Last updated 3 October 2026
Who we are
We are Discover Profiles Pty Ltd (ABN 18 612 337 550).
We deliver behavioural profiling services to help our customers better recruit, train, and engage the people they work with.
Your trust is important to us
We value the privacy of the people we deal with, and we aim to always be open and transparent about how we handle personal information.
This policy describes how we handle personal information, which is any information about a person who is identified or reasonably identifiable.
We will update this policy if we change how we handle personal information. The latest version is available at www.discoverprofiles.com/privacy.
What we do
Our customers are organisations who want to understand more about how specific individuals are likely to behave in different circumstances. Our customers typically use our services to help them understand the likely behavioural styles of their current or potential staff members.
We only collect personal information where it is necessary to carry out our business functions, which includes managing DISC profiles, maintaining our business relationships, and updating our business contacts on our latest service developments.
We collect different kinds of personal information depending on our relationship to an individual. We generally collect personal information about the following people:
- Individuals who are invited by our customers to complete a DISC profile (participants)
- Individuals who manage their organisation’s accounts (account managers)
- People who work with or for our customers (business contacts)
We collect and use personal information about participants as instructed by our customers. We rely on our customers to let participants know in advance that they will be invited to complete a DISC questionnaire, and to obtain their consent where necessary.
We keep records about participants for as long as the customer that invited them keeps its account with us, unless the customer deletes them sooner or asks us to. When a customer asks us to delete records, or closes its account, we delete them within 30 days.
DISC reports are generated automatically from a participant’s questionnaire responses, using a fixed scoring method. We don’t use them to make decisions about participants. The customer that invited a participant decides how to use their report.
The table below describes the types of personal information we collect about participants in more detail.
| Name |
To refer to participants in communications and DISC reports |
From the customer that has invited the participant to complete a profile |
Participants can use a pseudonym if they don’t want to use their real name – this should be discussed with the customer that has invited them to complete a profile. |
| Gender |
To refer to participants in DISC reports |
From the customer that has invited the participant to complete a profile |
Individuals can contact us to tailor their DISC report to use their preferred gender. |
| Email address (optional) |
To send invitations to participants |
From the customer that has invited the participant to complete a profile |
Customers can choose to send invitations to a participant using their own communication method, in which case we don’t collect the participant’s email address. |
| DISC questionnaire responses |
To produce a participant’s DISC report |
Directly from the participant |
|
| DISC report |
To describe how a participant is likely to behave, based on their responses to the DISC questionnaire |
This is new personal information that we infer based on the participant’s DISC questionnaire responses |
This report contains opinions about participants’ behaviour, and should be used in conjunction with due consideration of a participant’s aptitude, experience, skills and interests. |
| IP address and device information |
To keep our systems secure and to investigate problems |
Using automated systems when the participant completes the questionnaire |
Kept in our system logs for no more than 12 months. |
We collect and use personal information about account managers so that they can access our services on behalf of their organisation. They can ask us to send invitations to participants and to create DISC reports for participants.
We generally keep our records about account managers until the relevant customer closes their account with us.
The table below describes the types of personal information we collect about account managers in more detail.
| Name |
To address communications to account managers |
From the account manager’s organisation |
Account managers can use a pseudonym if they don’t want to use their real name. |
| Company/organisation |
To identify the organisation that the account manager works for |
From the account manager’s organisation |
|
| Email address |
To contact the account manager and to allow them to access our services |
From the account manager’s organisation |
|
| Password |
To allow the account manager to access our services |
From the account manager |
|
| IP address and sign-in activity |
To allow us to log access to our systems and services for security purposes |
Using automated systems when the account manager accesses our services |
|
| Payment details |
To process payments when an account manager buys credits |
Entered by the account manager directly into our payment provider, Stripe |
We don’t see or store full card numbers. |
We collect a range of personal information about our business contacts so that we can keep them up to date on our services. This can include their name, contact details, employer, and past dealings with us.
We generally keep our records about business contacts while we have an active or potential business relationship with them.
We may also collect personal information from individuals directly, such as when they deal with us in person or over the phone, subscribe to our newsletter, or use our website.
Our website uses cookies that it needs to work, such as cookies that keep account managers signed in, keep a questionnaire in progress, and protect forms against misuse.
We may also collect personal information from third parties (for example, through a referral or public sources such as LinkedIn).
We don’t buy email or marketing lists.
We share personal information with our customers as part of our services. For example, we share participants’ DISC questionnaire responses and DISC reports with the customers who invited them.
We use products and services provided by others (service providers) to help us manage and run our business (such as our email and file storage systems). When we do this, we take reasonable steps to ensure that our service providers are reputable and handle personal information securely and in accordance with applicable privacy laws.
We process personal information with the help of the following service providers:
| Microsoft |
Email, productivity software, data storage and web app hosting through Microsoft 365 and Azure |
All types of personal information that we collect and use |
Australia |
Postmark
https://postmarkapp.com/ |
To send transactional emails to participants and account managers |
Name and email address of participants and account managers, and the content of the emails we send them |
USA |
Api2Pdf
https://www.api2pdf.com/ |
To generate PDF versions of DISC reports |
Name and DISC report of participants. Api2Pdf deletes generated PDFs after 24 hours. |
USA |
| Stripe |
To process card payments for credit purchases |
Name, email address and payment details of account managers who buy credits |
USA and Australia |
| Xero |
To issue invoices and keep our accounting records |
Name and contact details of customers’ billing contacts |
USA |
| HubSpot |
To keep records of our business contacts and send them updates about our services |
Name, contact details and organisation of business contacts |
Australia |
Some of these service providers are in the United States, so personal information we hold may be disclosed to recipients there. We may also disclose personal information where the law requires or authorises it.
We take steps to protect the personal information that we hold from unauthorised access, use or disclosure, and from accidental loss.
We store and transmit electronic records using secure encryption methods, and we keep physical records in secure locations. Our staff only have access to the personal information that they need to fulfil their responsibilities. Our platform and its data are hosted in Microsoft Azure data centres in Australia.
We don’t put personal information about participants into artificial intelligence (AI) tools, and we don’t use it to train AI models.
If we have collected personal information to do work for a customer, we will only keep that information for as long as we need it. If you end your business relationship with us, we’ll safely delete as much information about you as we reasonably can, but we might need to keep some records (such as emails and notes made during calls, copies of our work, and billing and payment history) and our service providers may keep copies or back-ups.
Deleted information can remain in our encrypted backups until those backups expire, which takes up to 12 months. We use backups only to recover from a system failure, never to retrieve information that has been deleted.
Your rights
You can ask us to give you a copy of your personal information, update it, or make a complaint. There’s no charge to update your personal information or to make a privacy complaint.
If we hold your information because a customer invited you to complete a DISC profile, we handle it on that customer’s behalf. We’ll pass your request to the customer within two business days and help them respond.
If you request a copy of your personal information, we will let you know if we need to charge you for access. This charge will only be what we reasonably need to cover the cost to give you a copy of your personal information.
If you’re concerned about how we’ve handled your personal information, we’d like you to let us know. We’ll try to make things right as soon as we possibly can, and we’ll keep you updated during the process. We’ll acknowledge your complaint within five business days and aim to resolve it within 30 days.
If you’re not satisfied with our response, you can complain to the Office of the Australian Information Commissioner (OAIC) at www.oaic.gov.au or on 1300 363 992.
If you’re in the European Union or the United Kingdom, the customer that invited you decides how your information is used and is responsible for it under the data protection law that applies to you. You can exercise your rights through them, and we’ll help them respond.
Getting in touch
You can email our privacy officer at privacy@discoverprofiles.com, write to us at PO Box 1871, Castle Hill NSW 1765, or call us on:
- Within Australia: 1300 59 59 19
- Outside Australia: +61 2 9659 3431