Privacy policy

1. PURPOSE

• Promote transparency and accountability, and foster a privacy and data protection culture across BAI;
• Ensure compliance with the Privacy Act 1988 (Cth) (“Privacy Act”), Australian privacy principles and all other applicable privacy and data protection legislation;
• Ensure employee confidence and compliance in their processing of personal data, and being fully informed and aware of their responsibilities and obligations; and
• Provide confidence to BAI’s customers and suppliers that their personal data is being well managed and ensure data subjects know how they can access it.

2            STATEMENT

• Your privacy and trust are important to us and this privacy policy (“Policy”) provides important information about how BAI Communications Pty Ltd and its affiliated companies (“we”, “us”, “our, ‘BAI”) process your personal data.
• In the course of our business we may need to process your personal data and this Policy details what information is collected and how it is collected, disclosed, protected, used and for how long it is stored and for what purposes and with whom it is shared. We also advise how you may request access to your personal data and how to make a complaint.
• BAI is the data controller in relation to the processing activities described below. This means that we decide why and how your personal data is processed.
• We are committed to protecting your privacy and processing your personal data fairly and lawfully in compliance with the privacy act and all other applicable privacy and data protection legislation. If you have any questions about this statement or our privacy practices, please contact our privacy officer on the contact details set out below.
• This is our main privacy policy. We may also provide additional, specific privacy information to you as you interact with us in different ways (e.g. that we will only use certain information for specific purposes). To the extent that specific privacy information differs from what we say below, those differences will apply in those circumstances.
• This Policy may change from time to time so please check this page occasionally to ensure that you’re happy with any changes.

3            DEFINITIONS

“Data subject” means any individual person who can be identified, directly or indirectly, via an identifier such as a name, an ID number, location data, or via factors specific to the person’s physical, physiological, genetic, mental, economic, cultural or social identity;

“Personal data” is any data which lets you identify a living individual. Personal data can be factual (for example, a name, a personal email address, phone number or date of birth) or it can be an opinion about that person, their actions or behaviour. If you can’t use a piece of data to identify an individual, but can combine it with other data we hold to identify an individual then all of that data is personal data;

“Process/processing” of personal data means almost any handling or use of personal data, including (but not limited to) collection, recording, organisation, storage, modification, transfer and deletion;

“Special categories of personal data” relate to racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, and the Processing of genetic data, biometric data for the purpose of uniquely identifying a natural person, data concerning health or data concerning an individual’s sex life or sexual orientation.

4            SCOPE

This Policy applies to all BAI offices and to all people who handle work for any office, or any associated entities including directors, employees and all temporary or contract staff, secondees and consultants whether or not they are employed by BAI and irrespective of length of service or duration of contract.

5            RELATED DOCUMENTS

5.1          Please also refer to our:

• Information security policy statement;
• Data protection impact assessment procedure; and
• Subject access request procedure;

which are located on our Policy portal intranet.

6            HOW WE COLLECT PERSONAL DATA

6.1          We may collect personal data directly from you when you:

• Make an enquiry or contact us during the ordinary course of business such as by online enquiry, email, phone or by letter;
• Apply to us for a job vacancy;
• Purchase or request products or services from us;
• Use our website;
• Use our mobile applications, for example our Australian business uses Google Maps APIs on selected mobile and laptop applications. We attach below the link to Google’s Privacy Policy:

http://www.google.com/policies/privacy.

• Use our social media accounts, e.g. via Facebook, LinkedIn or X (formerly Twitter);
• Notify us of a data breach or make a complaint; and
• Complete any surveys we contact you about.

6.2         We may also collect special categories of personal data when we:

• Manage our operations;
• Comply with our statutory obligations; or
• Liaise with third parties who have authority to provide us with your personal data such as your employer in certain circumstances.

7            TYPES OF PERSONAL DATA WE COLLECT ABOUT YOU

7.1          We typically Process the following types of personal data about you:

• Your name, home address, personal email address and personal phone number;
• Your work email address and other work contact details;
• Your role, industry, location, position and/or job title within your employment;
• Your area of employment (e.g. marketing, sales, procurement);
• Details of your visits to our premises; and
• Details of transactions you carry out with us in the course of business or through our website.

8            HOW WE USE YOUR PERSONAL DATA

8.1          We will process your personal data in connection with the management of our relationship with you for the following purposes:

• To provide you or your employer with requested products or services;
• For account management purposes and to keep in touch with you about requested products or services;
• To identify persons authorised to trade on behalf of our customers, suppliers and/or service providers;
• For administrative purposes in relation to the security and access of our systems, premises, platforms and secured websites and applications;
• To comply with our legal and regulatory obligations and requests anywhere in the world, including reporting to and/or being audited by national and international regulatory bodies;
• For monitoring and assessing compliance with our policies and standards;
• To comply with court orders and exercise and/or defend our legal rights; and
• As otherwise permitted or required by any applicable law or regulation.

9            HOW WE LAWFULLY PROCESS YOUR PERSONAL DATA

9.1          We will only process your personal data, where:

• You have given your consent to such processing; and in relation to special categories of personal data we will always obtain your specific informed consent. We will always obtain your explicit consent for marketing activities, in order to contact you by email or text with marketing information about our products and services (except where we may rely on legitimate commercial interests as described below). Please see the marketing section (section 16) below in this Policy. You may withdraw your consent for us to use your Personal Data at any time. Please see section 13 on withdrawing your consent for further details; or
• The Processing is necessary to provide our services such as when we are providing you with any of our products and services; or
• The Processing is necessary for compliance with our legal obligations, such as:
  • To identify you when you contact us;
  • To verify the accuracy of data we hold about you; and/or
  • To comply with a request from you in connection with the exercise of your rights; or
  • The Processing is necessary for our legitimate commercial interests or those of any third-party recipients that receive your Personal Data, such as:
    • Operating and managing contracts with our suppliers and service recipients; and
    • For the establishment and defence of our legal rights and
    • To assess and process applications from job applicants.

10        WHO MIGHT WE SHARE YOUR PERSONAL DATA WITH?

10.1        We do not and will not sell, rent out or trade your personal data. We will only disclose your personal data in the ways set out in this Policy and, in particular, to the following recipients:

• To any of our related companies;
• To our third-party service providers, agents, subcontractors and other organisations for the purposes of providing services to us or directly to you on our behalf (for example cloud services providers, hosting, email and content providers, marketing agencies (if you have given your consent to this) and administrative services providers;
• To any third party to whom we assign or novate any of our rights or obligations;
• To any prospective buyer in the event we sell any part of our business or assets; and/or
• To any government, regulatory agency, enforcement or exchange body or court where we are required to do so by applicable law or regulation or at their request.

10.2       When we use third party service providers, we only disclose to them any personal data that is necessary for them to provide their service and we have a contract in place that requires them to keep your information secure and not to use it other than in accordance with our specific instructions.

11        HOW WE PROTECT YOUR PERSONAL DATA

11.1       We are committed to safeguarding and protecting your personal data and we have implemented and maintained appropriate technical and organisational measures to ensure a level of security appropriate to protect any personal data provided by you to us from accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to Personal Data transmitted, stored or otherwise Processed. This is set out in our Information Security Policy.

12        HOW DO WE PROTECT YOUR PERSONAL DATA IF WE SEND IT OVERSEAS?

12.1      The personal data we collect from you may be transferred to (including accessed in or stored in) a country or territory outside Australia, including to countries whose laws may not offer the same level of protection of personal data as are enjoyed within Australia. We will ensure that any such international transfers are made subject to appropriate or suitable safeguards as required by the Privacy Act. These safeguards include imposing contractual obligations on the recipient of your personal data or ensuring that the recipients are subscribed to ‘international frameworks’ that aim to ensure adequate protection. Copies of the relevant safeguard documents may be requested from our privacy officer whose contact details are set out below.

13        YOUR RIGHTS IN RELATION TO THE PERSONAL DATA WE COLLECT

13.1      Under data protection law, you have rights we need to make you aware of. The rights available to you depend on our reason for processing your personal data, and we set these out below:

• You have the right to ask us for copies of your personal data. This right always applies. There are some exemptions, which means you may not always receive all the information we process. Please see our subject access request procedure and form located on our Policy portal intranet;
• You have the right to ask us to rectify information you think is inaccurate. You also have the right to ask us to complete information you think is incomplete. This right always applies;
• You have the right to ask us to erase your personal data in certain circumstances. Unless there is a reason that the law allows us to use your personal data for longer, we will make reasonable efforts to comply with your request;
• You have the right to ask us to restrict the processing of your personal data where you believe it is unlawful for us to do so, you have objected to its use and our investigation is pending or you require us to keep it in connection with legal proceedings. In these situations, we may only process your personal data whilst its processing is restricted if we have your consent or are legally permitted to do so, for example for storage purposes, to protect the rights of another individual or company or in connection with legal proceedings;
• Where we rely on our legitimate business interests as the legal basis for processing your personal data for any purpose(s), as outlined under section 9 on how we may lawfully process your personal data, you may object to us using your personal data for these purposes by emailing or writing to us at the address at the end of this Policy. Except for the purposes for which we are sure we can continue to process your personal data, we will temporarily stop processing your personal data in line with your objection until we have investigated the matter. If we agree that your objection is justified in accordance with your rights under data protection laws, we will permanently stop using your data for those purposes. Otherwise, we will provide you with our justification as to why we need to continue using your data;
• You may object to us using your personal data for direct marketing purposes and we will automatically comply with your request. If you would like to do so, please email or write to us at the address at the end of this Policy;
• You have the right to object to processing if we can process your personal data because the process forms part of our public tasks, or is in our legitimate interests;
• You have the right to ask that we transfer the personal data you gave us from one organisation to another or give it to you. The right only applies if we are processing personal data based on your consent or under, or in talks about entering into a contract and the processing is automated.

You can ask us to send your personal data directly to another service provider, and we will do so if this is technically possible. We may not provide you with a copy of your personal data if this concerns other individuals or we have another lawful reason to withhold that information.

You are not required to pay any charge for exercising your rights. We have one month to respond to you.

Please contact our privacy officer on the contact details below in relation to any of the above rights.

• Where we rely on your consent as the legal basis for processing your personal data, as set out under section 9 on how we lawfully process your personal data, you may withdraw your consent at any time by contacting our privacy officer using the details at the end of this Policy.

If you would like to withdraw your consent or object to receiving any direct marketing to which you previously opted-in, you can do so using the unsubscribe tool in that communication (if it is an email), or by contacting our privacy officer using the contact details at the end of this Policy. If you withdraw your consent, our use of your personal data before you withdraw is still lawful.

If you have provided consent for your details to be shared with a third party, and wish to withdraw this consent, please also contact the relevant third party in order to amend your preferences.

14        HOW LONG WILL WE HOLD YOUR PERSONAL DATA FOR?

14.1    We will only retain your personal data for as long as necessary to fulfill the purpose for which it was collected or to comply with legal, regulatory or internal policy requirements.

15        LINKS TO OTHER WEBSITES

15.1     We may provide links to other websites operated by third parties. We make no representations or warranties in relation to the privacy practices of any third-party website and we are not responsible for the privacy policies or the content of any third-party website. If you visit these websites, they will be governed by their own terms of use (including privacy policies).

16        OUR MARKETING

16.1     We may process your preferences to receive marketing information directly from us by email and text in the following way:

• If you place an order with us for a product or service, we may contact you with marketing information in the ways mentioned in the notices presented to you as part of that transaction, except where you indicate you would prefer otherwise.

16.2    If you do not complete a purchase and have not indicated that you would prefer otherwise, we may remind you by phone or email about your incomplete purchase.

16.3    From time to time, we may ask you to refresh your marketing preferences by asking you to confirm that you want to continue receiving marketing information from us.

16.4    We may contact you with marketing information by post and telephone by using your personal data or with targeted advertising delivered online through social media and platforms operated by other companies using their profiling tools or use your personal data to tailor marketing to improve its relevance to you, unless you object.

16.5    You can amend your marketing preferences at any time by contacting our Privacy Officer using the contact details at the end of this Policy.

17        THIRD PARTY MARKETING

17.1        We will only share your personal data with our third-party partners for them to contact you directly with marketing information about their products and services where you have indicated to us that you would like us to do so.

17.2       Once shared, the relevant third party’s privacy policy will apply to their processing of your personal data, not ours. If you’d like to opt out of receiving marketing from a third party after providing your consent, you can do so at any time by contacting the relevant third party directly.

17.3    You have the right to opt out of our use of your personal data to provide marketing to you in any of the ways mentioned in this Policy. Please also see section 13 on withdrawing your consent and on objecting to our use of your Personal Data and automated decisions made about you.

18        HOW WE UPDATE OR CHANGE THIS PRIVACY POLICY

18.1    We may change or update parts of this Policy in order to maintain our compliance with applicable law and regulation or following an update to our internal practices. Any changes will be notified to you by posting an updated version on our website. Therefore, please ensure that you regularly check this Policy, so you are fully aware of any changes or updates.

19        HOW YOU CAN CONTACT US

19.1    If you have any queries about the contents of this Policy, or wish to inform us of a change or correction to your Personal Data, would like a copy of the Personal Data we collect on you or would like to raise a complaint or comment, please contact our Privacy Officer using the details set out below:

Privacy Officer
BAI Communications Pty Limited
Email: privacy@baicommunications.com

Address: Level 10, Tower A, 799 Pacific Highway, Chatswood, NSW 2067, AUSTRALIA

20        WHO ELSE YOU CAN COMPLAIN TO:

20.1       We would like to be able to resolve all your concerns, and we hope that we can do so. Where we have not been able to do this, you have the right to contact the appropriate data protection regulator if you consider that we have breached your data protection rights.

The contact details of the appropriate data protection regulator for Australian complaints are:

Office of the Australian Information Commissioner
Online/Enquiry Form: https://www.oaic.gov.au/contact-us
Phone: 1300 363 992