DRAFT for review by a qualified Australian legal practitioner before use. Not legal advice.
Collection Notice and Consent (Quote Request Form)
Operating entity: Blue Collar News Services Pty Ltd (ABN [TBC]) ("we", "us", "our") Website: Services.BlueCollarNews.com.au Version: 2.0 (draft) | Effective date: [TBC]
This document specifies (a) the APP 5 collection notice provided at the point of collection on the quote request form, and (b) the exact consent wording displayed, with the design and record-keeping rules. The wording in boxed quotes is the customer-facing copy; the surrounding text is implementation guidance for the lawyer and developers.
Business decision (v2): The five separate checkboxes in v1 were consolidated into a single required consent, and the verbose on-form collection-notice paragraph was replaced with a short pointer to the Privacy Policy. This was a deliberate UX/commercial decision (the operator did not want the matching mechanics (the number of businesses and first-come-first-served allocation) advertised on the form). Sections 2 and 4 record the resulting wording and the legal trade-offs the lawyer must confirm are acceptable.
1. APP 5 collection notice (at the quote form)
Under APP 5, at or before collection we must take reasonable steps to notify the individual of certain matters. The form does not display the full notice inline; instead it shows the single consent statement (section 2) plus a prominent link: "See how we handle your information in our Privacy Policy." The full APP 5 matters (purpose, recipients, overseas disclosure, access/correction, complaints) live in the Privacy Policy.
Lawyer note: Confirm that the single consent statement + a one-click Privacy Policy link satisfies "reasonable steps" under APP 5 for this collection, or whether a short inline notice must be restored. The operator's preference is to keep the matching mechanics (recipient count, allocation method) off the form and disclosed only in the Privacy Policy.
2. Consent (exact wording)
Display one (1) required checkbox, un-ticked by default, which gates submission:
Checkbox 1: Core consent (gates submission)
☐ I agree that my name, contact details and job information can be shared with independent local businesses so they can contact me about this job, by phone, SMS or email, to provide a quote. I understand details already shared with them can't be recalled. (Required to submit your request.)
Below the checkbox: "See how we handle your information in our Privacy Policy."
The recorded version identifier for this wording is share_with_businesses v1 (see supabase/seed/consent-wording.ts and consent_wording_versions).
3. Design and implementation rules (mandatory)
3.1 No pre-ticked box. The checkbox defaults to un-ticked; the user must take positive action to consent.
3.2 Service must function without marketing consent. No marketing consent is collected on the form. Any future marketing opt-in must be separate, optional, and obtained via double opt-in, never bundled into this consent and never a condition of the service.
3.3 Plain language and prominence. Wording must be plain English, legible, and not hidden behind links.
3.4 Record of consent. For each submission we store, in consent_records: (a) the consent type/key and wording version shown; (b) the state (granted true/false); (c) the timestamp; and (d) the IP address and user agent. Retain for the life of the relationship plus the applicable limitation period.
3.5 Versioning. Any change to the wording appends a new version (never edit in place) so historical consents tie to the exact text shown.
4. Legal rationale and trade-offs (for lawyer review)
4.1 Single consolidated consent. The one checkbox covers (i) disclosure of personal information to the matched businesses (APP 6) and (ii) the businesses contacting the consumer about this job by phone, SMS and email. Consolidating these is more convenient but carries risk the lawyer must weigh:
- Spam Act 2003 (SMS/email): consent to commercial electronic messages can be bundled with the service consent provided it is express and the messages relate to the requested job. Confirm this is acceptable, and note the businesses remain independently responsible for sender-ID and a working unsubscribe.
- Do Not Call Register Act 2006 (phone): the consent includes phone contact "about this job". Confirm whether explicit reference to the Do Not Call Register (as in v1) should be restored for businesses to rely on the "agreed to" exception. The businesses also carry their own DNCR obligations under the Business Customer Agreement.
4.2 No marketing on the form. Marketing from us is a distinct purpose and is not collected here, avoiding the bundling/ACL s23 risk that a combined service+marketing consent would create.
4.3 Recipient mechanics disclosed in the Privacy Policy, not the form. The "up to five (5) independent businesses, first-come-first-served" detail is omitted from the form copy (business decision) but must remain accurately disclosed in the Privacy Policy to meet APP 5/6. Confirm the Privacy Policy carries this disclosure.
5. Cross-references
5.1 Read with the Privacy Policy (clauses 6 and 8) and Terms of Use (clause 5).
End of Collection Notice and Consent (draft v2).