Tabcorp Park Privacy Policy (TP-LRC-PO-004)
- INTRODUCTION
The handling of personal information is a key aspect of corporate governance. Tabcorp Park is strongly committed to protecting the rights of individuals and complying with its obligations under the Privacy Act 1988 (Cth) the (” Privacy Act”) and the Australian Privacy Principles (“APP”). Tabcorp Park has adopted this Privacy Policy to affirm its commitment to protecting the privacy of the people from whom it collects personal information. The core requirements of the Privacy Act are embedded within the APP’s. The APPs set out how organisations must collect, use, keep secure and disclose personal information.
- PURPOSE
The purpose of this policy is to inform individuals regarding Tabcorp Park’s privacy obligations and commitments, and to outline the principles relating to:
• Responsible collection and management of personal information;
• Providing individuals with the right to access the information Tabcorp Park holds about them;
• Handling queries and complaints about privacy; and
• Ensuring that there is a balance between the free flow of information and the requirement to protect the privacy of personal information, that is always in the best public interest.
Tabcorp Park’s handling of personal information is regulated by the Office of the Australian Information Commissioner (“OAIC”).
- SCOPE
This policy covers all personal and sensitive information collected and held by Tabcorp Park as defined by the Privacy Act, and where applicable, the Health Records Act 2001 (Vic). The handling of employee records is exempt from the Privacy Act if it directly relates to current and former employment relationships, therefore areas of this policy may not be applicable to employee records.
The policy applies to Tabcorp Park employees, advisory committees, contractors, and representatives.
- RESPONSIBILITIES
Tabcorp Park personnel should familiarise themselves with this Policy and ensure that they exercise appropriate due diligence in carrying out their required responsibilities. Such responsibilities are consistent with the obligations that legislation places on officers, managers, supervisors, workers and others in the workplace in relation to privacy.
- PRIVACY PRINCIPLES
5.1 COLLECTING PERSONAL OR SENSITIVE INFORMATION
Tabcorp Park only collects personal information that is necessary to perform its core functions and activities. Tabcorp Park collects information about its customers, suppliers, employees and other stakeholders for the purposes of conducting its core business of gaming, hotel and entertainment functions as well as supporting harness racing activities. Tabcorp Park may collect personal and sensitive information. Personal information that Tabcorp Park may collect includes contact information (such as names, address, email address, fax, and telephone number), credit card information, emergency information etc. Tabcorp Park may be required to collect sensitive information in order to conduct its core activities, particularly in relation to criminal history and health information. Personal and sensitive information which is collected by Tabcorp Park will be collected fairly and within lawful means.
Personal and sensitive information may be collected by way of forms filled out by individuals (including online forms), surveys, emails, telephone conversations, online user-generated content and market research, face to face meetings, interviews and surveillance.
Personal information may be collected via solicited or unsolicited means.
Solicited personal information is information which is explicitly requested by another entity to provide personal information or where Tabcorp Park takes active steps to collect that personal information (i.e. – directly from the individuals involved). Examples of solicited information that Tabcorp Park may collect include (but is not limited to):
• A completed form or application submitted by an individual;
• Complaints received via Tabcorp Park’s website;
• An employment application sent to Tabcorp Park in response to a job advertisement;
• A form completed to enter a competition being conducted by Tabcorp Park;
• Personal information provided regarding fraud or whistleblowing matters;
• Records within Tabcorp Park’s visitors book;
• A record of a credit card payment, hotel and function bookings; and
• CCTV footage that identifies individuals.
Unsolicited personal information is information that is received by Tabcorp Park that was not requested directly by Tabcorp Park. If Tabcorp Park receives personal information about an individual in circumstances where it did not solicit the information, Tabcorp Park will (within a reasonable period after receiving the information), determine whether or not it would have been entitled to collect such information having regard to its functions and activities. If Tabcorp Park determines that it is not entitled to such information, Tabcorp Park will destroy the information or ensure that the information is de-identified.
Generally, individuals have the option of dealing with Tabcorp Park anonymously or using a pseudonym, such as when making a general inquiry regarding Tabcorp Park functions or activities. However, it may be impracticable for Tabcorp Park to deal with individuals in that way in other circumstances or Tabcorp Park may be required or authorised by law to know a person’s identity in order to perform its functions.
Tabcorp Park generally collects personal information directly from individuals; however, in some circumstances personal information may be collected about individuals from other persons, including:
• Where the information is obtainable from a publicly-available source (e.g. – by way of a company search); and/or
• Where it is unreasonable or impracticable to collect the information from the individual, for example, a medical opinion.
5.2 USE AND DISCLOSURE OF PERSONAL INFORMATION
Tabcorp Park may use or disclose personal information about individuals for the primary purpose in which it was collected, or for reasonably expected secondary purposes which are related to the primary purpose, or for purposes which individuals; have consented or otherwise permitted under the Privacy Act or required under law.
Generally, Tabcorp Park may use and disclose personal information for a range of purposes, including (but not limited) to:
• Provide individuals products and services that have been requested;
• Respond to queries or feedback;
• Analyse and improve all aspects of Tabcorp Park’s business, including, but not limited its product offering, or business systems, processes, outcomes, communication, website, engagement and performance;
• Provide communications or publications in which might be of interested, or for which individuals have requested; and
• Consider employment applications.
Tabcorp Park may disclose personal information to a related party such as Harness Racing Victoria or third parties authorised to carry out functions on behalf of Tabcorp Park if necessary. Before Tabcorp Park discloses personal information to a third party, it will take steps as are reasonable in the circumstances to ensure that the third party does not breach the APP’s in relation to the information.
5.3 DIRECT MARKETING
Tabcorp Park may use personal information to send marketing and promotional information by post, mail, social media or telephone including SMS. Individuals can opt-out of receiving direct marketing communications at any time. Where individuals do not opt-out, Tabcorp Park assumes it has ongoing consent to send information and communications.
5.4 CROSS-BORDER DISCLOSURE OF PERSONAL INFORMATION
There may be circumstances where Tabcorp Park may be required to disclose personal information about individuals to an overseas recipient (for example, where data is stored in a cloud that is not located in Australia). Where disclosures to overseas recipients are necessary, Tabcorp Park will take steps as are reasonable in the circumstances to ensure that the overseas recipient complies with the APP’s.
5.5 QUALITY OF PERSONAL INFORMATION
Tabcorp Park will take reasonable steps to ensure that the personal information it collects, uses or discloses is accurate, up to date and complete. To ensure that the personal information Tabcorp Park collects about you is up-to-date and complete we:
• Record information in a consistent format;
• Where necessary, confirm the accuracy of information we collect from a third party or public source;
• Promptly add updated or new personal information to existing records;
• Regularly audit our contact lists to check their accuracy.
We also review the quality of personal information before we use or disclose it.
5.6 STORAGE AND SECURITY OF PERSONAL INFORMATION
Tabcorp Park will take reasonable steps to protect the personal information it holds against interference, loss, unauthorised access, use, modification or disclosure, and other misuse. These steps include password protections for accessing electronic IT systems, securing paper files in locked cabinets, and physical access restrictions. Any personal information no longer required will be destroyed in accordance with legislation.
5.7 ACCESS AND CORRECTION
Individuals may request access to the personal information Tabcorp Park holds about them, or requests that Tabcorp Park change personal information that needs to be updated. Tabcorp Park will allow access or make the requested changes except where the law does not permit us to provide access or make the changes requested. If Tabcorp Park denies access or refuses to correct personal information, Tabcorp Park will provide written notice detailing the reasons for the refusal and the mechanisms available should the individual wish to make a complaint.
Only the individual or another person authorised by that individual, such as a legal guardian or authorised agent can make a request to access or change personal details. Tabcorp Park has a verification process which will be exercised prior to the provision of the request to access or change personal information held.
If personal information has previously been supplied to a third party and an individual requests us to notify the third party of the correction, Tabcorp Park will take such steps as are reasonable to give that notification unless impracticable or unlawful to do so.
5.8 COMPLIANTS AND QUERIES
Individuals can obtain further information in relation to this Privacy Policy or provide comments or complaints by either contacting Tabcorp’s Privacy Officer by telephone, email or post via the contact details provided below.
Email privacyofficer@hrv.org.au
Telephone (03) 83780200
Post 400 Epsom Road
Flemington, VIC 3031
