What is personal information?

Personal information is essentially information or an opinion about an identified individual, or an individual who is reasonably identifiable, whether the information or opinion is true or not and whether recorded in a material form or not.

Sensitive information is a subset of personal information and is essentially information or opinion about a person’s racial or ethnic origin, political opinions, membership of a political, trade or professional association or a trade union, religious or philosophical beliefs or affiliations, sexual orientation or practices, criminal record or health, genetic or biometric information or templates.

See the Act for full details of what is and is not included.

What information do we collect and hold?

The kinds of personal information we collect and hold vary depending on the services and/or products we are providing, but generally can include:

• Your contact information such as full name (first and last), e-mail address, current postal address, delivery address (if different to postal address) and phone numbers;
• Details relating to your education and qualifications;
• Details relating to your employment (if applicable) or your previous employment;
• Your date of birth and gender;
• Information relevant to our products and/or services;
• Other information such as your opinions, statements and endorsements collected personally or via surveys and questionnaires, including but not limited to your views on the products and/or services offered by us; and
• Any relevant payment or billing information, (including but not limited to bank account details, direct debit, credit card details, billing address).

The type of sensitive information we may collect generally includes:

• criminal record;
• membership of a professional or trade association.

How do we collect and hold personal information?

We only collect personal information by lawful and fair means and where it is reasonably necessary for, or directly related to, one or more of our functions or activities.

Unless it is unreasonable or impracticable for us to do so, or as provided otherwise under this Privacy Policy, we will collect your information directly from you, your employer or your agents.

We may obtain personal information indirectly and who it is from can depend on the circumstances. We will usually obtain it from another NIBA member or insurance intermediaries, anyone appointed to review and handle complaints or disputes, professional indemnity and other insurers and anyone appointed to handle a claim thereunder, regulatory or other law enforcement or government bodies, and persons who we enter into business alliances with.

We attempt to limit the collection and use of sensitive information from you unless we are required to do so in order to provide our services and/or products to you. However, we do not collect sensitive information without your consent.

We hold the personal information we collect within our own data storage devices or with a third party provider of data storage. We discuss the security of your personal information below.

The purposes for which we collect, hold, use and disclose your personal information.

We collect, hold, use and disclose your personal information where it is reasonably necessary for, or directly related to, one or more of our functions or activities, to offer and administer our various products and/or services or otherwise as permitted by law.

Such purposes include to identify you, responding to enquiries, providing assistance, maintaining and administering our products and/or services (for example the NIBA Members Practice Manual, NIBA Brochures, Education and Learning Programmes, Client Bulletin, audit services, NIBA Gazette, QPIB and the Insurance Brokers Code of Practice); processing payments; processing survey or questionnaire responses; market research and the collection of general statistical information using common internet technologies such as cookies; providing you with marketing information regarding other products and/or services (of ours or a third party); quality assurance and training purposes; performing administrative operations (including accounting and risk management) and any other purpose identified at the time of collecting your information.

We also use it to help to develop and identify products and/or services that may interest our members, conduct market or consumer satisfaction research, develop, establish and administer alliances and other arrangements with other organisations in relation to the promotion, administration and use of our respective services and/or products. For more information on our services and/or products please contact us.

We do not use or disclose personal information for any purpose that is unrelated to our services and/or products and that you would not reasonably expect (except with your consent). We will only use your personal information for the primary purposes for which it was collected or as consented to.

We do not sell, trade, or rent your personal information to others.

We have a duty to maintain the confidentiality of our members’ affairs, including personal information. Our duty of confidentiality applies except where disclosure of your personal information is with your consent or compelled by law. In some cases, information may be made available to your employer.

We usually disclose personal information to third parties who assist us or are involved in the provision of our services and/or products and your personal information is disclosed to them only in connection with the services and/or products we provide to you or with your consent. We may also disclose it for direct marketing purposes explained in more detail below.

The third parties include: our related companies and our representatives who provide services for us, our agents or contractors, our insurers, other insurers and reinsurers, your agents, premium funders, other insurance intermediaries, our legal, accounting and other professional advisers, data warehouses and consultants, social media and other similar sites and networks, publishers of industry newsletters, magazines and journals, investigators, loss assessors and adjusters, credit agencies, training providers, your employer, anyone either of us appoint to review and handle complaints or disputes, regulators or government bodies, other industry associations, and our alliance and other business partners and any other parties where permitted or required by law.

These parties are prohibited from using your personal information except for the specific purpose for which we supply it to them and we take such steps as are reasonable to ensure that they are aware of the provisions of this Privacy Policy in relation to your personal information.

We also use personal information to develop, identify and offer services and/or products that may interest you, conduct market or customer satisfaction research. From time to time we may seek to develop arrangements with other organisations that may be of benefit to you in relation to promotion, administration and use of our respective services and products. See direct marketing explained in more detail further below.

We do not use sensitive information to send you direct marketing communications without your express consent.

If we do propose to disclose or use your personal information other than for the purposes listed above, we will first seek your consent prior to such disclosure or use.

If we give third parties (including their agents, employees and contractors) your personal information, we require them to only use it for the purposes we agreed to.

What happens if you don’t give us your personal information?

If you choose not to provide us with the information we have requested, we may not be able to provide you with our services or products or properly manage and administer the services and/or products provided to you or others.

Anonymity and Pseudonymity

You have the option of not identifying yourself or using a pseudonym provided we are not required or authorised by or under an Australian law, or a court/tribunal order to deal with individuals who have identified themselves or it not impracticable for us to deal with you on this basis.

It will generally be impracticable for you to deal with us anonymously or using a pseudonym if you wish to use our services or products.

What we expect of you and third parties we deal with

When you provide us with personal information about other individuals, we rely on you to have made them aware that you will or may provide their information to us, the purposes we use it for, the types of third parties we disclose it to and how they can access it (as described in this document). If it is sensitive information we rely on you to have obtained their consent to the above. If you have not done either of these things, you must tell us before you provide the relevant information.

If we give you personal information, you and your representatives must only use it for the purposes we agreed to.

Where relevant, you must meet the requirements of the Australian Privacy Principles set out in the Privacy Act 1988, when collecting, using, disclosing and handling personal information on our behalf.

You must also ensure that your agents, employees and contractors meet the above requirements.

Security of your personal information

We endeavour to protect any personal information that we hold from misuse and loss, unauthorised access, modification and disclosure.

We maintain physical security over our paper and electronic data stores and premises, such as locks and security systems. We also maintain computer and network security; for example, we use firewalls (security measures for the Internet) and other security systems such as user identifiers and passwords to control access to computer systems where personal information is stored.

Transfer of information overseas

Your personal information may be disclosed to some of our service providers who are located overseas. Who they are may change from time to time. You can contact us for more information, and a list of countries we deal with from time to time is set out at the bottom of this policy. When we send information overseas, in some cases we may not be able to take reasonable steps to ensure they do not breach the Privacy Act and they may not be subject to the same level of protection or obligations that are offered by the Act. By proceeding to acquire our services and/or products you agree that you cannot seek redress under the Act or against us (to the extent permitted by law) and may not be able to seek redress overseas.

Accuracy of and Access to your Personal Information

We will take reasonable steps to ensure that the personal information you provide is accurate, complete and up to date, whenever it is used, collected or disclosed.

Throughout our dealings with you we will take reasonable steps to confirm the details of your personal information we hold and ask you if there are any changes required.

The accuracy of personal information depends largely on the information you provide to us, so we rely on you to:

• let us know if there are any errors in your personal information you become aware of; and
• keep us up-to-date with changes to your personal information (such as your name or address).

You are entitled to access your personal information if you wish and request correction if required except in some exceptional circumstances provided by in law. For example, we may refuse access where the:

• information may have an unreasonable impact on the privacy of others;
• request is frivolous or vexatious;
• information relates to existing or anticipated legal proceedings and would not be accessible by the process of discovery in those proceedings;
• information would reveal our intentions in relation to negotiations in such a way as to prejudice those negotiations.

Where providing access would reveal evaluative information generated by us in connection with a commercially sensitive decision-making process, we will provide an explanation for the decision rather than direct access to the information.

If we refuse access or to give access in the manner requested by you we will let you know why in writing and provide you with details about how to make a complaint about the refusal.

If we make a correction to your personal information we may retain a copy of the previous information for our records or as required by law.

If you wish to access your personal information please contact us.

In most cases we do not charge for receiving a request for access to personal information or for complying with a correction request.

Direct Marketing

We may use your personal information, including any email address you give to us, to provide you with information and to tell you about our services, products and/or events or any other direct marketing activity (including third party products, services and/or events which we consider maybe of interest to you). Without the limitation just described, if it is within your reasonable expectations that we send you direct marketing communications given the transaction or communication you have had with us, then we may also use your personal information for the purpose of sending you direct marketing communications which we may consider to be of interest to you. We may request our related parties to contact you about services and/or products that may be of interest to you.

Our Website

You are able to visit our website without providing any personal information. We will only collect personal information through our websites with your prior knowledge for example where you submit an enquiry or application online.

Email addresses are only collected if you send us a message and will not be automatically added to a mailing list.

Cookies

A cookie is a small string of information that a website transfers to your browser for identification purposes. The cookies we use may identify individual users.

• Cookies can either be “persistent” or “session” based. Persistent cookies are stored on your computer, contain an expiration date, and are mainly for the user’s convenience.
• Session cookies are short-lived and are held on your browser’s memory only for the duration of your session; they are used only during a browsing session, and expire when you quit your browser.
• We may use both session and persistent cookies. This information may be used to personalise your current visit to our websites or assist with analytical information on site visits.
• Most internet browsers can be set to accept or reject cookies. If you do not want to accept cookies, you can adjust your internet browser to reject cookies or to notify you when they are being used. However, rejecting cookies may limit the functionality of our website.

Complaints regarding the handling of your personal information

If you believe:

• your privacy may have been prejudiced;
• we or our representatives have breached the Australian Privacy Principles or an APP code,

then you have the right to make a complaint about the matter.

In the first instance, your complaint should be addressed in writing to us (see How to contact us and opt out rights section for contact details). We will investigate the matters raised by you and respond directly to you.

If you are dissatisfied with our response, or you have not received a response from us of any kind to your complaint within 30 days, you should refer the matter to the Office of the Australian Information Commissioner (OAIC) in accordance with the Act.

OAIC can be contacted on 1300 363 992 or at www.oaic.gov.au.

Updating this Privacy Policy

This Privacy Policy is current from 12 March 2014. In the event that this Privacy Policy or any part thereof is amended or modified in the future, the revised version will be available at our office or on our website.

How to contact us and opt out rights

If you wish to gain access to your personal information, want us to correct or update it, have a complaint about a breach of your privacy, wish to withdraw your consent to any of the uses of your information including receiving offers of products and/or services from us, or have any other query relating to our Privacy Policy, please contact us.

You can also obtain information on privacy issues in Australia on the Office of the Australian Information Commissioner (“OAIC”) website at www.oaic.gov.au or by contacting the OAIC by email at enquiries@oaic.gov.au or by calling on 1300 363 992.

Transfer of information overseas

NIBA may transfer information to business associates and suppliers in the following countries:

Belgium
Canada
France
Hong Kong
Indonesia
Ireland
Italy
Malaysia
New Zealand
Nigeria
Philippines
Singapore
South Africa
Thailand
United Kingdom
United States of America