Enmasse respects your privacy. This policy explains what personal information we collect, why we collect it, how we look after it and the choices you have.
It applies to our website, our training, consulting, digital diagnostics and eLearn services, our events and our marketing. It is written to meet the Australian Privacy Act 1988 (Cth) and the Australian Privacy Principles, the UK General Data Protection Regulation (UK GDPR) and Data Protection Act 2018, and the EU General Data Protection Regulation (EU GDPR) where it applies.
Enmasse is the trading name of two companies. Each is responsible for (the "controller" of) the personal information it collects:
In this policy, "Enmasse", "we", "us" and "our" mean whichever of these companies you are dealing with.
We only collect the information we need. Depending on how you deal with us, this may include:
You don't have to give us your information, but if you don't we may not be able to respond to you, deliver a service or let you take part in a programme. You can contact us anonymously or under a pseudonym where that is practical.
Our work covers mental health, wellbeing, respect at work, inclusion and family violence prevention. Some surveys, diagnostics or training activities may therefore collect sensitive information, such as information about your health, experiences at work or personal circumstances. The law calls this "sensitive information" in Australia and "special category data" in the UK and EU.
We only collect it when it is genuinely needed for the programme you are taking part in. When we do, we will:
We use your information for the purposes below. Under UK and EU GDPR we must also tell you the legal reason ("lawful basis") for each.
Where we rely on legitimate interests, we have balanced our interests against your rights. You can ask us for details of that assessment. We won't use your information for a new, unrelated purpose without telling you first.
If your employer has engaged us to run training, a diagnostic or a survey, we often process your information on their behalf and under their instructions. In that case your employer is the controller and we act as their processor (sometimes called a service provider).
We only use that information to deliver the agreed work, and we handle it under a written agreement with your employer. If you have questions about how your employer uses the results, please contact them first. We will help them respond to any request you make.
We send our Ignite newsletter, event invitations and updates about our services. We do this in line with the UK Privacy and Electronic Communications Regulations and the Australian Spam Act 2003.
We will only email you if you have signed up, or if you are an existing business contact and the email is relevant to your role. Every email includes an unsubscribe link, and you can also opt out by contacting us. We never sell your information to anyone.
Our email platform records whether you open our emails and click links, so we can understand what content is useful.
Our website uses cookies and similar technologies. Essential cookies keep the site working. Analytics and marketing cookies, such as those set through Google Tag Manager, Google Analytics and HubSpot, help us understand how people use the site and only run if you agree to them.
You can change your choices at any time through our cookie banner or your browser settings. Our Cookies Policy (https://enmasse2.com/terms-and-conditions/cookies-policy) gives full details.
We only share your information when we need to, and only what is necessary. This may include:
Our service providers may only use your information to provide services to us, and must keep it secure and confidential.
As we operate in Australia and the UK, your information may be transferred between the two countries. Some of our service providers may also store information in other countries, including the United States and the European Union.
When information leaves the UK or EU, we protect it using an adequacy decision (the UK and EU both recognise each other, and the UK recognises the US through the UK Extension to the Data Privacy Framework), or approved contract terms such as the UK International Data Transfer Agreement or the EU Standard Contractual Clauses. Australia does not currently have an adequacy decision, so transfers to our Australian team use these contract terms. When we send information overseas from Australia, we take reasonable steps to ensure the recipient handles it in line with the Australian Privacy Principles.
You can ask us for more detail about these safeguards.
We keep information only as long as we need it for the purpose we collected it, or as long as the law requires. After that, we securely delete the information or de-identify it so it can no longer be linked to you.
We use appropriate technical and organisational measures to protect your information from loss, misuse, unauthorised access, change or disclosure. These include access controls, encryption, secure suppliers and staff training. Enmasse2 Ltd holds Cyber Essentials certification.
No system is completely secure. If a data breach is likely to cause you serious harm, we will tell you and the relevant regulator as the law requires, including under Australia's Notifiable Data Breaches scheme.
Wherever you are, you can ask to see the information we hold about you and ask us to correct it if it is wrong or incomplete.
If you are in the UK or EU, you also have the right to:
To make a request, contact us using the details below. We will respond within one month (UK and EU) or 30 days (Australia). We may need to confirm your identity first. Some rights have legal limits, and if we can't fully meet your request we will explain why.
We do not make decisions about you that have legal or similarly significant effects based solely on automated processing. Our diagnostics may use software to score or analyse responses, but a person reviews the results and any recommendations.
If you are unhappy with how we have handled your information, please contact us first so we can try to put it right. We will acknowledge your complaint within 5 working days, investigate it and give you a written response, usually within 30 days.
We review this policy regularly and will post any changes on this page with a new date. If we make significant changes, we will let you know where we can.
Last updated: 08/10/2026
For any privacy question or request, please contact our privacy team.
Email: [email protected]
Australia: Privacy Officer, En Masse Pty Ltd, L19 & 20 Como Tower Offices, 644 Chapel Street, South Yarra VIC 3141. Phone +61 3 9429 8441
United Kingdom: Privacy Lead, Enmasse2 Ltd, Bankside 300, Peachman Way, Broadland Business Park, Norwich, Norfolk NR7 0LB. Phone +118 227 7855