Why and how the InPlace collects and uses personal information

The INPLACE collects personal information necessary to carry out our business, including one or more of our functions of providing high quality residencies for artists and researchers, public workshops and exhibitions and/or performances. We may also collect personal information for other lawful uses in connection with the INPLACE’s activities consistent with this privacy policy.

The purposes for which we usually collect and use personal information relate to circumstances when we receive, respond to or action:

• purchase of a workshop ticket either at the INPLACE or online purchase of an INPLACE product;
• enrolments in programs and registration for events including talks, performances and workshops;
• subscriptions to our e-newsletter;
• donations, bequests, sponsorship and other support;
• requests for information or brochures and other general inquiries;
• venue hire and events arrangements;
• recruitment processes (including for volunteers, internships and work experience);
• injuries or incidents that occur at sites operated by INPLACE;
• interaction with INPLACE through our website or through social networking activities including, but not limited to, Instagram.

Through these interactions and by making available to INPLACE your personal information for our associated collection and use, you are giving us permission to send you information about upcoming events, programs, products and services offered by INPLACE that may be of interest to you.

We also collect and use your personal information for market research purposes, to market online services and to innovate and remain client-focused in our delivery of products and services.

We collect personal information directly from you. We may collect and update information over the phone, by email, over the internet, including through your social networking interactions with INPLACE, in person, in writing or if you participate in an INPLACE survey.

We may also collect personal information from third parties in ways that you would expect.

Type of Personal Information We Collect

The type of personal information we generally collect includes your name, email, gender, postcode, postal address and contact numbers as well as any additional information you provide to us, or authorise us to collect, as part of your interaction with INPLACE. For example, it may be necessary to collect more information for the processing of application for residencies, grants or assistance or enrolling you in a program. In the case of our recruitment activities, we may also collect information about you from third parties who you have nominated as referees.

Closed Circuit Television (CCTV) is in use on the INPLACE’s premises outside only for security and safety purposes. CCTV footage is likely to capture pictures or video footage of individuals. Footage is accessed by persons authorised to do so and may be provided to law enforcement agencies. By attending INPLACE’s premises you consent to the capture and storage of your image on CCTV for use in accordance with this privacy policy.

We do not collect sensitive information such as your political or religious beliefs or sexual preference unless you consent to its collection. We may collect details for statistical purposes such as ethnic background. This type of information can assist us to better develop and deliver programs.

Specific Rights of European Residents

INPLACE is committed to ensuring its compliance with the GDPR. Although our Privacy Policy explains how INPLACE meets all of its obligations for Australian individuals, INPLACE may also have some individuals who are habitually located in the European Union (‘EU Residents’) who have additional rights in respect of their Personal Data.

Personal Data is defined as: “Any information relating to an identifiable person who can be directly or indirectly identified in particular by reference to an identifier”. This should be considered fundamentally interchangeable with the Australian expression “Personal Information” for the purposes of this Privacy Policy.

Under the GDPR, INPLACE is primarily a “controller” of Personal Data, as opposed to being a “processor”. As part of its GDPR compliance, INPLACE provides its services in a way that ensures:

• Personal Data (i.e. Personal Information) is:
  • processed fairly, lawfully and in a transparent manner; and
  • collected and processed only for specified and lawful purposes.
• Processed Personal Data (i.e. Personal Information that is used, held or disclosed by INPLACE) is:
  • adequate, relevant and not excessive;
  • accurate and, where necessary, kept up to date;
  • kept secure, and not longer than necessary;
  • not transferred to countries outside the European Union without adequate protection; and
  • treated in accordance with individuals’ legal rights.

Whilst INPLACE strives to provide you with appropriate access and control over your data, individuals covered by the GDPR are also able to:

• prescriptively restrict, limit or otherwise provide instructions to INPLACE regarding how INPLACE can use their Personal Data. This includes being able to object to how and why their Personal Data is used (e.g. by the removal of their consent for particular functions);
• request the erasure (i.e. deletion) of their information; and
• request INPLACE to provide all Personal Data held about them in a portable format, meaning in a way that is structured, commonly used and machine-readable. Users who exercise this right to data portability are also able to direct INPLACE to transmit this data to other entities who they intend to allow to process their Personal Data.

INPLACE will allow and assist individuals who are EU Residents to exercise these rights, unless we have compelling and legitimate legal grounds not to (e.g. a legal obligation under Australian legislation, or if the Personal Data has been fully anonymised).

InPlace’s Interaction with you via the Internet and Social Media

Cookies

INPLACE displays ads for current and upcoming exhibitions on the internet and social media. INPLACE adds cookies to users’ browsers and uses web beacons and measurement software and tools on our website to enable us to tailor ads based on prior visits to the INPLACE website. Cookies are small files that a website can store on a user’s computer and are used for keeping the ‘state of a user session’, that is remembering who you are from a page requesting information through to supplying it. The information includes how often users visit the site, what pages they visit, what links they click, what geolocation the visit originated in, what browser they use, what operating system they use, and what other sites they visited prior to coming to our site.

You may opt out of the use of cookies by disabling certain functions in your web browser or by visiting the Network Advertising Initiative opt-out page. However, in doing so, you may be unable to access certain pages or content on our website.

Links to Other Sites

INPLACE provides links to websites of other organisations with which we collaborate. Some of those websites allow interaction and sharing of content including social media buttons such as iTunes, Google play, Facebook, Twitter, Instagram and YouTube. These linked sites, applications and widgets are not under INPLACE’s control and we cannot accept responsibility for the conduct of companies linked to the INPLACE websites, or their collection of information through these third-party applications or widgets. Before disclosing information on any other website or using these applications or widgets you should examine the terms and conditions of using that website and the relevant third party’s data collection practices and privacy policy.

ISP Activity Logs

When you look at this website, our Internet Service Provider may make a record of your visit or log information such as your server address, your top-level domain name (for example .com, .gov, .au), the date and time of the visit to the site, the pages accessed and documents downloaded, the previous site visited, and the type of browser used.

No attempt is, or will be, made to identify users browsing activities except, in the unlikely event of an investigation, where a law enforcement agency may exercise a warrant to inspect activity logs.

Anonymity

INPLACE will provide individuals with the opportunity to remain anonymous or to use a pseudonym in their dealings with us where it is lawful and practicable (for example, when making a general enquiry). Generally, it is not practicable or lawful for INPLACE to deal with individuals anonymously or pseudonymously on an ongoing basis. If we do not collect personal information about you, you may be unable to participate in or have access to our events, programs or activities. Personal information and contact details are also required by us to allow us to issue a tax-deductible receipt and to register you for certain events, programs and activities.

How We Hold Information

We store information in a number of Australian resident secure databases (including trusted third-party storage providers), paper-based files or other electronic record keeping methods. Personal information may be collected in paper-based document and converted to electronic form for use or storage (with the original paper-based documents either archived or securely destroyed). We take reasonable steps to protect your personal information from misuse, interference and loss and from unauthorised access, modification or disclosure.

INPLACE uses physical security and other measures to ensure that personal information is protected from misuse, interference and loss and from unauthorised access, modification and disclosure.

We maintain computer and network security by using firewalls, user identifiers and passwords to control access to our computer system. Donations and registrations made on the INPLACE website use encryption methods and credit card data is stored using systems compliant with the Payment Card Industry Data Security Standard.

We also take steps to destroy or de-identify information that we no longer require. In some cases there are statutory requirements for retaining information for a prescribed period of time.

Marketing Promotions

INPLACE uses and discloses the personal information it collects to communicate directly with you to promote its goods and services. You can unsubscribe using the unsubscribe link at the bottom of our electronic direct marketing communications. You may also contact INPLACE to request not to receive direct marketing communications by emailing admin@inplace.org.au. If you opt-out of receiving marketing material from us, please note that INPLACE may still contact you in relation to its ongoing relationship with you. For example, if you are an INPLACE Donor or Volunteer we may still send you information relevant to that relationship with us.

Disclosure of Personal Information

We do not sell personal information. We may disclose your personal information for the purposes explained at the time of collection, or otherwise as set out in this privacy policy. We will not disclose your personal information for other purposes without first seeking your consent, unless authorised or required by law. INPLACE may share personal information such as your email address with third parties to enable them to provide a service, such as information about an upcoming event, when they have a legitimate business relationship with us.

INPLACE may disclose information to trusted third parties engaged to assist with services including data processing, data analysis, information technology services and support, website maintenance/development, venue and event promoters, printing, record archiving, data mailing and market research. Except as provided below, the third parties to which we disclose personal information are located in Australia. We take steps to require any such third parties to protect the privacy and security of your personal information and to only use it for the purpose for which it is disclosed.

Disclosure of Information to Overseas Recipients

INPLACE does not typically or routinely disclose personal information to overseas recipients. Unless consent has been given, or an exception under the Australian Privacy Principles applies, INPLACE will only disclose personal information to overseas recipients where reasonable steps have been taken to ensure the overseas recipient does not breach the Australian Privacy Principles in relation to your personal information.

Our Response to a Data Breach

In the event of a data breach, such as the unauthorised loss, use or disclosure of your personal information, we will assess and respond in line with our applicable policies and procedures, which incorporate the requirements contained in the Privacy Act. Pursuant to our obligations under the Privacy Act, we will notify you where your personal information is involved in an eligible data breach that is likely to result in serious harm. Such notification will also include making recommendations about the steps you should take in response to the breach. Where required by law, the Australian Privacy and Information Commissioner will also be notified of an eligible data breach.

Your Personal Information – How to Access and Correct it

To request access to your personal information, please contact Admin@InPlace.org.au. We will take reasonable steps to ensure that the personal information we collect, use or disclose is accurate, complete and up-to-date. If your personal details change, such as your contact details, or if you consider the information held by us is inaccurate, out-of-date, incomplete, irrelevant or misleading, please contact us to correct or update your details.

We undertake to promptly acknowledge any requests for access and correction to your personal information and will take reasonable steps to correct the information. A request to remove or delete personal information may not be possible to comply with as certain personal information must be retained by INPLACE for a specific period as specified by applicable legislative and regulatory requirements. In limited circumstances, a request to access, correct or delete personal information may be declined in accordance with the Australian Privacy Principles. In such instances, INPLACE will provide a reason for its decision.

Making a Complaint

You may contact us at any time if you have any questions or concerns about this privacy policy or how your personal information has been handled using the contact details below. If you have contacted INPLACE and your question or concern has not been able to be resolved to your satisfaction, you may make a complaint to us.

All privacy complaints should be directed in writing to admin@inplace.org.au and your complaint will be considered to determine whether there are simple or immediate steps that can be taken to resolve the issue. We will endeavour in the first instance to deal with your complaint and to take any steps necessary to resolve the matter within one to two weeks.

If your complaint requires more detailed consideration or investigation, we will acknowledge receipt of your complaint and will ask you to provide us with further information about the circumstances of the matter that you are complaining about, how you believe your privacy has been interfered with and how you believe your complaint should be resolved.

We will endeavour to acknowledge receipt of the further information within 5 business days of receiving it and to complete our investigation into your complaint in a timely manner. This may include, for example, gathering the relevant facts, locating and reviewing relevant documents and speaking to relevant individuals. In most cases, we expect that complaints will be investigated and a response provided within 30 days of receipt of the information from you. If the matter is more complex and our investigation may take longer, we will write and let you know.

If you consider INPLACE’s response to be unsatisfactory or believe that INPLACE may have breached the Australian Privacy Principles or the Privacy Act, a complaint may be made to the Office of the Australian Information Commissioner.

The Office of the Australian Information Commissioner can be contacted by telephone 1300 363 992 or via the Office of the Australian Information Commissioner website.