1. Introduction
1.1 We, at Impact Culture Australia Pty Ltd (ABN 37 686 956 196) (“we”, “us”, “our”), respect and value your privacy. We are fully committed to protecting your personal data and information. Our privacy policy below, details how we collect and use personal information, your rights to the information and the legal bases we rely upon to process and/or use information.
1.2 Personal information covers any information about a living person from which they can be identified. Anonymous data, which is information from which a person’s identity has been removed, is not personal information.
1.3 This privacy policy should be read together with our terms & conditions also available on our website.
2. About us
2.1 We offer, among other things, an impact capability assessment on our website. The purpose of the assessment is for organisations to self-assess how embedded impact is into their organisational culture. Our assessment tool is available for use on our website, as a data platform.
3. Grounds for collecting personal data
3.1 Privacy and data protection laws in Australia (in particular, the Privacy Act 1988 (Cth)) and the European Union (EU) (in particular, the General Protection Data Regulation 2016/679) set out various bases upon which businesses can legally collect and process an individual’s personal information. We outline below some of these bases.
3.2 We will generally only use your personal data for the purpose or purposes for which it was collected, unless we reasonably consider that we need to use it for another reason and that reason is consistent with the original purpose.
A. With your permission or consent
3.3 With your permission or consent only, we can collect and process your personal information. Your consent will be necessary, if we process from you sensitive or special personal data (for example, information on your race, ethnicity, religious or philosophical beliefs, sex life, sexual orientation, political opinions, trade union membership, health and genetic and biometric data). Usually, if we rely on your consent as the legal basis for processing your personal information, you will be able withdraw your consent, at any time.
B. Contractual obligations
3.4 Sometimes, it is our contract with you, which requires us to collect personal information from you. For example, we may collect your name and other contact details to identify you as a new or existing client of ours. In some instances, because of the contractual laws of a country, we may not be able to enter into a contract with you and supply you with our services or online tools, unless and until you have provided us with at least some personal details (such as your full name, residential or postal address, email address and contact telephone number).
C. Meeting legal obligations
3.5 In addition to our contractual obligations, other laws may also require us to collect and process your personal information. Anti-money laundering laws, for example, often require the collection of personal information from our clients. Again, if you are unable to give us some of your personal data, then these laws may prohibit us from entering into a contract with you and/or supplying services or online tools to you.
D. Business interests
3.6 We may also need your personal information to pursue the legitimate interests of our business, so long as this does not materially impact your rights, freedoms or interests. For example, we may collect and use your personal data to help us grow our business.
3.7 If you are unsure of the bases upon which we are relying to collect and use your personal information, then you can always contact us to find out (see section 13 below for our contact details).
4. Collection of personal information
4.1 We may collect personal information from you in the course of our business, including when you acquire our services or use our online tools, through your use of our website, when you contact or request anything from us or as a result of your relationship with our staff, our suppliers and/or other clients.
A. Types of data collected
- We may process any of the following data from you, among others:
- contact information, including your name, your organisation, your title, your relationship to a person, your address, email address and phone number(s);
- identification and background information provided by you or collected as part of our business acceptance processes, this may include your full name, photographic identification and gender;
- usage data includes information about how you use our website;
- financial information, such as bank account and payment card details;
- marketing and communications data including your preferences in receiving marketing from us and our third parties and your communication preferences;
- technical information, such as information collected from your visits to our website(for example, internet protocol address, your login data, browser type and location); and/or
- personal information provided to us by or on behalf of our clients or generated by us in the course of supplying services or online tools to them.
B. Reasons for collecting data
- In broad terms, the main reasons why we collect personal information, are as follows:
- to help us provide and deliver our services and online tools;
- to identify you and confirm your identity;
- to develop and market new services and online tools;
- to provide client support and/or technical assistance;
- to monitor the usage of our services and online tools;
- to comply with any applicable laws or Court or Tribunal orders;
- to ensure you follow any contract with us and/or our policies; and/or
- to provide you with news, special offers and general information on other services, online tools and/or events which we offer that are similar to those that you have bought or inquired about, unless you have opted out of receiving such information.
C. Purposes of data collection
I Marketing purposes
4.4 We may collect information from you, through our website, in various ways. Parts of our website may invite you to provide us with your personal data. If you provide us with your personal data (for example, your name and email address), this may be used to grow our business in a way that does not materially impact on your rights, freedoms or interests.
II Automated technologies or interactions
4.5 When you use our website, we may automatically collect technical information about your equipment, browsing activity and/or patterns. We collect this information and may use cookies, server logs and/or other similar technologies. We may also receive technical data if you visit other websites employing cookies including, analytics providers such as Google based outside the EU, advertising networks based outside the EU and search information providers based inside or outside the EU. We consider that the collection of this information is necessary to pursue our legitimate interests in a way that might reasonably be expected. We may, for example, use this information to analyse how our clients use our services and online tools, to develop our services and grow our business. The way we use this information should not materially affect your rights, freedoms or interests.
B. Collection of data in other ways
4.6 Our website aside, we may also collect information from you in more traditional ways. This includes through direct interactions with you (such as when you provide us with your personal details, if you are interviewed), from third-party sources (such as tax authorities) or from public sources.
4.7 We may have to obtain certain personal details from you if required, to follow anti-money laundering and counter-terrorism laws. To meet our legal obligations, we may need to confirm the identity of new clients, and in some cases, existing clients. In some cases, we may be forced to decline to, or may not be allowed to, offer you our services and online tools. We consider that the legal basis for this processing of personal information is to perform contractual obligations and to comply with legal or regulatory obligations that apply to us.
5. Security of data
5.1 We are committed to ensuring that your personal information is secure. To prevent illegal access or disclosure, we have, together with our business partners, endeavoured to implement appropriate technical, physical and other processes and procedures to safeguard and protect your personal data. We monitor our systems for potential issues and attacks and we carry out penetration testing to identify measures to strengthen security.
5.2 In addition, we limit access to your personal data to only those persons in our business who need to know the information. Also, they will only process your personal information in accordance with our instructions and they are under a duty of confidentiality.
5.3 We have procedures in place to identify and respond to data security breaches. We will notify you and any relevant data protection authority of a breach, if we legally need to do so.
6. Retention of data
6.1 Whenever we collect or process your personal information, we will only keep it for as long as is necessary for the purpose for which it was collected. Alternatively, we may be forced to keep your personal information in order to meet legal, accounting and/or reporting requirements. We may also keep your personal information if it is reasonably required for us to do so due to the potential for litigation.
6.2 In deciding the appropriate retention period for personal data, we will usually consider the amount, nature and sensitivity of the personal data, the potential risk of harm from unauthorised use or disclosure of your personal data, the purposes for which we process your personal data and whether we can achieve our purposes through other means and the applicable legal, regulatory, accounting and/or other requirements.
6.3 At times, your personal information may be either deleted entirely or made anonymous (for example, by being combined with other data so that it can be used in a manner which does not identify the individuals concerned for statistical analysis and/or business planning).
6.4 You can also ask us to remove your personal information from our systems, if this is required or permitted by law.
7. Sharing of data
7.1 We may share your personal information with third parties. These third parties may act as “data processors” or “joint data controllers”, in the course of us providing our services or online tools to you. The parties we may provide your personal information to, include without limitation:
- our suppliers;
- to our insurers;
- to our IT service providers (including, without limitation, Seer Data); and
- to regulators or tax authorities.
7.2 We use the services of third parties to help us with our website hosting and our social media communications across multiple channels (including Twitter, LinkedIn, Instagram and Facebook).
7.3 We require that all third parties that act as “data processors” for us provide sufficient guarantees to implement appropriate technical and business measures, only process personal data for legal purposes and in accordance with our instructions.
8. Processing of personal information
8.1 We may transfer, store and process your information in the manner set out in section 7 above.
8.2 If you are from the European Economic Area (EEA), this may involve the transfer of your personal information out of the EEA. The law in the country to which your personal information is transferred may be different to the law applicable in the country where you reside.
8.3 Where we transfer, store and process your personal information outside of the EEA we have ensured that appropriate safeguards exist to provide an adequate level of data protection. In particular, we will ensure that at least one of the following safeguards is in place:
(a) we will only transfer your personal data to countries considered to provide an adequate level of protection for personal data by the European Commission. For further details, see European Commission: Adequacy of the protection of personal data in non-EU countries;
(b) where we use certain service providers, we may use specific contracts approved by the European Commission which give personal data the same protection it has in the EU. For further details, see European Commission: Model contracts for the transfer of personal data to third countries.
(c) where we use providers based in the United States of America, we may transfer data to them if they are part of the Privacy Shield which requires them to provide similar protection to personal data shared between the EU and the United States of America. For further details, see European Commission: EU-US Privacy Shield.
8.4 If you need more information, on how your personal information may be transferred outside of the EEA, then you can contact us. See our contact details in section 13 below.
8.5 For individuals from Japan, this may sometimes involve the transfer of personal information out of Japan. We will not disclose personal data to a third party without obtaining your prior consent, except if allowed under the Personal Information Protection Act of Japan (Law No. 57 of 2003) (PIPA).
9. Direct marketing
9.1 It should be easy for you to stop receiving direct marketing communications from us. You can click the ‘unsubscribe’ or ‘opt-out’ link in any email communication that we send to you, or email us at [email protected]. You should note, however, that you may continue to receive communications for a short period after changing your preferences while our systems are fully updated.
9.2 For any third-party marketing, we will get your express opt-in consent before we share your personal data with anyone else, aside from us, for marketing purposes.
10. Your legal rights
10.1 There are various rights available to you in respect of the personal information we have about you. However, your rights may vary depending on which laws apply to our dealings with you. If you wish to exercise any of the rights set out below, then you can contact our personal data supervisor (see details in clause 13.3 below).
A. Request access
10.2 We will generally provide you with a copy of your personal data within the timeframes noted in applicable laws. For EU residents, we will do this for free, consistently with applicable laws.
B. Correction
10.3 If any of the information we have about you is incomplete, inaccurate or incorrect, then you will have the right to have the information corrected.
C. Erasure & to be forgotten
10.4 You can ask us to delete or remove your personal information in some instances. For EU residents, whenever you have given us your consent to use your personal information, you have the right to change your mind at any time and withdraw your consent.
10.5 If we are processing your personal data on the basis of our legitimate interests, you can ask us to stop processing your data for reasons connected to your own situation. We must then do so unless we believe we have a legitimate overriding reason to continue processing your personal data.
D. Data portability
10.6 In some cases, you may have the right to obtain your personal data in a structured, commonly used and machine readable format and to reuse it elsewhere or ask us to transfer it to a third party of your choice.
E. Objection
10.7 In other cases, you may have a right to object to us processing your data. Where your personal data is being processed for direct marketing purposes, you will have a right to object at any time.
F. Automated decision-making & profiling
10.7 You may also have a right not to be subject to a decision based on automated processing where the decision will have a legal effect or a similarly significant effect on you.
10.8 To protect the confidentiality of your personal information, we will need you to confirm your identity before proceeding with any request. If you have allowed a third party to make a request for you, we will ask them to prove that they have the permission to make the request for you.
11. Minor’s privacy
11.1 We will not knowingly collect personally identifiable information from anyone under the age of 18. If you are a parent or guardian and are aware that a minor has provided us with personal information, please contact us. If we become aware that we have collected personal information from a minor without obtaining their parental consent, we will immediately take steps to remove the information from our servers and systems.
12. Links to third party websites
12.1 Our website may have links to third party websites, plug-ins and applications. Clicking on these links or enabling these connections may allow third parties to collect or share data about you. If you follow a link to any third party website, you should be aware that these websites have their own privacy policies and notices and we do not accept any responsibility or liability for their data processing activities. You should read and familiarise yourself with other websites’ privacy policies, before using them.
13. Contact us
13.1 We hope this privacy policy has helped you in explaining how we handle your personal information and your rights over it. Our privacy policy details most of your rights under applicable laws, but not necessarily all rights you may have. If you have other rights under any law applicable to you, then we will always follow that applicable law.
13.2 If you have any issues concerning our privacy policy, then please contact us by email on [email protected].
13.3 We have appointed a personal data supervisor who is responsible for answering all questions on our privacy policy. If you have any queries on our privacy policy, including any requests to exercise your legal rights, then please contact our personal data supervisor at [email protected]
14. Complaints
14.1 You can make a complaint to the relevant data protection authority (DPA), in your country, at any time. Before you do so, however, we would appreciate the opportunity to discuss any concerns you have directly with you.
15. Changes to privacy policy
15.1 At all times, our most recent privacy policy will be available on our website. You will be able to obtain previous versions of our privacy policy by contacting us.
16. Duty to inform us of changes
16.1 It is important that the personal data that we hold about you is accurate and current. You should always keep us informed of any changes to your personal information, while you have a relationship with us.