Privacy Policy

Introduction 

While doing business, there may be circumstances where Asuria People Services Pty Ltd (“Asuria”, “we”, “us’ or “our”), collects personal information. Personal information is information or an opinion about an individual who is reasonably identifiable.

This Asuria Privacy Policy (“Policy”) has been developed to ensure that such information is handled and protected appropriately and in accordance with the 13 Australian Privacy Principles (“APPs”) set out in the Privacy Act 1988 (Cth) (“Act”).

This Policy sets out the broad controls that Asuria has adopted to govern the way it collects and uses personal information, the circumstances under which it may disclose personal information to third parties, how persons can access their personal information held by Asuria, and what they can do if they are unhappy with Asuria’s treatment of their personal information.

Asuria may make changes to the Asuria Privacy Policy from time to time, without notice, via the uploading of an updated version of this Policy on the Asuria website at www.asuria.com.au.

Who is Asuria? 

In this Policy, Asuria refers to group of companies that trade under Asuria People Services Pty Ltd including Asuria RTO Code 21912 (formerly known as AETS) and all related entities and this Policy.

Scope

Who does this Policy apply to?

This Policy applies to any individuals whose personal information we may hold or collect including:

•    Officers and employees
•    Agents, contractors, consultants or suppliers of goods or services
•    Participants in programs or services delivered by us
•    A person whose information may be given to us by a third party
•    A person seeking employment with us.

Asuria will be fair and open about the way we collect information about you and what we intend to do with the information we collect.

Policy

What information does this Policy refer to?

This Policy applies to personal information and sensitive information. 

Purpose of this Privacy Policy

The purpose of this Privacy Policy is to;
•    Describe the types of personal information that we collect, hold, use and disclose
•    Outline our personal information handling procedures
•    Explain our authority to collect your personal information, why it may be held by us, how it is used and how it is protected
•    Explain our procedures in the event that your personal information is disclosed without authorisation
•    Provide information about how to access your personal information, correct it if necessary and complain if you believe it has been wrongly collected or inappropriately handled.

What is personal information?

Asuria, including its employees, contractors and agents, is subject to the Act and to the requirements of the APPs contained in the Act. 
The APPs regulate how organisations can collect, hold, use and disclose personal information and how you can access and correct that information.

“Personal Information” is information or an opinion about an identified individual or an individual who is reasonably identifiable, whether true or not, and whether recorded in material form or not. Common examples include your name, telephone number, email address and date of birth.

Sensitive information

In this Policy there are also references to sensitive information, which is a subset of personal information. “Sensitive information” is information or an opinion about a person that is of a sensitive nature, including information about racial or ethnic origin, political opinions, membership of a political association, religious beliefs or affiliations, philosophical beliefs, membership of a profession or trade association, membership of a trade union, sexual orientation or practices, criminal record, or health, genetics, biometrics or disability.    

What is not personal information?

Information where Asuria has removed any personally identifiable references to a person, so that the person cannot be reasonably identifiable from the information, is not personal information.
Asuria may use this information for its own purposes and gain. For example, the fact that x participants aged 20-40 have accessed our services, is not personal information.

Collection of personal information 

Asuria collects information in a variety of ways in the course of running our business, including:
•   Providing services to participants, trainees and other parties;
•   Engaging suppliers, contractors, labour hire workers and other personnel;
•   Responding to questions about our services and our business;
•   Responding to complaints and enquiries via our online complaints process;
•   Interacting with people via our website or via social media and related platforms;
•   Conducting trade promotions and information sessions;
•   Via security processes at our sites including our sign in registers

The kinds of personal information that Asuria collects and holds depends on the circumstances, but can include names, addresses and other contact details, details about a person’s work experience and other qualifications, date of birth, driver’s licence details, bank account details and photographs.

Means of collection

Asuria collects most personal information directly from the person, unless the person consents to the collection of information by someone else other than them, or Asuria is required or authorized at law, or by a court/tribunal order, to collect the information from someone other than the individual. Third parties may also share information with us about people, including the applicable Government departments and other related parties. In all other respects, where reasonably practicable, Asuria will collect personal information directly from you and inform you that this is being done.

When Asuria collects personal information, Asuria will take reasonable steps to ensure that the person is aware of: 
•    the collection; 
•    the purpose of the collection; 
•    the main consequences (if any) if the information is not collected;
•    the types of organisations (if any) to which the information may be disclosed (including those located overseas);
•    any law that required the particular information to be collected; and
•    the fact that this Policy contains details on access, correction and complaints.
Personal information collected by Asuria is held in a variety of formats including hardcopy and on our computer systems.

If Asuria received solicited information (personal information that Asuria has not requested) and Asuria determines that they could not have collected this information, if requested, under the Australian Privacy Principles, and the information is not contained in a Commonwealth record, Asuria shall destroy or de-identify the information if it is lawful and reasonable for Asuria to do so.
Where practicable, you may deal with Asuria anonymously or by pseudonym, however in some circumstances this may not be practicable and Asuria may need to request personal information.

Collection of sensitive information 

Asuria only collects, holds and handles information about you that is necessary for the Company to perform the services that are requested of Asuria, that is otherwise reasonably necessary for business activities or if required by an Australian law or court. Asuria will not collect sensitive information unless the person to whom it relates consents to the collection and, the information is reasonably necessary for one or more of Asuria's business functions or activities. 

The exception to this is where collection is required or authorised by law, is necessary to prevent or lessen a serious and imminent threat to the person’s (or another person’s) life or health or is necessary in relation to legal proceedings (current, anticipated or potential), or another permitted exception in the Act applies.

Cookies

Asuria uses ‘cookies’ and other similar technologies in electronic communications to help us collect information about the way you interact with our content online and help the Company to improve your experience when visiting the Asuria website. 
Cookies are data files that your browser places on your computer or device. They remember the type of browser that the visitor is using and which additional browser software the user has installed. They remember preferences such as languages and region, which remain as your default settings when you next revisit the website. The cookies also allow the user to rate pages and fill in comment forms on the website. 
Cookies cannot collect any information stored on your computer or files. 
Users can visit www.allaboutcookies.org for more information and details on how to delete or reject cookies.

Additional information regarding credit information

In connection with the operation of Asuria, Asuria collects and uses credit information of individuals. The types of credit information that the Company collects and uses for the purposes of assessing an application for credit include:
1.    Names, addresses and other contact details of account holders and guarantors (both prospective and current)
2.    Bank account details
3.    Driver's license details
4.    Financial information 
Such information is collected from the relevant individual and from credit reporting bodies, as well as from publicly available information. Asuria uses the information collected to create an internal credit assessment report.
Asuria does not disclose credit information to credit reporting bodies, except for an individual’s identity in order to obtain a credit check from the credit reporting body.

Google Analytics

Asuria uses Google Analytics to collect information about how people use our website. Google Analytics does this by using cookies to understand the types of websites you visit and the way you interact with those websites. The information Asuria obtains from Google Analytics helps us understand user needs and offer a better user experience. 
By using the Asuria website, you consent to the processing of data about you by Google in the manner described in Googles Privacy Policy which is available at: http://google.com/intl/en/policies/privacy . You can opt out of Google Analytics by using the Google Analytics opt-out browser add-on. Further information is available at: https://tools.google.com/dlpage/gaoptout

Use or disclosure of personal information 

The use to which Asuria can put personal information depends on the reason for which it was collected. Asuria may use personal information for its primary purpose of collecting the information, or for a related secondary purpose that we could reasonably be expected to use the personal information for.
Asuria respects the privacy of personal information and will take reasonable steps to keep it strictly confidential. 
Asuria will disclose personal information to third parties if it is necessary for the primary purpose of collecting the information, or for a related secondary purpose, if the disclosure could be reasonably expected. Where such disclosure is necessary, Asuria will require that the third party undertake to treat the personal information in accordance with the APP.

Otherwise, Asuria will only disclose personal information to third parties without the consent of the person to whom the information relates if the disclosure is:

•    necessary to protect or enforce Asuria’ rights or interests or to defend any claims;
•    necessary to prevent or lessen a serious threat to a person’s health or safety;
•    required or authorised by law;
•    permitted by another exception in the Act

If Asuria uses or discloses personal information to third parties in accordance with the above, Asuria must make a written note of the use of disclosure.
Asuria may disclose personal information to a related Asuria company in Australia or overseas, subject to the provisions of the Act. In such circumstances, the related company will only use the personal information for the same purposes that the disclosing Asuria company is authorised to use the personal information for and take such steps as are reasonable in the circumstances to ensure that the overseas recipient does not breach the Australian Privacy Principles in relation to the information.

We may also disclose any personal information we consider necessary to comply with any applicable law, regulation, legal process, governmental request or industry code or standard. 

Direct marketing

Under no circumstances will Asuria sell your personal information.

Information security 

Asuria will take all reasonable steps to ensure that all personal information held by the Company is secure from any unauthorised access or disclosure. Asuria stores personal information in archive systems for a period Asuria considers reasonable depending on the primary purpose for which the information was collected. Only properly authorised people who have a need to access personal information to perform their job will be able to see or use that information.
Personal information will be de-identified or destroyed when it is no longer required such that it cannot re-identified at a later date.
Asuria will ensure that its employees receive training about the management of personal information relevant to their respective roles and responsibilities in accordance with Asuria's Information Security Policy.

It is important for us to securely store the personal information we collect. You must keep all personal information you access or use in the course of your employment or dealings with us or on our behalf confidential.     You must not access personal information other than as required to complete your employment duties or contractual arrangements with us. We continually review and monitor our security systems to ensure personal information remains secure. If you have any suggested improvements, please feel free to let us know.

Adoption of government related identifiers 

Asuria will not adopt a government related identifier of an individual as its own identifier of the individual unless the adoption of the government related identifier is required or authorized by or under an Australian law or court/tribunal order.
Asuria will not use or disclose a government related identifier of an individual unless:
•    the use or disclosure of the identifier is reasonably necessary for the organization to verify the identity of the individual for the purposes of the organisations activities or functions; 
•    the use or disclosure of the identifier is reasonably necessary for the organization to fulfil its obligations to an agency or a State or Territory authority; or 
•    any other exception provided for in the Act.

Accessing personal information  

You can access, or request that we correct, your personal information by writing to us. We may require proof of identity. If we do not allow you to access any part of your personal information, we will tell you why in writing. We will not charge you for requesting access to your personal information but may charge you for our reasonable costs in supplying you with access to this personal information.

You have the right to access any personal information we hold about you, subject to some exceptions provided by law. Such a request must be made in writing and addressed to the Asuria Privacy Officer at the address below:

Asuria Privacy Officer

The Zenith, Level 17, Tower A
821 Pacific Highway,
Chatswood, NSW, 2067
E: privacyofficer@asuria.com.au 

Dealing with requests for access

The Asuria Privacy Officer, or delegate of Asuria will must respond to the request for access to personal information within a reasonable period after the request is made and give access to the information in the manner requested by the individual, if it is reasonable and practicable to do so.

Refusal to give access

If Asuria refuses to give access to the information, or to give access in the manner requested by the individual, Asuria will give the individual a written notice that sets out:
•    the reasons for the refusal, except to the extent that, having regard to the grounds for the refusal, it would be reasonable to do so; and
•    the mechanisms available to complain about the refusal; and
•    any other matter prescribed by the regulators,
and take steps (if any) as are reasonable in the circumstances to give access in a way that meets the needs of the entity and the individual.

Correction to personal information 

Asuria will take reasonable steps to ensure the accuracy and completeness of the personal information they hold. However, if Asuria is satisfied that, having regard to a purpose to which the information is held, the information is inaccurate, out-of-date, incomplete, irrelevant or misleading; or the individual requests Asuria to correct the information, Asuria will take steps (if any) as are reasonable in the circumstances to correct the information to ensure, having regard to the purpose for which it is held, the information is accurate, up-to-date, complete, relevant and not misleading. If a person believes that any personal information that Asuria holds about them is inaccurate or out of date, then they should contact the Asuria Privacy Officer.

If Asuria corrects personal information and the individual requests Asuria notify a third party of the correction; Asuria will take such steps (if any) as are reasonable in the circumstances to give that notification unless it is unreasonable, impracticable or unlawful to do so.
If Asuria refuses to correct personal information, Asuria must give the individual a written notice that sets out:
•    the reasons for the refusal, except to the extent that, having regard to the grounds for the refusal, it would be reasonable to do so; and
•    the mechanisms available to complain about the refusal; and
any other matter prescribed by the regulators.

Notifiable Data Breach Scheme 

As an organisation regulated by the Act, Asuria abides by the requirements of the Notifiable Data Breach Scheme (“NDB scheme”). 

The NDB scheme requires Asuria to notify individuals and the Office of the Australian Information Commissioner (OAIC) about eligible data breaches. An eligible data breach occurs when the following criteria are met: 
•    There is unauthorised access to or disclosure of personal information held by an entity (or information is lost in circumstances where unauthorised access or disclosure is likely to occur). 
•    This is likely to result in serious harm to any of the individuals to whom the information relates. 
•    The entity has been unable to prevent the likely risk of serious harm with remedial action.
In the unlikely event of an eligible data breach, Asuria will manage the circumstances according to our Data Breach Notification Policy and any State or Federal Government deed or contractual requirements.

As part of the Data Breach Notification Policy, we will notify you as soon as reasonably practicable if we:
•    discover or suspect that your personal information has been lost, accessed by, or disclosed to, any unauthorised person or in any unauthorised manner; 
•    believe that you are likely to suffer serious harm as a result; and
•    are unable to prevent the likely risk of harm. 
If you discover or suspect a data breach has occurred, you must immediately inform your direct manager or any other person in management so that we can:
•    act quickly to mitigate any harm that may result from a data breach; and
•    complete any notification procedures required.

If you would like more information about our Data Breach Notification Policy, please contact our Privacy Officer on privacyofficer@Asuria.com.au.

Complaints 

If a person wishes to complain about any breach by Asuria of this Policy, the Australian Privacy Principles, Privacy Act or another code or law which binds Asuria (if any), a complaint may be lodged in writing by post or email to the address provided, addressed to the Asuria Privacy Officer:

Asuria Privacy Officer

The Zenith, Level 17, Tower A
821 Pacific Highway,
Chatswood, NSW, 2067
E: privacyofficer@asuria.com.au 

At all times, privacy complaints:
•    will be treated seriously;
•    will be dealt with promptly;
•    will be dealt with in a confidential manner; and
•    will not affect your existing obligations or your commercial arrangements with us.
Our Privacy Officer will endeavour to:
•    respond to you within 10 business days; and
•    investigate and attempt to resolve your concerns within 30 business days or any longer period necessary and notified to you by our Privacy Officer.

If Asuria is unable to resolve the matter, you may raise your concern with the Office of the Australian Information Commissioner (OAIC): 
o    Ph: 1300 363 992 
o    E: enquiries@oaic.gov.au 
o    GPO BOX 5218 SYDNEY NSW 2001