaded files such as inspection photographs and images.
Resend
United StatesSends notification and reminder emails.
Only once email sending is switched on. As at the date above, the product sends no email.
Anthropic, OpenAI and Google
United StatesGenerate draft training content and draft inspection templates when a client asks for it.
Only when a client uses the AI drafting features. Text a client submits for drafting is sent to the chosen provider. No training or inspection records are sent for this purpose.
How long we keep it
Training, inspection and submission records
Kept for as long as the client's account is open, because they are the evidence the client is required to hold. Deleted within 30 days of the account closing, unless the client asks in writing for a copy first.
A person who leaves the client's organisation
Their account can be deactivated immediately, which stops all access. Their completed training records are kept, because removing them would destroy the client's own compliance evidence. Their record can be permanently deleted on request.
Sign-in and change history
Kept for as long as the account is open. This is the audit trail and it is deliberately not editable.
Backups
Held for 14 days and then overwritten. A deletion may therefore persist in a backup for up to 14 days after it is made.
How it is protected
- You sign in with your existing Microsoft work account. We never see or store your password.
- Each organisation's records are separated, and sensitive fields are encrypted with a key unique to that organisation.
- Everything travels over an encrypted connection.
- The database is backed up nightly and the backup is checked by restoring it, not by assuming the job ran.
- Changes are recorded in an audit trail that users cannot edit.
Your rights
You can ask for a copy of what we hold about you, ask for it to be corrected, or ask for it to be deleted. Start with your employer, since they control the account. Deleting a person is built into the product, so an employer can action it directly.
One honest caveat: completed training records are the employer's compliance evidence, and they may have a legal reason to keep them even after someone leaves. Where that applies, we will say so rather than quietly refusing.
If something goes wrong
If personal information is exposed in a way that is likely to cause serious harm, we will tell the affected organisation without undue delay and work with them on notifying the people involved and the regulator, as required under the Australian Privacy Act notifiable data breaches scheme.