Privacy policy.

Introduction and Purpose

National Ageing Research Institute Limited ABN 71 154 866 047 (NARI, we, us, our) is committed to respecting the privacy of individuals, clients and stakeholders Personal Information consistent with our obligations under the Australian Privacy Principles (Principles) as set out in the Privacy Act 1988 (Cth), including the Privacy and Other Legislation Amendment Act 2024 and from other relevant applicable legislation and regulations (collectively referred to as the Privacy Obligations).

The Privacy Obligations govern the way in which we collect, use, disclose, store, secure and dispose of your Personal Information. This Privacy Policy (Policy) outlines our ongoing obligations to you in respect of the way in which we manage your Personal Information and how individuals may access and correct their information or make a privacy complaint.

Overarching Policy Principles

We collect, utilise and administer a range of Personal Information for various purposes. This Policy primarily applies to personal information collected in connection with our corporate, operational, stakeholder engagement and employment activities. Personal information collected as part of research activities is governed by separate research protocols, participant information and consent forms, ethics approvals and applicable legal requirements.

We recognise the essential right of individuals to have their Personal Information collected, used and disclosed in ways which they would reasonably expect, and with appropriate storage, protection and accessibility arrangements in place.

We are bound by the Privacy Obligations which impose specific requirements when it comes to handling Personal Information. We have adopted the following principles in relation to handling your Personal Information.

We will:

• Collect, use and disclose Personal Information only for our primary purpose or a related purpose, or for another purpose with the person’s consent;
• Where possible, ensure that all parties are informed as to why we collect the information and how we administer the information gathered;
• Store Personal Information securely, protecting it from unauthorised access;
• Provide you with access to your own information and the right to seek its correction; and
• Respond to any data breaches by reporting such breaches in accordance with the applicable laws.

What is Personal Information?

Personal Information includes a broad range of information, or an opinion, that could identify an individual. Examples of Personal Information we collect includes (but is not limited to), names, addresses, email addresses, telephone numbers, photographs and employee record information.

Some Personal Information is further classified as Sensitive Information, (we only collect such information where the individual has consented, or collection is required or authorised by law) which is defined to include information or opinion about such things as an individual’s racial or ethnic origin, political opinions, membership of a political association, religious or philosophical beliefs, membership of a trade union or other professional body, criminal record or health information.

How we collect Personal Information

In general terms, we collect information connected with our operations and activities. We collect Personal Information from several sources including directly from the individual to whom the information pertains, from correspondence, by telephone, in writing, by email, via our website, from other websites, from our media and publications, social media (Facebook, Twitter, YouTube, LinkedIn, etc.), from other publicly available sources, from cookies and other tracking technology, from third parties, etc.

In addition, we may collect your Personal Information to help us communicate with you and the public, including when individuals register to participate in an event, forum or training program, are added to our newsletter mailing list or for a broad range of other situations associated with our provision of services to, and communications with, our stakeholders.

Also, were lawful and practical, individuals may interact with us anonymously or using a pseudonym. However, in many circumstances we may require identification to provide services, respond to enquiries or meet our legal obligations.

Reasons we collect Personal Information

We collect your Personal Information for the Primary Purpose of providing our services to you, and for providing information to our stakeholders and clients and for marketing purposes. We may also use your Personal Information for Secondary Purposes related to the Primary Purpose, in circumstances where you would reasonably expect such use or disclosure.

When we collect Personal Information, we will, where appropriate and where possible, explain to you why we are collecting the information and how we plan to use it. In collecting Personal Information, we will not do anything, or engage in any practice, that contravenes the Privacy Obligations.

Use of your Personal Information

We undertake to only use Personal Information in the following circumstances:

• For the Primary Purposes for which it was collected or a Secondary Purpose that you would reasonably expect us to use or disclose the information and is related to the Primary Purpose;
• For such other purposes as are subsequently agreed between us and you;
• With your consent or where required or authorised by law; and
• Where we have engaged a third-party service provider or partner to perform services of functions on our behalf (and where this occurs, the third-party service provider will only use the information collected in the circumstances outlined within this Policy).

Disclosure of your Personal Information

In certain instances, we may disclose your Personal Information to certain third parties so that they may use and disclose your information for any of the purposes referred to above.

Personal Information may also be released to grant award providers so that we can meet our reporting requirements to our funding and other partners, affiliates, contractors and consultants who perform services on our behalf.

When we disclose your information to a third party (including software platforms and other databases) who are providing services to us, we will require the third party to protect your information in accordance with the Privacy Obligations and treat it confidentially, through the contract of service we sign with them.

As mentioned above, we use a number of third-party products to provide our services. Some of these service providers are located overseas. NARI is not accountable for the actions of an overseas third party about the use of your Personal Information, and there is no redress under the Privacy Obligations should the overseas third party breach your Personal Information in any way. Additionally, you may not be able to seek redress in the overseas jurisdiction.

You should also be aware that the overseas third party may not be subject to the same privacy obligations and may be compelled to disclose Personal Information to a further third party by an overseas authority.

To the greatest extent possible, before disclosing personal information overseas, we will take reasonable steps to ensure that overseas recipients handle personal information in a manner consistent with Australian privacy requirements.

Security of Personal Information

We hold Personal Information in hardcopy and electronic formats. We take reasonable steps to ensure that Personal Information we hold is secure and protected from misuse, loss, unauthorised access, modification or disclosure. Security measures may include encryption, secure cloud environments, multi-factor authentication, access controls, staff training, monitoring and incident response procedures.

Information is stored in access-controlled premises, in electronic servers and databases with restriction of access, use of logins, passwords, firewalls, multi-factor authentication and other security measures.

Generally, we will only retain your Personal Information for as long as it is required for the purpose it was collected and in accordance with our applicable legislative and governance obligations.

AI and Automated Technologies

We may use technology tools, including artificial intelligence-enabled systems, to assist with administrative and operational activities. Personal information will not be used in these systems except in accordance with applicable privacy obligations and our internal governance requirements.

Data Breaches

We must report certain data breaches to the Office of the Australian Information Commissioner and to the impacted individuals when a data breach has occurred and is likely to result in serious harm to any individuals whose Personal Information is involved in the breach.

An eligible data breach occurs when:

• There is unauthorised access to or unauthorised disclosure of Personal Information, or a loss of Personal Information, that we hold;
• That is likely to result in serious harm to one or more individuals; and
• We have not been able to prevent the likely risk of serious harm with remedial action.

We have a Data Breach Response Plan in place in the event of a data breach.

Access, Correction and Privacy Complaints

You have rights to request access to and correction of information we hold about you. Requests for access or correction should be made in writing to our Privacy Officer which may may require verification of identity before providing access.

We also encourage you to advise us of any personal detail changes as they occur.

If you believe we have breached your privacy or mishandled your personal information, you may lodge a complaint with us by contacting our Privacy Officer.

If you are not satisfied with our response, you may lodge a complaint with the Office of the Australian Information Commissioner.

To access or correct your data, or lodge a complaint, please contact the NARI Privacy Officer via:

Phone: (03) 9969 6500

Email: privacy@nari.edu.au

Post: NARI Privacy Officer

34-54 Poplar Rd, Parkville VIC 3052

Changes to this Policy

We reserve the right to change, modify or update this Policy as required to reflect legislative, regulatory and operational changes. Any revision to this Policy will be published on our website. The revised version shall take effect immediately upon publication.