Privacy Policy (Summary)

1.3. This Privacy Policy describes how we manage Personal Information when you use or engage with our Digital Assets, our services, or communicate with us.

1.4. Please ensure that you read this Privacy Policy carefully as it applies to all Personal Information we collect through your interactions with our Digital Assets and services. We reserve the right to modify this Privacy Policy at any time.

1.5. By engaging with us, our Digital Assets, or our services, you acknowledge and consent to us collecting, accessing, storing, using, disclosing and disposing your Personal Information in accordance with this Privacy Policy and the Digital Assets Terms of Use (Terms of Use).

1.6. If you have questions about your Personal Information or our Privacy Policy, please contact us: records@karlka.com.au.

2 Definitions

Aboriginal Data includes any data, facts, information or statistics about Australian Aboriginal and Torres Strait Islander people, from Aboriginal and Torres Strait Islander people, or about their families, communities, history, culture or Country, including ICIP.

Cookies are small files (including web beacons, pixels, tags, scripts and other similar technologies) placed on your computer, mobile or other device.

Indigenous Cultural and Intellectual Property (ICIP) refers to Australian Aboriginal and Torres Strait Islander peoples’ rights to their heritage, comprising all objects, sites, language and knowledge, the nature or use of which has been transmitted or continues to be transmitted from generation to generation, and which is regarded as pertaining to a particular Aboriginal or Torres Strait Islander group or its territory.

Indigenous Data Sovereignty (IDSov) means the right of Australian Aboriginal and Torres Strait Islander peoples to exercise control over the management of Aboriginal Data across the data ecosystem.

KNAC or We or Us means Karlka Nyiyaparli Aboriginal Corporation RNTBC (ICN 3649).

Personal Information is defined under section 6 of the Privacy Act as information or an opinion about an identified individual, or an individual who is reasonably identifiable. For example, this may include your name, age, date of birth, gender, contact details and postcode. It may also include financial information, including your credit card information, or a photograph of you. Personal Information does not include anonymous, aggregated or de-identified information or information about companies which does not identify individuals.

Privacy Act means the Privacy Act 1988 (Cth).

Sensitive Information is a category of Personal Information defined under section 6 of the Privacy Act that may include information about racial or ethnic origin, political opinions, religious or philosophical beliefs, criminal record, membership of a professional, trade association or trade union or sexual preferences.

3 Personal Information we collect

3.1 We collect Personal Information only where it is relevant and necessary to deliver our Digital Assets or services, to perform our functions and activities, or as required by law. The types of information we collect depends on how you engage with us and our Digital Assets.

3.2 The types of Personal Information we might collect from you include:

• personal details including name, address, email address, mobile and telephone number, gender, age, date of birth, place of work;
• information relating to services we have provided to you or that you have enquired about, including any additional information necessary to deliver those products and services and respond to your inquiries;
• information you provide to us directly or indirectly through your contact with us or use of our Digital Assets;
• details or history of your preferences, interests and behaviour relating to our Digital Assets;
• your IP address, web log and related domain, browser, computer and connection information, statistics on page views, traffic to and from websites, device ID, device type and geo-location information; and
• statistics on your activity such as page views, the sites you were visiting before you came to our websites, traffic to, from and within the websites, and ad data.

3.3 We only collect Sensitive Information where it is reasonably necessary to fulfil one or more of our functions and activities. Examples of Sensitive Information that we might collect include information your identify as an Aboriginal or Torres Strait Islander person, your language group or apical group.

3.4 Depending on what you choose to share with us, we might also collect Aboriginal Data, such as information about lived experiences, personal, family or community histories, or your family and community, or ICIP.

3.5 Information that we collect that is also Aboriginal Data will be managed as far as reasonably possible in accordance with Indigenous Data Sovereignty (IDSov) principles, having regard to the Privacy Act and other applicable laws.

4 How we collect Personal Information

4.1 We collect Personal Information from you in a variety of ways, including:

4.1.1 Directly from you, including when you:

• deal with us directly over the phone, e.g. with an enquiry or to provide feedback,
• interact with us online, including through our websites, email, webchats, mobile applications (via the Apple iOS App Store or Google Play – these app store platforms will also handle your personal information for their own purposes and have their own privacy policies) and social media platforms (such as Facebook and LinkedIn – these social media platforms will also handle your personal information for their own purposes and have their own privacy policies);
• complete feedback forms, surveys or questionnaires;
• register for a subscription with us;
• interact with marketing or promotional activities;
• Automatically online, including when you:
• browse or interact with our Digital Assets, e.g. click on banners, hyperlinks or plugins, view or download resources;
• are online – see our Cookies Policy below.

4.1.2 From third parties, including when you:

• interact with any third-party content or hyperlinks on our Digital Assets; and
• from publicly available sources of information.

4.2 Where we can, we will collect Personal Information directly from you, rather than from another person or source.

5 How we use Personal Information

5.1 We use Personal Information for the primary purpose of delivering our Digital Assets and services to you, and to conduct our functions and activities.

5.2 The main purposes for which we handle Personal Information include:

• to enable your access, interaction and use of our Digital Assets;
• to answer your requests, questions and complaints, and provide you with information or technical support;
• to administer forms, surveys, questionnaires, or for other marketing and promotional activities;
• to deliver, optimise and improve the Digital Assets;
• to carry out administration, research, marketing, planning, fraud and loss prevention activities, development, quality control and research to improve the way we provide our Digital Assets and services to you;
• to comply with laws or regulations or any directions given by regulators or legal authorities.

5.3 Other than for the purposes described above, we will not use your Personal Information without your prior consent.

6 When we disclose Personal Information

6.1 We only share or disclose your Personal Information for the purposes for which you provided it. We will always ask your permission before sharing or disclosing your Personal Information for a secondary (unrelated) purpose, unless the Privacy Act or APPs authorises or requires the use or disclosure.

6.2 We do not routinely disclose Personal Information to third parties unless:

• you have consented to the disclosure;
• the disclosure is directly related to the primary purpose of collection, for example, it is necessary to provide you with information you have requested about our Digital Assets or services;
• the disclosure is for secondary purposes that you would reasonably expect and is related to the primary purpose of collection;
• the disclosure is permitted or otherwise required by laws, regulations or professional standards.

6.3 We take reasonable steps to ensure that, before disclosing Personal Information to any third party, they comply with the requirements of the Privacy Act and the APPs.

6.4 We might also share non-personal, de-identified and aggregated information for research, funding, sponsorship, or promotional purposes.

6.5 Subject to clause 6.6, we will not disclose Personal Information that is Aboriginal Data to third parties, except where you have provided your express written consent.

6.6 We reserve the right to disclose Personal Information that may be considered Aboriginal Data in accordance with IDSov principles, the Privacy Act, the APPs and this Privacy Policy.

6.7 We might disclose personal information outside of Australia, including to third party suppliers, cloud based and other service providers and website hosts located offshore. We will take all reasonable steps to ensure that any overseas recipient deals with such personal information in a way that is consistent with the Privacy Act, the APPs and IDSov.

7 Indigenous Data Sovereignty (IDSov)

7.1 In delivering our Digital Assets, we recognise and agree to uphold the right of Aboriginal peoples to maintain, control, protect and develop Aboriginal Data, known as Indigenous Data Sovereignty (IDSov), in accordance with Article 31 of the United Nations Declaration on the Rights of Indigenous Peoples.

7.2 Where reasonable and practical to do so, we apply IDSov principles to the collection, storage, access, use, disclosure and disposal of Aboriginal Data, including:

• Transparency as to the objectives of collecting Aboriginal Data from you;
• Free, prior and informed consent is sought and obtained for the collection of Aboriginal Data;
• Transparency regarding the storage of the Aboriginal Data, including how and where it will be stored;
• Transparency concerning the extent of access and use of the Aboriginal Data and the form in which the data is intended to be accessed or used (including any de-identified data);
• That once collected, the provider of the Aboriginal Data can request that their data not be used, whether at all or for certain purposes, and that this request will be agreed to where reasonable and practical to do so;
• That, where reasonable, the provider of the Aboriginal Data can request to access their data, or that their data be destroyed and/or repatriated, and we will not unreasonably deny such requests;
• The use of Aboriginal Data by us now and into the future, protects, respects and supports the individual and collective interests of Aboriginal peoples.

8 Cookies Policy

8.1 We use Cookies for our internal management purposes, including, without limitation, to analyse trends, manage functionality, administer our Digital Assets, track users’ movements around the Digital Assets and to gather demographic information about our user base.

8.2 We might store, issue and request Cookies from your devices to collect both Personal Information and de-identified information.

8.3 Our employees, contractors, agents and related bodies corporate and third-party suppliers and related service providers might also use technologies such as cookies to gather information about your activities on our Digital Assets in order to provide you advertising based on your browsing activities and interests.

8.4 You can change your browser settings to reject the use of cookies, however please note that this may prevent you from using the full functionality of our Digital Assets.

9 Direct Marketing

9.1 We might send you direct marketing communications and information about our Digital Assets or our services. This might take the form of emails, SMS, mail or other forms of communication, in accordance with the Spam Act 2003 (Cth) and the Privacy Act.

9.2 You can elect not to receive marketing materials from us by contacting us or using the opt-out facilities provided.

10 Third-Party Sites

10.1 Our Digital Assets might contain links to websites and embedded content owned and operated by third parties. We do not endorse those linked sites and are not responsible for the privacy or policies of, or any content on, those sites. We encourage you to review the privacy policy of each site you visit, especially if you intend to disclose any Personal Information via that site.

11 Posting

11.1 On some KNAC Digital Assets you can post or upload comments, images, photos, writings or other material (Post/s) subject to our Terms of Use. Please be aware that these Post/s might become publicly available and might be read, collected and used by others and we are unable to control or limit third party use of the Posts once you have shared them.

11.2 We suggest you regularly check the information you Post to ensure its accuracy. If you do not wish the information to be publicly available, please do not Post the information.

12 Anonymity

12.1 Where possible, you have the option of interacting with us anonymously (for example, as a visitor to our website/s) or through a pseudonym. However, it might impact our ability to provide our services to you.

13 Security

13.1 We take reasonable steps to protect your Personal Information from misuse, interference, loss, unauthorised access, modification or disclosure.

13.2 KNAC implements a range of physical and electronic privacy, confidentiality and data security practices designed to protect the Personal Information held by us.

13.3 We store Personal Information in electronic and hard copy form in a secure environment, which can be accessed only by authorised personnel. However, please keep in mind that no internet transmission of information or data is ever completely secure.

14 Access and Correction of Personal Information

14.1 We will take all reasonable steps to ensure Personal Information is accurate, complete and up-to-date, however, we rely on the accuracy of Personal Information as provided to us both directly and indirectly.

14.2 You have the right to access and review your Personal Information that we hold. You can contact us if you want to access or correct Personal Information we hold about you. When you make such a request, we will need you to verify your identity so we can be sure that you are the person to whom the information relates.

14.3 We will generally provide you with access to your Personal Information where reasonable and practical to do so, and in accordance with the Privacy Act and APPs, and will take reasonable steps to correct your Personal Information.

14.4 If we refuse, or are unable, to correct or provide you with access to your Personal Information, we will write to you to explain the reasons why this is the case.

15 Destruction and De-identification of Personal Information

15.1 We store Personal Information only for as long as it is necessary to fulfill the purposes for which it was collected, as permitted by the Privacy Act, or to comply with legal obligations.

15.2 When Personal Information is no longer required, or we have been directly instructed by the provider of the Personal Information to permanently remove or suppress it, we will take reasonable steps to securely destroy or permanently de-identify it.

15.3 You can request the destruction or de-identification of your Personal Information at any time. If you provided express consent for the collection of your Personal Information, you can withdraw that consent by submitting a written request. Upon receiving your request, we will review and inform you of the outcome. Generally, we will be able to comply with your request, however, if we are unable to do so, we will provide written reasons for any refusal.

16 Notifiable Data Breaches Scheme

16.1 In the event of any unauthorised access or disclosure or loss of Personal Information that is likely to result in serious harm, we will investigate and notify you (including recommendations about the steps you should take in response) and the Office of the Australian Information Commissioner pursuant to the Privacy Act.

17 Complaints about your Privacy

17.1 Please contact us if you think we have breached the Privacy Act or wish to make a complaint about the way we have handled your Personal Information. We will take reasonable steps to manage and respond to your privacy complaint in a timely manner.

17.2 If you would like further information about privacy and the protection of your Personal Information, or if you feel we have not resolved your complaint satisfactorily, you can contact the Office of the Australian Information Commissioner at www.oaic.gov.au.

18 Contact Us

18.1 If you wish to contact us about this Privacy Policy and/or the Terms of Use, or to access or correct your Personal Information, please contact us via:

Karlka Nyiyaparli Aboriginal Corporation RNTBC (ICN 3649)
8 Byass Street, South Hedland WA 6722

P: +61 8 9140 2755
E: records@karlka.com.au