Privacy and Policy

Wistec Pty Ltd is committed to providing quality services to our clients and ensuring that appropriate security measures are applied to protect the confidentiality, integrity, and availability of our information and that of our customers.

This policy enables Wistec Pty Ltd to identify, manage, and achieve these commitments.

This policy applies to the delivery of services to Wistec customers.

About This Policy

The Privacy Act 1988 requires entities bound by the Australian Privacy Principles to have a privacy policy. This privacy policy outlines the personal information handling practices of Wistec Pty Ltd.

At Wistec Pty Ltd, we respect the privacy of all personal information in our care, and this commitment is demonstrated in our policy on information privacy. The major points of this policy concern how personal information is collected, used, kept, and disclosed, and the rights that individuals have to access the information that Wistec Pty Ltd holds.

For the purpose of this policy, any reference to “Wistec”, “we”, “our”, or “Wistec Pty Ltd” is a reference to Wistec Pty Ltd, ABN [insert ABN], and its group of companies.

Overview

We collect, hold, use, and disclose personal information to carry out functions or activities, including:

• Handling privacy and freedom of information (FOI) complaints and FOI reviews
• Taking other regulatory action under the Privacy and FOI Act
• Providing advice on privacy, FOI, and information policy issues
• Consulting with stakeholders, for example, on privacy or FOI guidance
• Maintaining registers, such as organizations that have opted into Privacy Act coverage
• Responding to access to information requests
• Communicating with the public, stakeholders, and the media, including through websites and social media
• Assessing suitable candidates for career opportunities within Wistec

Collection of Personal Information

At all times, we try to only collect the information we need for a particular function. Wistec Pty Ltd may collect the information you give us online, by email, post, facsimile, face to face, over the phone, or through our partners. In most cases, the personal information Wistec Pty Ltd will collect from you is the personal information required by us in our effort to provide products and services to you and your organization. This information may include but is not limited to:

• Name
• Email address
• Phone numbers
• Business title
• Company name
• Employment/Contracting applications containing employment history and references

Collecting Sensitive Information

Sometimes we may need to collect sensitive information about you, for example, to handle a complaint. This might include information about your association memberships, criminal history, genetic or biometric information.

Collecting Through Our Website

Wistec’s public website, www.wistec.com.au, is hosted in Australia. We collect information through our website in various ways.

Our website uses technologies such as cookies and/or web beacons to make use of the website and services as convenient as possible. Cookies are pieces of information that a website transfers to a computer’s hard drive for record-keeping purposes. A web beacon is a technical method that sends information related to access to websites or the opening or previewing of an HTML-formatted email. Most web browsers are set to accept tracking technologies such as cookies or web beacons. These tracking technologies allow Wistec to monitor items an individual may want to purchase as they move through the site and to record how many people are using which areas of the site.

You may choose to accept or decline cookies. Most web browsers automatically accept cookies, but you can usually modify your browser setting to decline cookies if you prefer. This may prevent you from taking full advantage of the website.

Our website may contain links to enable you to visit other websites of interest easily. However, once you have used these links to leave our site, please note that we do not have any control over that other website. Therefore, we cannot be responsible for the protection and privacy of any information which you provide while visiting such sites, especially if they are not governed by this privacy policy. You should exercise caution and look at the privacy statement applicable to the website in question.

Social Networking Services

We use social networking services such as LinkedIn, Facebook, and YouTube, Instagram, TikTok, Wechat and others to communicate with the public about our work. When you communicate with us using these services, we may collect your personal information, but we only use it to help us communicate with you and the public. The social networking service will also handle your personal information for its own purposes. These services have their own privacy policies. You can access the privacy policies for LinkedIn, Facebook, and YouTube (a Google company) on their websites.

Notifiable Data Breach

Our primary goal is to maintain information governance and security via compliance with the Privacy Act 1998 (Cth) ( Privacy Act 1988 (Cth)). For personal information that we hold:

• If we suspect there has been a data breach, we will take appropriate remedial actions, if possible, to contain the suspected breach.
• We will conduct an assessment within 30 days from when our suspicions arose. The assessment will follow our procedure for Information Security Incident Management.
• If we determine there has been a breach and the assessment concludes there is a risk of serious harm, we will:
  • Notify affected persons in line with current standard processes unless the incident is covered by an exception to the Act.
  • Notify the Australian Information Commissioner.

We will review the incident and take appropriate actions to prevent future breaches.

In relation to cloud and network services that we may provide to you, it is your responsibility to ensure that no personal information is stored or processed by our cloud and network services. Just like the landlord of a storage shed does not take inventory of the tenant’s goods, we provide the place for you to store your data but do not inspect it. However, if we have reasonable grounds to believe that personal information may have been stored in our cloud which has been compromised, we will notify you and share all relevant details of the alleged breach in accordance with our obligations under the Act and may assist you with your assessment and remedial actions under the Act.

Disclosure

On occasion, we may supply your personal information to third-party service providers who assist us in the provision of services, such as the following:

• Providing technical services
• Distribution of marketing information to you (except where you have chosen to opt out of receiving this information from us)
• Supply of billing and payment services
• Where we are legally obliged to do so

Our relationships with such third-party service providers are governed by our contracts with them. Those service providers are required to hold your personal information in confidence and comply with the Australian Privacy Act 1988 and associated Australian Privacy Principles.

Disclosure of Sensitive Information

We only disclose your sensitive information for the purposes for which you gave it to us or for directly related purposes you would reasonably expect or if you agree, for example, to handle a complaint.

Disclosure to Other Regulators or External Dispute Resolution Schemes

We may disclose information that relates to complaints or investigations to the OAIC or other Australian or international regulators, or to external dispute resolution (EDR) schemes. We will generally only disclose your personal information to other regulators or EDR schemes if you agree and where the information will assist the OAIC or the other regulator or EDR scheme in investigating a matter.

Quality of Personal Information

To ensure that the personal information we collect is accurate, up-to-date, and complete, we:

• Record information in a consistent format
• Where necessary, confirm the accuracy of information we collect from a third party or a public source
• Promptly add updated or new personal information to existing records

We also review the quality of personal information before we use or disclose it.

Storage and Security of Personal Information

We take steps to protect the security of the personal information we hold from both internal and external threats by:

• Regularly assessing the risk of misuse, interference, loss, and unauthorized access, modification, or disclosure of that information
• Taking measures to address those risks, for example, we keep a record (audit trail) of when someone has added, changed, or deleted personal information held in our electronic databases and regularly check that staff only access those records when they need to

Disposal of Your Personal Information

Wistec Pty Ltd will only keep personal information it needs for the purpose for which it was collected. Wistec will securely dispose of such information when it has no further need to use it, or it is required by law to do so.

Staff Training

All staff will undergo in-house training on the Privacy Policy and our obligations, and all new staff will complete this training as an element of our Induction Program.

Accuracy of The Personal Information Held By Wistec

Wistec is committed to ensuring that this personal information is accurate and up-to-date and will take reasonable steps to ensure its accuracy. You may request the right to review and adjust the information that may be recorded by Wistec or ask questions, comments, or reports concerning privacy by contacting Wistec using the details at the bottom of this document.

Opt-Out

Occasionally Wistec likes to inform you about product enhancements, new products, solutions, or client events. You may request that certain information about you be removed, which we will immediately comply with, provided the information is not necessary for tax purposes or to identify you or for contractual reasons. You may opt out by contacting Wistec using the details at the bottom of this document.

Staff Privacy & Personal Information

Wistec, at times, will collect and retain personal information from prospective, current, or past employees, contractors, volunteers, those

in a host employer arrangement, or others when reasonable to do so. These documents are considered employee records and are not covered under the Australian Privacy Principles where they relate to current or former employment relationships between the individual and Wistec.

The information collected is dependent on the type of role or position that is held or is being considered, but may include name, address (and other contact details), date of birth, next of kin, financial information, health records, background check outcomes, visa status, identity verification documents, nationality, references, resume, and qualification/certification records.

This information is generally collected during Wistec’s recruitment and onboarding processes directly from the employee but can also be gathered from training providers, recruitment agencies, or third-party organizations (e.g., background checks). We may also collect personal information from other people, for instance, in the case of a reference check.

Personal information is collected to enable Wistec to meet its legal obligations as an employer, including our duty of care and WHS/OHS requirements, and will only be disclosed where the individual has consented, where we are authorized to do so by law, to prevent or lessen a serious threat to life or public safety, or where this could be reasonably expected.

All personal information will be maintained with confidentiality, and access will be restricted to only those with appropriate security levels and a reasonable need to access the information. Personal information can be accessed at any time by the employee via a request to People & Culture. Wistec encourages all employees, volunteers, trainees, and contractors to advise of any change to their personal information.

Complaints or Questions Regarding Your Privacy

In most cases, you have the right to access the personal information that we hold about you. Requests for access should be directed to the Privacy Officer, whose contact details are set out below. You may contact us regarding any aspect of this policy using the details at the bottom of this document.

Contact Details

• Email: privacy@wistec.com.au
• Mail: Privacy Officer Suite 18, Level 2, 55 Gawler Place Adelaide SA 5000

You may also contact us through our online presence at www.wistec.com.au.

This version includes the updated company name, contact details, and address while retaining the key elements of the original privacy and policy statement.