Privacy Policy

Purpose and scope

The purpose of our Privacy Policy is to provide information about: what personal information we collect, how we handle that information, including how we use, disclose and store it, how you can access your personal information or make a complaint about our handling of your personal information.

This Privacy Policy should be read in conjunction with our Information Policy, which sets out we collect, handle, use and disclose information.

We are subject to the Privacy Act 1988 (Privacy Act) and the Australian Privacy Principles (“APPs”) contained in the Privacy Act. The APPs set out the manner in which agencies and organisations may collect, store, use and disclose personal information and how a person can access and/or correct records containing their personal information. Users enquiring about their rights and remedies for breaches of privacy can access detailed information at the Office of the Australian Information Commissioner.

Personal information

Personal information is defined in the Privacy Act as any ‘information or an opinion about an identified individual, or an individual who is reasonably identifiable, whether the information or opinion is true or not, and whether the information or opinion is ‘recorded in a material form or not’.

Sensitive information

Sensitive information is a special subset of personal information which requires greater protection under the Privacy Act. Sensitive information is defined in the Privacy Act as information or an opinion about an individual’s racial or ethnic origin, political opinions, membership of a political association,religious beliefs or affiliations, philosophical beliefs, membership of a professional or trade association, membership of a trade union, sexual orientation or practices, or criminal record. It is also personal health information about an individual, genetic information, and biometric information

What personal information is collected

We may collect personal information about you when you interact with us. Generally, the types of personal information collected include:

your name
your contact details, including email address, postal address and telephone number.

Information you provide to us and your opinion on something, for example when making a complaint, submission, general enquiry or assisting us with our inquiries or investigations, may also be your personal information.

What if I don’t want to share my personal information with you?

If you do not wish to provide us with your personal information, you may contact us anonymously, or by using a pseudonym. By remaining anonymous, or by using a pseudonym, we may be limited in our ability to respond to or make further enquiries regarding your complaint, submission or enquiry with us.

Do you collect sensitive information?

In some instances, we may need to request sensitive information. Where we do request sensitive information, we will explain to you why we need it. We can only collect sensitive information with your consent except as otherwise permitted under the Privacy Act. Sensitive information may require different handling. We will handle personal information that is sensitive information consistently with the Privacy Act.

What if I want my personal information removed later?

If you provide your personal information to us, and later request us to remove your personal information from our systems, we may be limited in our ability to do so due to our legal obligations to maintain certain records.

How personal information is collected

Your personal information may be collected through various means, either directly from you or from third parties. We may only solicit and collect personal information:

for a lawful purpose that is reasonably necessary for, or directly related to, one or more of our functions or activities
by lawful and fair means.

In addition, we can only collect sensitive information with your consent, unless an exception applies under the Privacy Act.

From a third party

We may receive personal information about you from a third party. For example we may receive information about you from the police, a government agency, industry body or another regulator (including international regulators). This could be in the context of someone reporting a scam or an alleged-wrongdoing to us. The personal information provided by third parties in these circumstances is often your name and contact details, but it could also include an opinion about you.

If we receive personal information about you from a third party, and this information is relevant to our work, we will take reasonable steps in the circumstances to notify you of certain matters concerning that collection. However please note that in some circumstances, it may be reasonable for us not to notify you.

Providing us with personal information about a third party

If you choose to provide us with the personal information of a third party, please ensure you have the consent of the individual concerned before sharing it with us.

Directly from you

We may collect personal information directly from you. This could include when you:

subscribe to our email alerts
communicate with us via social media platforms
complete an online form or make a submission to us
send us an email
call us or our information centres
send correspondence to our offices
respond to a request to participate in a survey, consultation or study
apply for jobs with us

When you subscribe to email alerts or interact with us on social media

When you subscribe to email alerts you must provide an email address to which the system can send your alerts. You are free to use an anonymous email address. We will not use your email address to send you any unsolicited information, unless you otherwise indicate that you would like to receive additional information from us.

Third party email distributors may collect personal information, such as distribution lists which contain email addresses, and other information relating to those email addresses.

Social media

We use social media platforms such as Twitter, Facebook and YouTube to communicate with the public about our service. When you communicate with us using these services we may collect your personal information, but we only use it to help us to communicate with you and the public.

The social media platforms will also handle your personal information for their own purposes. These services have their own privacy policies. You can access the privacy policies for Twitter, Facebook and YouTube (a Google company) on their websites.

When you contact us to make a general inquiry, complaint or submission

This applies to general enquiries or requests. We will sometimes provide a number of online forms for enquiries, complaints, reports, submissions and web feedback. The personal information you provide to us on our websites is voluntary. You can also contact us via email.

How personal information is used and disclosed

Generally, when we receive personal information it is in relation to, or provided together with, other information that is in connection with our functions and activities. Therefore, at the broadest level, we collect personal information for the primary purpose of fulfilling functions and activities. It may be that the primary purpose of collection is more limited — for example, that it is collected for the purpose of recording a request for a refund.

We can only use or disclose personal information for the particular purpose for which it was collected, unless one of the following applies:

we obtain the individual’s consent to use personal information for a different purpose (that is, a secondary purpose)
the individual would reasonably expect us to use or disclose their personal information for a secondary purpose, and that purpose is related to the primary purpose of collecting (or, for sensitive information, directly related to the primary purpose) the personal information
the secondary use or disclosure is required or authorised by or under an Australian law or a court/tribunal order
an exception in Australian Privacy Principle 6 applies.

In many cases, personal information is provided together with other confidential information that is in connection with our functions and activities. We are required to handle such confidential information in accordance with our obligations under the Competition and Consumer Act and other similar legislation that limits the use and disclosure of confidential information.

Use of personal information

We may use personal information for the purpose of preparing statistics to enable us to better understand trends — for example, identifying demographics and allowing us to better target educational and awareness campaigns.

Disclosure of personal information

We may disclose your personal information to a third party such as:

external service providers who we engage to assist us with our functions. These could include an external lawyer, economic advisor, auditor, or third party IT service provider
a regulator or law enforcement agency, courts and tribunals, government agencies

There may be circumstances where we are legally required or permitted to disclose information (and this may involve personal information). Examples of when we may be legally required to disclose information include in response to requests under the Freedom of Information Act (where the request meets the requirements in the Act) or in response to court/tribunal orders.

In most cases, we will endeavour to notify and consult any individuals whose personal information may be disclosed about the proposed release of the information. However, in some instances we are not legally required to notify the individual prior to disclosing or sharing the information.

Where information is disclosed to a third party we will, to the extent reasonably possible, ensure that the third party is subject to the requirements of the Privacy Act or otherwise take steps to ensure that the third party meets our obligations under the Privacy Act, such as including obligations in our contracts.

In some instances, we are required by law to publish submissions you make to us on a public register on our website — this means that your personal information (for example, your name) may be made public on our website in conjunction with your submission.

Please note even if you request to have your personal information removed from the public register or our records down the track, we may be limited in our ability to do so, due to our legal obligations to maintain records on the public register and to maintain certain records.

Disclosing personal information overseas

There are some circumstances where we may share your personal information overseas. This is generally undertaken in accordance with Australian law, international treaties, or memoranda of understanding. We will take reasonable steps (if any) in the circumstances to ensure the overseas recipient protects the personal information we provide to it in accordance with Australian Privacy Principles.

We may disclose personal information overseas:

where we use a third party consultant or contractor to provide services to us, and that third party contractor is based overseas
where we store data in the cloud or on servers that are located outside Australia
when you apply for jobs with us

By submitting a job application to we, you consent to us using and disclosing any personal information you have supplied:

for the purposes including verifying that information and undertaking further assessment
to technical teams and service providers we use to facilitate assessment tasks to assist with problem resolution in the recruitment system
to external professional services firms when we seek their assistance with assessing your application.

By submitting a job application to us, you consent to us collecting additional personal information about you to assist in assessing your suitability for the role you are applying for, and for employment by us.

We may collect personal information about you from an array of sources, including but not limited to interviews and online tests, and comments from people you nominate as referees and other people (that can attest to your work performance, including previous supervisors, and publicly available information, including via social media).

You also consent to us conducting a criminal history check (where applicable), which could involve collection of information from various sources including the Australian Criminal Intelligence Commission.

Limiting our use of your personal information

If you do provide us with your personal information and you wish to limit the use and disclosure of the personal information, we recommend you expressly state those limitations when contacting us.

If you do not state any limitations, please note that even if you request to have your personal information removed from the public register or from our records down the track, we may be limited in our ability to do so, due to our legal obligations to maintain records on the public register and to maintain certain records.

How personal information is stored

We will take reasonable steps to protect personal information they hold from misuse, interference and loss, as well as unauthorised access, modification or disclosure.

For example, personal information may be subject to access restrictions. We have in place policies and information protection procedures, including (where appropriate) physical secure file storage, password protection of electronic databases, and the provision of information to staff on a ‘need to know’ basis.

How you can access or correct your personal information

Accessing your personal information

You can request access to, and correction of personal information we hold about you in accordance with Australian Privacy Principles 12 and 13.

To request access to your personal information, please contact us. When making your request, please provide sufficient information to enable us to identify records held by us that contain your personal information and to verify that the information contained in the records is your personal information.

We will provide you access to your personal information except in certain circumstances where we are not required to by law.

Where access is refused, we will act in accordance with the Privacy Act and the APPs.

Correcting your personal information

You can request to correct your personal information by contacting us and making a request in writing.If we are unable to correct your personal information in the manner you request, we will act in accordance with the Privacy Act.

Lodging a complaint

If you believe we have breached the law regarding your privacy, you can lodge a complaint with the appropriate government agency.

Visiting our website

We do not collect any personal information purely from your visit to our website. Find out more about the information collected when you visit our website or interact with us online, such as through cookies and website analytics.

Cart

Footer