Privacy policy

Last updated 24 October 2026

CROP Workforce Management ("CROP") is software for staffing agencies, operated by Strattegee Pty Ltd ("we", "us"). This policy explains what personal information CROP handles and how. We follow the Australian Privacy Principles in the Privacy Act 1988 (Cth).

Who is responsible for your information

If you work for, or are placed by, an agency that uses CROP, that agency decides what information it collects about you and why. We store and process it for the agency, under our agreement with them. For questions about how your agency uses your information, contact your agency first. You can also contact us using the details below.

What CROP holds

• Contact and account details: name, email address, mobile number and the agency you belong to.
• Work details: the roles you work in, your availability, leave, and the shifts you are offered, accept and work.
• Credentials: professional registrations (such as AHPRA), police and screening checks, training records, vaccination evidence, and right-to-work information, including numbers, dates and copies of documents you or your agency provide. Some of this, such as vaccination records, is health information, which is sensitive information under the Privacy Act.
• Messages: a record of the emails and texts sent to you (for example shift offers and expiry reminders).
• App and device information: a notification token so we can send shift alerts to your phone, and basic technical logs used to keep the service secure and working.
• Location: only if a future clock-in feature is used, and only with your consent at the time.

How it is used

To run the agency's rostering and shift allocation, to check that workers hold the credentials a shift needs, to send shift offers and reminders, to keep the service secure, and to meet legal obligations. We do not sell personal information or use it for advertising.

Where it is stored and who can see it

• CROP data is stored in Australia, with DigitalOcean in Sydney.
• Sign-in is handled by our identity provider, Zitadel, in its Australian region.
• Email and SMS messages are sent through messaging providers (currently Resend for email and ClickSend for SMS), who receive only what is needed to deliver each message, such as your name, email address or mobile number and the message itself. Some of these providers may process messages outside Australia, including in the United States. Messages don't include health information or document numbers; a vaccination, for example, is described only as a vaccination record.
• Each agency can see only its own data. Staff at the agency see what their role allows.
• Clients of an agency may see the name, role and relevant credential status of workers booked for their shifts.

Security

Information is encrypted in transit, access requires sign-in with two-factor authentication, and agencies' data is kept separate at the database level. If a data breach is likely to cause serious harm, we will notify the people affected and the Office of the Australian Information Commissioner as required.

Access, correction and deletion

You can ask for a copy of your information, ask for it to be corrected, or ask for your CROP account to be deleted. See how to delete your account. Some records may need to be kept for a period after you leave, for example where workplace or tax law requires your agency to keep them.

Contact and complaints

Email info@strattegee.com. We aim to respond within 30 days. If you are not satisfied with our response, you can complain to the Office of the Australian Information Commissioner at oaic.gov.au.