InPlace’s Commitment to Privacy
InPlace Projects Incorporated (INPLACE) is committed to managing personal information in accordance with the Australian Privacy Principles contained in the Privacy Act 1988 (Cth) and, where applicable, the European Union’s General Data Protection Regulations (GDPR).
Personal information is information or an opinion about an identifiable individual, or an individual who is reasonably identifiable. The information or opinion does not have to be true or recorded in a material form.
Why and how the InPlace collects and uses personal information
The purposes for which we usually collect and use personal information relate to circumstances when we receive, respond to or action:
- purchase of a workshop ticket either at the INPLACE or online purchase of an INPLACE product;
- enrolments in programs and registration for events including talks, performances and workshops;
- subscriptions to our e-newsletter;
- donations, bequests, sponsorship and other support;
- requests for information or brochures and other general inquiries;
- venue hire and events arrangements;
- recruitment processes (including for volunteers, internships and work experience);
- injuries or incidents that occur at sites operated by INPLACE;
- interaction with INPLACE through our website or through social networking activities including, but not limited to, Instagram.
Through these interactions and by making available to INPLACE your personal information for our associated collection and use, you are giving us permission to send you information about upcoming events, programs, products and services offered by INPLACE that may be of interest to you.
We also collect and use your personal information for market research purposes, to market online services and to innovate and remain client-focused in our delivery of products and services.
We collect personal information directly from you. We may collect and update information over the phone, by email, over the internet, including through your social networking interactions with INPLACE, in person, in writing or if you participate in an INPLACE survey.
We may also collect personal information from third parties in ways that you would expect.
Type of Personal Information We Collect
The type of personal information we generally collect includes your name, email, gender, postcode, postal address and contact numbers as well as any additional information you provide to us, or authorise us to collect, as part of your interaction with INPLACE. For example, it may be necessary to collect more information for the processing of application for residencies, grants or assistance or enrolling you in a program. In the case of our recruitment activities, we may also collect information about you from third parties who you have nominated as referees.
We do not collect sensitive information such as your political or religious beliefs or sexual preference unless you consent to its collection. We may collect details for statistical purposes such as ethnic background. This type of information can assist us to better develop and deliver programs.
Specific Rights of European Residents
Under the GDPR, INPLACE is primarily a “controller” of Personal Data, as opposed to being a “processor”. As part of its GDPR compliance, INPLACE provides its services in a way that ensures:
- Personal Data (i.e. Personal Information) is:
- processed fairly, lawfully and in a transparent manner; and
- collected and processed only for specified and lawful purposes.
- Processed Personal Data (i.e. Personal Information that is used, held or disclosed by INPLACE) is:
- adequate, relevant and not excessive;
- accurate and, where necessary, kept up to date;
- kept secure, and not longer than necessary;
- not transferred to countries outside the European Union without adequate protection; and
- treated in accordance with individuals’ legal rights.
Whilst INPLACE strives to provide you with appropriate access and control over your data, individuals covered by the GDPR are also able to:
- prescriptively restrict, limit or otherwise provide instructions to INPLACE regarding how INPLACE can use their Personal Data. This includes being able to object to how and why their Personal Data is used (e.g. by the removal of their consent for particular functions);
- request the erasure (i.e. deletion) of their information; and
- request INPLACE to provide all Personal Data held about them in a portable format, meaning in a way that is structured, commonly used and machine-readable. Users who exercise this right to data portability are also able to direct INPLACE to transmit this data to other entities who they intend to allow to process their Personal Data.
INPLACE will allow and assist individuals who are EU Residents to exercise these rights, unless we have compelling and legitimate legal grounds not to (e.g. a legal obligation under Australian legislation, or if the Personal Data has been fully anonymised).
InPlace’s Interaction with you via the Internet and Social Media
INPLACE displays ads for current and upcoming exhibitions on the internet and social media. INPLACE adds cookies to users’ browsers and uses web beacons and measurement software and tools on our website to enable us to tailor ads based on prior visits to the INPLACE website. Cookies are small files that a website can store on a user’s computer and are used for keeping the ‘state of a user session’, that is remembering who you are from a page requesting information through to supplying it. The information includes how often users visit the site, what pages they visit, what links they click, what geolocation the visit originated in, what browser they use, what operating system they use, and what other sites they visited prior to coming to our site.
Links to Other Sites
ISP Activity Logs
When you look at this website, our Internet Service Provider may make a record of your visit or log information such as your server address, your top-level domain name (for example .com, .gov, .au), the date and time of the visit to the site, the pages accessed and documents downloaded, the previous site visited, and the type of browser used.
No attempt is, or will be, made to identify users browsing activities except, in the unlikely event of an investigation, where a law enforcement agency may exercise a warrant to inspect activity logs.
INPLACE will provide individuals with the opportunity to remain anonymous or to use a pseudonym in their dealings with us where it is lawful and practicable (for example, when making a general enquiry). Generally, it is not practicable or lawful for INPLACE to deal with individuals anonymously or pseudonymously on an ongoing basis. If we do not collect personal information about you, you may be unable to participate in or have access to our events, programs or activities. Personal information and contact details are also required by us to allow us to issue a tax-deductible receipt and to register you for certain events, programs and activities.
How We Hold Information
We store information in a number of Australian resident secure databases (including trusted third-party storage providers), paper-based files or other electronic record keeping methods. Personal information may be collected in paper-based document and converted to electronic form for use or storage (with the original paper-based documents either archived or securely destroyed). We take reasonable steps to protect your personal information from misuse, interference and loss and from unauthorised access, modification or disclosure.
INPLACE uses physical security and other measures to ensure that personal information is protected from misuse, interference and loss and from unauthorised access, modification and disclosure.
We maintain computer and network security by using firewalls, user identifiers and passwords to control access to our computer system. Donations and registrations made on the INPLACE website use encryption methods and credit card data is stored using systems compliant with the Payment Card Industry Data Security Standard.
We also take steps to destroy or de-identify information that we no longer require. In some cases there are statutory requirements for retaining information for a prescribed period of time.
INPLACE uses and discloses the personal information it collects to communicate directly with you to promote its goods and services. You can unsubscribe using the unsubscribe link at the bottom of our electronic direct marketing communications. You may also contact INPLACE to request not to receive direct marketing communications by emailing email@example.com. If you opt-out of receiving marketing material from us, please note that INPLACE may still contact you in relation to its ongoing relationship with you. For example, if you are an INPLACE Donor or Volunteer we may still send you information relevant to that relationship with us.
Disclosure of Personal Information
INPLACE may disclose information to trusted third parties engaged to assist with services including data processing, data analysis, information technology services and support, website maintenance/development, venue and event promoters, printing, record archiving, data mailing and market research. Except as provided below, the third parties to which we disclose personal information are located in Australia. We take steps to require any such third parties to protect the privacy and security of your personal information and to only use it for the purpose for which it is disclosed.
Disclosure of Information to Overseas Recipients
INPLACE does not typically or routinely disclose personal information to overseas recipients. Unless consent has been given, or an exception under the Australian Privacy Principles applies, INPLACE will only disclose personal information to overseas recipients where reasonable steps have been taken to ensure the overseas recipient does not breach the Australian Privacy Principles in relation to your personal information.
Our Response to a Data Breach
In the event of a data breach, such as the unauthorised loss, use or disclosure of your personal information, we will assess and respond in line with our applicable policies and procedures, which incorporate the requirements contained in the Privacy Act. Pursuant to our obligations under the Privacy Act, we will notify you where your personal information is involved in an eligible data breach that is likely to result in serious harm. Such notification will also include making recommendations about the steps you should take in response to the breach. Where required by law, the Australian Privacy and Information Commissioner will also be notified of an eligible data breach.
Your Personal Information – How to Access and Correct it
To request access to your personal information, please contact Admin@InPlace.org.au. We will take reasonable steps to ensure that the personal information we collect, use or disclose is accurate, complete and up-to-date. If your personal details change, such as your contact details, or if you consider the information held by us is inaccurate, out-of-date, incomplete, irrelevant or misleading, please contact us to correct or update your details.
We undertake to promptly acknowledge any requests for access and correction to your personal information and will take reasonable steps to correct the information. A request to remove or delete personal information may not be possible to comply with as certain personal information must be retained by INPLACE for a specific period as specified by applicable legislative and regulatory requirements. In limited circumstances, a request to access, correct or delete personal information may be declined in accordance with the Australian Privacy Principles. In such instances, INPLACE will provide a reason for its decision.
Making a Complaint
All privacy complaints should be directed in writing to firstname.lastname@example.org and your complaint will be considered to determine whether there are simple or immediate steps that can be taken to resolve the issue. We will endeavour in the first instance to deal with your complaint and to take any steps necessary to resolve the matter within one to two weeks.
If your complaint requires more detailed consideration or investigation, we will acknowledge receipt of your complaint and will ask you to provide us with further information about the circumstances of the matter that you are complaining about, how you believe your privacy has been interfered with and how you believe your complaint should be resolved.
We will endeavour to acknowledge receipt of the further information within 5 business days of receiving it and to complete our investigation into your complaint in a timely manner. This may include, for example, gathering the relevant facts, locating and reviewing relevant documents and speaking to relevant individuals. In most cases, we expect that complaints will be investigated and a response provided within 30 days of receipt of the information from you. If the matter is more complex and our investigation may take longer, we will write and let you know.
If you consider INPLACE’s response to be unsatisfactory or believe that INPLACE may have breached the Australian Privacy Principles or the Privacy Act, a complaint may be made to the Office of the Australian Information Commissioner.
The Office of the Australian Information Commissioner can be contacted by telephone 1300 363 992 or via the Office of the Australian Information Commissioner website.