Australian Privacy Act Compliance at Kentico software
At Kentico software, we are dedicated to complying with the Australian Privacy Act 1988 and adhering to the 13 Australian Privacy Principles (APPs). Below is a detailed explanation of each APP and how we ensure compliance.
1. Open and Transparent Management of Personal Information
Definition: This principle requires organizations to manage personal information in an open and transparent way, including having a clear and accessible privacy policy.
How We Meet It: We maintain a comprehensive privacy policy that is easily accessible on our website. This policy outlines how we collect, use, store, and disclose personal information. We regularly review and update this policy to ensure transparency and compliance.
2. Anonymity and Pseudonymity
Definition: Organizations must give individuals the option to remain anonymous or use a pseudonym when interacting with them, unless it is impractical or unlawful to do so.
How We Meet It: We provide options for individuals to engage with our services anonymously or under a pseudonym where feasible. For example, users can browse our website without revealing their identity or can use pseudonyms in initial inquiries.
3. Collection of Solicited Personal Information
Definition: This principle governs the collection of personal information. It requires that only information necessary for the organization’s activities be collected, and it must be done lawfully and fairly.
How We Meet It: We only collect personal information that is essential for delivering our services. We inform individuals about the purpose of collection and ensure that it is done in a fair and lawful manner.
4. Dealing with Unsolicited Personal Information
Definition: Organizations that receive unsolicited personal information must determine if they could have collected it under APP 3. If not, they must destroy or de-identify it.
How We Meet It: If we receive unsolicited personal information, we assess its relevance to our business needs. If it is not needed, we promptly destroy or de-identify the information in accordance with our data retention policies.
5. Notification of the Collection of Personal Information
Definition: Organizations must notify individuals when they collect their personal information, explaining the purpose, how it will be used, and to whom it may be disclosed.
How We Meet It: We provide clear notifications at the point of data collection, informing individuals of why their personal information is being collected, how it will be used, and who it might be shared with. This is done through consent forms, pop-ups, and our privacy policy.
6. Use or Disclosure of Personal Information
Definition: Personal information must only be used or disclosed for the primary purpose for which it was collected, or for a secondary purpose if the individual consents or if an exception applies.
How We Meet It: We use personal information strictly for the purposes stated in the privacy policy. If we need to use or disclose information for a different purpose, we seek explicit consent from the individual unless an exception under the law applies.
7. Direct Marketing
Definition: Organizations can only use personal information for direct marketing if certain conditions are met, including obtaining consent from the individual.
How We Meet It: We use personal information for direct marketing when we have obtained explicit consent from the individual or under the basis of legitimate interest. We ensure that our marketing activities under legitimate interest are balanced with your rights and do not override your privacy. You can always opt out if you prefer not to receive these communications.
8. Cross-border Disclosure of Personal Information
Definition: Before disclosing personal information to an overseas recipient, organizations must ensure that the recipient complies with the APPs or that the individual is aware and consents to the transfer.
How We Meet It: When we transfer personal information overseas, we take steps to ensure that the recipient adheres to equivalent privacy protections as required by the APPs.
9. Adoption, Use, or Disclosure of Government Identifiers
Definition: Organizations must not adopt, use, or disclose a government-related identifier (e.g., tax file number) unless required by law or necessary to verify identity.
How We Meet It: We do not adopt or use government-related identifiers unless such information is uploaded by the customer directly.
10. Quality of Personal Information
Definition: Organizations must take reasonable steps to ensure that the personal information they collect, use, and disclose is accurate, up-to-date, and complete.
How We Meet It: We regularly review and update our records to ensure the accuracy and completeness of personal information. Individuals are encouraged to notify us of any changes to their information, and we promptly make corrections as needed.
11. Security of Personal Information
Definition: Organizations are required to protect personal information from misuse, interference, loss, unauthorized access, modification, or disclosure.
How We Meet It: We employ a range of security measures, including encryption, access controls, and regular security audits, to protect personal information. We also have protocols in place to respond to data breaches swiftly and effectively.
12. Access to Personal Information
Definition: Individuals have the right to access the personal information an organization holds about them, subject to some exceptions.
How We Meet It: We provide individuals with access to their personal information upon request, unless an exception applies. Requests can be made through our data privacy team (privacy[at]kentico.com), and we respond in a timely manner.
13. Correction of Personal Information
Definition: Organizations must take steps to correct personal information if it is inaccurate, out-of-date, incomplete, irrelevant, or misleading.
How We Meet It: We promptly correct any personal information that is identified as inaccurate or incomplete. Individuals can request corrections, and we make updates as necessary to ensure information accuracy.