1.1. Introduction
Professional Certification Group is bound by the Australian Privacy Principles (‘APP’) set out in the Privacy Act 1988 (Cth) (‘Privacy Act’). We are committed to ensuring that all our business dealings comply with the Australian Privacy Principles and acknowledge the importance of keeping Personal Information confidential and secure.
Please note that if at any time Professional Certification Group is required by law to release Personal Information, Professional Certification Group must co-operate fully.
1.2. Why and How We Collect Personal Information
‘Personal Information’ is information or an opinion (including information or an opinion forming part of a database), whether true or not, and whether recorded in a material form or not, about an individual whose identity is apparent, or can reasonably be ascertained, from the information or opinion.
Professional Certification Group collects Personal Information when it is engaged by an individual or business, so that Professional Certification Group may provide advice, recommendations and services.
Professional Certification Group also collects Personal Information:
- To conduct our business and manage the internal accounting and administration requirements of our business;
- To ensure that our clients’ needs are both acknowledged and met;
- To comply with our legal obligations; and
- To help us manage and enhance our services.
The Personal Information we collect and hold may include name and contact details, age, financial details and other information that is relevant to the services we provide, or necessary to carry out an individual’s instructions.
We collect Personal Information by gathering, acquiring or obtaining Personal Information from the individual directly. In some instances it may be unreasonable or impracticable to obtain Personal Information from the individual directly, in such circumstances Personal Information may be provided to us by third parties so that we may provide advice and services.
We will try to collect information from an individual directly wherever possible. Where we collect information from someone else, we will, where possible, obtain this with the individual’s consent.
If we collect Personal Information about an individual, whether or not from a third party, if it is reasonable to do so we will ensure that the individual is aware of such collection and the circumstances surrounding such collection.
An individual is under no obligation to give us Personal Information about the individual or anyone else. However, if the individual does not provide the information we request, it may affect our ability to provide and/or administer our services.
1.3. Website Collection
Professional Certification Group may collect Personal Information from its website through receiving subscription applications and emails. Professional Certification Group may also use third parties to analyse traffic at the website, which may involve the use of cookies. Information collected through such analysis is anonymous.
1.4. Use and Disclosure of Personal Information
When Professional Certification Group refers to ‘use’ of Personal Information, it means the use within the Professional Certification Group for the purposes outlined above. When Professional Certification Group refers to ‘disclose’, it means providing the information to persons outside of Professional Certification Group.
We use Personal Information for the primary purposes for which it is collected (as set out above), for reasonably expected secondary purposes which are related to the primary purposes, and in other circumstances authorised by the Privacy Act and the APPs.
For example, we may use Personal Information to:
- Provide an individual with a specific service;
- Administer and manage the services we provide;
- Provide information about other services that may be of benefit to the individual; or
- Comply with any requirements under an Australian Law or a court/tribunal order.
Professional Certification Group will not use or disclose to third parties any Personal Information obtained from an individual unless:
- It relates to the primary purpose of collection and where it would be expected of us;
- The individual has consented to the use or disclosure;
- We have reason to suspect unlawful activity;
- It is required or authorised by law;
- We propose to sell the Professional Certification Group business, in which case we may disclose the individual’s information to potential purchasers for the purpose of them conducting due diligence investigations. Any such disclosure will be made in confidence and it will be a condition of that disclosure that no Personal Information will be used or disclosed by them. In the event that a sale of our business takes place, we may transfer the individual’s Personal Information to the purchaser of the business. The individual will be advised of any such transfer;
- As part of our regulatory or statutory obligations, it is required for government agencies, including the Australian Taxation Office, and other enforcement bodies;
- It is to our service providers (as is strictly necessary) to enable them to provide services to us, for example, auditors, legal and financial consultants; or
- It is to financial product providers, for example insurance companies and fund managers, in order to carry out the individual’s instructions.
Our service providers also respect an individual’s privacy.
1.5. Direct Marketing
Professional Certification Group will not use or disclose any Personal Information for the purposes of direct marketing, unless the information was collected from the individual, and the individual would reasonably except Professional Certification Group to use or disclose the information for such purpose.
If the individual has consented, we may use Personal Information for direct marketing purposes that would not be reasonably expected of Professional Certification Group. In the event that it is impracticable to obtain consent from the individual, we may still use or disclose Personal Information for direct marketing purposes not reasonably expected, however, in these instances we will include a prominent statement in each communication that an individual may request not to receive direct marketing communications from Professional Certification Group.
An individual may request not to receive direct marketing communications from Professional Certification Group at any time, and we will give effect to such request.
1.6. Unsolicited Personal Information
If Professional Certification Group receives Personal Information that we did not solicit, we will, within a reasonable period after receiving the information, determine whether or not we could have collected the information under the APP.
If we determine that Professional Certification Group could not have collected the Personal Information, and the information is not contained in a Commonwealth record, then we will, as soon as practicable but only if it is lawful and reasonable to do so, destroy the information or ensure that it is de-identified.
1.7. Quality of Personal Information
We will take all reasonable steps to ensure that the Personal Information we collect is accurate, complete and up-to-date. In addition, any Personal Information used or disclosed will be relevant having regard to the purpose of the use or disclosure.
1.8. Protecting Personal Information
We will take all reasonable steps to protect Personal Information from misuse, interference, loss, unauthorised access, modification or disclosure.
Personal information is stored securely whether in an electronic or physical form. The information is stored in secured premises and in electronic databases, which are password protected.
In the event that the individual ceases to be a client of Professional Certification Group, any Personal Information that we hold will be held for a minimum period of 7 years in order to comply with legislative and professional requirements.
In the event that Professional Certification Group no longer requires the Personal Information for any authorised purpose, having regard to the above legislative requirements, Professional Certification Group will take reasonable steps to destroy or de-identify the Personal Information.
1.9. Openness
We will maintain, and review, clearly expressed policies on our management of Personal Information and make these readily available.
We will take reasonable steps, on request, to let an individual know the sort of Personal Information we hold, its purpose, and how we collect, use, store, and disclose that information.
1.10. Accessing and Correcting Personal Information
An individual has a right to ask us what sort of Personal Information we have about the individual and how we collect, store and use it.
We will provide the individual with access to Personal Information on request within a reasonable period after the request is made except where it:
- May pose a serious threat to the life, health or safety of any individual, or to public health or public safety;
- Would have an unreasonable impact on the privacy of other individuals;
- May have an unreasonable impact upon the privacy of others;
- Is frivolous or vexatious;
- Is likely to prejudice the taking of appropriate action in relation to suspected unlawful activity, or misconduct of a serious nature, that relates to Professional Certification Group’s functions or activities;
- Is likely to prejudice one or more enforcement related activities conducted by, or on behalf of, an enforcement body;
- Relates to existing or anticipated legal proceedings with the person who is the subject of the information and would not be accessible through discovery;
- May reveal our intentions and prejudice negotiations with the individual;
- May prejudice investigation of any possible unlawful activity; or
- Would be unlawful or denial of access is allowed by law.
We will, prior to providing access, require the individual to provide evidence of their identity.
Where we have declined to provide information on the above grounds, we will provide to the individual written notice that sets out the reasons for the refusal, where it is reasonable to do so, and the mechanisms available to make a complaint about the refusal.
No fee will be charged for an access request. The individual may be charged the reasonable expenses incurred in providing any information (such as search and photocopying costs).
We will take all reasonable steps to ensure that the information is correct, accurate and current.
We will correct Personal Information held if we discover that the information is incorrect, or the individual requests the Professional Certification Group to make the change, within a reasonable time of becoming aware of such error or the request being made. If the individual requests, Professional Certification Group will take reasonable steps to notify any third party, that Professional Certification Group has previously disclosed Personal Information to, that corrections are required to be made to the information. However, Professional Certification Group will only comply with such request if such notification is not impracticable or unlawful.
If we are asked to correct Personal Information and we do not agree that it is wrong, we will provide a written explanation of the reasons for our refusal to correct the information, and the mechanisms available to the individual to make a complaint if they are unsatisfied. In these circumstances, we will keep a record of the information regarded as inaccurate or out-of-date.
1.11. Government Identifiers
We will not use identifiers assigned by the Government, such as a tax file number, Medicare number or pension card number, for our own file recording purposes.
We will not use or disclose a government related identifier of an individual unless the use or disclosure is reasonably necessary for Professional Certification Group to verify the identity of the individual for the purposes of Professional Certification Group’s activities or functions.
1.12. Anonymity and Pseudonymity
Individuals have the option of not identifying themselves, or of using a pseudonym, when dealing with Professional Certification Group in relation to a particular matter, unless it is impracticable for Professional Certification Group to deal with the individual who has not identified themselves or who has used a pseudonym.
Individuals do not have the option of not identifying themselves, or of using a pseudonym, if Professional Certification Group is required or authorised by or under an Australian law, or court/tribunal order, to deal with individuals who have identified themselves.
1.13. International Disclosure of Personal Information
Professional Certification Group will not disclose Personal Information to an overseas recipient, unless the individual has consented to the disclosure.
Before disclosing Personal Information to an overseas recipient, Professional Certification Group will take such steps that are reasonable in the circumstances, to ensure that the overseas recipient does not breach the APP in relation to the Personal Information, unless we believe the recipient is subject to a law that has the effect of protecting information in a way that is substantially similar to the APP.
1.14. Sensitive Information
‘Sensitive Information’ includes information relating to an individual’s racial or ethnic origin, political opinions, religion, philosophical beliefs, trade union or other professional or trade association membership, sexual preferences, criminal record, and also includes health information about an individual.
Professional Certification Group will not collect Sensitive Information about an individual unless the individual consents, and the information is reasonably necessary for one or more of Professional Certification Group’s functions or activities.
Sensitive Information will be used and disclosed only for the purpose for which it was provided or a directly related secondary purpose, unless they agree otherwise, or where certain other limited circumstances apply (e.g. where required by law).
Professional Certification Group will not disclose Personal Information to others for the purpose of allowing them to direct market their products and services.
Professional Certification Group will only collect Sensitive Information with an individual’s consent unless the collection is required by law or to establish, exercise or defend a legal or equitable claim, or it is necessary to prevent or lessen a serious or imminent threat to the life or health of the person who is the subject of the information.
1.15. Policy Updates
This privacy policy may be reviewed and updated from time to time without Professional Certification Group giving notice to take account of new laws, new technologies, operational changes and practices, and the changing business environment.
1.16. Availability of Privacy Policy
If a person or body requests a copy of Professional Certification Group’s privacy policy in a particular form, Professional Certification Group must take such steps as are reasonable in the circumstances to give the person or body a copy in that form free of charge.
1.17. Complaints
If an individual is not satisfied with Professional Certification Group’s conduct, responses or believes Professional Certification Group has breached the APP, the individual can use our complaints handling procedure, which is activated by the individual contacting Professional Certification Group management. If the individual is unsatisfied with our response, the individual is entitled to contact the Office of the Privacy Commissioner.