1. Introduction

AMA Group Limited, and its controlled entities recognises the importance of protecting the privacy of all our stakeholders and our ongoing obligations in respect to how we manage personal information.
AMA Group Limited and its controlled entities will be referred to as “AMA”, “we”, “us” or “our” within this Privacy Policy (Policy).

2. Purpose

This Policy explains how we manage personal information and also describes the types of information we hold and why, as well as how that information is collected, stored, used, disclosed and disposed of.

3. Policy statement

AMA is committed to protecting the privacy rights of all stakeholders.

In Australia, AMA is subject to the Privacy Act 1988 (Cth) (Privacy Act) and handles the personal information that it collects and stores in accordance with the Australian Privacy Principles (APPs) contained in the Privacy Act.

In New Zealand (NZ), AMA is subject to the Privacy Act 2020 (Privacy Act NZ) and handles the personal information that it collects and stores in accordance with the Information Privacy Principles (IPPs) contained in the Privacy Act NZ.

4. What is personal or sensitive information?

Personal Information is information or an opinion that identifies an individual. The personal information we collect will depend on how you interact with us, and examples include:

• name, address (postal and email) and telephone numbers;
• gender, date of birth, marital status, occupation, country of birth, next of kin;
• recruitment information such as tax file number, employment history, work visa and other information to verify your identity and right to work;
• payment information such as credit card details; and
• other information needed to provide services.

Sensitive information is personal information that is given a higher level of protection by privacy laws in Australia. It includes information about an individual’s race or ethnic origin, political opinions, membership of a political, professional or trade associations or trade unions, religious beliefs, criminal record or health information.

In this Policy, when we talk about personal information, we include sensitive information.

5. Dealing with us anonymously

Where it is lawful and practicable to do so, individuals may deal with us anonymously or by using a pseudonym (e.g. when inquiring about services generally). However if individuals wish to make a booking for our services, the service will require the provision of personal identifying information.

6. Our website

Visitors to our website do not disclose information unless they provide such information through an enquiry form. When individuals visit our website anonymously, non-personal information may be collected including but not limited to browser type, version and language, operating system, pages viewed while browsing the site, page access times and referring website address. This collected information is used solely internally for the purpose of gauging visitor traffic, trends and delivering personalised content to individuals while they are at this site.

7. Why do we collect, store, use and disclose personal information?

We collect your personal information for the primary purpose of:

• understanding your requirements and providing our services to you;
• providing information to our clients and marketing;
• identifying you and conducting appropriate checks;
• recruitment, training and developing our employees;
• managing complaints and disputes, and reporting to dispute resolution bodies; or
• satisfying specific legal or regulatory obligations.

We also collect information about:

• suppliers and their employees (including business name, address and contact details); and
• potential employees (including names, addresses, contact details, employment and academic histories and the names of their referees).

Without the above details, AMA Group would not be able to carry on its business and provide products and services to its customers.

We may also use your personal information for secondary purposes closely related to the primary purpose, in circumstances where you would reasonably expect such use or disclosure, or for other purposes required or authorised by or under law.

If you do not provide personal information requested of you to AMA, we may be unable to provide you with the products and services you request of us.

If you provide your email address, telephone and/or mobile phone number, you also consent to AMA using your email address, telephone and/or mobile phone number to contact you (including by telephone call, SMS or email) for any of the above purposes.

8. How do we collect personal information

Where reasonable and practicable to do so, we will collect your personal information only from you. However, in some circumstances we may be provided with information by third parties. In such cases, we will protect it as set out in this Privacy Policy.

9. Who we share your personal information with

We may share your personal information internally within our corporate group as well as with third parties involved in the running of our business and your authorised representatives. This may involve sharing information across national borders.

We may also need to share your personal information (which may sometimes include sensitive personal information) with:

• people you have authorised to interact with us on your behalf (such as recruitment agencies);
• third parties who provide services we use to run our business including IT service providers, web hosting organisations, mail houses, recruitment firms and external service providers that assist AMA Group to perform other shared services functions;
• our professional advisors (such as our lawyers and accountants); and
• government authorities or other persons where obliged to do so by an applicable law.

Your personal information (including sensitive information) will be accessible to AMA Group employees who are involved in the recruitment process and may also be shared with third party recruitment agencies, including:

• your referees (or the organisations they represent);
• third party service providers who supply services to AMA Group to manage your online application or conduct criminal checks, cloud-based video interviewing and assessments, reference checking, psychometric testing or other pre-employment screening processes;
• recruitment agencies or other third parties acting on our behalf during the recruitment process;
• law enforcement agencies to verify whether you have a criminal record;
• educational or vocational organisations to verify your qualifications; or
• our related entities.

These third parties may collect, store, use and disclose personal information in the provision of recruitment services to AMA Group, and are also bound by confidentiality and privacy obligations.

10. COVID-19 vaccination

If you are employed in a role that requires you to be fully vaccinated against COVID-19 by a relevant legislative requirement (e.g. Public Health Order), you must provide evidence of your vaccination records to your Manager or HR representative (as appropriate). For example, an “online immunisation history statement” or a “COVID-19 digital certificate from the Australian Immunisation register”. The information you provide will be stored in accordance with the relevant legislative requirement.

11. Overseas disclosure

We will send your personal information overseas and collect personal information from overseas, including when:

• you have asked us to do so or we have your consent;
• we are authorised or required by law or a court/tribunal to do so;
• we have outsourced a business activity or function to an overseas service provider; or
• we undertake certain electronic transactions.

In addition, our websites may be hosted by servers outside Australia or NZ, and we may also use technical support services that are based off shore. This means that technically speaking, individuals’ personal information may travel electronically from Australia or NZ to another country, and back to Australia or NZ. When sending information offshore, we ensure all providers we engage can and will observe the requirements of the APPs and IPPs.

12. Use of cookies

We use cookies on our website and may collect information about you using cookies to provide a number of services to you. A cookie is a piece of data that a website sends to your browser, and which is then stored on your computer or other internet enabled device.

Cookies are generally one of two types, a session cookie or a persistent cookie. A session cookie is a temporary cookie that is placed on the device and remains until you leave one of our websites. A persistent cookie will remain on your device for a period of time or duration specified in the cookie despite you leaving our websites.
Cookies generally allow our websites you are browsing to interact more efficiently with your device.

AMA Group uses cookies to collect and use information for a range of purposes, including;

• to maintain and improve the operation of our websites;
• track user preferences and product requirements; and
• to customise our websites and target and improve advertising or marketing relevance.

We may also have an arrangement with third parties which provide us with data to help us analyse and understand how our website users interact with our website and to improve the relevance of our advertising to you on third party websites. You are able to use your browser settings to manage cookies. These settings may include deleting all or some cookies, not accepting any cookies or being notified when cookies are being used. Sometimes if you decide not to allow or accept a cookie, it may affect your use or the functionality of our websites.

You can choose to decline cookies by making changes to your browser settings, but if you do so, your user experience may be affected and you may not be able to take advantage of the full functionalities of our website.

13. Storing of personal information

We may store personal information in different ways, including in paper and electronic form. The security of personal and information is important to us and we take all reasonable steps to protect it from misuse or loss and from unauthorised access, modification or disclosure. We ensure compliance with notifiable privacy and data breaches reporting requirements.

Some of the ways we do this include:

• requiring our staff and contractors to maintain confidentiality and observe privacy laws to ensure compliance with the APPs and IPPs;
• implementing document storage security;
• imposing security measures for access to computer systems; and
• only allowing access to personal information where the individual seeking access to their own information has satisfied identification requirements.

Once stored personal information is no longer required for its primary purpose (subject to any applicable laws), it is disposed of in a secure manner or de-identified.

14. Maintaining the quality of your personal information

We take all reasonable steps to ensure that the personal information we collect, use and disclose is accurate, complete and up to date. However, the accuracy of that information depends largely on the quality of the information provided to us.

We therefore suggest that individuals:

• let us know if there are any errors in personal information; and
• keep us up to date with changes to personal information (e.g. their name and address).

Individuals may do this by mail or email (see Contact Us below).

15. Accessing personal information

Individuals have a right to access their personal information and can contact us to request access. In order to protect your personal information we may require identification from you before releasing the requested information.

We will disclose individual’s personal information to an individual’s authorised representatives only where written authority has been provided or where evidence has been provided that nominated individuals can act on an individual’s behalf. We cannot provide an authorised representative with access to an individual’s personal information unless they can demonstrate that they have the individual’s consent or have legal authority to do so.

16. Contact us

Please contact us if you would like to seek access to or request that we correct the personal information we store about you:

• By mail: AMA Group Privacy Officer, Level 13, 484 St Kilda Road, Melbourne VIC 3004
• By email: [email protected]

17. Complaints

Individuals who believe that we have breached their privacy rights in any way or wish to discuss any issues about our Policy, should contact us on the details below so that we can try to satisfy any questions and correct any errors on our part.

However, if you are unhappy with our response, you have the right to make a complaint to the applicable Privacy Commissioner.

• In Australia on telephone number 1300 363 992, or in writing to:
  Office of the Australian Information Commission
  GPO Box 5218
  Sydney NSW 2001
• In NZ on telephone number 0800 803 909, or in writing to:
  Privacy Commissioner
  PO Box 10 094,
  Wellington 6143

18. Further information

If individuals would like more information about privacy in general, please refer to the Office of the Australian Information Commissioner’s website www.oaic.gov.au, or the Privacy Commissioner’s (NZ) website https://www.privacy.org.nz/.

19. Variations

AMA reserves the right to vary, replace or terminate this Policy from time to time. To obtain a copy of the latest version at any time you should visit our website at www.amagroupltd.com or contact the Privacy Officer as above.

Version: V2 – 2022
Effective Date: September 2022
Approved By: AMA Group CEO
Maintained By: Company Secretariat