It is a policy of Riverside Ski Park that any personal information collected by it is properly managed and protected from misuse. Riverside Ski Park is therefore committed to ensuring that it fulfils its obligations under the Privacy Act 1988 (Cth) and the National Privacy Principles when dealing with the personal information of our customers, employees and contractors. This policy sets out how Riverside Ski Park will manage personal information it collects and uses in the course of business.
Aims and Objectives
Riverside Ski Park will not collect personal information unless the information is necessary for one or more of its functions or activities.
Riverside Ski Park will only collect personal information by lawful and fair means and will not do so in an unreasonably intrusive way.
When collecting personal information from an individual, Riverside Ski Park will take all reasonable steps to ensure that the individual is aware of:
- the identity of Riverside Ski Park and how to contact us;
- the fact that the individual is able to gain access to the information;
- the purposes for which the information is collected;
- the organisations to which Riverside Ski Park usually discloses information;
- any law that requires particular information to be collected; and
- the main consequences (if any) for the individual if all or part of the information is not provided.
When reasonable and practicable to do so, Riverside Ski Park will only collect personal information about an individual from that individual.
If we collect personal information about an individual from someone else, Riverside Ski Park will take all reasonable steps to ensure that the individual is or has been made aware of the matters listed in (a) – (f) above, except where making the individual aware of these matters would pose a serious threat to the life or health of any individual.
Use and Disclosure
Riverside Ski Park will only use or disclose personal information about an individual for the purpose of providing its goods and services to the individual (“primary purpose”).
However, Riverside Ski Park may also use or disclose personal information about an individual where such use or disclosure arises in the context of Riverside Ski Park providing its goods and services to the individual (“secondary purpose”). In such cases, Riverside Ski Park will take all reasonable steps to ensure that such use or disclosure aligns with all requirements of National Privacy Principle 2.
Riverside Ski Park will take all reasonable steps to make sure that the personal information it collects, uses or discloses is accurate, complete and up-to-date.
Riverside Ski Park will take all reasonable steps to protect the personal information it holds from misuse and loss and from unauthorised access, modification or disclosure.
Riverside Ski Park will take all reasonable steps to destroy or permanently de-identify personal information if it is no longer needed for any purpose for which the information may be used or disclosed under National Privacy Principle 2.
On request by a person, Riverside Ski Park will take all reasonable steps to let the person know, generally, what sort of personal information it holds, for what purposes, and how it collects, holds, uses and discloses that information.
Access and Correction
If Riverside Ski Park holds personal information about an individual, Riverside Ski Park will provide the individual with access to the information on request, except to the extent that:
- in the case of personal information other than health information, providing access would pose a serious and imminent threat to the life or health of any individual; or
- in the case of health information, providing access would pose a serious threat to the life or health of any individual; or
- providing access would have an unreasonable impact upon the privacy of other individuals; or
- the request for access is frivolous or vexatious; or
- the information relates to existing or anticipated legal proceedings between Riverside Ski Park and the individual, and the information would not be accessible by the process of discovery in those proceedings; or
- providing access would reveal the intentions of Riverside Ski Park in relation to negotiations with the individual in such a way as to prejudice those negotiations; or
- providing access would be unlawful; or
- denying access is required or authorised by or under law; or
- providing access would be likely to prejudice an investigation of possible unlawful activity; or
- providing access would be likely to prejudice:
- the prevention, detection, investigation, prosecution or punishment of criminal offences, breaches of a law imposing a penalty or sanction or breaches of a prescribed law; or
- the enforcement of laws relating to the confiscation of the proceeds of crime; or
- the protection of the public revenue; or
- the prevention, detection, investigation or remedying of seriously improper conduct or prescribed conduct; or
- the preparation for, or conduct of, proceedings before any court or tribunal, or implementation of its orders;
by or on behalf of an enforcement body; or
- an enforcement body performing a lawful security function asks Riverside Ski Park not to provide access to the information on the basis that providing access would be likely to cause damage to the security of Australia.
However, where providing access would reveal evaluative information generated within Riverside Ski Park in connection with a commercially sensitive decision-making process, Riverside Ski Park may give the individual an explanation for the commercially sensitive decision rather than direct access to the information.
If Riverside Ski Park is not required to provide the individual with access to the information because of one or more of paragraphs (a) to (k) above Riverside Ski Park will, if reasonable, consider whether the use of mutually agreed intermediaries would allow sufficient access to meet the needs of both parties.
Riverside Ski Park may charge for providing access to personal information. If charges do apply, they will be limited to the costs incurred by Riverside Ski Park in providing that personal information.
If an individual is able to establish that personal information held by Riverside Ski Park is not accurate, complete and up-to-date, Riverside Ski Park will take all reasonable steps to correct the information so that it is accurate, complete and up-to-date.
Where an individual and Riverside Ski Park disagree about whether personal information is accurate, complete and up-to-date Riverside Ski Park will, on request by the individual, associate with the information a statement claiming that the information is not accurate, complete or up-to-date.
If Riverside Ski Park denies access to, or refuses correction of, personal information it holds about an individual Riverside Ski Park will provide that individual with reasons.
When identifying an individual, Riverside Ski Park will not adopt as its own identifier an identifier of the individual that has been assigned by government agency, agents of or service providers to government agencies or any another organisation, i.e. drivers licence numbers, Medicare numbers, etc.
Riverside Ski Park will not use or disclose an identifier assigned to an individual as described above except in accordance with National Privacy Principle 7.
Wherever it is lawful and practicable, individuals have the option of not identifying themselves when entering transactions with Riverside Ski Park.
Transborder Data Flows
Riverside Ski Park may transfer personal information about an individual to someone (other than Riverside Ski Park or the individual) who is in a foreign country only if:
- Riverside Ski Park reasonably believes that the recipient of the information is subject to a law, binding scheme or contract which effectively upholds principles for fair handling of the information that are substantially similar to the National Privacy Principles; or
- the individual consents to the transfer; or
- the transfer is necessary for the performance of a contract between the individual and Riverside Ski Park or for the implementation of pre-contractual measures taken in response to the individual’s request; or
- the transfer is necessary for the conclusion or performance of a contract concluded in the interest of the individual between Riverside Ski Park and a third party; or
- all of the following apply:
- the transfer is for the benefit of the individual;
- it is impracticable to obtain the consent of the individual to that transfer;
- if it were practicable to obtain such consent, the individual would be likely to give it; or
- Riverside Ski Park has taken reasonable steps to ensure that the information which it has transferred will not be held, used or disclosed by the recipient of the information inconsistently with the National Privacy Principles.
Riverside Ski Park will not collect sensitive information about an individual unless:
- the individual has consented; or
- the collection is required by law; or
- the collection is necessary to prevent or lessen a
serious and imminent threat to the life or health of any individual, where the
individual whom the information concerns:
- is physically or legally incapable of giving consent to the collection; or
- physically cannot communicate consent to the collection; or
- the collection is necessary for the establishment, exercise or defence of a legal or equitable claim.
This policy applies to:
- Riverside Ski Park and its directors, officers and managers;
- all employees, trainees, volunteers, outworkers, apprentices and work experience students of Riverside Ski Park, collectively referred to as “employees”;
- all contractors, and employees of contractors, performing work within Riverside Ski Park at the direction of, or on behalf of, Riverside Ski Park; and
- all of Riverside Ski Park’s workplaces and other places where employees or contractors of Riverside Ski Park may be working for or representing Riverside Ski Park.
Responsibilities of Employees and Contractors
At all times all employees and contractors are required to:
- understand and comply with this Policy;
- ensure they do not engage in, aid or abet, any conduct in breach of this Policy or is otherwise unlawful;
- report to Riverside Ski Park all incidents of conduct in breach of this Policy or otherwise unlawful that they witness occurring as soon as possible.
Breach of this Policy
If an employee breaches this Policy they may be subject to disciplinary action which, in serious cases, may lead to termination of employment. Contractors who breach this Policy may have their contracts terminated and visitors who breach this Policy may be asked to leave Riverside Ski Park immediately.
Process for Access
An individual may obtain access to their personal information by sending a written request to Riverside Ski Park. If granting access is straightforward, Riverside Ski Park will take all steps to grant access within 14 days of receipt of that written request. If, granting access is more complicated, Riverside Ski Park will take all steps to grant access within 30 days of receipt of that written request.
“Personal Information” means information or an opinion (including information or an opinion forming part of a database), whether true or not, and whether recorded in a material form or not, about an individual whose identity is apparent, or can reasonably be ascertained, from the information or opinion.
“Sensitive information” means:
(a) information or an opinion about an individual’s:
(i) racial or ethnic origin; or
(ii) political opinions; or
(iii) membership of a political association; or
(iv) religious beliefs or affiliations; or
(v) philosophical beliefs; or
(vi) membership of a professional or trade association; or
(vii) membership of a trade union; or
(viii) sexual preferences or practices; or
(ix) criminal record;
that is also personal information; or
(b) health information about an individual; or
(c) genetic information about an individual that is not otherwise health information.