All those juicy Privacy Policy pieces

1. Scope

This policy covers all Arc Members. For this policy, an Arc Member includes all current Members, Alumni and Associate Members.

As a membership organisation, Arc is committed to ensuring the privacy of your information by complying with the Privacy Amendment (Private Sector) Act 2000, Privacy Amendment (Enhancing Privacy Protection) Bill 2012, the Australian Privacy Principles set out in the Privacy Act 1988 and the privacy provisions of all other applicable legislation. Arc acknowledges that the privacy of our members' personal information should be treated with the utmost sensitivity.

2. Responsibilites

Arc:

• Ensures membership officers are aware of the policy and their responsibilities in regards to student membership information and the Australian Privacy Principles.
• Promotes, administers, monitors, evaluates and reports on this Policy.
• Formulates and implements a procedure to respond to members' requests to access and/or update their information within a reasonable time.
• Approves the release of information (Personal or Sensitive) to an external body or person.
• Receives and investigates any formal privacy complaints from Arc members.
• Reports on compliance, when required, with applicable legislation to Arc's board.

3. What personal information Arc collects and holds

Personal information is any information about you, whether it is true or not, where your identity is apparent or can reasonably be ascertained from that information.

Arc collects and holds information that we consider relevant for the provision of services to you as a member.

Examples of personal information we hold include:

• Your first and last name (including title)
• Your student number
• Your contact details (including email address, mobile phone number, and address)
• Your age
• Information about your university degree (including your faculty, attendance pattern, whether you're a local or international student, and the year you started Uni)

4. What is sensitive information?

Sensitive information is information about your:

• Health;
• Racial or ethnic origin;
• Political opinions;
• Membership of a political association, professional or trade association or trade union;
• Religious beliefs or affiliations;
• Sexual preferences or practices;
• Criminal records

We usually do not collect sensitive information about our members but will do so when required or authorised by law, or where you consent to provide this information.

In the unlikely event we have to source sensitive information about you, we will do so in accordance with the Australian Privacy Principles and with other laws such as NSW and Commonwealth Anti-Discrimination Laws.

5. Why and how we collect your information

Your personal information will only be collected by Arc for us to ensure we are providing targeted, appropriate and useful services to our members, and we will only collect information about you that is necessary to perform our functions and activities. Personal information is primarily collected directly from you when you fill out and submit one of our Arc membership forms, including any online membership systems we may use. We may also collect personal information when you contact us via telephone, mail, fax, e-mail, or through our website. Personal information may also be collected if you complete an Arc student survey.

Some of the services we offer to members, such as Legal & Advocacy services, may typically involve a significant amount of personal and sensitive information being disclosed to and held by a specific department of Arc. This information is considered strictly confidential, may be subject to additional legal protection against disclosure, is not shared by the department, nor is it collected by the Marketing and Membership Manager. Certain information collected by Arc may also be collected by a third party which provides specific services to Arc, for example SpArc, Salesforce, Mailchimp, Eventbrite. You may also be required to provide certain personal information to a third party when carrying out certain transactions, such as purchasing tickets to Arc events or parties. These third parties have their own, separate privacy policies which can be found on their website or by contacting them directly.

6. Unsolicited personal information

In the event that we receive unsolicited personal information about you that we did not take any active steps to receive, we will deal with it according to the Australian Privacy Principle 4.

7. Disclosure and use of personal information

We will only use your personal information in accordance with the Australian Privacy Principles. These principles let us use your information for the purposes for which it is collected. When you provide personal information to Arc as a member, this means your personal information may be disclosed to or used in connection with:

• The planning, improvement and actual provision of Arc services by the Marketing and Membership Manager and other relevant employees of Arc (i.e. including those people associated with Arc who would legitimately be entitled to have it disclosed to them).
• Allowing us to keep you updated on Arc's upcoming events and important news such as elections and AGM notices.
• Internal purposes such as auditing, research and data analysis to enable Arc to improve its services for members.
• Complying with any lawful request to disclose the information.
• Arc will never sell personal information to third parties or allow personal information to be used for direct marketing via third parties.

8. Remaining anonymous

You have the option of interacting with us anonymously or using a pseudonym, however in situations where this is impracticable and we are not provided with the information, we will be limited in our ability to provide you with particular services and Arc membership in general.

9. Access

Subject to some exceptions which are set out in the Australian Privacy Principles (Principle 12), an Arc member can gain access to the personal information we hold about them by submitting their request to the Arc in writing, or via their online membership account.

We will respond in writing to written requests for access within a reasonable time. We may charge you an access fee in some circumstances.

10. Correction

If your personal information changes, you can contact Arc and we will endeavour to update and correct the information we hold about you. You are also able to update your personal information if it changes via your online membership account, which you may access using a password-protected login. We may also contact you from time to time to check the information we hold is still correct.

11. Information Security

We will keep your information in a secure cloud environment and we train our staff to identify and manage privacy risks. We may store your personal information in paper and/or electronic form. We may use cloud storage to store the electronic form of personal information we hold about you, the cloud storage and the IT servers may be located in or outside Australia.

Information will only be retained for a reasonable period of time that is necessary for an authorised purpose. You can request at any time, in writing, to destroy your personal information. We will fulfil this request so far as we are legally permitted to do so.

We use all reasonable means to prevent your personal information from misuse, interference, loss as well as unauthorised access, modification or disclosure.

If we believe that a notifiable data breach has occurred we will follow the Office of Australian Information Commissioner guidelines to notify all members in a timely manner.

12. Communication

This policy will be available free through the Arc @ UNSW Limited website.

We are constantly reviewing all of our policies. As a consequence, we may change this policy from time to time or as the need arises.

13. Contact us about privacy

If you have any questions, complaints or suggestions about the way we have protected your personal information as set out in this Privacy Policy you can contact Arc at membership@arc.unsw.edu.au. If after initially lodging your complaint with Arc you are still not satisfied with the response or do not feel the matter has been resolved, you may contact Arc's designated Privacy Complaints Officer at privacy@arc.unsw.edu.au who will consider your complaint in accordance with applicable legislation and Arc's own policies and procedures. Your complaint will be acknowledged within 2 working days, and a response to your complaint provided within 20 working days of receipt.

If you remain dissatisfied or have concerns about any privacy issue you may also contact the Office of the Australian Information Commissioner on 1300 363 992 or www.oaic.gov.au.

ACKNOWLEDGEMENTS 

Office of the Australian Information Commissioner