APP Privacy Policy

1.           Scope

This policy sets out standards, rights and obligations in relation to handling, holding, accessing and correcting individual personal information.

2.           Purpose

To ensure International Institute of Technology (IIT) maintain the privacy and confidentiality of its RTO personnel and participant records. IIT complies with the Privacy Act 1988 including the 13 Australian Privacy Principles (APPs) as outlined in the Privacy Amendment (Enhancing Privacy Protection) Act 2012.

IIT manages personal information in an open and transparent way. IIT comply with the APPs and any binding registered APP code, and provide suitable policies and procedures for IIT personnel to be able to deal with related inquiries and complaints that may be received from time to time.

The following sections of this policy outline how we manage personal information.

Data Collection of potential students (leads)

For any course enquiry; telephone, email, online form etc, potential students (leads) details are obtained. These details may include:

• Name (not a required field; enables student to remain anonymous)
• Email Address
• Contact Number (not a required field; enables student to remain anonymous)
• Location
• Course Enquiry is for

Potential students (leads) may receive promotional emails in relation to the course/s they enquired about. Leads have the option of unsubscribing from these promotional emails by responding to the promotional email with “unsubscribe”. The lead is then immediately removed from the internal marketing list.

Australian Privacy Principle 1 – Open and transparent management of personal information

Purposes for information collection, retention, use and disclosure

As a government registered training organisation, regulated by the Australian Skills Quality Authority, IIT is required to collect, hold, use and disclose a wide range of personal and sensitive information on participants in nationally recognised training programs. This information requirement is outlined in the National Vocational Education and Training Regulator Act 2011 and associated legislative instruments. In particular, the legislative instruments:

• Student Identifiers Act 2014;
• Standards for Registered Training Organisations (RTOs) 2015; and
• Data Provision Requirements 2012.

It is noted that IIT is also bound by various State Government Acts requiring similar information collection, use and disclosure (particularly Education Act(s), Vocational Education & Training Act(s) and Traineeship & Apprenticeships Act(s) relevant to state jurisdictions of IIT operations).

It is further noted that, aligned with these legislative requirements, IIT delivers services through a range of Commonwealth and State Government funding contract agreement arrangements, which also include various information collection and disclosure requirements.

Individuals are advised that due to these legal requirements, IIT discloses information held on individuals for valid purposes to a range of entities including:

• Governments (Commonwealth, State or Local);
• Job Network Providers, and Employers (student permission required via an Authority to Access Form)
• Service providers such as credit agencies and background check providers.

Kinds of personal information collected and held

The following types of personal information are generally collected, depending on the need for service delivery:

• Contact details;
• Employment details;
• Educational background;
• Demographic Information;
• Course progress and achievement information; and
• Financial billing information.

The following types of sensitive information may also be collected and held:

• Identity details;
• Employee details & HR information;
• Complaint or issue information;
• Disability status & other individual needs;
• Indigenous status; and

IIT does not collect personal information from more vulnerable segments of the community (such as children

How personal information is collected

IIT’s usual approach to collecting personal information is to collect any required information directly from the individuals concerned. This may include the use of forms (such as enrolment forms) and the use of web based systems (such as online enquiry forms, web portals or internal operating systems).

IIT does receive solicited and unsolicited information from third party sources in undertaking service delivery activities. This may include information from such entities as:

• Governments (Commonwealth, State or Local);
• Job Network Providers, and Employers (student permission required via an Authority to Access Form); and
• Service providers such as credit agencies and background check providers

How personal information is held

IIT’s approach to holding personal information includes robust storage and security measures at all times. Information on collection is:

• Stored in secure, password protected systems, such as learning management system and student management system; and
• Monitored for unlawful access, data breaches, unknown logins, and appropriate authorised use at all times.

IIT data systems are hosted internally with robust internal security to physical server locations and server systems access. Virus protection and backup procedures are in place.

Destruction of paper based records occurs as soon as practicable in every matter, through the use of secure shredding and destruction services.

Individual information held across systems is linked through an IIT allocated identification number for each individual.

Retention and Destruction of Information

IIT must retain student records for 30 years as required by law, for reasons such as matching qualifications with individuals in the event a student requires a re-issued certificate.

Specifically for our RTO records, in the event of our organisation ceasing to operate the required personal information on record for individuals undertaking nationally recognised training with us would be transferred to the Australian Skills Quality Authority, as required by law.

Accessing and seeking correction of personal information

IIT confirms all individuals have a right to request access to their personal information held and to request its correction at any time. In order to request access to personal records, individuals are to make contact with:

CEO- International Institute of Technology (IIT)

1300 88 33 46

education@iit.edu.au

A number of third parties, other than the individual, may request access to an individual’s personal information. Such third parties may include employers, Governments (Commonwealth, State or Local) and background check providers

In all cases where access is requested, IIT will ensure that:

• Parties requesting access to personal information are robustly identified and vetted;
• the individual to whom the information relates will be need to confirm consent via a completed form submitted via the third party or by completing IIT’s Authority to Access Form
• Only appropriately authorised parties, for valid purposes, will be provided access to the information.

Complaints about a breach of the APPs or a binding registered APP code

If an individual feels that IIT may have breached one of the APPs or a binding registered APP code, the matter must be addressed as per IIT’s APP Privacy Complaints Procedure, below for further information.

In the event an individual has a complaint or concern they must undertake the following steps

1. Submit a written complaint to the Chief Executive Officer (CEO).
2. IIT will respond within a reasonable timeframe (within 30 calendar days); if the individual is not satisfied with IIT’s response they can take the matter to the Office of the Australian Information Commission (OAIC)
3. Individuals can lodge a privacy complaint to the OAIC via their preferred means of an online form. Alternatively, individuals can submit their complaint by mail, fax or email. The Online Form and contact details are available from the following website:

https://www.oaic.gov.au/about-us/contact-us

4. If the individual is not satisfied with IIT’s response (as per step 2 above( they can also take the matter to the Australian Skills Quality Authority (ASQA)
5. Individuals can lodge a complaint in relation to a privacy obligation not being met to ASQA, who will consider complaint and information. This can be done via an online form available on the ASQA website:

https://www.asqa.gov.au/

Likely overseas disclosures

IIT confirms that individuals’ personal information is not directly disclosed to overseas recipients and/or countries.

Individuals are subject to the Privacy Policy of third party data storage providers such as Google, Wisenet (Student Management System) and Survey Monkey (student feedback system)

Making our APP Privacy Policy available

IIT provides our APP Privacy Policy available free of charge, with all information being publicly available from the Student Information link on our website at https://www.iit.edu.au/about/

This website information is designed to be accessible as per web publishing accessibility guidelines, to ensure access is available to individuals with special needs (such as individuals with a vision impairment).

In addition, this APP Privacy Policy is:

• Included within our Student Information Guide
• Referred to on Enrolment Forms (details of how the policy may be accessed is provided); and
• Available for distribution free of charge on request, as soon as possible after the request is received, including in any particular format requested by the individual as is reasonably practical.

If, in the unlikely event the APP Privacy Policy is not able to be provided in a particular format requested by an individual, we will explain the circumstances around this issue with the requester and seek to ensure that another appropriate method is provided.

Review and Update of this APP Privacy Policy

IIT reviews this APP Privacy Policy:

• On an ongoing basis, as suggestions or issues are raised and addressed, or as government required changes are identified;
• Through our internal audit processes on at least an annual basis;
• As a part of any external audit of our operations that may be conducted by various government agencies as a part of our registration as an RTO or in normal business activities; and
• As a component of each and every complaint investigation process where the compliant is related to a privacy matter.

Where this policy is updated, changes to the policy are widely communicated to internal personnel through internal communications, and externally through publishing of the policy on IIT’s website and other relevant documentation (such as our Student Information Guide) for clients.

Australian Privacy Principle 2 – Anonymity and pseudonymity

IIT provides individuals with the option of not identifying themselves, or of using a pseudonym, when dealing with us in relation to a particular matter, whenever practical. This includes providing options for anonymous dealings in cases of general course enquiries or other situations in which an individuals’ information is not required to complete a request.

Individuals may deal with us by using a name, term or descriptor that is different to the individual’s actual name wherever possible. This includes using generic email addresses that do not contain an individual’s actual name, when individuals access enquiry forms they are not required to provide their full name or contact number.

IIT only stores and links pseudonyms to individual personal information in cases where this is required for service delivery (such as system login information) or once the individual’s consent has been received.

Individuals are advised of their opportunity to deal anonymously or by pseudonym with us where these options are possible.

Requiring identification

IIT must require and confirm identification in service delivery to individuals for nationally recognised course programs. We are authorised by Australian law to deal only with individuals who have appropriately identified themselves. That is, it is a Condition of Registration for all RTOs under the National Vocational Education and Training Regulator Act 2011 that we identify individuals and their specific individual needs on commencement of service delivery, and collect and disclose Australian Vocational Education and Training Management of Information Statistical Standard (AVETMISS) data on all individuals enrolled in nationally recognised training programs. Other legal requirements, as noted earlier in this policy, also require considerable identification arrangements.

There are also other occasions within our service delivery where an individual may not have the option of dealing anonymously or by pseudonym, as identification is practically required for us to effectively support an individual’s request or need.

Australian Privacy Principle 3 — Collection of solicited personal information

IIT only collects personal information that is reasonably necessary for our business activities.

We only collect sensitive information in cases where the individual consents to the sensitive information being collected, except in cases where we are required to collect this information by law, such as outlined earlier in this policy.

All information we collect is collected only by lawful and fair means.

We only collect solicited information directly from the individual concerned, unless it is unreasonable or impracticable for the personal information to only be collected in this manner.

Australian Privacy Principle 4 – Dealing with unsolicited personal information

IIT may from time to time receive unsolicited personal information. Where this occurs we promptly review the information to decide whether or not we could have collected the information for the purpose of our business activities. Where this is the case, we may hold, use and disclose the information appropriately as per the practices outlined in this policy.

Where we could not have collected this information (by law or for a valid business purpose) we immediately destroy or de-identify the information (unless it would be unlawful to do so).

Australian Privacy Principle 5 – Notification of the collection of personal information

Whenever IIT collects personal information about an individual, we take reasonable steps to notify the individual of the details of the information collection or otherwise ensure the individual is aware of those matters. This notification occurs at or before the time of collection, or as soon as practicable afterwards. (Such as reference to Privacy Policies upon collection of data on enrolment forms or online enquiry forms)

Our notifications to individuals on data collection include:

• IIT’s identity and contact details, including the position title, telephone number and email address of a contact who handles enquiries and requests relating to privacy matters;
• If the collection is required or authorised by law, including the name of the Australian law or other legal agreement requiring the collection;
• The purpose of collection, including any primary and secondary purposes;
• The consequences for the individual if all or some personal information is not collected;
• Other organisations or persons to which the information is usually disclosed, including naming those parties;
• Whether we are likely to disclose the personal information to overseas recipients, and if so, the names of the recipients and the countries in which such recipients are located.
• A link to this APP Privacy Policy on our website or explain how it may be accessed; and
• Advice that this APP Privacy Policy contains information about how the individual may access and seek correction of the personal information held by us; and how to complain about a breach of the APPs, or any registered APP code, and how we will deal with such a complaint.

Where possible, we ensure that the individual confirms their understanding of these details, such as through signed declarations on enrolment forms, or website form acceptance of details.

Collection from third parties

IIT generally collect information directly from individuals, however where IIT collects personal information from another organisation, we:

1. Confirm whether the other organisation has provided the relevant notice above to the individual; or
2. Whether the individual was otherwise aware of these details at the time of collection; and
3. If this has not occurred, we will undertake this notice to ensure the individual is fully informed of the information collection.

Australian Privacy Principle 6 – Use or disclosure of personal information

IIT only uses or discloses personal information it holds about an individual for the particular primary purposes for which the information was collected, or secondary purposes in cases where:

• An individual consented to a secondary use or disclosure;
• An individual would reasonably expect the secondary use or disclosure, and that is directly related to the primary purpose of collection; or
• Using or disclosing the information is required or authorised by law.

At times IIT use personal information collected for internal marketing purposes. Contact emails are used but not disclosed to other recipients. Individuals have the option of opting out from marketing at the time of enrolment, or from any received marketing emails.

Requirement to make a written note of use or disclosure for this secondary purpose

If IIT uses or discloses personal information in accordance with an ‘enforcement related activity’ we will make a written note of the use or disclosure, including the following details:

• The date of the use or disclosure;
• Details of the personal information that was used or disclosed;
• The enforcement body conducting the enforcement related activity;
• If the organisation used the information, how the information was used by the organisation;
• The basis for our reasonable belief that we were required to disclose the information.

Australian Privacy Principle 7 – Direct marketing

IIT does not engage with any third parties to undertake direct marketing.

IIT does not use or disclose the personal information that it holds about an individual for the purpose of direct marketing, unless:

• The personal information has been collected directly from an individual, and the individual would reasonably expect their personal information to be used for the purpose of direct marketing; or
• The personal information has been collected from a third party, or from the individual directly, but the individual does not have a reasonable expectation that their personal information will be used for the purpose of direct marketing; and
• We provide a simple method for the individual to request not to receive direct marketing communications (also known as ‘opting out’).

On each of our direct marketing communications, IIT provides a statement that the individual may request to opt out of future communications, and how to do so. We comply with any request by an individual promptly and undertake any required actions for free.

An individual may also request us at any stage not to use or disclose their personal information for the purpose of direct marketing. We comply with any request by an individual promptly and undertake any required actions for free.

We also, on request, notify an individual of our source of their personal information used or disclosed for the purpose of direct marketing unless it is unreasonable or impracticable to do so.

Australian Privacy Principle 8 – Cross-border disclosure of personal information

IIT does not disclose personal information about an individual to any overseas recipient.

Australian Privacy Principle 9 – Adoption, use or disclosure of government related identifiers

IIT does not adopt, use or disclose a government related identifier related to an individual except:

• In situations required by Australian law or other legal requirements;
• Where reasonably necessary to verify the identity of the individual;
• Where reasonably necessary to fulfil obligations to an agency or a State or Territory authority; or
• As prescribed by regulations.

Australian Privacy Principle 10 – Quality of personal information

IIT takes reasonable steps to ensure that the personal information it collects is accurate, up-to-date and complete. We also take reasonable steps to ensure that the personal information we use or disclose is, having regard to the purpose of the use or disclosure, accurate, up-to-date, complete and relevant. This is particularly important where:

• When we initially collect the personal information; and
• When we use or disclose personal information.

We take steps to ensure personal information is factually correct. In cases of an opinion, we ensure information takes into account competing facts and views and makes an informed assessment, providing it is clear this is an opinion. Information is confirmed up-to-date at the point in time to which the personal information relates.

Quality measures in place supporting these requirements include:

• Internal practices, procedures and systems to audit, monitor, identify and correct poor quality personal information (including training staff in these practices, procedures and systems);
• Protocols that ensure personal information is collected and recorded in a consistent format, from a primary information source when possible;
• Ensuring updated or new personal information is promptly added to relevant existing records;
• Providing individuals within their enrolment details with a simple means to review and update their information on an on-going basis by contacting a member of the Enrolments Team;
• Reminding individuals to update their personal information at critical service delivery points (such as completion) when we engage with the individual;
• Contacting individuals to verify the quality of personal information where appropriate when it is about to be used or disclosed, particularly if there has been a lengthy period since collection (such as new forms for re-enrolment); and
• Checking that a third party, from whom personal information is collected, has implemented appropriate data quality practices, procedures and systems.

Australian Privacy Principle 11 — Security of personal information

IIT takes active measures to consider whether we are able to retain personal information we hold, and also to ensure the security of personal information we hold. This includes reasonable steps to protect the information from misuse, interference and loss, as well as unauthorised access, modification or disclosure.

We destroy or de-identify personal information held once the information is no longer needed for any purpose for which the information may be legally used or disclosed.

Access to IIT offices and work areas is limited to our personnel only – visitors to our premises must be authorised by relevant personnel and are accompanied at all times. With regard to any information in a paper based form, we maintain storage of records in an appropriately secure place to which only authorised individuals have access.

IIT personnel are provided with training and information on privacy issues, and how the APPs apply to our practices, procedures and systems. Training is also included in our personnel induction practices.

We conduct ongoing internal audits (at least annually and as needed) of the adequacy and currency of security and access practices, procedures and systems implemented.

Australian Privacy Principle 12 — Access to personal information

Where IIT holds personal information about an individual, we provide that individual access to the information on their request. In processing requests, we:

• Require the individual to submit a Third Party Access to Student Files Authorisation Form (available via IIT website or upon request)
• Ensure through confirmation of identity that the request is made by the individual concerned, or by another person who is authorised to make a request on their behalf;
• Respond to a request for access:
  • Within 14 calendar days, when notifying our refusal to give access, including providing reasons for refusal in writing, and the complaint mechanisms available to the individual; or
  • Within 30 calendar days, by giving access to the personal information that is requested in the manner in which it was requested.
• Provide information access free of charge.

Australian Privacy Principle 13 – Correction of personal information

IIT takes reasonable steps to correct personal information we hold, to ensure it is accurate, up-to-date, complete, relevant and not misleading, having regard to the purpose for which it is held.  No fees or levies are charged for changes to personal information.

Individual Requests

On an individual’s request, we:

• Correct personal information held; and
• Notify any third parties of corrections made to personal information, if this information was previously provided to these parties.

In cases where we refuse to update personal information, we:

• Give a written notice to the individual, including the reasons for the refusal and the complaint mechanisms available to the individual;
• Upon request by the individual whose correction request has been refused, take reasonable steps to associate a statement with the personal information that the individual believes it to be inaccurate, out-of-date, incomplete, irrelevant or misleading;
• Respond within 14 calendar days to these requests; and
• Complete all actions free of charge.

Correcting at IIT’s initiative

We take reasonable steps to correct personal information we hold in cases where we are satisfied that the personal information held is inaccurate, out-of-date, incomplete, irrelevant or misleading (that is, the information is faulty). This awareness may occur through collection of updated information, in notification from third parties or through other means.