Version as at December, 2018
The South East Tasmanian Aboriginal Corporation (SETAC) is a not-for-profit community controlled and Government funded Aboriginal Corporation in South East Tasmania. SETAC provides: health services, aged-care services, education and family services, community services, cultural services, and works in partnership with other organisations
We recognise that the scope and scale of our company means that we touch many lives. As a community business, this is not something that we ever take lightly.
Protecting your privacy and the confidentiality of your personal information is fundamental to the way SETAC does business.
At the time of publication the SETAC consists of the following businesses each of which are bound by this Policy:
The South East Tasmanian Aboriginal Corporation (SETAC)
ABN: 92 219 498 784
Fanny Cochrane Smith Church & Living History Museum
At all times we try to only collect the information we need for the particular function or activity we are carrying out.
The main way we collect personal information about you is when you give it to us. For example, we collect personal information where required to provide health services, aged-care services, education and family services, community services, cultural services, works in partnership with other organisations, memberships, and surveys. Such personal information may comprise of one or more of the following:
We will also collect information that you provide us when signing up to mailing lists and registering for our events, or when submitting feedback on your experience with our websites.
Further, SETAC may collect information from you because we are required or authorised by Australian law, or court or tribunal to collect that information.
Sensitive information is personal information about a person’s racial or ethnic origin, political opinion, membership of a political association, religious beliefs or affiliations, philosophical beliefs, membership of a professional or trade association, membership of a trade union, sexual orientation or practices, criminal record, genetic information or health information.
SETAC will not collect, use or disclose sensitive information about you unless we need the information for one of our functions or activities and we have your consent (or we are legally required to do so).
For example, we may collect health information from you or family member where we respond to a distress call or you request participation in certain tour activities.
There may be occasions when we collect personal information about you from a third party. For example, we may collect personal information from:
Further, in the course of handling and resolving a complaint, data breach, review or an investigation, we may collect personal information (including sensitive information) about you indirectly from publicly available sources or from third parties such as:
Our websites, products, applications, and services may contain links to third-party websites, products, and services. Our products and services may also use or offer products or services from third parties. These websites may store information across multiple countries.
Information collected by third parties, that may include such things as location data or contact details, is governed by their privacy practices. We encourage you to learn about the privacy practices of those third parties.
At the time of publication, our Service Providers and Partners include:
Survey / Campaign Management:
Partners / Stakeholders:
Tasmanian Regional Aboriginal Community Alliance (TRACA)
Tasmanian Aboriginal Health Reference Group (TARHG)
Whenever you visit or interact with any of our websites, we as well as any third party service providers may use a variety of technologies that automatically or passively collect information about how our websites are accessed and used [‘Usage Information’]. Usage Information may include, in part, browser type, operating system, the page served, the time and the preceding page views. This statistical data provides us with information about the use of our websites, such as how many visitors visit a specific page, how long they stay on that page, and which hyperlinks, if any, they ‘click’ on. Usage Information is non-identifying, but if we are to associate it with you as a specific and identifiable person, we then treat is information as Personal Information.
We may also automatically collect your IP address or another unique identifier [‘Device Identifier’] for the computer, mobile device, technology or other devices [collectively, ‘Device’] you use to access our websites. A Device Identifier is a number that is automatically assigned to your Device when you access a website or its servers, and our computers identify your Device by its Device Identifier.
The technologies used on our websites to collect Usage Information, including Device Identifiers, may include:
Small graphic images or other web programming code called pixels, may be included in our websites and email messages. Pixels or similar technologies may be used for a number of purposes, including, without limitation, to count visitors to the websites, to monitor how users navigate the websites, to count how many emails that were sent were actually opened or to determine whether content sent was actually viewed.
We use social networking services such as Facebook, Instagram, Twitter, YouTube, and Google Business to communicate with the public about our work. When you communicate with us using these services we may collect your personal information, but we only use it to help us to communicate with you and the public. The social networking service will also handle your personal information for its own purposes. These services have their own privacy policies. You can access the privacy policies for Facebook, Instagram, Twitter, and YouTube (a Google company) on their websites.
Your consent is important.
SETAC may require your consent to use and/or disclose your information in particular ways. Your consent may either be inferred or expressed.
Inferred Consent is
Expressed consent is for example:
If you no longer want to receive our offers, information on our services and other promotional activities you can ‘opt-out’, or ‘unsubscribe’ from any of our commercial electronic messaging such email, SMS, MMS or IM, or contact us directly.
From time to time SETAC will hold events where images are likely to be taken for various promotion and electronic publications such as email campaigns.
We will at all times ensure to provide as much detail as possible about what the image will be used for and who will be able to see it. By entering a SETAC event, customers:
SETAC will use particular care in the handling the images and other personal information of children. Depending on the age and ability of the child to understand our explanation about what is going to happen with their image and to make a truly informed choice, SETAC will discuss these things with their parent or guardian first.
If SETAC becomes aware that personal information that has been collected relates to a child without the consent of a parent or guardian, we will use reasonable efforts to:
SETAC will also meet the requirements of any other legislation that protects children.
Personal information is only used within SETAC in the provision of services for which it was obtained and may be used to provide customers, through direct marketing, with knowledge of other services and promotions conducted by SETAC. Your personal information is not sold or passed on to third parties for their marketing purposes.
SETAC uses a number of service providers to whom we disclose personal information. These include providers that we have partnered with to provide health services or other providers who host our website servers, manage our accounting, manage our IT, undergo research, and manage our human resources information.
To protect the personal information we disclose we:
We only disclose your sensitive information for the purposes for which you gave it to us or for directly related purposes you would reasonably expect or if you agree, for example, to handle a complaint, or where we respond to a distress call or you request participation in certain tour activities.
SETAC may need to disclose your information to organisations located overseas. From time to time we may choose to use online solutions located overseas to perform direct marketing, undertake surveys, and store data. Also, we only disclose your information to these overseas organisations when it is necessary for the services they provide to SETAC.
When we disclose your information overseas, we are required to take measures to ensure your information is treated in accordance with the standards that apply in Australia.
To ensure that the personal information we collect is accurate, up-to-date and complete we:
We also review the quality of personal information before we use or disclose it.
SETAC protects your personal information from misuse and loss. We also protect it from unauthorised access, modification and disclosure by ensuring that your personal information can only be accessed by people properly authorised to have access.
Under the Privacy Act (Australian Privacy Principles 12 and 13) you have the right to ask for access to personal information that we hold about you and ask that we correct that personal information. You can ask for access or correction by contacting us and we must respond within 30 days. If you ask, we must give you access to your personal information, and take reasonable steps to correct it if we consider it is incorrect, unless there is a law that allows or requires us not to.
We will ask you to verify your identity before we give you access to your information or correct it, and we will try to make the process as simple as possible. If we refuse to give you access to, or correct, your personal information, we must notify you in writing setting out the reasons.
If we make a correction and we have disclosed the incorrect information to others, you can ask us to tell them about the correction. We must do so unless there is a valid reason not to.
If we refuse to correct your personal information, you can ask us to associate with it (for example, attach or link) a statement that you believe the information is incorrect and why.
From 19 December 2018, if we become aware of a suspected personal information data breach we will conduct an appropriate assessment to determine if there is a likely risk of serious harm to any individual associated with the data breach. Where we believe there is a likely risk of serious harm, we will notify the Office of the Australian Information Commissioner and any affected individuals in accordance with our obligations under the law.
If you wish to complain to us about how we have handled your personal information you should do so in writing. If you need help lodging a complaint, you can contact us.
If we receive a complaint from you about how we have handled your personal information we will determine what (if any) action we should take to resolve the complaint.
We will tell you promptly that we have received your complaint and then respond to the complaint within 30 days.
If you are not satisfied with our response you may ask for a review by a more senior Management Official (if that has not already happened), or you can access an external dispute resolution service, or apply to the Office of the Australian Information Commissioner (OAIC) to have your complaint heard and determined. The Privacy Commissioner may be contacted at: www.oaic.gov.au, or email: firstname.lastname@example.org
We may give a copy of the complaint or application to the Office of the Australian Information Commissioner, or other regulatory body or law enforcement agency as required by law.
SETAC Programs & Operations Manager
19 Mary Street, Cygnet, TAS, 7112