Peak Output Privacy Policy

Incorporating Australian, GDPR (EU/UK) and U.S. State Privacy Law Requirements

Last reviewed July 2026

Introduction

At Peak Output Pty Ltd (“the Company,” “we,” “us,” or “our”), the privacy and security of our clients' and platform users' personal information are very important to us. While providing the benefits of our online assessments, insights and education services, we maintain rigorous control over all personal information we process.

This Policy applies to all individuals whose personal information we process, regardless of location, and is structured as follows: Part A sets out our universal privacy commitments and practices; Part B sets out additional disclosures and rights specific to individuals located in the European Union and United Kingdom (GDPR); and Part C sets out additional disclosures and rights specific to individuals located in the United States, including California and other states with comprehensive privacy legislation.

Our commitment to security and privacy is backed by data encryption, login and password authentication, and network integrity technologies.

Part A - Universal Practices

1. Our Philosophy

At Peak Output Pty Ltd (“the Company,” “we,” “us,” or “our”), the privacy and security of our clients' and platform users' personal information are very important to us. While providing the benefits of our online assessments, insights and education services, we maintain rigorous control over all personal information we process.

This Policy applies to all individuals whose personal information we process, regardless of location, and is structured as follows: Part A sets out our universal privacy commitments and practices; Part B sets out additional disclosures and rights specific to individuals located in the European Union and United Kingdom (GDPR); and Part C sets out additional disclosures and rights specific to individuals located in the United States, including California and other states with comprehensive privacy legislation.

Our commitment to security and privacy is backed by data encryption, login and password authentication, and network integrity technologies.

2. Definition of Personal Information

Personal information means any information or opinion about an identified or identifiable individual, whether the information is true or not and whether recorded in a material form or not.

Sensitive personal information includes information about an individual's health, criminal record, religious beliefs, ethnicity, sexual orientation, trade union membership, or political opinions, and — where applicable under GDPR — “special category data” as defined in Article 9 of the GDPR.

As a general rule, we do not collect sensitive personal information. Where we do collect sensitive personal information, we only do so with your explicit consent, where reasonably necessary for our functions or activities, or as otherwise permitted or required by law.

3. Information We Collect

3.1 Internal Use of Personal Information

The Company collects information during the engagement and assessment process. Mandatory personally identifiable information includes first name, surname, phone number, postal address, and email address. The Company uses this information internally to process and respond to your requests and to communicate with you. Employees and contractors of the Company are bound by strict confidentiality obligations, and any misuse of client information is grounds for disciplinary action up to and including termination. Client information is made available to employees only on a need-to-know basis.

3.2 Information Collected During the Peak Output Discovery Process

The Peak Output Discovery Administrative System exists to better understand an individual's behaviors, talents, and motivations. We collect responses to the Peak Output Discovery Process in order to better understand the factors that drive workplace decisions and interactions. Upon completion of any Discovery Process, we store your responses together with your contact information (name and email) for the purpose of identifying these records as yours. We may also collect demographic information such as language and country of residence to customize your Discovery experience, subject to your prior consent where required.

3.2 Information Collected During the Peak Output Discovery Process

The Peak Output Discovery Administrative System exists to better understand an individual's behaviors, talents, and motivations. We collect responses to the Peak Output Discovery Process in order to better understand the factors that drive workplace decisions and interactions. Upon completion of any Discovery Process, we store your responses together with your contact information (name and email) for the purpose of identifying these records as yours. We may also collect demographic information such as language and country of residence to customize your Discovery experience, subject to your prior consent where required.

3.3 Use of Information Collected During the Discovery Process

We gather your responses and translate them into key behavioral and talent insights. These insights vary by application, and are typically produced to allow an engaging business to customize service delivery and the working relationship to your needs and preferences.
Automated Processing and Profiling Disclosure
The Discovery Process involves automated processing of your responses to generate behavioral and talent insights (“profiling”). This profiling informs coaching recommendations, team composition insights, and development planning, but does not by itself make any final decision about your employment, compensation, or legal status without human involvement from your engaging organization. Where you are located in the European Union or United Kingdom, additional rights relating to this profiling are set out in Part B below.

4. Insights Sharing and Privacy Settings

Upon completing the Discovery Process, you may choose to share your Peak Output Insights record with friends, family, and other members of the Peak Output Community. This optional feature allows licensed Peak Output Community users who have an established relationship with you to access your Insights record. If a business holds your contact information in its own customer database, Peak Output may, subject to your prior consent, provide that business with access to view your Insights record. In this process, Peak Output does not provide access to your personal contact information, only your Insights results.

5. Our Representatives and Third-Party Disclosure

The Company and its authorized representatives use information only for the purpose of facilitating the Discovery Process and related services. Representatives receive only the minimum information necessary for this purpose and are contractually obligated to keep that information confidential and to use it for no other purpose.

The Company will not disclose your personal information to third parties without your consent, except where compelled to do so by law. Where an Educational or Training Facilitator is engaged by your organization to run a session with you or your team, or to provide a service such as one-on-one coaching, that facilitator may be given access to the Peak Output platform to facilitate that session using your individual and team talent and behavioral content.
The Company also engages a limited number of third-party service providers (including cloud hosting, payment processing, and our psychometric assessment partner) who process personal information on our behalf under contractual confidentiality and data protection obligations. We do not sell personal information to third parties for their own independent marketing purposes.

6. International and Overseas Disclosure of Information

The Company is based in Australia, and your personal information may be stored, processed, or accessed in Australia and in other countries in which the Company or its service providers operate, including the United States. Where you are located in the European Union or United Kingdom, transfers of your personal information to Australia and other non-adequate jurisdictions are made subject to appropriate safeguards as described in Part B below, such as Standard Contractual Clauses approved by the European Commission.

Before disclosing personal information to an overseas recipient, the Company takes reasonable steps to ensure that the recipient does not breach the Australian Privacy Principles, GDPR (where applicable), or applicable U.S. state privacy law in relation to that information, including through contractual data protection obligations with our service providers and platform infrastructure partners.

7. Your Access to Your Information

You may at any time request from the Company a copy of your personal information that has been collected through this site or the Discovery Process. The Company will provide it to you and correct any errors you identify, subject to the additional jurisdiction-specific rights set out in Parts B and C.

8. Record Retention

The Company retains your personal information and assessment data for as long as reasonably necessary to fulfil the purposes described in this Policy, including the ongoing delivery of coaching, development, and platform services to you and your engaging organization, and for legitimate validation and research purposes.
Specifically:

  • Active client and platform user records are retained for the duration of the engagement and for two years thereafter to meet legal, accounting, and contractual obligations.
  • Where your personal assessment data is used for validation or research purposes beyond this period, it is de-identified (“blinded”) and aggregated with other user data so that it is no longer identifiable to you.
  • You may request earlier deletion of your personal information, subject to the rights and exceptions set out in Parts B and C below.

9. Storage and Security of Information

The Company uses a variety of physical and electronic security measures, including restricted physical access to our offices, firewalls, and secure databases, to keep personal information secure from misuse, loss, or unauthorized use or disclosure.

We take reasonable steps to:

  • protect your personal information from interference, misuse, loss, unauthorized access, modification, or disclosure;
  • destroy or permanently de-identify your personal information when it is no longer required; and
  • keep your personal information up to date, accurate, complete, and relevant.
Data Breach Notification
In the event of a data breach that is likely to result in a risk to your rights and freedoms, the Company will notify affected individuals and, where required by applicable law, the relevant supervisory or regulatory authority (including the Office of the Australian Information Commissioner under the Notifiable Data Breaches scheme, the relevant EU/UK supervisory authority within 72 hours under GDPR Article 33, or applicable U.S. state regulators) without undue delay.

10. Cookies

To enable the Company to develop personalized service offerings online, the Company uses cookies and similar technologies to maintain continuity within a client's Online Service session and, where applicable, to understand platform usage. Session cookies are deleted by both the client's browser and the Company's servers when the client logs out. Where the Company uses any persistent or third-party analytics cookies, this will be disclosed to you through a cookie banner or consent mechanism at the point of collection, consistent with applicable law (including the GDPR's ePrivacy requirements for EU/UK users). The Company does not use cookies to collect or store sensitive personal information and does not sell cookie-derived data to third parties.

11. Website Links

Our website may provide links to other sites. This Policy does not apply to those linked sites. We recommend that you read the posted privacy policy whenever interacting with any external website.

12. Access and Correction

You may request access to, or correction of, any personal information we hold about you, unless an exception under applicable law applies. The Peak Output platform provides online access to your personal details, such as name and email address, which you may access and update at any time. If you request the Company to provide this information through another channel, we may charge a reasonable fee to cover the cost of providing it, where permitted by applicable law.

Please contact our Privacy Officer using the details in Section 16 below to seek access to your personal information or to raise a complaint concerning your information privacy. We may decline a request to access or correct your personal information in certain circumstances; where we do, we will provide written reasons and information about the complaint mechanisms available to you. Our Privacy Officer will investigate access or correction requests and respond as soon as reasonably practicable.

13. Use of a Pseudonym

Where it is lawful and practicable to do so, you may interact with us anonymously or using a pseudonym.

14. Children's Information

Peak Output's services are designed for use by working adults in an employment or professional development context. We do not knowingly collect personal information from children under the age of 16 (or the relevant age of digital consent in your jurisdiction), and our services are not directed at children. If we become aware that we have inadvertently collected personal information from a child, we will take reasonable steps to delete it.

Part B - Additional Terms For EU and UK Individuals (GDPR)

This Part B applies in addition to Part A where you are located in the European Economic Area (EEA) or United Kingdom, or where your personal information is otherwise subject to the EU General Data Protection Regulation (GDPR) or the UK GDPR. Where there is any inconsistency between Part A and this Part B in relation to such individuals, this Part B prevails.

B1. Data Controller

For the purposes of the GDPR, Peak Output Pty Ltd is the data controller of personal information processed through the Discovery Process and platform, except where your engaging organization independently determines the purposes and means of processing your information, in which case your employer or engaging organization may act as the data controller and Peak Output as its data processor under a separate data processing agreement.

B2. Lawful Basis for Processing

We process your personal information under the following lawful bases, depending on the activity:

  • Contract (Art. 6(1)(b)): where processing is necessary to perform our services to you or your engaging organization, such as administering the Discovery Process and generating insights.
  • Consent (Art. 6(1)(a)): where you have given clear consent, such as for Insights Sharing with the Peak Output Community, or for the collection of demographic information to customize your experience.
  • Legitimate Interests (Art. 6(1)(f)): where processing is necessary for our legitimate interests in operating, securing, and improving our platform and services, and these interests are not overridden by your interests or fundamental rights.
  • Legal Obligation (Art. 6(1)(c)): where processing is necessary to comply with a legal obligation, such as responding to a lawful request from a public authority.

Where we process special category data (Art. 9), such as health information disclosed in a coaching context, we rely on your explicit consent or another applicable Article 9 condition.

B3. Automated Decision-Making and Profiling

Peak Output is NOT an automated decision-making tool. The Discovery Process generates behavioral and talent insights that are designed to inform and support a leader's or organization's own decision-making process. These insights are never the sole or determining factor in any decision made about you, and are always considered alongside human judgment and other relevant information by your engaging organization.

To the extent any processing of your Discovery Process responses is later found to involve automated decision-making that produces legal effects concerning you or similarly significantly affects you, you have the right to obtain human intervention, to express your point of view, and to contest the decision. Please contact our Privacy Officer using the details in Section 16 of Part A to exercise this right.

B4. Your Rights Under GDPR

Subject to applicable conditions and exceptions, you have the right to:

  • Access: obtain confirmation of whether we process your personal information, and a copy of that information.
  • Rectification: request correction of inaccurate or incomplete personal information.
  • Erasure (“right to be forgotten”): request deletion of your personal information in certain circumstances.
  • Restriction: request that we limit the processing of your personal information in certain circumstances.
  • Data Portability: receive your personal information in a structured, commonly used, machine-readable format, and have it transmitted to another controller where technically feasible.
  • Objection: object to processing based on legitimate interests, including profiling, and to processing for direct marketing purposes at any time.
  • Withdraw Consent: withdraw your consent at any time where processing is based on consent, without affecting the lawfulness of processing before withdrawal.
  • Lodge a Complaint: lodge a complaint with your local supervisory authority, or the supervisory authority of the EU/UK member state in which you reside or work.

To exercise any of these rights, please contact our Privacy Officer using the details in Section 16 of Part A. We will respond within one month of receiving a verifiable request, extendable by a further two months for complex requests, as permitted under GDPR.

B5. International Transfers

As Peak Output is based in Australia, personal information transferred from the EEA or UK to Australia constitutes a transfer to a third country that does not benefit from an EU adequacy decision. We safeguard such transfers through the European Commission's Standard Contractual Clauses (SCCs) or the UK International Data Transfer Addendum, as applicable, incorporated into our agreements with relevant service providers and engaging organizations. A copy of the relevant safeguards can be requested from our Privacy Officer.

B6. EU/UK Representative

Peak Output does not meet the requirements under Article 27 GDPR to have an appointed EU and/or UK representative. 

B7. Data Protection Officer

Peak Output does not meet the requirements under Article 37 GDPR to appoint a Data Protection Officer.

Part C - Additional Terms For United States Individuals

This Part C applies in addition to Part A where you are a resident of the United States, including residents of California, Virginia, Colorado, Connecticut, Utah, and other states with applicable comprehensive consumer privacy laws. Where there is any inconsistency between Part A and this Part C in relation to such individuals, this Part C prevails.

C1. California Privacy Rights (CCPA / CPRA)

If you are a California resident, the California Consumer Privacy Act, as amended by the California Privacy Rights Act (collectively, “CCPA”), provides you with the following rights in relation to your personal information:

  • Right to Know
    Request disclosure of the categories and specific pieces of personal information we have collected about you, the categories of sources, the purpose for collection, and the categories of third parties with whom we share personal information.
  • Right to Delete
    Request deletion of personal information we have collected from you, subject to certain exceptions.
  • Right to Correct
    Request correction of inaccurate personal information.
  • Right to Opt-Out of Sale or Sharing
    Direct us not to sell or share your personal information. The Company does not sell personal information for monetary consideration. However, the Insights Sharing feature described in Section 4 of Part A may constitute “sharing” under the CCPA's broad definition if it involves cross-context behavioral advertising; this is assessed as not applicable to Peak Output's current Insights Sharing model, which operates on an opt-in, individual-to-individual basis rather than for advertising purposes.
  • Right to Limit Use of Sensitive Personal Information
    Direct us to limit the use of sensitive personal information (such as health information disclosed in a coaching context) to purposes necessary to provide the requested services.
  • Right to Non-Discrimination
    We will not discriminate against you for exercising any of your CCPA rights.

To exercise any of these rights, please contact our Privacy Officer using the details in Section 16 of Part A. We will verify your request before responding, and will respond within 45 days, extendable by a further 45 days where reasonably necessary.

Categories of Personal Information Collected (Preceding 12 Months)

CategoryCollected?Sold or Shared?
Identifiers (name, email, phone, postal address)YesNo
Professional / employment informationYesNo
Demographic information (language, country of residence)Yes, with consentNo
Discovery Process responses and derived behavioural insightsYesNo (shared only with your consent via Insights Sharing)
Sensitive personal information (e.g. health, if disclosed in coaching)Limited, with consentNo
Internet / platform activity informationYesNo

C2. Other U.S. State Privacy Rights

If you are a resident of Virginia, Colorado, Connecticut, Utah, or another U.S. state with a comprehensive consumer privacy law, you may have rights similar to those described in Section C1 above, including rights to access, correct, delete, and obtain a portable copy of your personal information, and to opt out of the processing of your personal information for purposes of targeted advertising, the sale of personal information, or certain types of profiling. To exercise these rights, please contact our Privacy Officer using the details in Section 16 of Part A. We will respond in accordance with the timeframes required under the applicable state law.

C3. Children's Online Privacy Protection Act (COPPA)

Consistent with Section 14 of Part A, our services are not directed at children under 13, and we do not knowingly collect personal information from children under 13 in a manner inconsistent with COPPA.

C4. Biometric Information

Peak Output's Discovery Process is a self-report behavioral and personality assessment based on your responses to questions; it does not collect biometric identifiers such as fingerprints, retina scans, or voiceprints as defined under state biometric privacy laws (e.g. the Illinois Biometric Information Privacy Act).

C5. U.S. Contact for Privacy Requests

U.S. residents may direct privacy requests and inquiries to our Privacy Officer using the contact details in Section 16 of Part A.

Part D — General Provisions

15. Complaints and Further Information

We recognize our responsibility to protect the privacy of your personal information. If you have questions or comments about our handling of your personal information, please contact the Privacy Officer using the details below. You may also use these details to raise concerns or complaints regarding compliance with this Policy, the Australian Privacy Principles, the GDPR, or applicable U.S. state privacy laws.

If you are not satisfied with how we have handled your complaint, you may lodge a complaint with the relevant regulator for your jurisdiction:

Australia

Office of the Australian Information Commissioner

Telephone: 1300 363 992

Address: GPO Box 5218, Sydney NSW 2001

Email: enquiries@oaic.gov.au

Website: www.oaic.gov.au

European Union / United Kingdom

You may lodge a complaint with the supervisory authority in your EU member state of residence, work, or the place of the alleged infringement, or with the UK Information Commissioner's Office (ICO) if you are a UK resident:

ICO Website: www.ico.org.uk

United States of America

California residents may lodge a complaint with the California Privacy Protection Agency (CPPA) or the California Attorney General's office. Residents of other U.S. states may contact the applicable state Attorney General's consumer protection office.

16. Responsibility and Review

The Privacy Officer is responsible for compliance with this Policy and for ensuring that it is brought to the attention of existing and new employees or contractors of the Company. This Policy is reviewed periodically and updated where required, including to reflect changes in applicable privacy law across the jurisdictions in which Peak Output operates.

17. Our Contact Details

If you have any questions or comments concerning this Policy or our handling of your personal information, you may contact the Privacy Officer at:

Address: Peak Output Pty Ltd

PO Box 108, Porepunkah VIC 3740, Australia

Email: hello@peakoutput.com (Attention: Privacy Officer)

18. Changes to This Policy

The Company may amend this Policy from time to time to reflect changes in our practices or in applicable law. Changes will be posted on our website at www.peakoutput.com and will be effective immediately upon publication unless otherwise stated. We encourage you to review this Policy periodically.