Privacy Policy - My AFS
Last updated: 10 October 2026, Version 1.0
Austral Facility Services (“AFS”, “we”, “us”, “our”) is committed to handling personal information in accordance with the Privacy Act 1988 (Cth) (Privacy Act) and the Australian Privacy Principles (APPs).
This policy explains what personal information we collect through My AFS, our employee portal at myafs.australfs.com.au, why we collect it, how we hold it, who we disclose it to, and how you can access it, correct it, or complain about how we have handled it.
- Name: EMG Facility Services Pty Ltd, trading as Austral Facility Services
- ABN: 66 623 184 529
- Head Office: 25/23 Ashtan Place, Brisbane 4014
- Email: afsconnect@australfs.com.au
1. What My AFS is and who this policy applies to
My AFS is a website for people who work for AFS. Once you have created an account and AFS has confirmed who you are, it shows you your own work information: your upcoming shifts, your leave balances and your employee details. It also lets you read AFS policies.
Anyone can create an account, but access to your work information is only given after AFS has reviewed your registration and linked your account to your employee record.
This policy covers the personal information My AFS collects and shows. It does not replace the information AFS gives you about how your employment records are handled, and it does not cover the privacy practices of Google, Microsoft, Apple or Facebook when you sign in with them, or of any website you reach from a link in My AFS.
2. What personal information we collect
| Category | Examples | Source |
|---|---|---|
| Account | Your email address, and whether you have confirmed it | You, when you create an account or first sign in |
| Sign-in | If you use a password: your password, stored only as a one-way hash. If you sign in with Google, Microsoft, Apple or Facebook: a unique account identifier from that provider and which provider you used | You, and the sign-in provider you choose (see section 3) |
| Registration | Your first name, last name and mobile number, and your employee ID if you choose to give it | You, when you register |
| Account review | Which employee record your account is linked to, whether your registration was approved or declined and why, and who at AFS reviewed it and when | AFS staff who review registrations |
| Technical | Details of the requests your browser makes, such as the page requested, the time, and the response | Collected automatically when you use My AFS (see section 8) |
Work information My AFS shows you
Once your account is linked, My AFS shows you information AFS already holds about you in its rostering and workforce systems: your name, employee ID, mobile number and site, your upcoming shifts, and your leave balances. My AFS reads this information to show it to you; it does not keep its own copy, and it does not change your records.
What we do not collect
- No payment or bank account details.
- No location, contacts, camera or microphone access.
- No sensitive information as defined in section 6 of the Privacy Act, such as health information, racial or ethnic origin, religious beliefs or union membership.
- No advertising, tracking or third-party analytics cookies or scripts.
3. Signing in with Google, Microsoft, Apple or Facebook
Where My AFS offers it, you can sign in with your existing Google, Microsoft, Apple or Facebook account instead of a password. When you do:
- We ask only for basic sign-in permissions (for Google, the openid, email and profile scopes). We do not ask for access to your mail, files, contacts, calendar or anything else in that account.
- The provider tells us a unique identifier for your account and your email address, and may also send your name.
- We use the identifier only to recognise you the next time you sign in, and the email address to confirm it is yours and to show it on your profile. We store the identifier, the email address and the name of the provider. We do not store the name the provider sends.
- We do not use information from your Google, Microsoft, Apple or Facebook account for advertising, we do not sell it, and we do not share it with anyone else, except as required by law.
My AFS's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
You can stop My AFS using your Google, Microsoft, Apple or Facebook account at any time from that account's security or connected-apps settings. To have us delete the identifier we hold, contact us (section 10).
4. How we collect personal information
We collect personal information:
- directly from you, when you create an account, sign in, confirm your email address or register;
- from the sign-in provider you choose, as described in section 3;
- from AFS staff, when they review your registration and link your account to your employee record; and
- automatically, when your browser requests pages from My AFS.
5. Why we collect, hold, use and disclose it
We collect and use personal information to:
- create your account, sign you in and keep your account secure;
- confirm who you are before linking your account to your employee record;
- show you your own shifts, leave balances and employee details, and AFS policies;
- send you service emails, such as email confirmation links and password reset codes;
- administer, secure and support My AFS, including investigating misuse and diagnosing faults; and
- comply with any legal obligation, or respond to a lawful request from a court, regulator or law enforcement agency.
The details you give when you register are used only to identify you. They do not update your employee record. If your details there are wrong, tell your manager or AFS HR.
We will only use or disclose your personal information for a secondary purpose where you have consented, or where the secondary purpose is permitted under APP 6.
6. Who we disclose it to
- AFS personnel who review registrations, administer My AFS, or support you when you contact us.
- Service providers: Microsoft Azure, which hosts My AFS and sends its emails; Microsoft 365, where AFS policies are stored; and IT support and security providers engaged by AFS, who are bound by confidentiality and data-handling obligations.
- Where required or authorised by law, including to courts, regulators, insurers, or in connection with a legal claim.
Your shifts, leave balances and employee details are only ever shown to you in My AFS, not to other users.
We do not sell personal information, and we do not disclose it to third parties for their own marketing purposes.
7. Other people's information
My AFS shows you your own information only. AFS policies are company documents; please do not share them outside AFS. Our Terms of Service set out this obligation.
8. Where your information is stored, and how we secure it
My AFS, its database and its email service are hosted in Microsoft Azure in Australia (Australia East). We do not disclose personal information collected through My AFS to overseas recipients. If you choose to sign in with Google, Microsoft, Apple or Facebook, that provider handles your sign-in under its own privacy policy and may process it outside Australia.
We take reasonable steps to protect personal information from misuse, interference and loss, and from unauthorised access, modification or disclosure, including:
- showing your work information only after your account has been confirmed and linked to you;
- restricting access to authorised AFS personnel on a role-based basis;
- encrypting information in transit to and from My AFS;
- storing passwords only as one-way hashes, never in a form that can be read back;
- limiting repeated sign-in attempts;
- multi-factor authentication on all AFS staff accounts that administer My AFS;
- logging and monitoring of administrative access; and
- contractual security obligations on our service providers.
Your browser. When you sign in, My AFS keeps a sign-in token in your browser's storage. It is kept only for the browser session, unless you sign in with your email and password and tick “Keep me signed in”, in which case it stays on this device until it expires after 24 hours or you sign out. The token always expires after 24 hours.
Monitoring. My AFS uses Microsoft Application Insights to monitor performance and diagnose faults. It records technical details of each request, such as the address requested, the response time and the status. Your IP address is used to estimate an approximate location and is not stored. This information is kept for up to 90 days.
9. How long we keep it
- Email confirmation links expire after 48 hours, and password reset codes after 15 minutes.
- Your account, sign-in and registration details are kept while you have a My AFS account. You can ask us to delete your account (section 10), and we take reasonable steps to destroy or de-identify these details once they are no longer needed.
- Monitoring information is kept for up to 90 days (section 8).
10. Accessing, correcting and deleting your information
In My AFS. You can see your employee details and how you sign in on your profile page.
Requests to us. You can ask for access to the personal information we hold about you, ask us to correct it if it is inaccurate, out of date, incomplete, irrelevant or misleading, or ask us to delete your My AFS account. Email afsconnect@australfs.com.au. We will respond within a reasonable period, typically within 7 business days. There is no charge for making a request. If we refuse access or a correction, we will tell you why in writing and explain how you can complain. Deleting your My AFS account does not delete your employee record.
11. Data breaches
AFS is subject to the Notifiable Data Breaches scheme in Part IIIC of the Privacy Act. If we suspect a data breach, we will assess it promptly. If we conclude there has been an eligible data breach, one likely to result in serious harm, we will notify the affected individuals and the Office of the Australian Information Commissioner as required by law.
12. Dealing with us anonymously
APP 2 gives you the option of dealing with us anonymously or under a pseudonym where that is lawful and practicable. It is not practicable for My AFS: it shows you your own work information, so we need to know who you are. You can make a general privacy enquiry anonymously, though we may not be able to respond fully or resolve a complaint if we cannot identify you.
13. Marketing
We do not use personal information collected through My AFS for direct marketing.
14. Complaints
If you believe we have breached the APPs or otherwise mishandled your personal information, please tell us first so we can try to fix it.
Step 1: Notify AFS
Email afsconnect@australfs.com.au, or write to 25/23 Ashtan Place, Brisbane 4014, marked to the attention of “Compliance”. Describe what happened, when, and what outcome you are seeking. We will acknowledge your communication within 3 days and aim to respond substantively within 30 days. If we need longer, we will tell you why.
Step 2: Speak to the OAIC
If we do not respond within 30 days, or you are not satisfied with our response, you may complain to the Office of the Australian Information Commissioner (OAIC). A privacy complaint to the OAIC must be made in writing:
- Online: through the privacy complaint form at oaic.gov.au
- By email: oaicintake@oaic.gov.au
- By post: GPO Box 5288, Sydney NSW 2001
- Enquiries: 1300 363 992
Generally, a complaint to the OAIC must concern something that occurred less than 12 months ago, and you must have complained to us first.
15. Changes to this policy
We may update this policy to reflect changes to My AFS, to our systems, or to the law. The date at the top shows when it was last changed.
16. Contact us
- Name: EMG Facility Services Pty Ltd, trading as Austral Facility Services
- ABN: 66 623 184 529
- Head Office: 25/23 Ashtan Place, Brisbane 4014
- Email: afsconnect@australfs.com.au