Privacy Policy
1. WHERE CAN THIS PRIVACY POLICY BE FOUND?
This Policy is located on Our website and can be accessed via the following link:
Privacy Policy – Leishman Associates (leishman-associates.com.au)
We will make a copy of this policy available to anyone, on request.
2. INTRODUCTION; APPLICATION OF PRIVACY LAWS
3. SOME IMPORTANT EXPRESSIONS DEFINED
Act means the Privacy Act 1988 (Cth)
Events Business means that part of Our business in which We provide conference and other event management services for Our clients.
GDPR means the European Union General Data Protection Regulation.
Personal Information means information which identifies (or can reasonably be used to identify) an
individual and includes “personal data” as defined in the GDPR.
Privacy Principle means an “Australian Privacy Principle”, as set out in the Act.
4. ACCOUNTABILITY
It is the responsibility of all Leishman Associates staff to comply with privacy laws (where applicable) and this policy. We will conduct periodic training for Our staff. Privacy training will be included in the induction of all new staff.
We will, where legally required and otherwise when commercially and legally possible, reasonable and appropriate, require Our contractors to agree to comply with this policy and with the provisions of applicable privacy laws.
5. CONSENT AND OUR APPROACH TO IT
6. WHAT KINDS OF PERSONAL INFORMATION DO WE NORMALLY COLLECT? HOW AND FOR WHAT PURPOSES DO WE COLLECT IT?
The kinds of Personal Information We collect, the way We collect it and Our purpose of doing so, depends on a variety of circumstances, including the nature of Our interaction with that person. The individuals from/about whom We collect information fall into the following main categories:
- clients or staff of clients who may be acquiring or proposing to acquire Our services, including from both Our Event Management Business and Our Association Management Business;
- members of the associations to which We provide services in connection with Our Association Management Business;
- individuals who attend the conferences and other events that We manage for Our clients;
- sponsors and exhibitors as well as media and other stakeholders who support and participate in the conferences and events that We manage; and
- suppliers of goods and services to Us and Our clients, including venues, the suppliers of accommodation and travel and tour providers.
What information do We collect?
For Our Association Management Business
The fact of a person’s membership of an association may comprise sensitive information.
We usually collect names, addresses, phone numbers and email details of staff members of Our clients, participants in the events We manage (including delegates, sponsors, exhibitors, media representatives and others) and of any external suppliers of goods or services with whom We interact in providing Our services.
If We are engaged to make bookings for travel and accommodation, We will collect personal information, which may include sensitive information (see below) and passport details where We are required to make bookings for international travel, or visa applications.
We may collect credit card information if that is the means by which an individual is to pay Us or Our client.
If an individual is to pay for attendance or other participation in a conference/event, We may also collect that person’s credit-card details, or other particulars, as may be necessary to process payments.
Payments made to Us by credit card are subject to, and compliant with, Payment Card Industry (“PCI”) security protocols and We do not retain or store credit card details.
Individuals will need to check with hotels and other providers of accommodation to determine their policies and procedures for retention, storage and use of credit card information.
We may also collect Sensitive Information in the following instances:
- health information, where that may be relevant to:
- the supply of food and beverage to individuals with special dietary needs, at events We manage;
- access to and egress from venues and other facilities and places at which the event takes place or that are connected to the event’s social programme or activities;
- travel and accommodation bookings and visa applications that We may make for individuals; and
- the prevention of the spread of disease, such as COVID-19.
- information concerning an individual’s religious, ethnic or philosophical background or allegiance, where that is relevant to food and beverage supplied to those individuals at
events We manage, or where it is relevant to other cultural aspects of those events; and - where We are managing a conference or other event for a trade or professional association, information pertaining to an individual’s membership of the association is itself sensitive information as defined in the Act.
Purposes and use of collection of Personal Information
For Our Association Management Business
Generally, We collect Personal Information so that We can interact with the individual and/or their business, and, by doing so, provide professional conference and event management services for Our client (the conference/event host) and to manage their conferences and events.
We collect Personal Information for the purposes of managing Our commercial relationship with Our clients, suppliers, conference delegates and other attendees and with other participants, such as sponsors and exhibitors. This enables Us to accept payments, allow admission to, and participation, in conferences or other events, and to manage the delivery of goods and services to the individuals during conferences/events.
If We are engaged to make bookings for travel and accommodation for individuals, We will collect their personal information, which may include sensitive information (see below).
In some cases, for example where We are engaged to make bookings for international travel, or obtain visas, We may ask the individual to provide Us with passport details and other informationneeded for those purposes.
In the case of sponsors and exhibitors, the collection of Personal Information enables Us to manage the delivery of their entitlements and benefits and to manage their participation in the event.
We also collect and retain Personal Information so We can let individuals know of any relevant news on Our current and future events and activities that may be of interest to them.
Where We collect Sensitive Information, it is usually for the purpose of arranging the supply to that individual of culturally-sensitive or health-sensitive services, and goods including food and beverage.
We may also collect health information to ensure that individuals have appropriate access to and egress from venues, facilities and other places at which the event is to take place, or that are connected to the event’s social programme or related activities.
Collection of health information may also enable Us to manage health issues and to help prevent the spread of disease, such as COVID-19. We may collect (and disclose to health authorities) health information to prevent entry of persons with communicable disease to the Event and/or to enable contact tracing during or after the event.
In some instances, We may be required by law or public health order to collect and disclose such health information, to comply with Our obligations under work health and safety laws, or to comply with a duty of care.
Marketing
We may retain Your Personal Information and send You information (including by electronic means) about events hosted by Our clients that We consider You may be interested to participate in.
You have the right at any time to ask that We stop contacting You for marketing purposes. We will comply with any such request.
How do We collect Personal Information?
In the case of attendees at the conferences and events We manage, We usually collect Personal Information direct from attendees, from Our client or from an external or contracted supplier of conference registration services.
Such Personal Information will usually be supplied to Us by electronic means, such as emails, or by attendees themselves when they submit on-line registration forms (usually contained in the event websites that We manage) to register their wish to attend, or to participate as a sponsor, exhibitor,
speaker, or in some other capacity.
In some instances, individuals may register others to participate in or attend events, such as other staff of their business, or as guests at dinners and other social functions.
We may also collect Personal Information about an individual from Our client, the host of the relevant event that We are managing, if they provide Us with contact information of:
- their members, in cases where Our client is an association; and/or
- persons who have participated in previous events hosted by Our client, whether as a delegate, sponsor, exhibitor, supplier, or in some other capacity.
7. HOW DO WE HOLD THE PERSONAL INFORMATION WE COLLECT?
We hold the Personal Information We collect in a variety of ways, including on Our electronic (computer) database (which may be stored “in the cloud”) and, in some cases also on file in hard copy.
We have adopted various security measures to protect this information from unauthorised access (see below).
8. OUR DISCLOSURE OF PERSONAL INFORMATION TO OTHERS
We will only disclose personal information collected by Our Association Management Business, if it is reasonably expected by the individual and reasonably necessary for the performance of Our services. In all other circumstances We will obtain the consent of the individual before disclosure.
Our Events Business:
When We manage a conference or event for a client, We usually do so as agent for and on behalf of Our client. Accordingly, We will usually provide Personal Information collected in the course of managing their conferences and events to Our clients.
If an individual is attending a conference or event We are managing, We usually disclose that person’s Personal Information to sponsors of, and exhibitors at, that event.
We may use on-line platforms, such as “Events Air” to assist with registration and other aspects of Our management of events. Personal information collected from individuals may be entered and stored on those platforms. The providers of those platforms may have access to personal information entered and stored, although usually that would be limited to situations where We have requested technical support.
We will also disclose Personal Information to third parties as the individual would reasonably expect in the provision of Our services. For example, where it is necessary or desirable to ensure that an individual receives appropriate goods or services at an event, We will disclose relevant Personal Information (including, if necessary, Sensitive Information) to suppliers that We or Our client/host engage to provide those goods or services.
The circumstances will determine what information will be disclosed – but We will make reasonable endeavours to ensure that only the information that is necessary or desirable is disclosed.
Some suppliers may need an individual’s Personal Information to provide appropriate goods or services. We may, for example, engage conference registration desk services, ushers and event “hosts”, who may have access to Personal Information.
We may also engage third parties to assist with the development, maintenance or hosting of conference and event websites, databases and other information technology utilised at the conference or event. Those suppliers may have access to personal information We collect, but We will, wherever commercially possible and reasonable, contractually require those suppliers to comply with privacy laws.
If an individual pays for accommodation, We may disclose that person’s credit card details to the hotel or other supplier of accommodation. Those details may be retained by those hotels and suppliers of accommodation as provided in their respective privacy policies and as notified in their privacy collection statements. They may also retain Your credit card information in order to ensure full payment is made for room hire and other goods and services provided to You. We encourage all individuals to request and review the privacy policies and collection statements issued by hotels and other suppliers of accommodation.
In some cases, We may need to pass on Sensitive Information, where this is necessary to arrange the supply of culturally sensitive goods or services to the individual or for health reasons. For example, We may need to advise a venue, or food and beverage supplier, if the individual has special dietary requirements that may be based on religious or philosophical beliefs, or that arise (for example) because the individual has a particular food allergy.
In the case of health information related to communicable disease such as COVID-19, We will disclose it to public health authorities where We are required to do so under law or public health order or regulation, or when the individual consents. We may also disclose it where required to comply with Our work health and safety obligations or with a duty of care.
Additional disclosure – applicable to Association Management Business and Our Events Business:
We may from time to time out-source management of certain “in-house” functions, such as:
- development and management of Our own website and databases;
- the provision, to Our clients, of reports and other information on the events and projects We manage;
- marketing; and/or
- book-keeping and accounting.
In such cases the external service provider may have access to Personal Information that We have collected. In such cases it is Our policy to include, where legally required and otherwise where commercially possible and appropriate, provisions in the contract that oblige the service provider to observe the confidentiality of Personal Information, to comply with Our privacy policy and, applicable privacy laws.
We may also disclose Personal Information to Our professional advisers, such as Our lawyers, accountants and other advisers, in any case where We need to seek advice.
Apart from disclosure to third parties as outlined above, We will not otherwise disclose an individual’s Personal Information to other third parties unless:
- We have the individual’s consent;
- making the disclosure is related (in the case of Sensitive Information, directly related) to the primary purpose for which We have collected the information and We deem that the individual would reasonably have expected Us to make the disclosure;
- We are required to do so by law, in which case We would inform the individual, unless doing so itself is unlawful or would impede or defeat the purpose of the disclosure; or
- in the case of Our Events Business, We are required to hand over Our management of a conference or event to another professional conference organiser or event manager;
- We are negotiating a sale of Our business or a substantial part of it, in which case We will disclose the information only if the other party (with whom We are negotiating) agrees to refrain from use of the information until it completes the purchase.
We will never sell an individual’s Personal Information unless We have the individual’s express consent, or the sale is part of a sale of Our business or a part of Our business, as noted above.
9. OVERSEAS DISCLOSURE
- We are satisfied that privacy laws in the overseas country provide similar protection for the privacy of the individual as applies in Australia under the Act; or
- We obtain the consent of the individual.
10. ON-LINE PRIVACY AND THIS WEBSITE
Cookies
Cookies are text files placed on your computer to collect standard Internet log information and visitor behaviour information. When you visit Our website or an event website, We may collect information from you automatically through cookies or similar technology. For further information,
visit:
www.allaboutcookies.org
We may use cookies in a range of ways to improve your experience on Our website, including keeping you signed in and understanding how you use Our website.
By using cookies, We do not collect any additional personal information about you that can identify you.
There are a number of different types of cookies, however, Our website uses navigational and functionality cookies, known as “session cookies”. These allow Our website to recognize” your computer and remember your previously selected preferences, acting as a kind of “bookmark” to make your visit to Our website more fluid and efficient.
Session cookies are temporary and are erased when you close your browser at the end of your visit. The next time you visit, Our website will not recognise you and will treat you as a new visitor as We do not implant anything in your browser to let the website know that you have visited before.
11. SECURITY OF PERSONAL INFORMATION
It is not appropriate in this Policy to provide specific details of security measures We have adopted to protect the privacy of Personal information We hold. To do so could compromise those security measures.
- physical barriers including locked doors;
- cctv security cameras;
- access technology, password systems and encryption where appropriate; and
- administrative and behavioural protocols for Our staff,
If We are the victim of a cyber-attack or other unauthorised access to Personal Information occurs, We will:
- make all reasonable endeavours to minimise the harm caused to the privacy of individuals’ Personal Information and to prevent similar, further unauthorised incursions; and
- comply with applicable data-breach notification rules.
12. ACCESS AND CORRECTION RIGHTS
We will provide individuals access to the Personal Information which We hold about them, unless the Act (if it applies to Us) would allow Us to deny access to some or all of the Personal Information concerned, or to provide an explanation for a decision instead.
Some circumstances where the Act (if it applies to Us) would allow Us to deny access are where:
- providing access would unreasonably be to the detriment of the privacy of anotherindividual;
- the request is frivolous or vexatious;
- the requested information relates to existing or anticipated legal proceedings between Us and the individual;
- giving access would reveal Our intentions in relation to negotiations with the individual and prejudice those negotiations; or
- providing access would be unlawful or if denying access is required or authorised under law.
This is not an exhaustive list of circumstances where We may have or reserve the right to deny access.
When an individual requests access to Personal Information, We will require a written request, to be sent to Us at the address noted below.
We will acknowledge the access request within 14 days and deal with it within 30 days or earlier. Though We may ask, We will not require an explanation of why the request has been made as a condition of giving access. We will not charge a fee for providing access.
If We determine to deny access to the whole or part of Personal Information requested, We may provide a short explanation, but We will not provide detailed reasoning.
13. GDPR RIGHTS
If the GDPR applies, We will usually be a “data processor” for its purposes.
If it applies, you have the following rights under the GDPR,
- The right to access – You have the right to request Us to provide You with copies of Your Personal Information.
- The right to rectification – You have the right to request Us to correct any information You believe is inaccurate. You also have the right to request Us to complete information You believe is incomplete.
- The right to erasure – You have the right to request Us to erase Your Personal Information, under certain conditions.
- The right to restrict processing – You have the right to request that We restrict the processing of Your Personal Information, under certain conditions.
- The right to object to processing – You have the right to object to Our processing of Your Personal Information, under certain conditions.
- The right to data portability – You have the right to request that We transfer the Personal Information that We have collected to another organisation, or directly to You, under certain conditions.
If You make a request under the GDPR, You must tell Us that the GDPR is the basis of Your request. We will respond to You within one calendar month. If You would like to exercise any of these rights, please contact us at this email address: jenna@leishman-associates.com.au
14. USE OF GOVERNMENT IDENTIFIERS
We will not use government identifiers such as tax file numbers or Medicare numbers as a means of identifying an individual.
15. ANONYMITY
16. CONTACTING US AND COMPLAINTS
If an individual:
- has an enquiry about Our management of Personal Information or privacy procedures;
- wishes to request access to Personal Information;
- wishes to see a copy of this Policy document; or
- wishes to make a complaint about Our handling of Personal Information that individual can contact Us by the following means:
Phone: 61 3 62347844
Email: jenna@leishman-associates.com.au
Postal Address: The Privacy and Data Protection Officer, Leishman Associates Pty Limited,
227 Collins Street, Hobart TAS 7000, attention Paula Leishman.
17. COMPLAINTS PROCEDURE
This section 17 is subject to Our promise to respond to GDPR requests as noted in section 12, above.
Complaints about privacy must be made in writing, addressed to Us as provide in section 16 of this policy. This will allow Us to deal with complaints in a professional, sensitive and consistent manner.
We will acknowledge receipt of a request within 30 days of receiving it and We will respond within a further 30 days of that acknowledgement. We will also make reasonable endeavours to deal with the complaint within that time, assuming that We are able to investigate and ascertain the necessary facts within that time. We will notify the individual if We consider that it is likely to take substantially longer.
If We consider that a complaint is bona fide, the complainant will be given an opportunity to discuss the matter with Us.
After consideration of the complaint and consultation with the individual who has submitted it, We will notify the individual what is to be done, if anything, to redress the complaint.
Also, We will assess whether the complaint demonstrates a systemic problem and will make a determination as to how We can address/rectify such issues so they do not recur.
Paula Leishman
Director,
Leishman Associates Pty Ltd
