Privacy Policy - Ignition Advice | Digital advice. Made human.

Privacy and Personal Data Protection Policy

Ignition Wealth Ltd (ACN 602 351 968)
Address: Level 2, 5 Martin Place, 2000 NSW Australia
Website: www.discoverignition.com
Email: sales@ignitionadvice.com
Phone: +61 1300 656 924

1. Introduction

Ignition makes use of a variety of data about identifiable individuals, customers & prospects and other stakeholders. In collecting and using this data, the organisation is subject to a variety of legislation controlling how such activities may be carried out and the safeguards that must be put in place to protect it. Specifically, Ignition must comply with the Australian Privacy Act 1988 (‘Privacy Act’), including the Australian Privacy Principles (‘APPs’), the European General Data Protection Regulation (EU GDPR) and the UK General Data Protection Regulation (UK GDPR). We are required by law to notify you of the information contained in this Privacy Policy.

Ignition is related to other companies and entities (related entities). This Privacy Policy applies to the use of your personal information by us and by those related entities. Those related entities may also have their own privacy policies which set out additional detail or differences in their privacy practices. To the extent that those privacy policies are inconsistent with this Privacy Policy, those privacy policies will prevail over this Privacy Policy in relation to the actions of those related entities. A reference in this Privacy Policy to Ignition, we, us or our is also a reference to those related entities.

This Policy applies to current and former employees, workers and contractors as well as the individuals described in paragraph 6. This Policy does not form part of any contract of employment or other contract to provide services. We may update this notice at any time. The purpose of this policy is to set out the relevant legislation and to describe the steps Ignition is taking to comply with it. This control applies to all systems, people and processes who have access to Ignition systems.

We have appointed a Privacy Officer who is responsible for overseeing questions in relation to this Privacy Policy. If you have any questions about this Privacy Policy, including any requests to exercise your legal rights in the European Union and the United Kingdom, please contact the Privacy Officer using the details set out at paragraph 18.

2. Data Protection Principles

We will comply with data protection legislation. Depending on where you reside, this generally requires that the personal information we hold about you must be:

Used lawfully, fairly and in a transparent way.
Collected only for valid purposes that we have clearly explained to you and not used in any way that is incompatible with those purposes.
Relevant to the purposes we have told you about and limited only to those purposes
Accurate and kept up to date.
Kept only as long as necessary for the purpose we have told you about.
Kept securely.

3. What kinds of personal information do we collect and hold?

Personal data or personal information means any information about an individual from which that person can be identified. It does not include data where the identity has been removed (anonymous data). There are ‘special categories’ of more sensitive personal data which require a higher level of protection (indicated with a *). We may collect and hold a range of information about you to provide you with our services, including:

Personal contact details, including full name, title, address, telephone number and personal email address.
Age and/or date of birth.
Gender.
Marital status and dependants.
Next of kin, and emergency contact information.
Australian Business Number (ABN), Personal Public Service (PPS) number, National Insurance Number, Tax File Number.
Bank account details, payroll records and tax status information.
Salary, annual leave, pension and benefits information.
Start date.
Location of employment or workplace.
Copy of driver’s licence and details of other identification information.
Recruitment information – including copies of right to work documentation, reference and other information included in a CV or cover letter or otherwise provided in connection with the application process.
Immigration data.
Passport details.
Employment records – including employment status, job titles, work history, working hours, training records and professional memberships.
Compensation history.
Performance information.
Disciplinary and grievance information.
CCTV footage and other information obtained through electronic means such as swipe card records.
Information about your use of our information and communications systems, including IP Address, and your social media accounts and profiles.
Photographs.
* Information about your race or ethnicity, religious beliefs, sexual orientations and political opinions.
* Information about your health, including any medical conditions, health and sickness records.
* Genetic information and biometric data.
* Information about criminal convictions and offences.

4. How do we collect personal information?

We collect Personal Information to allow us to conduct our business functions, to provide, market and sell our products and services and for the specified purposes set out in paragraph 7. For example, personal information may be collected:

when you use or buy or apply to use or buy our products or services
in the course of providing you with our products and services
through our application processes
when you provide us, or you offer or apply to supply us, with goods or services
when you provide information to us in any way (including by completing forms, disclosing information over the phone or via email when you call us or send us correspondence, or providing us a business card)
when you request information about us, our products or our services
when you provide feedback to us
when you visit or fill in a form on our website
when you visit premises from which we operate
when you (or your employer) provide that information to us in the course of conducting or administering our relationship with you
when you are carrying out activities in connection with our business operations
when you submit a job application to us,
when you otherwise contact us by telephone, fax, email, social media, post or in person, or
where we are otherwise required or authorised by law to do so.

When providing our products and services, dealing with our personnel, or obtaining goods and services from our service providers, suppliers or contractors, we generally collect personal information directly from the relevant individual where reasonable and practicable.

We may also collect personal information about you from a third party and other sources, such as:

marketing agencies, identity verification services and marketing agencies
your nominated representatives (eg spouse, accountant, power of attorney, brokers and other professional advisors)
publicly available sources of information, or
related entities, companies and businesses of Ignition,

but we will only collect your Personal Information in this way if it is unreasonable or impracticable to collect this information directly from you or if we are otherwise permitted to do so and if so, we will take reasonable steps to ensure that you are made aware of this Policy. We may also use third parties to analyse traffic at our website, which may involve the use of cookies. Information collected through such analysis is anonymous. We will not collect sensitive information about you without your consent unless an exemption in the APPs, the EU GDPR or the UK GDPR applies. These exceptions include if the collection is required or authorized by law or necessary to take appropriate action in relation to suspected unlawful activity or serious misconduct. If you do not provide us with the personal information we request, we may not be able to provide you with our products or services or meet your needs appropriately. We do not give you the option of dealing with us anonymously or using a pseudonym. This is because it is illegal or impractical for us to deal with individuals who are not identified.

5. Unsolicited personal information

We may receive unsolicited personal information about you. We destroy or de-identify all unsolicited personal information we receive, unless it is relevant to our purposes for collecting personal information. We may retain additional information we receive about you if it is combined with other information we are required or entitled to collect. If we do this, we will retain the information in the same way we hold your other personal information.

6. Who do we collect personal information about?

The personal information we may collect, and hold includes (but is not limited to) personal information about the following individuals:

customers, potential customers and their representatives;
contractors and subcontractors and potential contractors and subcontractors and their representatives in relation to providing goods and services to us;
our employees past and present, including applicants;
visitors to our website;
service providers or suppliers and potential service providers or suppliers and their representatives, directors, partners, proprietors and shareholders; and
any other person who comes into contact with Ignition.

7. How will we use your information?

Most commonly, we will use your personal information in the following circumstances:

Where we need to perform the contract we have entered into with you;
Where we need to comply with a legal obligation;

Where it is necessary for our legitimate interests (or those of a third party) and your interests and fundamental rights do not override those interests.

We may use your personal information in the following situations, in the unlikely event they arise

Where we need to protect your or someone else’s interest;
Where it is needed in the public interest or for official purposes.

Generally, in the United Kingdom and the European Union, we do not rely on consent as a legal basis for processing your personal information, although we will get your consent before sending third party direct marketing communications to you via email or text message. You have the right to withdraw consent at any time by contacting us using the details set out at paragraph 18.

For a description of all the ways we plan to use your personal information, please refer to the table below. These purposes apply to all personal information we collect. The table also sets out which of the legal bases we rely on for those purposes in the European Union and the United Kingdom in accordance with the EU GDPR and UK GDPR. We have also identified what our legitimate interests are where appropriate. We will only use your personal information for the purposes for which we collected it, unless we reasonably consider that we need to use it for another reason and that reason is compatible with the original purpose. If we need to use your personal information for an unrelated purpose, we will notify you and we will explain the legal basis which allows us to do so. Please note that we may process your personal information without your knowledge or consent, in compliance with the above rules, where this is required or permitted by law. Please also note that we may process your personal information for more than one lawful ground depending on the specific purpose for which we are using your personal information.

a. Special categories

Special categories of particularly sensitive personal information require higher levels of protection. We need to have further justification for collecting, storing, and using this type of personal information. We may process special categories of personal information in the following circumstances:

With your explicit consent;
Where we need to carry out our legal obligations or exercise rights in relation to your employment with us. We have in place an appropriate policy document and safeguards which we are required by law to maintain when processing such data;

Where it is needed in the public interest, such as for equal opportunities monitoring or in relation to our occupational pension scheme. We have in place an appropriate policy document and safeguards which we are required by law to maintain when processing such data.

Less commonly, we may process this type of information where it is needed in relation to legal claims or where it is needed to protect yours or others interests, and you are not capable of giving consent, or have already made the information public. We may also process such information about members or former members in the course of legitimate business activities with the appropriate safeguards.

As an employer, we may use your particularly sensitive information in the following ways:

We will use information relating to leaves of absence, which may include sickness absence or family related leaves, to comply with employment and other laws.
We will use information about your physical or mental health, or disability status, to ensure your health and safety in the workplace and to assess your fitness to work, to provide appropriate workplace adjustments, to monitor and manage sickness absence and to administer benefits.
We will use information about your race or national or ethnic origin, religious beliefs to ensure meaningful equal opportunity monitoring and reporting.
We will use your biometric information for the purpose of developing, testing and training biometric algorithms and demonstrating Ignition’s products (with your explicit consent).

We do not need your consent if we use special categories of your personal information in accordance with our written policy to carry out our legal obligations or exercise specific rights in the field of employment law. In limited circumstances, we may approach you for your written consent to allow us to process certain particularly sensitive data, including your biometric information. If we do so, we will provide you with full details of the information that we would like and the reason we need it, so that you can carefully consider whether you wish to consent. You should be aware that it is not a condition of your contract with us that you agree to any request for consent from us.

b. Criminal Convictions

We may only use information relating to criminal convictions where the law in your jurisdiction allows us to do so. This will usually be where such processing is necessary to carry out our obligations and provided we do so in line with our data protection policy.

Less commonly, we may use information relating to criminal convictions where it is necessary in relation to legal claims, where it is necessary to protect your or someone else’s interests and you are not capable of giving your consent, or where you have already made the information public. We may also process such information about members or former members in the course of legitimate business activities with the appropriate safeguards.

We will only collect information about criminal convictions if it is appropriate given the nature of the role and where we are legally able to do so. Where appropriate and lawful, we will collect information about criminal convictions as part of the recruitment process or we may be notified of such information directly by you in the course of you working for us. We will use information about criminal convictions and offenses in the following ways:

Job Applicants Australia and United Kingdom: An offer of employment will be contingent upon consideration of the results of any background check including information about criminal convictions.
Job Applicants other European countries: We may seek information regarding criminal convictions in any other European jurisdiction where this is legally permissible, for the purpose of considering an offer of employment.
Existing Employees: Where it is reasonably required for our legitimate business interests, for example, for the purpose of complying with customer security requirements when employees enter a customer’s premises, a background check may be undertaken during your employment even if a previous check was already completed. This may include information about criminal convictions where this is legally permissible.

c.Automated Decision Making

Automated decision making takes place when an electronic system uses personal information to make a decision without human intervention. We are allowed to use automated decision making in the following circumstances:

Where we have notified you of the decision and given you 21 days to request a reconsideration;
Where it is necessary to perform the contract with you and the appropriate measures are in place to safeguard your rights;
In limited circumstances, with your explicit consent and where appropriate measures are in place to safeguard your rights.

If we make an automated decision on the basis of any particularly sensitive personal information, we must have either your explicit written consent or it must be justified in the public interest, and we must also put in place appropriate measures to safeguard your rights. You will not be subject to decisions that will have a significant impact on you based solely on automated decision-making, unless we have a lawful basis for doing so and we have notified you. We do not envisage that any decisions will be taken about you using automated means, however we will notify you in writing if this position changes.

8. Data Sharing

We may disclose data and personal information with third parties, including third party service providers and other entities in the group. We require third parties to respect the security of your data and treat it in accordance with the law. We will share data with third parties where required by law, where necessary to administer the working relationship with you or where we have another legitimate interest in doing so. All our third-party service providers and other entities in the group are required to take appropriate security measures to protect your personal information in line with our policies. We do not allow our third-party service providers to use your personal data for their own purposes. We only permit them to process your personal data for specified purposes and in accordance with our instructions. We will share your personal information with other entities in our group as part of our regular reporting activities on company performance, in the particular context of a business reorganization or group restructuring exercise, for system maintenance support and hosting of data. Sensitive information will be used and disclosed only for the purpose for which it was provided (or a directly related secondary purpose), unless you agree otherwise or there is a relevant legislated ability or restriction.

In particular, and without limitation, we may disclose your personal information to:

any of our internal divisions, business units, departments, or group members and other related entities;
your nominated representatives;
other organisations or individuals who assist us in providing products and services to you;
professional service providers and advisors who perform functions on our behalf, such as lawyers;
representatives, agents or contractors who are appointed by us in the ordinary operation of our business to assist us in providing goods or services or administering our business (such as for data storage or processing, printing, mailing, marketing, planning and product or service development);
banks, lenders, financiers, valuers, insurers, brokers, auditors, business consultants and IT service providers; and
government, regulatory authorities, and other organisations as required or authorised by law.

Additionally, as we continue to develop our business, we may buy, merge or partner with other companies or organisations, and in so doing, acquire customer personal information. In such transactions, personal information may be among the transferred assets. Similarly, in the event that a portion or substantially all of our business or assets are sold or transferred to a third party, we may also disclose certain information including your personal information to a purchaser or potential purchaser in connection with the sale or potential sale of us, our business or any of our assets, including in insolvency.

Notice for Australian Employees

We may disclose your Tax File Number to other persons when we are acting on your behalf in the conduct of your affairs (for example, to our execution broker, or to share registries). When we do so, we are acting in accordance with Section 8WB(1A) (c) of the Taxation Administration Act 1953. We do not adopt identifiers assigned by the Government (such as driver’s licence numbers) for our own file recording purposes, unless one of the exemptions in the Privacy Act applies.

If we disclose your personal information to service providers that perform business activities for us, they may only use your personal information for the specific purpose for which we supply it. We require that all contractual arrangements with third parties adequately address privacy issues and will make third parties aware of this Policy.

9. Sending information overseas

We may disclose your personal information to our related entities within the Ignition group, for the purposes of their provision of services and support to us, or if they otherwise need to access that information in connection with the provision of products or services to you or otherwise for the purposes set out in this Privacy Policy. Those entities may be located overseas, outside of your country of residence, including Australia, the United Kingdom, Ireland, and other countries from time to time, and therefore your personal information may be disclosed to those entities in those countries. To the best of our knowledge, Ignition is EU GDPR and UK GDPR compliant.

In addition to overseas disclosures to our related entities within the Ignition group, some of your personal information may also be disclosed, transferred, stored, processed or used overseas by us, or by third party service providers. This may happen if:

our offices or related entities are overseas
we (Including any of our related entities) outsource certain activities overseas
transactions, information, services or products have an overseas connection, or
our computer systems including IT servers are located overseas.

In particular, your personal information may be disclosed to third parties In Australia, the United Kingdom, Ireland, and such other countries in which those parties or their, or our, computer systems may be located from time to time, where it may be used for the purposes described in this Privacy Policy.

If you reside in Australia, you consent to the collection, use, storage, and processing of your personal information outside of Australia as set out in this Privacy Policy.

Any overseas disclosure does not affect our commitment to safeguarding personal information we collect, and we will take reasonable steps to ensure overseas recipients comply with the relevant legislations. We will not disclose your personal information to overseas recipients unless:

we have taken reasonable steps to ensure that the recipient does not breach the Privacy Act, the APPs, the EU GDPR or the UK GDPR;
we use specific contracts approved for use in the European Union and the United Kingdom which give personal information the same protection as it has in the European Union and the United Kingdom, when transferring your personal data out of the European Union and/or the United Kingdom;
the recipient country has been deemed to provide an adequate level of protection for personal information; or
we are otherwise permitted by law to do so.

Some of our subsidiaries or associates may have their own individual privacy policy. Those policies may include additional overseas countries to which those entities may disclose your personal information. Before providing any personal information directly to those entities, you should read and understand their applicable privacy policy which may describe different practices regarding the way they disclose, transfer, store, process and use your personal information. Our related entities may also disclose that personal information to different overseas countries to those mentioned above, and they may be required to comply with legislation in different jurisdictions to us.

Please contact us if you want further information on the specific mechanism used by us when transferring your personal data out of the European Union and/or the United Kingdom.

10. Data Security

We recognise the importance of securing the personal information of our customers. We have put in place appropriate security measures to prevent your personal information from being accidentally lost, used or accessed in an unauthorized way, altered or disclosed. In addition, we limit access to your personal information to those employees, agents, contractors and other third parties who have a business need to know. They will only process your personal information on our instructions and they are subject to a duty of confidentiality. Details of these measures may be obtained from Ignition’s Information Security Manager. We have put in place procedures to deal with any suspected data security breach and will notify you and any applicable regulator of a suspected breach where we are legally required to do so.

11. Data Retention

We will only retain your personal information for as long as reasonably necessary to fulfil the purposes we collected it for, including for the purposes of satisfying any legal, regulatory, tax, accounting or reporting requirements. We may retain your personal information for a longer period in the event of a complaint or if we reasonably believe there is a prospect of litigation in respect to our relationship with you.

To determine the appropriate retention period for personal information, we consider the amount, nature and sensitivity of the personal information, the potential risk of harm from unauthorised use or disclosure of your personal information, the purposes for which we process your personal information and whether we can achieve those purposes through other means, and the applicable legal, regulatory, tax, accounting or other requirements.

For further information as to any specific retention periods that might apply to personal information we hold about you, please contact us using the details set out at the top of this Privacy Policy.

12. Direct Marketing

We may only use personal information we collect from you for the purposes of direct marketing without your consent if:

the personal information does not include sensitive information; and
you would reasonably expect us to use or disclose the information for the purpose of direct marketing; and
we provide a simple way of opting out of direct marketing; and

you have not requested to opt out of receiving direct marketing from us.

If we collect personal information about you from a third party, we will only use that information for the purposes of direct marketing if you have consented (or it is impracticable to obtain your consent), and we will provide a simple means by which you can easily request not to receive direct marketing communications from us. We will draw your attention to the fact you may make such a request in our direct marketing communications. You have the right to request us not to use or disclose your personal information for the purposes of direct marketing, or for the purposes of facilitating direct marketing by other organisations. To do so, please contact us using the details at the beginning of this Policy, or use the unsubscribe functionality provided in any direct marketing communication that you have received from us. We must give effect to the request within a reasonable period of time. You may also request that we provide you with the source of their information. If such a request is made, we must notify you of the source of the information free of charge within a reasonable period of time.

13. Information collected via our websites

a. General

Personal information may be collected by us and by our third party service providers who assist us in operating our website referred to above, including its subdomains and any other website we operate from time to time.

We may use various technological methods from time to time to track the visiting patterns of individuals accessing our websites, including but not limited to the methods set out in this paragraph 13.

b. Cookies

A “cookie” is a small text file that may be placed on a computer by a web server. Our website may use cookies which may enable us to identify you or your browser while you are using our site. These cookies may be permanently stored on a computer or are temporary session cookies. They are used for a variety of purposes, including security and personalisation of services. They are frequently used on websites and you can choose if and how a cookie will be accepted by configuring your preferences and options in your browser.

If you disable the use of cookies on your web browser or remove or reject specific cookies from our websites or linked sites then you may not be able to gain access to all of the content and facilities in those websites.

c. Google Analytics

We may use Google Analytics to help analyse how you use our websites. Google Analytics generates statistical and other information about website use by means of cookies, which are stored on users’ computers. The information generated is used to create reports about the use of our Website. Google will store this information.

If you do not want your website visit data reported by Google Analytics, you can install the Google Analytics opt-out browser add-on. For more details on installing and uninstalling the add-on, please visit the Google Analytics opt-out page at https://tools.google.com/dlpage/gaoptout

d. Click Stream Data

When you read, browse or download information from our websites, we or our internet service provider may also collect information such as the date, time and duration of a visit, the pages accessed, the IP address of your computer, and any information downloaded. This information may be used for purposes including statistical, reporting and website administration, maintenance and improvement purposes.

14. Third party content (eg social media links)

Some of the content on our websites may include applications made available by third parties, such as social media buttons or links that allow you to share content or links to our website through the relevant third party platforms. These third party applications themselves may facilitate collection of information by those third parties, through your interaction with the applications and sometimes even if you do not interact directly with them. We are not responsible for the technical operation of these applications or the collection and use practices of the relevant third parties. Please visit the relevant third party websites to understand their privacy practices and options they may make available to you in relation to their collection of your personal information.

15. Your Rights

It is important that the personal information we hold about you is accurate and current. Please keep us informed if your personal information changes during your working relationship with us.

Under certain circumstances, by law you have the right to:

Request access to your personal information (commonly known as a “data subject access request”). This enables you to receive a copy of the personal information we hold about you and to check that we are lawfully processing it.
Request correction of the personal information that we hold about you. This enables you to have any incomplete or inaccurate information we hold about you corrected.
Request erasure of your personal information. This enables you to ask us to delete or remove personal information where there is no good reason for us continuing to process it. You also have the right to ask us to delete or remove your personal information where you have exercised your right to object to processing (see below).
Object to processing of your personal information where we are relying on a legitimate interest (or those of a third party) and there is something about your particular situation which makes you want to object to processing on this ground. You also have the right to object where we are processing your personal information for direct marketing purposes.
Request the restriction of processing of your personal information. This enables you to ask us to suspend the processing of personal information about you, for example if you want us to establish its accuracy or the reason for processing it.

Request the transfer of your personal information to another party.

If you want to review, verify, correct or request erasure of your personal information, object to the processing of your personal data, or request that we transfer a copy of your personal information to another party, please contact the HR Department in writing. You will not have to pay a fee to access your personal information (or to exercise any of the other rights). However, we may charge a reasonable fee if your request for access is clearly unfounded or excessive. Alternatively, we may refuse to comply with the request in such circumstances or where we are otherwise permitted by law. We may need to request specific information from you to help us confirm your identity and ensure your right to access the information (or to exercise any of your other rights). This is another appropriate security measure to ensure that personal information is not disclosed to any person who has no right to receive it. We try to respond to all legitimate requests within one month. Occasionally it could take us longer than a month if your request is particularly complex or you have made a number of requests. In this case, we will notify you and keep you updated.
‍
In the limited circumstances where you may have provided your consent to the collection, processing and transfer of your personal information for a specific purpose, you have the right to withdraw your consent for that specific processing at any time. To withdraw your consent, please contact the HR Department. Once we have received notification that you have withdrawn your consent, we will no longer process your information for the purpose or purposes you originally agreed to, unless we have another legitimate basis for doing so in law.

16. Updates to this Policy

This Policy will be reviewed from time to time to take account of new laws and technology, and changes to our operations and the business environment.

17. Our responsibilities

It is the responsibility of management to inform employees and other relevant third parties about this Policy and of any changes to this Policy. Management must ensure that employees and other relevant third parties are advised of any changes to this Policy. All new employees are provided with timely and appropriate access to this Policy, and all employees are provided with training in relation to appropriate handling of personal information as part of our ISO/IEC 27001:2013 certification. Employees or other relevant third parties that do not comply with this Policy may be subject to disciplinary action.

18. Making a complaint

If you have any questions about this Policy, please contact us by:

telephoning +61 1300 656 924
writing to the Privacy Officer, Ignition, Level 2, 5 Martin Place, Sydney, NSW 2000
emailing – privacy@ignitionadvice.com

You have the right to make a complaint to the relevant data protection supervisory authority at any time. We would, however, appreciate the chance to deal with your concerns before you approach the relevant data protection supervisory authority, so please contact us in the first instance by using any of the above methods.

We will investigate your queries and privacy complaints within a reasonable period of time depending on the complexity of the complaint.

It would assist us to respond to your complaint promptly if it is made in writing. Please detail information relevant to your complaint.

We will notify you of the outcome of our investigation.

If you are not satisfied with our response to your complaint, you can also refer your complaint to the relevant data protection supervisory authority:

Australia

Office of the Australian Information Commissioner

Phone – 1300 363 992

Postal Address –Office of the Australian Information Commissioner, GPO Box 5218, SYDNEY NSW 2001, Australia

Europe

To find the relevant European Union national data protection authority, please consult the list on the following website: https://edpb.europa.eu/about-edpb/about-edpb/members_en

United Kingdom

Information Commissioner’s Office

Phone – 0303 123 1113

Postal Address – Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF