Your information, plainly put.
Koho is software for recruitment agencies. Agencies use it to format candidates' resumes, check references, send documents and agree terms of business with their clients. That means Koho holds personal information about people who have never signed up to it (candidates, referees and the agencies' clients), and this policy explains what happens to it.
At a glance
We handle personal information in accordance with the Privacy Act 1988 (Cth) and the Australian Privacy Principles.
01Who we are
Koho is operated by By CSK, ABN 15 792 348 524, of Melbourne, Victoria. Privacy enquiries go to privacy@koho.au.
REP Recruitment, a recruitment agency, uses Koho as a customer like any other: it has no access to any other agency's information, and the separation between agencies is enforced in the database itself.
02Two roles
We decide what is collected and why, and this policy is our commitment to you.
We hold your information on behalf of the recruitment agency you are dealing with. The agency decides what it collects about you and what it does with it, and its own privacy policy applies. We act on its instructions, keep its information separate from every other agency's, and do not use it for any purpose of our own.
If you are a candidate, referee or client, please contact the agency first: it can see, correct and delete what it holds about you. If you cannot reach it, or you are not sure which agency holds your information, write to us and we will help.
03The information held
Name, email address, job title, mobile number, a photo if you add one, your role in the workspace, and the agency's details (name, ABN, address, logo and brand settings).
Entered by the agency, or by you through a registration link: name and contact details, employment history, qualifications, the text of your resume, salary expectations, notice period and availability, right-to-work information and any evidence you upload for it, the referees you nominate, and the agency's notes.
Name, position, organisation, email address and phone number, how you worked with the candidate, your answers, and the record of your consent to give the reference.
Names, email addresses and roles of the people the agency deals with. For terms of business, the name, role and email address of the person who agrees to them, when they agreed, and the IP address and browser they agreed from. This is the audit trail of the agreement.
When you open, start and finish what the agency sent (a registration form, a reference request, a document or terms of business), Koho records those moments so the agency knows where things stand.
Our systems keep standard logs of requests, including IP addresses, so the service can be delivered and protected from abuse. If you email us, we keep your message and address so we can reply.
We do not seek sensitive information. A recruitment agency may hold some because of the role (for example, a visa status); it does so under its own policy.
04How it is collected
From agency staff when they use Koho; from candidates, referees and clients through the links an agency sends them; from documents an agency uploads, such as a resume; and from you, if you write to us.
05Why
To provide Koho to the agencies that use it: to format resumes, run reference checks, send documents, and record agreement to terms of business. For agency staff, also to run the account, keep it secure, and contact you about the service.
06Who we disclose it to
- The agency that holds the information, and the people it chooses to send documents to (for example, a completed reference to a hiring client).
- Service providers that run parts of Koho for us (section 07). They may use personal information only to provide that service.
- Where the law requires or authorises it.
We do not sell personal information, and we do not use one agency's information for another agency or for our own recruitment business.
07Where it is held, including overseas
Our database and file storage, including any resumes and documents an agency keeps.
Runs the application, koho.au and its visitor statistics, produces PDFs, and receives email sent to koho.au addresses.
Sends every email Koho sends.
Reads resumes, brand guidelines and an agency's existing terms of business into structured fields.
Serves the typefaces koho.au uses, and hosts the mailbox that email to koho.au addresses is forwarded to.
Koho uses AI (Anthropic's Claude) for three things: setting out an uploaded resume in the agency's template, reading an agency's brand guidelines, and importing an agency's existing terms of business. For a resume and for terms of business, the file is read on the consultant's own computer and only its text is sent; brand guidelines are sent as the PDF itself, since the layout is what is being read. Nothing is added that the candidate did not write, a consultant reviews the result before anything is saved, and under Anthropic's commercial terms the contents are not used to train its models. Market figures in Koho come from published government data, never from AI.
Before disclosing personal information to an overseas recipient, we take reasonable steps to satisfy ourselves that it will be handled consistently with the Australian Privacy Principles.
08Storage, security and retention
Every agency's information is held separately and is visible only to that agency's signed-in staff; the separation is enforced in the database itself. Documents are reached only through short-lived signed links, and the links sent to candidates, referees and clients are unguessable and expire.
Links sent to candidates, referees and clients expire after 30 days unless the agency sets otherwise.
Resume files are not stored by default. An agency can choose to keep them, in which case they are deleted automatically after the period the agency sets (two years unless it chooses otherwise).
Right-to-work and similar documents with an expiry date are kept until 90 days after they expire.
Candidate records (the structured profile, references and notes) are kept until the agency deletes them.
Signed terms of business and their audit trail are kept unaltered for as long as the agency's account exists, because they are the record of an agreement.
Closing an account. An agency can export everything its workspace holds at any time. When it closes the workspace, links still out stop working at once, no further email is sent for it, and 30 days later the workspace, its files and the logins that belong only to it are deleted. Until then an admin can cancel.
09Cookies and analytics
Sets only the cookies needed to keep agency staff signed in, and one that remembers whether you chose the light or dark theme. The pages candidates, referees and clients open set none.
Sets no cookies. It counts its visits with Cloudflare Web Analytics, which does not use cookies or follow you to other sites.
We run no advertising or cross-site tracking.
10Access and correction
You can ask for a copy of the personal information we hold about you and ask us to correct it. If it is held for an agency, we will pass your request to that agency and help it respond. Write to privacy@koho.au; we respond within 30 days, and there is no charge.
Reference responses are given in confidence. Whether a candidate can see one is a decision for the agency that asked for it.
11Data breaches
If a breach is likely to cause serious harm, we will notify the agencies affected, and the Office of the Australian Information Commissioner and the people affected as the Notifiable Data Breaches scheme requires.
12Complaints
Write to privacy@koho.au. We acknowledge complaints and respond within 30 days. If you are not satisfied, you can contact the Office of the Australian Information Commissioner at oaic.gov.au or on 1300 363 992.
13Changes
The current version is always at koho.au/privacy, with the date it was last updated at the top.
14Contact
Privacy enquiries, access requests and complaints: privacy@koho.au. We are based in Melbourne; ask at that address for a postal address.
Questions about your information?
Ask us, or ask for a copy of what we hold. We answer within 30 days, at no charge.