The Alliance Française de Canberra (AFC) is committed to protecting the privacy of personal information which the organisation handles, uses and manages. Personal information is information which directly or indirectly identifies a person.

Purpose

The purpose of this document is to provide a framework for the AFC in dealing with privacy considerations.

Policy

The AFC seeks to comply with the Australian Privacy Principles (APPs), which are contained in schedule 1 of the Privacy Act and apply from 12 March 2014. These outline how most Australian and Norfolk Island Government agencies, all private sector and not-for-profit organisations with an annual turnover of more than $3 million, all private health service providers and some small businesses (collectively called ‘APP entities’) must handle, use and manage personal information.

The AFC is incorporated in the ACT. There are Territory Privacy Principles in the Information Privacy Act 2014 (ACT) but these apply to ACT public sector agencies. They are substantially similar to the APPs and so the AFC, being a not-for-profit organisation, seeks to comply with the APPs.

The AFC has an annual turnover of less than $3 million and its compliance with the APPs is a policy but not a legal requirement.

The summary of AFC compliance with the APPs, set out below, is based on "Privacy Fact Sheet 17: Australian Privacy Principles" published by the Office of the Australian Information Commissioner" on its website. Further information is available from that source.

AFC COMPLIANCE WITH THE AUSTRALIAN PRIVACY PRINCIPLES (APPs)

APP 1. Open and transparent management of personal information

The AFC will take such steps as are reasonable in the circumstances to implement practices, procedures and systems relating to its functions or activities that will ensure that it complies with the APPs, and which will enable it to deal with inquiries or complaints from individuals about its compliance with the APPs.

The AFC will have a clearly expressed and up to date policy about the management of personal information.

The AFC will make its privacy policy available on its website.

APP 2. Anonymity and pseudonymity

Individuals have the option of not identifying themselves, or of using a pseudonym, when dealing with the AFC in relation to a particular matter.

This option does not apply if, in relation to that matter, the AFC is required or authorised by or under an Australian law, or a court/tribunal order, to deal with individuals who have identified themselves, or it is impracticable for the AFC to deal with individuals who have not identified themselves or who have used a pseudonym.

APP 3. Collection of solicited personal information

The AFC collects personal information from customers when they register on its site or place an order. When ordering or registering on the site, as appropriate, customers may be asked to enter name, email address, mailing address, phone number or credit card information. Customers may, however, visit the site anonymously in accordance with APP 2.

The AFC will not collect personal information (other than sensitive information) unless the information is reasonably necessary for one or more of the AFC's functions or activities.

The AFC will not collect sensitive information about an individual unless the individual consents to the collection of the information and the information is reasonably necessary for one or more of the AFC's functions or activities.

Sensitive information includes information about an individual's:

• health (including predictive genetic information)
• racial or ethnic origin
• political opinions
• membership of a political association, professional or trade association or trade union
• religious beliefs or affiliations
• philosophical beliefs
• sexual orientation or practices
• criminal record
• biometric information that is to be used for certain purposes
• biometric templates.

APP 4. Dealing with unsolicited personal information

If the AFC receives unsolicited personal information it will determine whether or not it could have collected the information under APP 3 if it had solicited it.

If the AFC determines that it could not have collected the personal information, and if the information is not contained in a Commonwealth record, the AFC will destroy the information or ensure that the information is de-identified.

APP 5. Notification of the collection of personal information

When the AFC collects personal information about an individual, the AFC will advise the individual of relevant matters including:

• the identity and contact details of the AFC;
• the purposes for which the AFC collects the personal information;
• that the AFC privacy policy contains information about how the individual may complain about a breach of the APPs;
• whether the AFC is likely to disclose the personal information to overseas recipients.

APP 6. Use or disclosure of personal information

Any of the information the AFC collects from customers may be used in one of the following ways:

• To personalise the experience (information helps the AFC to better respond to individual needs);
• To improve customer service (information helps to more effectively respond to customer service requests and support needs);
• To process transactions. Information, whether public or private, will not be sold, exchanged, transferred, or given to any other company for any reason whatsoever, without consent, other than for the express purpose of delivering the purchased product or service requested, or for secondary purposes where the customer would reasonably expect the AFC to use or disclose the information in accordance with the APPs;
• To send periodic emails. The email address provided for order processing may be used to send information and updates pertaining to orders, in addition to receiving occasional company news, updates, related product or service information.

If at any time a customer would like to unsubscribe from receiving future emails, detailed unsubscribe instructions are included at the bottom of each email.

If the AFC holds personal information about an individual that was collected for a particular purpose (the primary purpose), the AFC will not use or disclose the information for another purpose (the secondary purpose) unless:

• the individual has consented to the use or disclosure of the information; or

• the individual would reasonably expect the AFC to use or disclose the information for the secondary purpose and the secondary purpose is:
  • if the information is sensitive information — directly related to the primary purpose; or
  • if the information is not sensitive information — related to the primary purpose.

This principle does not apply to the use or disclosure by an organisation of personal information for the purpose of direct marketing.

APP 7. Direct marketing

If the AFC holds personal information about an individual, the AFC will not use or disclose the information for the purpose of direct marketing except if:

• the AFC collected the information from the individual; and
• the individual would reasonably expect the AFC to use or disclose the information for that purpose; and
• the AFC provides a simple means by which the individual may easily request not to receive direct marketing communications from the AFC; and
• the individual has not made such a request to the AFC.

The AFC may use or disclose sensitive information about an individual for the purpose of direct marketing if the individual has consented to the use or disclosure of the information for that purpose.

If the AFC uses or discloses personal information about an individual for the purpose of direct marketing by the AFC or the purpose of facilitating direct marketing by other organisations, the individual may request not to receive direct marketing communications from the AFC or request the AFC not to use or disclose the information for the purpose of direct marketing.

To the extent that it does not breach the APPs, the AFC does not sell, trade, or otherwise transfer to outside parties personally identifiable information. This does not include trusted third parties who assist the AFC in operating its website, conducting its business, or servicing customers, so long as those parties agree to keep this information confidential. The AFC may also release information when it believes release is appropriate to comply with the law, enforce its site policies, or protect its or others rights, property, or safety. However, non-personally identifiable visitor information may be provided to other parties for marketing, advertising, or other uses.

APP 8. Cross-border disclosure of personal information

Before the AFC discloses personal information about an individual to a person (the overseas recipient):

• who is not in Australia or an external Territory; and
• who is not the AFC or the individual;

the AFC will take such steps as are reasonable in the circumstances to ensure that the overseas recipient does not breach the APPs (other than APP 1) in relation to the information.

At the request of individuals, the AFC may organise a linguistic stay through the Alliance Française network in France.  The AFC will need to disclose relevant personal information to the Alliance Française of choice.

All customer data is stored and backed up to servers residing in Australia.

APP 9. Adoption, use or disclosure of government related identifiers

The AFC will not adopt a government related identifier of an individual as its own identifier of the individual unless:

• the adoption of the government related identifier is required or authorised by or under an Australian law or a court/tribunal order; or
• prescribed by the regulations.

The AFC will not use or disclose a government related identifier of an individual unless the use or disclosure of the identifier is reasonably necessary for the AFC to verify the identity of the individual for the purposes of the AFC's activities or functions.

APP 10. Quality of personal information

The AFC will take such steps as are reasonable in the circumstances to ensure that the personal information that it collects is accurate, up-to-date and complete.

The AFC will take such steps as are reasonable in the circumstances to ensure that the personal information that it uses or discloses is, having regard to the purpose of the use or disclosure, accurate, up-to-date, complete and relevant.

APP 11. Security of personal information

If the AFC holds personal information, it will take such steps as are reasonable in the circumstances to protect the information from misuse, interference and loss; and from unauthorised access, modification or disclosure.

If the AFC holds personal information about an individual; and

• it no longer needs the information for any purpose for which the information may be used or disclosed; and
• the information is not contained in a Commonwealth record; and
• the AFC is not required by or under an Australian law, or a court/tribunal order, to retain the information;
• the AFC will take such steps as are reasonable in the circumstances to destroy the information or to ensure that the information is de-identified.

The AFC makes use of cookies to measure website experience and for tracking purposes.

The AFC uses Secure Socket Layer (SSL) for capture and to administer customer data.

APP 12. Access to personal information

If the AFC holds personal information about an individual, the AFC will, on request by the individual, give the individual access to the information except if:

• the AFC reasonably believes that giving access would pose a serious threat to the life, health or safety of any individual, or to public health or public safety; or
• giving access would have an unreasonable impact on the privacy of other individuals; or
• the request for access is frivolous or vexatious; or
• the information relates to existing or anticipated legal proceedings between the AFC and the individual, and would not be accessible by the process of discovery in those proceedings; or
• giving access would reveal the intentions of the AFC in relation to negotiations with the individual in such a way as to prejudice those negotiations; or
• giving access would be unlawful; or
• giving access would reveal evaluative information generated within the AFC in connection with a commercially sensitive decision-making process.

APP 13. Correction of personal information

If personal details, such as address, name or email address, change, customers are asked to tell the AFC straight away.

If the AFC holds personal information about an individual and the AFC is satisfied that, having regard to a purpose for which the information is held, the information is inaccurate, out of date, incomplete, irrelevant or misleading; or if the individual requests the entity to correct the information, the AFC must take such steps as are reasonable in the circumstances to correct that information.

If the AFC refuses to correct the personal information as requested by the individual, the AFC will give the individual a written notice that sets out:

• the reasons for the refusal except to the extent that it would be unreasonable to do so; and
• the mechanisms available to complain about the refusal; and
• any other matter prescribed by the regulations.

Our Privacy Policy

Our Privacy Policy is available on our website at www.afcanberra.com.au

We encourage you to check our website regularly for any updates to the Policy.

How to contact us

If you wish to access your personal information or have any complaints

You can contact us at:

• Email at administration@afcanberra.com.au
• Telephone : 02 6257 6696
• Writing to the Alliance Française de Canberra

PO Box 6125, O’Connor ACT 2602

and we will  respond appropriately.