Skip to main content
Worker Portal

Orchard Tech App Privacy Policy

Effective date: 21 October 2026
Policy version: 1.8
App covered: Orchard Tech for iPhone, iPad, compatible Apple-silicon Macs, and Android phones and tablets

Short privacy summary

The Orchard Tech app lets workers keep personal weekly timesheets and paper-sheet photos on their device, manually compare their own records, and choose to save or share personal copies and backups. Timesheets do not sync to Orchard Tech or submit payroll automatically. The app also helps workers find published workplace information and save verified documents for offline use. These existing tools can be used without an account or phone registration. Optional Notifications links a phone to a staff-managed worker record using a private code, as explained in section 5C. The app does not contain advertising or cross-app tracking. Contact Orchard Tech lets a worker write, review and send a text-only workplace question or support message in the app. The information sent, how it is handled and the limits of a handoff confirmation are explained below.

Upload files lets a worker review and send their own requested workplace records or a hazard photo to Orchard Tech. The worker supplies a category, name, Orchard Tech worker ID, title, optional note and selected images. A selected PDF is converted into image pages on the device: the original PDF is not uploaded, but its visible page content is sent as images after the worker reviews and confirms the submission. The information may be private employment, identity, right-to-work, payroll, tax, banking or health information when included in the worker’s requested record. These submissions go privately to workerforms@orchardtech.com.au as described in section 5B.

On supported Apple devices, if approved farm boundaries are published, the app can use one location reading while it is open to suggest a work site. The comparison happens on the device. Orchard Tech does not receive or store the device coordinates or a location history, and a worker can decline location permission and use manual site selection. The Android release uses manual farm selection only; it does not request device location permission or obtain device coordinates.

The app stores language and tab preferences, cached public information, documents saved for offline use and minimal contact request status on the device. If a worker links their phone for Notifications, a protected credential is kept in native secure storage. Notification message contents are held only in app memory while it is active; Orchard Tech keeps the server records described in section 5C. Contact and attachment drafts are held in memory rather than saved permanently. Personal timesheets, their unfinished workday draft, change history and recovery copies are saved locally as described in section 3, which also explains paper photos, user-directed opening and sharing, backups, temporary transfer copies and minimal attachment request status. When the app connects to Orchard Tech’s services, Cloudflare and WP Engine process ordinary internet request information such as IP address, request time, requested path, user agent, response status and security or error information.

Orchard Tech does not sell app information, use it for targeted advertising or track workers across apps or websites.

1. Who is responsible

The Orchard Tech app and connected public worker services are operated by Suvarnabhoomi Pty Ltd ACN 141 241 769 as trustee for the Suvarnabhoomi Discretionary Trust, ABN 16 102 266 894, trading as Orchard Tech.

In this policy, “Orchard Tech”, “we”, “us” and “our” refer to that operator.

This policy is limited to the Orchard Tech app, its public worker services, optional staff-managed Notifications, and the collection and handling of records deliberately submitted through its Contact and Upload files workflows. It does not describe unrelated recruitment, payroll, employment-record, customer, supplier or general business processing, which is addressed in the Orchard Tech Website Privacy Policy or another specific collection notice.

2. What the current app does

The app gives workers access to published workplace information, safety documents, PALM Scheme resources and forms in English, Lea faka-Tonga and Bahasa Melayu. It can save eligible verified documents for offline use. It also offers personal weekly timesheets with farm, task and activity details, paper-sheet photos, manual comparisons and personal PDF/CSV exports and backups on the device. New timesheet, Contact, Upload files and Notifications instructions are currently provided in English; existing language controls and available resource translations remain accessible.

The current release:

  • lets workers use personal timesheets, public resources, saved documents, Contact and Upload files without an account or phone registration; optional Notifications requires a phone to be linked to a staff-managed worker record;
  • does not contain advertising, cross-app tracking or third-party behavioural-analytics SDKs;
  • does not sell personal information or use app information for direct marketing;
  • does not send a worker’s device coordinates to Orchard Tech;
  • does not monitor location in the background; and
  • offers voluntary text-only Contact Orchard Tech messages and Upload files through the native app interface, when each service is available. Upload files accepts reviewed images for Training, Hazard or Other, including image pages converted from a selected PDF on the device. Separate website forms may remain available on Orchard Tech’s website.

We will update this policy and any required collection notice before enabling account features beyond the phone registration described in section 5C, additional submission workflows, behavioural analytics beyond the aggregate operational statistics described in section 5, advertising or other materially different data handling.

3. Information handled only on the device

Location

On supported Apple devices, if approved farms and their detection boundaries are published, the app may ask for permission to obtain one precise location reading while the app is open. It compares that reading with approved farm boundaries on the device to suggest the farm the worker appears to be at. The Android release uses manual farm selection only. It does not request device location permission or obtain device coordinates.

The app:

  • does not monitor location in the background;
  • does not send coordinates, location accuracy or the suggested-farm result to Orchard Tech or another service;
  • does not save a location history; and
  • lets the worker decline permission and select a farm manually.

On supported Apple devices, automatic location suggestions are unavailable when the production worker service has no approved farms with usable detection boundaries. The Android release uses manual farm selection only.

Location permission can be changed in Settings > Privacy & Security > Location Services > Orchard Tech on an Apple device.

Preferences, searches and farm selection

The app stores the selected language and last-used tab in its private app storage. Search terms, the manually selected farm used to browse public site information and on-device location-matching results remain in the current app session and are not sent to Orchard Tech. Farm names entered in personal timesheets are separate saved record details and remain with those records as described below.

Cached worker information

The app stores a local copy of the public worker catalogue so approved information can remain available when reception is poor. If farms are later published, this may include approved farm details and farm-based weather information. Farm weather is based on the farm’s published coordinates, not the worker’s device location.

The public catalogue and saved files are stored in the app’s private local storage. On supported Apple devices, they are designated not to be backed up to iCloud. The Android release disables cloud backup and explicitly excludes app-managed local data from Android cloud backups and device-to-device transfers.

Contact draft and request status

The app holds an open contact draft in memory until the worker clears it or the app process ends. It does not save the message body as a persistent draft or automatically send it later. It stores one request identifier, creation time, send status and any returned handoff reference in app preferences until the worker clears that status or the app’s data is removed. A request identifier identifies a submission attempt, not a worker account. On supported Apple devices, device backup and restoration of app preferences are controlled by Apple. The Android release disables cloud backup and explicitly excludes app preferences from Android cloud backups and device-to-device transfers.

Attachment drafts, temporary copies and request status

The Upload files form holds the entered fields and selected content for the current submission. A selected PDF is read and rendered on the device before any converted image pages are sent. Selecting a file does not upload it. The app does not automatically scan the worker’s Photos or Files library, and it does not delete the original selected file from that library.

During a deliberate send, the app stages bounded portions of the reviewed image pages in private temporary app cache and streams them over HTTPS. It removes its transfer copies after the transfer ends or is cancelled. If the app stops unexpectedly or cleanup cannot complete, interrupted temporary copies may remain until later cleanup. Inactive copies older than 15 minutes are eligible for cleanup when the attachment service next loads or another transfer is prepared. These copies are not an automatic upload queue. The app does not automatically resend on reconnect or relaunch.

The app stores an upload-set identifier and group status records in app preferences until the worker clears that status or the app’s data is removed. For each group, these records contain its page range, page count and prepared byte total and, when an attempt has started, its request identifier, attempt time, send status and any returned handoff reference. A single-group selection also uses this status record. This minimal status does not contain the form body, name, worker ID, original filenames or selected page images. A request identifier identifies a submission attempt, not a worker account. After the app process ends, page images and entered form fields are not retained for automatic continuation; the saved group references help identify accepted, uncertain or missing groups before another selection is made. On Apple devices, backup and restoration of preferences are controlled by Apple. The Android release disables cloud backup and excludes app preferences from Android cloud backups and device-to-device transfers.

Notification registration and inbox

An optional staff-issued code links this phone to a worker record. The app keeps the resulting access credential in native protected storage: Apple Keychain restricted to this device, or encrypted Android app storage protected by Android Keystore. The credential is not placed in JavaScript storage, public catalogue requests, app preferences or exported timesheet backups. A new installation must be linked again. The one-use code is not saved as a draft.

Notification message titles, bodies, assigned-worker details and farm assignments are displayed from the protected service and held in app memory. The app clears them when it goes into the background or the phone is unlinked; it does not create an offline message archive. Reopening the inbox requires a connection. A linked phone can request messages without asking for the code each time, so keep the phone locked when it is not in use. Phone alerts remain optional.

Personal timesheets, paper photos and backups

A worker can save work dates, start and finish times, unpaid breaks, farm or site names, task codes, activities, optional cost-centre and spray/fertigation references, notes and days off. Optional worker details include full name, Orchard Tech ID, SELECT ID and contractor. Details can be saved for individual weeks. Workers can manually enter hours from their own paper sheet or office record for comparison; those values remain separate from calculated work hours. These are personal records, not employer-approved timesheets. The feature does not calculate wages, read office spreadsheets, automatically submit payroll or sync records to Orchard Tech. It can be used offline.

Timesheet records, weekly worker details, comparison values, export receipts and change history are stored in the app’s private preferences. An unfinished workday draft is also saved locally until saved or cancelled; this differs from the memory-only Contact and Upload files drafts. Earlier workday-log entries are brought into the new timesheet view without deleting the earlier stored log. Orchard Tech cannot remotely view, recover or delete these local records and has no automatic server copy.

A worker can deliberately select JPG/PNG photos of their own paper sheets and attach them to a week and farm. The app saves the selected image bytes, original filename, type, size, integrity fingerprint and association details in private local storage. It does not scan the photo library or delete the original source photo. Up to 20 MiB per photo and 40 MiB of saved photos in total are accepted. The saved image preserves any embedded metadata in the selected file, which may include the camera, capture time or GPS information. This differs from the separate Upload files workflow in section 5B, which rebuilds images before transfer. Avoid selecting another person’s private records or unnecessary sensitive information.

Choosing Open photo displays the saved image using the device’s preview or document viewer. On Android, another installed viewer may receive temporary read access to the selected file; its handling is governed by that app and the worker’s settings. Opening a photo does not automatically submit it to Orchard Tech.

A worker can create a personal PDF or CSV for a week and farm selection. These copies include the relevant saved timesheet and worker details; they are not a complete restorable backup. The separate JSON backup includes saved records, weekly details, comparison values, change history and the original bytes of attached paper photos. It does not include an unfinished draft or separately retained unreadable-data recovery archives. The app does not encrypt the backup file. A restore is validated, previewed and expressly confirmed before records change. Workers should keep backups private and save one before changing devices or removing the app.

PDF/CSV exports and JSON backups use the device’s save/share sheet, with a download fallback in a browser. Nothing is submitted to an employer automatically. A destination selected by the worker, such as Files, Mail or a cloud service, can receive and retain the chosen file under its own terms and settings. Backups can disclose earlier edited or deleted details in the included history, as well as visible photo content and embedded image metadata. The app creates private temporary export copies for this handoff. Copies older than 24 hours are eligible for cleanup when another export is prepared; this is not a promise of deletion at exactly 24 hours. An interrupted or uncertain handoff may leave a temporary copy until cleanup.

Editing or deleting an entry changes the active record and totals, but earlier values remain in local change history and may remain in the previous verified snapshot, preserved earlier workday log or recovery data. The app does not offer a separate erase-all-history control. If saved data becomes unreadable, the original text is retained for review and recovery; a confirmed recovery from backup retains that original. Removing a paper photo removes its current attachment and attempts to delete the app’s saved image file. If cleanup fails or recovery material must be preserved, private copies may remain until later cleanup or removal of app data. Removing a record or photo does not remove a source file or copies already saved outside the app.

On supported Apple devices, Apple may include app preferences in device backup or restoration depending on settings, so earlier records or drafts may reappear after a restore. Paper-photo files are stored in an app folder designated not to be backed up to iCloud; workers should use the explicit timesheet backup to keep records and photos together. The Android release disables cloud backup and excludes app-managed local data from Android cloud backups and device-to-device transfers. Removing remaining local data and external copies is explained in section 9.

4. Documents saved for offline use

When a worker chooses Save for offline use, the app downloads the approved document from Orchard Tech’s website and stores the document and related details on the device. Those details can include:

  • document title and language;
  • whether it is a company or farm document;
  • associated farm name and identifier, if applicable;
  • file type and size;
  • an integrity fingerprint;
  • the date saved; and
  • whether the saved copy is current, archived or not yet verified against the live catalogue.

Orchard Tech cannot remotely view the worker’s saved-document list. A worker can remove a saved document from the Saved tab. If a document is withdrawn from the live catalogue, the app may label the local copy as archived, but it remains on the device until the worker removes it or removes the app.

5. Information processed when the app connects online

The app makes encrypted HTTPS requests to Orchard Tech’s public worker services and, for linked phones, its protected Notifications service to:

  • request the catalogue in the selected language;
  • obtain published farm context and farm weather, if available;
  • check whether Contact messages and attachment submissions are available;
  • download a document selected by the worker;
  • link a phone, load authorised messages and assigned-worker details, record a message opening, update phone-alert registration or unlink a phone when using Notifications; and
  • send the Contact information or attachment fields and reviewed image pages a worker chooses to submit, after review and confirmation.

Catalogue and document requests do not include an Orchard Tech login, worker ID, advertising identifier, device coordinates, suggested-farm result, search terms or saved-document list. Contact requests additionally contain the message information described in section 5A. Attachment requests contain the reviewed fields and image pages described in section 5B. Protected Notifications requests use a separate device credential and the information described in section 5C. The app does not automatically add location or information from other apps to a contact message.

As with an ordinary internet request, Orchard Tech’s hosting and security providers process technical request information. This can include:

  • IP address and network-routing information;
  • request date and time;
  • requested URL, including the selected language or document path;
  • user-agent, device/browser and request-header information;
  • referrer, response status, file size, cache and routing information; and
  • security, diagnostic and error information.

An IP address can indicate an approximate country or region and can distinguish a network or device for security and visit-counting purposes. The requested language, page or document path can show how the public service was used.

The current public service is delivered through Cloudflare and hosted by WP Engine. These providers can generate aggregate traffic, request, cache, performance, error and security statistics. Orchard Tech can use technical information and those operational statistics only to deliver requested content, understand whether the public service is functioning, maintain availability and security, investigate faults, respond to privacy or support requests, and comply with legal obligations. Orchard Tech does not use them to create worker profiles or advertising profiles, or to track workers across apps or websites.

WP Engine currently makes edge access logs available to customers for up to the previous 72 hours and origin access logs as the most recent 1,500 requests. Orchard Tech does not intentionally export routine app access logs into a separate long-term worker profile. Cloudflare and WP Engine may retain separate operational, security and network records as needed to provide and protect their services or comply with law, under their service terms and privacy policies.

Apple may separately process App Store, TestFlight, device or diagnostic information under Apple’s own terms and privacy policy. Google may separately process Google Play, Android device or diagnostic information under Google’s own terms and privacy policy.

5A. Contact Orchard Tech messages and separate website forms

Messages sent from the app

Contact Orchard Tech collects your chosen topic, message, whether you include a name, any name and reply phone number you provide, whether a reply is requested, your privacy confirmation, and a request identifier and notice version. We use this information to handle your enquiry or requested reply and to prevent duplicate submissions. The app does not accept attachments, worker IDs or training evidence in this contact workflow.

If you choose “Send without my name”, the app omits the name and phone fields and does not request a reply. The server also discards any name or phone values supplied in that mode. Your message may still identify you, and ordinary hosting and security logs may exist. We do not promise anonymity.

The app sends the information over HTTPS to Orchard Tech’s website. The website passes a contact email to workerforms@orchardtech.com.au through Orchard Tech’s authenticated email service. The message is handled by authorised Orchard Tech personnel and the hosting, security and email providers needed to process it. The WordPress contact feature does not store the message body as a database record or attachment. The configured mail plugin’s email-content logging and asynchronous email queue are disabled.

The server keeps duplicate-prevention metadata, including a protected request key and content fingerprint, state, expiry and any handoff reference. This is not a copy of the message. The duplicate-prevention window is 24 hours; expired entries are eligible for scheduled cleanup. Security and rate-limit controls can also process technical request information. Actual deletion can occur after expiry when cleanup runs, and provider backups and logs have separate retention.

A successful result means that the server accepted the message for email handoff. It does not confirm arrival in the mailbox, staff review, a response, investigation, resolution or completion of an employer duty. If a result is uncertain, the app keeps that uncertainty visible. It does not automatically resend a message on reconnect or relaunch. Clearing the app does not cancel or recall a message that may already have been sent.

This is not an emergency service. For immediate danger, move to safety and contact your supervisor; call 000 for an emergency. Do not wait for a message response. Do not include passport, visa, bank, tax, medical or other private-document details, or information about another worker.

Separate website forms

Orchard Tech’s website separately offers hosted training, hazard-alert and contact forms at the website Forms page. The app’s former Forms launcher has been removed. If you separately use a website form, its collection notice explains the fields, purpose and restrictions for that workflow.

Those website forms may collect a name and worker ID; training and induction details; trainer, language-assistance and work-site information; a hazard description and location; messages, notes and an optional contact phone number; selected training-page images or an optional hazard photo; and form confirmations. They route handoff emails to workerforms@orchardtech.com.au. Accepted images are rebuilt as JPEG images before handoff, removing source filenames and EXIF/GPS metadata. The forms do not publish uploaded images or store them in the WordPress Media Library. Rebuilding an image is not malware scanning. Website contact messages do not accept attachments. Their no-name mode discards identity fields before constructing the email but does not guarantee anonymity.

Website submissions are handled by authorised Orchard Tech personnel and necessary providers for the relevant training, hazard or contact purpose. They are not used for advertising or cross-app tracking. Follow each form’s instructions about permitted information. A form confirmation or email handoff does not establish completed training verification, formal incident reporting or a response. These channels do not replace emergency action or required workplace processes.

5B. Attachments sent from the app

Collection notice version: 2026-10-10. Upload files collects the chosen Training, Hazard or Other category, name, Orchard Tech worker ID, title, optional note, reviewed image pages, privacy and own-record confirmations, notice version, a request identifier for each group, and input file counts and byte totals. For a grouped selection, the note also includes an upload-set identifier, group number and page range. It does not automatically add the worker’s device location, contacts, workday log or saved-document list.

The worker can select JPG/PNG images. The app decodes and rebuilds selected photos on the device before transfer, removing original filenames and embedded EXIF/GPS metadata from the transferred images. For training and other records, the worker can also select PDFs. A selection may contain up to 40 pages in total, including pages inside PDFs. The app renders PDF pages locally and converts them into JPEG images for review. The original PDF binary is not uploaded or emailed. Its visible page content is nevertheless disclosed when those images are sent. Interactive PDF features, embedded attachments and the original editable PDF are not delivered. Unsupported, encrypted, unreadable or excessive inputs are rejected before transfer. Each original photo or PDF must be 8 MiB or smaller, and the selected originals must total no more than 128 MiB. The prepared page images must total no more than 32 MiB. The app describes these MiB limits as MB. It divides the prepared selection into numbered groups, each containing no more than ten image pages and 8 MiB (8,388,608 bytes), for separate submission through the existing upload service. Hazard accepts one JPG/PNG image.

Workers must review the page images and details, confirm that these are their own requested records or their own hazard photo and that the pages are readable, acknowledge the collection notice and Privacy policy, and deliberately choose Send files for one group or the displayed Send all groups action for multiple groups. Drafts can be edited or cleared before sending. Selecting a file or returning online does not itself send it. The title, note and image page content may include personal or sensitive information in the worker’s requested record, including contact/address details, government-document or right-to-work identifiers, birth date, employment/training information, salary, tax or banking details, or health information. The service does not automatically obtain these records or use them for biometric identity matching.

Orchard Tech receives the fields and reviewed images through its HTTPS service and routes a separate email handoff for each group to workerforms@orchardtech.com.au. The app sends groups sequentially after the worker confirms the selection. Each group has its own request identifier and handoff result; a common upload-set identifier and the group/page-range information in the note connect a grouped selection. The app stops starting further groups after a rejection or uncertain result. A group already accepted for handoff may still arrive even if a later group is stopped or fails. Accepted groups are not resent when the worker deliberately continues the remaining groups. Generated transport filenames replace the original filenames. Selected photo metadata is removed on the device before transfer; the server also checks and rebuilds accepted images as JPEGs before handoff. These steps do not redact information visible within a page or photo, including a visible address or location. The uploads do not enter the WordPress Media Library or become public download links. Image rebuilding is not malware scanning. The original PDF is not sent to an external scanning provider.

Authorised Orchard Tech personnel and the hosting, security and mail providers needed to process the submission handle it for the chosen workplace purpose. The WordPress attachment feature does not retain the submitted page images or form body as a database record or public attachment. The server attempts to remove temporary copies after handling. A process interruption or cleanup failure can leave copies behind. Private temporary copies older than one hour are eligible for later cleanup when the existing scheduled cleanup job or another cleanup check runs. This does not guarantee deletion at an exact deadline or from provider backups. The configured mail plugin’s email-content logging and asynchronous email queue are disabled. Submitted email copies are retained as described in section 9. Hosting, security and mail providers may keep separate technical records under their service terms.

The server keeps duplicate-prevention metadata in WordPress options, including a protected request key, content fingerprint, state, timestamps and any handoff reference. This is not a copy of the name, note, document, image pages or form body. The retry/duplicate-prevention window is 24 hours. Expired metadata is eligible for the existing scheduled cleanup job; it may remain until that job actually runs. The expiry is not a promise of deletion exactly 24 hours after submission. Provider backups and logs have separate retention.

A handoff reference confirms server acceptance for email handoff. It does not establish mailbox delivery, staff review, accepted training completion, payroll processing, a completed incident process or a reply. The upload does not itself verify an identity/document or decide employment, visa, health or payroll outcomes. If delivery is uncertain, the app shows that uncertainty and does not automatically resend. Clearing local status cannot cancel or recall files already received or an email already handed off.

This is not an emergency service. For immediate danger, move to safety, contact your supervisor and call 000 in an emergency. Send only your own workplace records requested by Orchard Tech, or your own hazard photo. Check what was requested and every page, and include only information needed for that request. Do not submit another worker’s private records. Avoid identifiable people and private documents in hazard photos. The sensitive-document restrictions in the separate text-only Contact workflow remain in force; that message form is not an attachment route.

5C. Optional worker Notifications and phone alerts

Linking a phone and choosing recipients

Notifications lets authorised Orchard Tech staff send messages to all enrolled workers, workers assigned to a particular farm, or an individual worker. Staff create and maintain the worker reference, display name and authorised farm assignments. A worker chooses to link a phone by entering a private, one-use registration code supplied by Orchard Tech. Codes expire after 15 minutes. The code is not a public worker ID and must not be shared. Browsing a farm or using a location suggestion in the app does not enrol a worker, change their assignment or grant access to farm messages.

Enrolment sends the code, platform (Apple or Android) and a generic device label to the Orchard Tech service. It does not send a personal device name, phone contacts or device coordinates. The server links the registered device to the staff-managed worker record. The service also records a protected access-credential fingerprint, registration and last-access times, alert setting, platform and any revocation time. The credential itself is returned only to native protected storage on the phone. Registration codes and access credentials are stored as protected hashes on the server.

Messages and opening status

Orchard Tech stores the message title, text, optional Orchard Tech website link, intended audience, recipient records, sending staff member and creation/expiry times in its protected WordPress database. A phone can retrieve only messages authorised for its linked worker. Farm membership is checked again when a message is read or a phone alert is dispatched. These messages are not public website posts or email submissions.

Opening a message asks the server to record its first-open time against the worker and message. Staff can see recorded opening counts and alert-dispatch status. If the opening cannot be recorded, the app keeps the read status uncertain and offers a retry. An opening record does not prove the worker understood the message, completed a task or training, accepted a change, or that an employer obligation has been fulfilled. Alert-provider acceptance is separate from delivery to a phone and separate from opening the message.

Optional phone alerts and service providers

Phone alerts are separate from inbox access. The app asks the operating system for alert permission only after the worker chooses Enable phone alerts. A worker can decline permission and continue using the linked inbox. On an already linked phone with permission allowed, the app may refresh its delivery registration when it opens. Alert permission can be changed in the phone’s Settings for Orchard Tech.

Apple Push Notification service (APNs) delivers Apple-device alerts. Google Firebase Cloud Messaging (FCM), including its Firebase Installations dependency, delivers Android alerts. These services use a device/app delivery token and technical connection information. Firebase also processes a per-installation identifier and SDK/app/device metadata needed to provide its services. The Android app disables automatic FCM token registration and obtains a token only through the linked-phone alert flow. Google Analytics, advertising identifiers and behavioural-analytics SDKs are not added for Notifications, and Firebase delivery-metrics export is not enabled.

Orchard Tech stores the push delivery token encrypted on its server and keeps delivery attempts, provider response/status identifiers and related times. The alert sent to Apple or Google contains a generic notice and a message identifier. It does not contain the worker’s name, farm assignment, message title or message body. The worker opens the app to retrieve the details from Orchard Tech. The app does not subscribe phones to public farm topics. Hosting, security and notification providers process the information necessary to authenticate, protect and deliver these services under their applicable terms.

An alert may be delayed or prevented by connection, device settings or provider availability. Notifications is not an emergency channel. Contact a supervisor or Orchard Tech directly for urgent help, and call 000 for an emergency.

Unlinking and retention

The worker can choose Notifications → Phone registration and privacy → Unlink this phone. After the server confirms, this revokes that phone’s access, removes its stored server push token and clears the native access credential. An offline or failed unlink is not reported as completed. Orchard Tech staff can also revoke a phone or archive a worker’s notification access. A new one-use code is needed to link the phone again. Unlinking does not delete the worker record, messages, read records, provider records, personal timesheets or other app records.

Ordinary staff-to-worker messages expire from the inbox after 90 days. The scheduled cleanup removes expired messages and their recipient/read and dispatch rows when it runs; it is not a promise of physical erasure at the exact expiry time. Expired registration codes and rate-limit records are also eligible for scheduled cleanup, and notification administration audit records are removed after 90 days when cleanup runs. Worker records, farm assignments and registered/revoked device metadata have no automatic 90-day expiry. Contact Orchard Tech using section 11 to ask for access, correction or deletion; applicable recordkeeping needs and provider backups may limit immediate deletion. Apple and Google apply their own service retention to information they process. Turning off alerts or uninstalling the app does not itself delete Orchard Tech’s records.

6. How information is used and disclosed

Information handled through the app is used only to:

  • receive, match and review requested workplace records, training and induction evidence, assess and respond to hazard photos or alerts, and handle worker messages or requested replies as described in sections 5A and 5B;
  • provide the public worker-content service;
  • manage optional phone registration, authorised worker/farm audiences, message delivery, opening status and revocation as described in section 5C;
  • return information in the selected language;
  • deliver documents a worker requests;
  • review aggregate operational traffic, performance, error and security statistics;
  • maintain service security and reliability;
  • investigate and resolve technical issues;
  • answer privacy requests or complaints; and
  • meet lawful obligations.

Orchard Tech does not use app information for behavioural advertising, cross-app tracking or sale to data brokers.

Technical request information, and the personal fields, messages and reviewed image pages a worker deliberately submits, may be processed by service providers needed to host, secure and deliver the service and its email handoff, including Cloudflare, WP Engine and the configured mail services, or disclosed where authorised or required by law. Those providers process end-user information under their applicable service terms, data-protection terms and legal obligations.

Native Contact messages and separate hosted website submissions are handled as described in section 5A and their collection notices. Native attachment submissions are handled as described in section 5B, including private staff handling and necessary mail/hosting providers. Notifications is handled separately under section 5C, including staff-managed worker records and necessary Apple/Google alert services.

7. External websites, maps, calls and email

The catalogue can contain user-initiated links to government departments, PALM Scheme resources, workplace-safety regulators, workplace-relations bodies, insurers and other approved publishers. An external page opens in a separate browser view and is governed by the destination organisation’s privacy policy. On Android, this browser view is supplied by the device’s browser. The external website can receive ordinary browser-request information such as IP address, browser details and the requested page.

Training videos and online job guides open on the Orchard Tech website in a separate browser view. Website hosting and content-delivery providers process ordinary request information when pages, videos or downloads load, as described in the Orchard Tech Website Privacy Policy. Job guides may remember the English or paired English–Tongan reading choice in browser session storage. Opening these links does not send personal timesheets or the saved-document list. Opening or watching a video through these links does not create a completion, competence or supervisor sign-off record in the app.

If a worker chooses to open a farm in Apple Maps, the app supplies the published farm address, not the worker’s device coordinates, to the Maps link. Apple Maps may independently use device location according to the worker’s Apple settings and Apple’s privacy policy. On Android, the app opens the Google Maps website using the published farm address, without supplying the worker’s device coordinates. Google Maps and the browser may independently process information under the worker’s settings and their own privacy policies.

If a worker taps a phone or email link, the device’s Phone or Mail service, the telecommunications provider and the recipient handle that communication. The Orchard Tech app does not read contacts and does not capture call or email content.

8. Overseas processing

Cloudflare is a United States-based global provider and says it primarily stores information in the United States and European Economic Area, with transfers and access from other locations in which its group operates. WP Engine is a United States-based provider and may use international infrastructure and subprocessors.

Technical request information and deliberately submitted personal fields, messages and reviewed image pages may therefore be processed outside Australia, including in the United States and the European Economic Area, and may be accessed from other countries in which the necessary hosting, security and mail providers or their approved subprocessors operate. The app does not choose or promise a particular country for all provider processing or mailbox copies.

Where Australian privacy law applies to an overseas disclosure, Orchard Tech takes the reasonable steps required by that law, subject to any applicable exception.

Optional phone-alert information may also be processed outside Australia by Apple and Google and their service providers. The app does not choose or promise an Australian-only processing location for APNs, Firebase or the providers’ technical records. Notification payloads have the content limits described in section 5C.

9. Retention and deletion

The app applies the following local retention:

  • on supported Apple devices, a location reading and matching result are held temporarily in memory and are not written to app storage;
  • search terms and manual farm selection for browsing public site information last only for the current app session; farm names saved in personal timesheets follow the retention below;
  • language and tab preferences remain until changed or the app’s data is removed;
  • the public catalogue remains locally cached until refreshed or the app’s data is removed, and the app treats the cache as stale after 24 hours;
  • cached farm context is not used for automatic detection after it is stale or when a live refresh fails;
  • offline documents and their metadata remain until the worker removes them or removes the app;
  • notification codes and displayed message/worker details are memory-only; the protected native phone credential remains until the phone is successfully unlinked, its access is revoked and detected by the app, or app removal/new-installation handling clears it. Notification server records follow section 5C;
  • Contact and attachment drafts remain only in memory until cleared or the app process ends; private temporary attachment transfer copies and interrupted-copy cleanup are described in section 3;
  • Contact request identifiers, creation times, statuses and handoff references, and the attachment upload-set and group status records described in section 3, remain in app preferences until cleared or the app’s data is removed; and
  • personal timesheets, worker details, comparisons and locally saved workday drafts remain as described in section 3. Deleting an entry removes it from active totals but does not erase earlier values from change history, previous snapshots, preserved earlier logs or recovery data. Paper-photo removal and temporary export cleanup have the limits described in section 3.

Removing the app asks the operating system to remove its app-managed local data. On Apple devices, Apple controls device restoration and other operating-system behaviour. On Android, a worker can also remove app-managed local data through the device’s app-storage settings. The Android release disables cloud backup and explicitly excludes app-managed local data from Android cloud backups and device-to-device transfers. Copies a worker has opened, shared, pasted or saved in another app or service, including PDF/CSV exports, JSON backups and paper photos, must be removed separately from that destination. Removing the app does not erase an existing device backup or copies in other services; Apple restoration can restore app preferences as described in section 3.

Removing the app, clearing a draft or clearing local request status does not delete information already submitted to Orchard Tech or held in its mailbox, and does not delete the worker’s original source file. Contact messages and submitted attachment emails are retained for as long as reasonably necessary to handle the workplace purpose or enquiry, document its outcome and meet applicable recordkeeping requirements. They are then deleted or de-identified when permitted. If a message must be kept for a workplace matter or legal obligation, deletion may not be available. Requests about access, correction or deletion can be made using section 11. Provider backups, mail-system records and security logs may have separate retention and deletion arrangements; a deletion request does not promise immediate erasure from every backup. Orchard Tech will explain any applicable limits when responding. The server’s duplicate-prevention metadata has the 24-hour expiry and later scheduled cleanup described in sections 5A and 5B.

Notification message expiry, later cleanup and the distinct worker/device records are described in section 5C. Unlinking or deleting the app does not remove these server records or historical provider copies. A worker can ask Orchard Tech to correct an assignment, revoke a lost phone or review deletion of notification information using section 11.

Routine WP Engine access-log availability is described in section 5. Cloudflare and WP Engine may keep separate operational or security records for the periods necessary to provide, secure and audit their services or meet legal obligations. Orchard Tech keeps a privacy enquiry or complaint only for as long as reasonably necessary to respond, document the outcome and meet applicable legal recordkeeping requirements, then destroys or de-identifies it when permitted.

10. Security

The app minimises information sent off the device. It uses HTTPS, does not attach app-login credentials to public-content requests, restricts external links to approved HTTPS destinations, and verifies the type, size and integrity of documents saved offline.

Local information is kept within the app sandbox and is also protected by the worker’s device passcode and operating-system security settings. Workers should keep the operating system updated and report a lost or compromised device promptly.

Orchard Tech uses reasonable technical and organisational safeguards appropriate to the information and risks. No internet or storage system is completely secure. Orchard Tech assesses suspected eligible data breaches and, where the Notifiable Data Breaches scheme applies, notifies affected people and the Office of the Australian Information Commissioner as required.

11. Access, correction, deletion and complaints

The app’s existing tools remain available without a worker account or phone registration. Optional Notifications links a phone to a staff-managed worker record. Orchard Tech cannot remotely access information that exists only inside the app on a worker’s device. Orchard Tech may hold the notification information in section 5C and information the worker submits through native Contact, Upload files or separate hosted website forms. The access, correction, deletion and complaint process below applies to that server-held information.

A worker can:

  • revoke location permission in device Settings on supported Apple devices;
  • change the app language;
  • change phone-alert permission in device Settings, unlink a registered phone from Notifications, or contact Orchard Tech to correct a farm assignment, revoke a lost phone or request deletion of notification information;
  • review, edit or delete active personal entries and remove paper photos in My Workday / My timesheets, subject to the change-history and recovery retention described in section 3;
  • remove offline documents from the Saved tab;
  • clear a Contact or attachment draft or local request status from the respective screen, noting that this cannot recall a submission already handed off;
  • remove remaining app-managed local data by uninstalling the app; and
  • on Android, remove app-managed local data through the device’s app-storage settings.

A person can contact Orchard Tech to ask whether it holds personal information about them, request access or correction, request deletion where appropriate, or make a privacy complaint. Orchard Tech may need to verify identity before acting.

Orchard Tech aims to respond within 30 calendar days. If it cannot provide access, correction or deletion, it will explain the reason and available complaint avenues where required.

Please first send a complaint to Orchard Tech using the contact details below. If Orchard Tech does not respond within 30 days, or the person is not satisfied with the response, they may contact the Office of the Australian Information Commissioner.

12. Children

The app is not designed for young children and is not submitted in Apple’s Kids Category. It is intended for people who need Orchard Tech worker information. The app does not offer public self-service worker-account creation. Optional phone registration uses a code issued by Orchard Tech for an existing staff-managed worker record. Notifications, Contact, Upload files and separate hosted forms are intended for adults using Orchard Tech’s worker services and handle the information described in sections 5A, 5B and 5C.

13. Changes to this policy

Orchard Tech will review this policy before materially changing app or server data handling, including materially changing Notifications, native Contact, Upload files or hosted forms, or enabling additional submission workflows, account features beyond current phone registration, additional location processing, behavioural analytics beyond the aggregate operational statistics described in section 5, or advertising.

The revised effective date will be published, and an appropriate prominent notice will be provided when a change materially affects users’ privacy.

14. Contact

Privacy contact: Hari Yellina
Legal operator: Suvarnabhoomi Pty Ltd ACN 141 241 769 as trustee for the Suvarnabhoomi Discretionary Trust, ABN 16 102 266 894, trading as Orchard Tech
Email: hari@orchardtech.com.au
Phone: +61 439 323 232
Postal address: 12 Happy Valley Road, Robinvale VIC 3549, Australia

Please use the subject line Privacy request.