Last updated on 01/06/2018
We are committed to complying with our privacy obligations in accordance with all applicable data protection laws, including the Australian Privacy Principles contained in Schedule 1 to the Privacy Act 1988 (Cth) (the “Privacy Act“). We comply with the EU General Data Protection Regulation (“GDPR“) to the extent it applies to the personal data that we collect, hold, disclose and otherwise process (“GDPR Data“).
The Privacy Act defines “personal information” as information or an opinion about an identified individual, or an individual who is reasonably identifiable (a) whether the information or opinion is true or not; and
(b) whether the information or opinion is recorded in a material form or not. Section 187LA of the Telecommunications (Interception and Access) Act 1979 extends the meaning of personal information to cover information kept under Part 5‑1A of that Act.
Article 4(1) of the GDPR defines “personal data” as any information relating to an identified or identifiable natural person (‘data subject’); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person.
Our policy is to minimise the amount of personal data we collect. Accordingly, we only collect personal data that is adequate, relevant and limited to what is necessary for the purpose for which it is to be processed and only where we are entitled by law to collect it. We may also use collected personal data for other related, directly related or compatible purposes (if and where permitted by applicable law).
We collect names, gender, job titles, telephone numbers, mobile phone numbers, email addresses, occupation, credit card details, tax file numbers, bank account details, records of products and services supplied to a person, postal addresses, residential addresses, business addresses, information contained in resumes and employment records such as employment history, education, qualifications, medical certificates, academic transcripts, salary details, superannuation account detail, and criminal record personal data contained in comments and feedback, personal preferences,. We will process this personal data in order to administer our client, employment and business relationships, to answer questions about and to provide and manage our services, and to otherwise enforce our rights and comply with our obligations.
In the course of providing our services we may host client databases or content specifically at the request of our clients, that our clients have provided to us. These databases and content may include any type of personal data.
When providing our managed services, we may monitor or access our clients’ computer, network and other equipment remotely or on site. In the course of doing so, we will collect and process information about that equipment and any software and data processed by that equipment. This information includes IP addresses, server names, database names, network names, serial numbers of equipment used, Wi-Fi passwords, computer names, application names, browser history, user access logs, usernames, passwords, technical support log tickets, bandwidth used, error messages, social media handles, FTP server addresses, usernames and passwords, hostnames, subnet masks, router names, server addresses, hosting account usernames and passwords.
Subject to applicable laws, we may carry out electronic surveillance of our employees and contractors when they use our computer equipment, smartphone devices and networks to monitor compliance with company policies (including our Corporate IT Systems and Social Media Policy). This surveillance includes tracking and monitoring, reviewing and logging emails sent and received, websites visited, content viewed and files uploaded/downloaded. It also includes IP addresses, server names, database names, network names, serial numbers of equipment used, Wi-Fi passwords, computer names, application names, browser history, user access logs, usernames, passwords, technical support log tickets, bandwidth used, error messages, social media handles, FTP server addresses, usernames and passwords, hostnames, subnet masks, router names, server addresses, hosting account usernames and passwords.
We collect personal data of:
We collect personal data in the following ways:
We hold personal data that we collect in our offices, computer systems, and third party owned and operated hosting facilities. We use personal data for the following purposes:
We will only disclose personal data that we collect to third parties as follows:
we store backup copies of our computer files, software and databases in the cloud with our hosting providers who host those files, and that software and databases (including any personal data contained in them) on our third-party hosting providers’ computer servers located in their data centres;
where necessary or practical to do so for the purposes of providing services to our clients or for the purposes of operating our business, we hold our clients’ databases and content (including any personal data contained in them) on third party computer servers in the data centres of our hosting providers;
for example, we may need to supply your name to the professional advisors of other parties who you are dealing with (or any regulator) where we agree to represent you or provide you with services with regards to any matter, including but not limited to, where a client authorises us to do so we may need to provide the client’s personal data to its agents or other professional advisors;
we may appoint resellers, distributors, agents and channel partners to sell our products and services, or to manage parts of our business for us. In the course of those relationships, we may provide client or potential client personal data to them, or they may provide client or potential client personal data to us that they have collected for us;
with the provision of our services – in which case we may disclose your personal data to our suppliers and subcontractors as well as to members of our corporate group who we may subcontract the provision of all or part of our services to. For example, we may use printing providers who print documents on our behalf, couriers who deliver documents on our behalf which contain personal data, and share computers which contain personal data with our related bodies corporate;
in which case we may disclose your personal data to our marketing suppliers;
in which case we may disclose your personal data to our insurers, lawyers, accountants and other professional advisors;
in which case we may disclose your personal data to our email and newsletter service providers;
when we are contacted with questions or concerns regarding the products and services that we provide;
in which case we will provide client bank account, cheques and credit card details to our bank and merchant facility providers;
when providing information to our legal, accounting or financial advisors/representatives or debt collectors for debt collection purposes or when we need to obtain their advice, or where we require their representation in relation to a legal dispute;
with another entity – in which case we will provide to the purchaser or other entity the personal data that is the subject of the sale or merger;
of his or her personal data;
We may also provide your personal data to our lawyers, insurers and professional advisors and any court or administrative body, for one or more of the following purposes:
Since 22 February 2018, data breaches that are likely to result in serious harm must be reported to affected individuals and the Office of the Australian Information Commissioner (OAIC), except where limited exceptions apply. For the purposes of the GDPR, certain types of data breaches must also be reported to affected individuals if the breach is likely to result in a high risk of adversely affecting individuals’ rights and freedoms. In addition, the GDPR requires organisations to report certain types of data breaches to the relevant supervisory authority. We will notify affected individuals, the OAIC and relevant supervisory authorities of any data breach where we are required to do so in accordance with our legal obligations.
We do not use automated-decision making in our business.
Our websites may include links to third party websites and platforms. Our linking to those websites and platforms does not mean that we endorse or recommend them. We do not warrant or represent that any third-party website or platform operators comply with applicable data protection laws. You should consider the privacy policies of any relevant third-party websites and platforms prior to sending your personal data to them.
You may interact with social media platforms via social media widgets and tools such as the Facebook Like button and the Facebook pixel that may be installed on our websites. These widgets and tools may collect your IP address and other personal data. Your interaction with such widgets and tools, and any single sign-on services such as Open ID is governed by the privacy policies of the relevant social media operators and single sign-on service providers – please read them so that you are aware of how they process your personal data.
We take reasonable steps to protect personal data that we hold from unauthorised access, modification and disclosure and implement technical and organisational measures to ensure a level of protection appropriate to the risk of accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to personal data transmitted, stored or otherwise processed, as follows:
We do not send “junk” or unsolicited e-mail in contravention of the Spam Act 2003 (Cth). We will, however, use e-mail in some cases to respond to inquiries, confirm purchases, or contact clients. These transaction-based e-mails are automatically generated. Anytime a client or visitor receives e-mail it does not want from us they can request that we not send further e-mail by contacting us via email at: firstname.lastname@example.org or using any ‘unsubscribe’ tool contained in any communication we send. Upon receipt of any such request, we will ensure that they cease to receive automated emails from us.
We may transfer your personal data to our contractors and service providers who assist us with providing our products and services to you, and to assist us with the operation of our business generally, where we consider it necessary for them to provide that assistance.
Provided that we comply with applicable law, including the provisions of Australian Privacy Principle 8 (Cross-border disclosure of personal information), and the GDPR – in relation to GDPR Data, we may transfer your personal data to our offshore contractors and service providers as well, who may be located outside the European Union (EU) or the European Economic Area (EEA). At present, we do not transfer personal data out of Australia.
We will only engage new third parties to process GDPR Data that you instruct us to process as a processor on your behalf if you have authorised us to do so pursuant to a specific or general written authorisation and otherwise in compliance with the requirements of the GDPR.
It is our policy to retain personal data in a form which permits identification of any person only as long as is necessary for the purposes for which the personal data was collected; and for any other related, directly related or compatible purposes if and where permitted by applicable law. We will only process personal data that you provide to us for the minimum length of time permitted by applicable law and only thereafter for the purposes of deleting or returning that personal data to you (except where we also need to retain the data in order to comply with our legal obligations, or to retain the data to protect your or any other person’s vital interests). Where you require personal data to be returned, it will be returned to you at that time, and we will thereafter delete all then remaining existing copies of that personal data in our possession or control as soon as reasonably practicable thereafter, unless applicable law requires us to retain the personal data in which case we will notify you of that requirement and only use such retained data for the purposes of complying with those applicable laws.
Under the GDPR, you have a number of rights, including:
Please contact us if you wish to exercise any of your rights under the GDPR. We will handle all such requests in accordance with our legal obligations. If you withdraw your consent for processing, object to the processing of your personal data or request us to erase your personal data and as a result it is not possible or practical for us to continue providing you with our services, we may elect to terminate our business relationship with you.
We are XCentral Holdings Pty Ltd ABN 18 621 200 548 of 2.2/394 Lane Cove Rd, Macquarie Park, NSW, 2113. If you wish to contact us for any reason regarding our privacy practices or the personal data that we hold about you, please contact us at the following address:
To: XCentral Privacy Officer
Contact Us: Contact Form
Address: 2.2/394 Lane Cove Rd, Macquarie Park, NSW, 2113
Call: 1300 881 113
We will use our best endeavours to resolve any privacy complaint within ten (10) business days following receipt of your complaint. This may include working with you on a collaborative basis to resolve the complaint or us proposing options for resolution.
If you are not satisfied with the outcome of a complaint or you with to make a complaint about a breach of the Australian Privacy Principles you make refer the complaint to the Office of the Australian Information Commissioner (OAIC) who can be contacted using the following details:
Call: 1300 363 992
Address: GPO Box 5218, Sydney NSW 2001
In relation to GDPR Data, you may lodge a complaint with any relevant supervisory authority