New Zealand Privacy Statement
Kooyoora Ltd is committed to providing best-practice services to you. This privacy statement outlines our ongoing obligations to you in respect of how we manage your Personal Information and Health Information.
Kooyoora Ltd is required to comply with a number of privacy laws operating throughout Australia and New Zealand, including the Privacy Act 2020 (NZ) and the Health Information Privacy Code 2020 (NZ). These laws regulate how personal information is handled throughout its life cycle, from collection to use and disclosure, storage, accessibility and disposal.
This statement applies to any Personal Information or Health Information that a person provides to Kooyoora Ltd.
When Does Kooyoora Collect Information?
Kooyoora collects Personal Information and Health Information when providing the following services:
Complaint Management and Investigations
Person of Concern Management
Administration and Management of Redress Schemes
Clearance or Employment Screening Processes
Training
More information about our work is available at:
What Is Personal Information and How and Why Do We Collect It?
Under the Privacy Act, Personal Information means information about an identifiable individual and includes information relating to a death that is maintained by the Registrar-General under the Births, Deaths, Marriages, and Relationships Registration Act 2021 or any former Act.
Examples of Personal Information we collect include:
Names
Dates of birth
Addresses
Email addresses
Phone numbers
This Personal Information is obtained in many ways, including through:
Interviews and discussions
Correspondence
Redress applications
Complaint forms
Clearance applications
Telephone contact
Email correspondence
Postal correspondence
Our website
Your website
Media and publications
Publicly available sources
Cookies
Third parties
We collect your Personal Information for the primary purpose of providing services to you and our client organisations, performing service agreements, and marketing activities where specific or reasonably inferred consent has been provided.
We may also use your Personal Information for other purposes directly related to the primary purpose where you would reasonably expect such use or disclosure, and for other purposes authorised or consented to by you or required by law.
Examples include:
Verifying your identity
Improving the services we provide
Complying with legal obligations
By using our services, you consent to the Personal Information submitted by you, or with your authorisation, being collected, stored, used and disclosed for the purposes outlined in this statement and for any other purpose you authorise.
You may unsubscribe from mailing or marketing communications at any time through the unsubscribe facility included in our communications or by contacting us in writing.
We may, from time to time, provide links to third-party websites as a service to users. If you access a third-party website, this privacy statement does not apply to that site's privacy practices.
We are not responsible for the content, privacy practices or terms of use of third-party websites and make no representations regarding their accuracy, content or completeness. Any disclosure of personal information to third-party websites is at your own risk.
What Is Sensitive Personal Information and Why Do We Collect It?
Sensitive Personal Information may include information or opinions about:
Racial or ethnic origin
Political opinions
Membership of a political association
Religious or philosophical beliefs
Membership of a trade union or professional body
Criminal history
Health information
Types of sensitive personal information we may collect include:
Personal history, health information and the nature and impact of abuse experienced, so that appropriate supports can be provided
Background information, complaint histories, or other information gathered as part of an investigation or screening process
Sensitive Personal Information will only be used:
For the primary purpose for which it was obtained
For another purpose directly related to the primary purpose
With your consent
Where required or authorised by law
An example of a directly related purpose may be where information obtained through screening is required within a complaint management process.
What Is Health Information and How and Why Do We Collect It?
Health Information is defined in the Health Information Privacy Code and includes information about an identifiable individual, including:
Information about the health of that individual, including medical history
Information about any disability the individual has, or has had
Information about health services or disability support services being provided, or previously provided, to the individual
Health Information may be used to assist decision-making regarding:
Fitness assessments
Recovery needs
Wellbeing support
Redress-related processes
Health Information will be collected, used, stored and managed in accordance with the Health Information Privacy Code.
Collection of Personal Information from Third Parties
Where practicable, we will collect your Personal Information and Health Information directly from you.
In some circumstances, information may be provided by client organisations, law enforcement agencies or other third parties.
Examples include:
Evidence obtained during an investigation
Information obtained from other sources for screening purposes
Where appropriate, we will take reasonable steps to ensure you are made aware of information provided by third parties.
Unsolicited Personal Information
If we receive Personal Information that has not been requested, we will assess whether it is reasonably necessary for the administration of Kooyoora and the delivery of our services.
If it is not required and we are not legally required to retain it, we will delete, destroy or de-identify the information as soon as practicable.
Consequences of Not Consenting to the Collection of Your Personal Information
In some circumstances, Kooyoora is authorised or required by law to collect Personal Information.
Examples may include:
Name
Residential address
Date of birth
Information required to meet child safety obligations
Where required by law, we will explain the legal basis upon which information is collected.
If you do not provide required information:
You may be ineligible to hold certain roles, positions or responsibilities
We may be unable to provide services to you
Certain processes may not be able to proceed
Anonymity and the Use of Pseudonyms
You may choose not to identify yourself or may use a pseudonym when dealing with Kooyoora.
In some circumstances, anonymity or the use of pseudonyms may make it impractical for us to provide services.
Examples include:
Employment screening processes
Investigations requiring evidence testing
Complaint processes requiring formal statements
Disclosure of Personal Information
Your Personal Information may be disclosed:
To third parties where you have consented
Where disclosure is necessary to provide our services
To client organisations where required under service arrangements
To businesses that support our operations, including information technology systems and data hosting providers
Where required or authorised by law
We may transfer your information in connection with a sale, merger, consolidation, liquidation, reorganisation or acquisition.
Storage and Security of Personal Information
Your Personal Information is stored in a manner that reasonably protects it from misuse, loss, unauthorised access, use, modification or disclosure.
Kooyoora prioritises information security and undertakes regular cyber security risk assessments. These include planned system testing, the use of two-factor authentication, encryption software and secure information management systems.
Kooyoora's records systems used for complaints, investigations, persons of concern, wellbeing support and redress are supported by security controls including iRAP-assessed systems.
Hard-copy storage facilities are secured through restricted access controls, alarm systems and secure storage arrangements. Some information may be stored off-site in secure facilities.
When Personal Information is no longer required for the purpose for which it was collected, reasonable steps will be taken to destroy or permanently de-identify the information.
Most Personal Information will be retained for a minimum of seven years or longer where required by law.
All Personal Information is stored within Australia, and Kooyoora complies with Australian and New Zealand requirements regarding information management, security and data breaches.
Access to Your Personal Information
You may request access to the Personal Information held about you by contacting Kooyoora in writing.
Access is subject to legal restrictions and exceptions.
Access may be declined where:
Disclosure would pose a serious threat to the life, health or safety of an individual
Disclosure would create a significant likelihood of serious harassment
Disclosure would reveal information about another person who may experience significant distress or harm
Disclosure would likely prejudice the health of the individual concerned
Disclosure would be contrary to the interests of a person under 16 years of age
Disclosure would prejudice safe custody, rehabilitation or lawful processes
Other lawful grounds for refusal apply
Kooyoora will not charge a fee for making an access request but may charge a reasonable administrative fee for providing copies of records.
To protect your privacy, reasonable identification requirements may apply before information is released.
Maintaining the Quality of Your Personal Information
Kooyoora takes reasonable steps to ensure that Personal Information is accurate, complete and up to date.
If you believe information held by Kooyoora is inaccurate or incomplete, please contact us as soon as practicable.
If a requested correction cannot be made, we will provide reasons explaining why the request cannot be granted.
If you wish to correct your Personal Information, please contact us using the details below.
Policy Updates
This privacy statement may be updated from time to time and the current version is available on our website.
Any changes become effective when the updated statement is published.
Your continued use of our services following publication of an updated statement constitutes acceptance of those changes.
If you do not agree with any aspect of an updated statement, you should cease using our services and notify us.
Privacy Policy Enquiries and Complaints
The Privacy Officer
Kooyoora Ltd
PO Box 329
Canterbury VIC 3126 Australia
Email: enquiries@kooyoora.org.au
Phone: +61 1800 135 246
More information on privacy is available from:
Additional Information for Clearances and Employee Screenings
The following information applies in addition to the rest of this privacy statement when Kooyoora is providing clearance or employee screening services.
Why We Collect Information for Screening
Kooyoora collects Personal Information during clearance and employee screening processes to assess suitability for particular roles and responsibilities.
There are a range of requirements that organisations must consider when appointing people to positions of responsibility.
Suitability assessments may include consideration of:
Criminal history information
Child safety concerns
General safety concerns
Risk management considerations
Relevant employment and organisational information
Where concerns are identified during a suitability assessment, Kooyoora will contact the individual to discuss the matter and explain the next steps.