The purpose of this Policy is to ensure that Poly, an entity that is subject to the Australian Privacy Principles contained in the Privacy Act 1988 and the Privacy Amendment (Enhancing Privacy Protection) Act 2012 (together Legislation), manages personal information in a manner that complies with the Legislation. For the latest versions of the Legislation, please see www.comlaw.gov.au
This Policy sets out Poly’s management and requirements in relation to the protection and proper handling of personal information collected from individuals. It also provides individuals with the opportunity to make inquiries about Poly’s compliance with the Legislation.
For further information in relation to privacy, please visit the Office of the Australian Information Commissioner’s website at www.oaic.gov.au
Individuals are not required to identify themselves when dealing with Poly unless:
Poly only collects personal information when it is reasonably necessary for Poly’s functions or activities. The types of personal information that Poly may collect includes, but is not limited to:
The circumstances for which Poly may collect personal information include, but are not limited to:
Poly generally does not collect sensitive personal information about an individual, such as:
However, Poly may collect sensitive personal information if it is necessary for Poly to deal with the individual and the individual has consented to Poly doing so.
Poly may also collect personal information about an individual from a third party who may be the individual’s agent when it is reasonably necessary to do so. Poly will take reasonable steps to inform the individual that Poly has the individual’s personal information, unless it is obvious to the individual from the circumstances that Poly holds such information.
At or before the time, or, if that is not practicable, as soon as practicable after, Poly collects personal information about an individual, Poly will notify the individual of the following matters unless it is obvious from the circumstances:
Poly generally holds personal information about an individual that was collected for a particular purpose (Primary Purpose) and will not use or disclose the information for another purpose unless:
Poly may use the personal information for a purpose other than the Primary Purpose if:
Poly may use or disclose personal information for a purpose including, but not limited to:
Poly may disclose personal information to other Poly-related entities (together Poly Entities) and external parties in certain circumstances, including but not limited to:
Poly will not sell personal information to external entities for profit.
Poly may use or disclose personal information (other than sensitive personal information) about an individual for the purpose of direct marketing if:
Poly may use or disclose sensitive personal information about an individual for the purpose of direct marketing if the individual has consented to the use or disclosure of the information for that purpose.
If Poly uses or discloses personal information about an individual:
the individual may:
If an individual makes a request under paragraph 6.4, Poly will give effect to the request within a reasonable period after the request is made.
Poly may disclose personal information to parties outside of Australia as Poly is a foreign-owned entity and has affiliates globally. Poly will limit the disclosure of personal information under circumstances that are necessary, and will do so in accordance with the Australian Privacy Principles. Poly will also take necessary reasonable steps to ensure that the recipients of personal information have an appropriate data management mechanism in place.
Poly will take reasonable steps in the circumstances to protect the personal information:
Poly will take such steps as are reasonable in the circumstances to destroy the information or to ensure that the information is de-identified.
An individual can make a request in writing to Poly to access that individual’s personal information which may be held by Poly, provided the individual provides Poly with proof, to Poly’s satisfaction, of the identity of the individual making the request.
Poly may impose a charge for processing such request if it is necessary for Poly to expend time and resources to answer the request – otherwise, making the request is free of charge.
If the request to access personal information is not permitted by the Legislation or an Australian law, Poly will deny the request and provide the individual with a reason for such decision.
An individual can make a request in writing to Poly to change the personal information held by Poly about that individual that the individual believes to be inaccurate, out-of-date, incomplete, irrelevant or misleading.
If Poly is of the view that the personal information should not be changed, Poly may refuse to do so by providing the individual with reasons for such a decision.
If the individual disagrees with Poly’s view in paragraph 10.2, the individual can request a statement to that effect to be linked to the individual’s personal information and Poly must make keep that statement so linked.