1. Background 1.1 The privacy of your personal information is afforded the highest level of importance by Bah Bah Pty Ltd trading as Katuk (ACN 117 351 934) (“Company”).
1.4 The processing of personal information by us will always be in line with the Australian Privacy Principles contained in the Privacy Act 1998 (“Privacy Act”), the General Data Protection Regulation (“GDPR”), and in accordance with country-specific data protection regulations applicable to us. For the purposes of the GDPR we are a data controller.
1.5 We have implemented a number of technical and organisational measures to ensure the protection of personal information processed through our Services.
2.2 For all areas of the Services where consent is given it is just as easily able to be withdrawn through the appropriate account settings on the Website.
3. CHILDREN 3.1 Our Services are not offered to children. We do not knowingly collect personal information from children without parental or guardian consent.
3.2 If you become aware that a child has provided us with information please contact us. Any information provided that is in breach of this provision will be deleted.
4. PERSONAL INFORMATION WE COLLECT 4.1 The kinds of personal information that we may collect and hold from time to time includes:
(a) your contact information, including postal and residential addresses, telephone and facsimile numbers, and email addresses;
(b) details of any service we supply to you at your request;
(c) invoicing and payment details;
(d) data relating to your activity on our websites, including if you are a user of our service platform and information about you is inputted as part of its functionality, and/or via tracking technologies such as cookies;
(e) for job applicants or staff, employment history, educational qualifications, reference checks, payroll information and medical information (where relevant).
4.2 The legal basis for the above processing is based on:
(a) your consent through your voluntary submission of the form/s agreeing to these terms;
(b) the personal information being necessary for the performance of a contract to which you are a party;
(c) carrying out pre-contractual measures; and/or
(d) any other legitimate interests as detailed below.
5. COLLECTION 5.1 We will only collect personal information where it is reasonably necessary to do so for the conduct of our business. Any collection of personal information by us will be fair and lawful and will not be intrusive.
5.2 We will collect personal information about you in the following ways:
(a) if you provide your information by telephone, post, email or facsimile, through our website, or in person;
(b) if you contact us via email or submit your information through our Website on our “Contact Us” webpage located at https://www.katuk.com.au/contact-us/ or our “Masterclasses” webpage located at https://www.katuk.com.au/cocktail-class-south-yarra/ or our LiveChat box;
(c) if you require us to provide Services to you; and/or
(d) if during the course of using our Website or Services either you or a third party input information about you, as part of its functionality.
5.3 We may automatically collect information about how you use our Website, the areas of our Website that you visit, as well as information about your computer or mobile device including your IP address, device ID, physical location, browser and operating system type, and referring URLs, via cookies and other tracking technologies. Some of the information we collect may be anonymous and/or aggregated, while other information may be personal information. We may also collect information about you through analysing your actions with electronic communications we send to you from time to time, including your opening of such communications and clicking on included links. This information is necessary for providing personalised and location-based content as well as for analysing the use of resources, troubleshooting problems, preventing fraud, and improving our services. We may combine this information with information in your account to help prevent fraud.
5.4 If it is reasonable and practical do so, we will collect personal information about you only from you. In the course of operating our business, however, we may collect personal information from third parties such as suppliers, advertisers, mailing lists, recruitment agencies, contractors, clients and business partners. In addition, as part of the peer assessment functionality of our Website and Services, we will collect information about you from others associated with you, most likely your colleagues and collaborators. Some of this may be personal information.
5.5 If we collect personal information about you from a third party in circumstances outside the input requirements associated with our Website and Services we will, where appropriate, request that the third party inform you that we are holding such information, how we will use and disclose it, and that you may contact us to gain access to and correct and update the information.
5.6 When we collect personal information from you, we will take reasonable steps to notify you or ensure you are aware of:
(a) our identity and contact details;
(b) that we have collected your personal information, and whether that collect is required or authorised by law;
(c) the purposes of collection;
(d) the consequences if personal information is not collected (such as if this will affect our ability to provide products or services to you);
(e) our usual disclosures of personal information of the kind collected;
(g) whether we are likely to disclose personal information to overseas recipients, and if practicable, the relevant countries in which they are located.
6. HOLDING OF PERSONAL INFORMATION
6.1 We will hold personal information as either physical records, records on our servers, and records in cloud storage, and in some cases, records on third party servers or cloud storage facilities, which may be located overseas.
6.2 We take active steps to hold all hard copy and electronic records of personal information in a secure manner to ensure that they are protected from misuse, interference and loss, and unauthorised access, modification or disclosure.
6.3 We have procedures in place to destroy or de-identify personal information once it is no longer needed for a valid purpose or required to be kept by law.
7. USE OF PERSONAL INFORMATION
7.2 Generally we will use your personal information:
(a) to conduct our business, generate content and provide customer support and payment services (including updates and improvements);
(b) to administer contracts including to negotiate, execute and or manage a contract with you;
(c) for our administrative, marketing (including direct marketing), planning, product or service development, quality control, survey and research purposes, and our related bodies corporate, contractors and employees or service providers;
(d) to conduct business processing functions including providing Personal information to our related bodies corporate, contractors, service providers or other third parties, including but not limited to providing your information to a contractor and other goods and Services provided in our Services to personalise your experience with our Products and Services, for example, via connectivity with social media services;
(e) to provide your updated personal information to our related bodies corporate, contractors, employees or service providers;
(f) to provide, administer, market and manage our Services, including but not limited to, providing you with customary search results for use in our Services;
(g) to provide you with access to protected areas of the site and to authenticate your account;
(h) to conduct surveys to determine use and satisfaction with our Services;
(j) to verify information for accuracy or completeness (including by way of verification with third parties);
(k) to comply with our legal obligations, a request by a governmental agency or regulatory authority or legally binding court order;
(m)to aggregate and/or make anonymous your personal information, so that it cannot be used, whether in combination with other information or otherwise, to identify you;
(n) to resolve disputes and to identify, test and resolve problems;
(o) to notify you about the Services we provide and Products we sell and updates to the Services and Products from time to time;
(p) to protect a person’s rights, property or safety;
(q) for job applicants or tendering parties, to assess your eligibility for employment by the Company, or engagement by the Company as a contractor;
7.3 In the event that we hold sensitive information about you, we will only disclose or use that information with your consent or if another exception applies under applicable laws.
8. DISCLOSURE OF PERSONAL INFORMATION
8.1.1 Service Providers
126.96.36.199 We may share your personal information with service providers to:
(a) provide you with the Services that we offer you through our Services;
(b) to conduct quality assurance testing;
(c) to facilitate creation of accounts;
(d) to provide technical support;
(e) and/or to provide other services to us.
188.8.131.52 The service providers include:
(a) information technology service providers such as web host providers and analytical providers;
(b) mailing houses;
(c) market research organisations to enable them to measure the effectiveness of our advertising; and
(d) specialist consultants.
184.108.40.206 These third-party service providers are not permitted to use your personal information other than to provide the services requested by us.
8.1.2 Affiliates and Acquirers
8.1.3 Third parties and others you choose to share with:
220.127.116.11 We may disclose your personal information to third parties to whom you expressly ask to us to send the personal information to or to others you directly or indirectly choose for us to disclose your personal information to.
8.2 Please note when you make your information public, your information may become accessible through search engines.
8.3 We will take reasonable steps to ensure that anyone to whom we disclose your personal information respects the confidentiality of the information and abides by the APPs the GDPR or equivalent privacy laws.
9. IF WE CANNOT COLLECT YOUR PERSONAL INFORMATION
9.1 If you do not provide us with the personal information described above, some or all of the following may happen:
(a)We may not be able to provide the requested Products or Services to you, either to the same standard or at all;
(b)We may not be able to provide you with information about Products and Services that you may want; or
(c) We may be unable to tailor the content of our Website to your preferences and your experience of our Website and/or Services may not be as enjoyable or useful.
10. COOKIES POLICY
10.4 You can control and/or delete cookies as you wish.
11. MANAGING YOUR PERSONAL INFORMATION
11.1 Subject to the Privacy Act and the GDPR, you may request to access the personal information we hold about you by contacting us. All requests for access will be processed within a reasonable time.
11.2 Accessing or Rectifying your personal information:
11.2.1 We may, if required, provide you with tools and account settings to access, correct, delete, or modify the personal information you provided to us. You can find out more about how to do this by contacting us. In the event that you are unable to access your account to access or rectify your personal information, you may submit a request to us to correct, delete or modify your personal information.
11.3.1 We keep data for as long as it is needed for our operations. If you deactivate and delete your account your data will no longer be visible on your account. Please keep in mind that third parties may still retain copies of information you have made public through our Website.
11.3.2 If you wish to have us delete your data please contact us.
11.4 Object, restrict or withdraw consent:
11.4.1 If you have an account on the Website you will be able to view and manage your privacy settings. Alternatively, if you do not have an account, you may manually submit a request to us if you object to any personal information being stored, or if you wish to restrict or withdraw any consent given for the collection of your personal information.
11.4.2 You may withdraw your consent to the processing of all your personal information at any time. If you wish to exercise this right you may do so by contacting us.
11.4.3 You may withdraw your consent or manage your opt-ins by either viewing your account on the Services or clicking the unsubscribe link at the bottom of any marketing materials we send you.
11.5.1 We may, if required and possible, provide you with the means to download the information you have shared through our Website. Please contact us for further information on how this can be arranged.
11.6 We may retain your information for fraud prevention or similar purposes. In certain instances we may not be required or able to provide you with access to your personal information. If this occurs, we will give you reasons for our decision not to provide you with such access to your personal information in accordance with the Privacy Act and the GDPR.
11.7 There is no application fee for making a request to access your personal information. However, we may charge an administrative fee for the provision of information in certain circumstances such as if you make repeated requests for information or where the information is held by a third party provider.
12. ANONYMITY AND PSEUDONYMITY
12.1 We will allow our customers to transact with us anonymously or by using a pseudonym, wherever that is reasonable and practicable. However, this will not be possible if we are required or authorised by law or other instrument to deal with customers who have been appropriately identified, or where it is impracticable for us to deal with.
13. STORAGE AND SECURITY OF PERSONAL INFORMATION
13.1 We are committed to protecting the security of your personal information. We (and our third party service providers) use a variety of industry-standard security technologies and procedures to help protect your personal information from unauthorised access, use or disclosure. We use secure web services to collect your information and we store certain kinds of data in encrypted form.
13.2 We follow reasonable technical and management practices to help protect the confidentiality, security and integrity of data stored on our system. While no computer system is completely secure, we believe the measures implemented by us reduce the likelihood of security problems to a level appropriate to the type of data involved.
13.3 We encourage you to be vigilant about the protection of your own information when using digital services, such as social media. While we will endeavour to ensure that any relationships we have with third parties include an appropriate level of protection for your privacy, we will be limited in our ability to control any electronic platform operated by a third party.
14. INTERNATIONAL TRANSFER AND DISCLOSURE OF PERSONAL INFORMATION
14.1 Where we transfer personal information outside of the European Union or EFTA States, we ensure an adequate level of protection for the rights of data subjects based on the adequacy of the receiving country’s data protection laws.
14.2 We may disclose personal information to our related bodies corporate and third party suppliers and service providers located overseas for some of the purposes listed above. We take reasonable steps to ensure that the overseas recipients of your personal information do not breach the privacy obligations relating to your personal information.
14.3 We may disclose your personal information to entities located outside of Australia, including the following:
(a) Our related bodies corporate;
(b) Our data hosting and other IT service providers, located in various countries; and
(c) Other third parties located in various foreign countries.
14.4 We may disclose your personal information to entities within Australia who may store or process your data overseas.
15. NOTIFIABLE DATA BREACHES
We take data breaches very seriously. Depending on where you reside our policy is:
15.1 If you reside in Australia:
15.1.1 In the event that there is a data breach and we are required to comply with the notification of eligible data breaches provisions in Part IIIC of the Privacy Act 1988 (Cth) or any other subsequent sections or legislation which supersede this Part IIIC, we will take all reasonable steps to contain the suspected or known breach where possible and follow the following process set out in this clause.
15.1.2 We will take immediate steps to limit any further access or distribution where possible. If we have reasonable grounds to suspect that the data breach is likely to result in serious harm to any individuals involved, then we will take all reasonable steps to ensure an assessment is completed within 30 days of the breach or sooner if possible. We will follow the guide published by the Office of the Australian Information Commissioner (if any) in making this assessment.
15.1.3 If we reasonably determine that the data breach is not likely to result in serious harm to any individuals involved or any remedial action we take is successful in making serious harm no longer likely, then no notification or statement will be made.
15.1.4 Where, following an assessment and undertaking remedial action (if any), we still have reasonable grounds to believe serious harm is likely, as soon as practicable, we will provide a statement to each of the individuals whose data was breached or who are at risk. The statement will contain details of the breach and recommendations of the steps each individual should take. We will also provide a copy of the statement to the Office of the Australian Information Commissioner.
15.2 If you reside in the European Union of EFTA States:
15.2.1 We will endeavour to meet the 72 hour deadline as imposed by the GDPR, to report any data breach to the supervisory authority where a data breach occurs that will likely be a risk to you.
15.3 Further, where there is likely to be a high risk to your rights we will endeavour to contact you without undue delay.
15.4 We will review every incident and take action to prevent future breaches.
16. INTEGRITY AND RETENTION OF DATA
17. CONTACT INFORMATION
If you reside in Australia:
You can confidentially contact our Privacy Officer at:
Pratt Hospitality Group Pty Ltd Po Box 799, South Yarra Victoria 3141 Phone: 0448 006 006 Email: firstname.lastname@example.org
If we do not resolve your enquiry, concern or complaint to your satisfaction or you require further information in relation to any privacy matters, please contact the Office of the Australian Information Commission at:
Telephone: 1300 363 992
Office Address: Level 3, 175 Pitt Street, Sydney NSW 2000
Postal Address: GPO Box 5218, Sydney NSW 2001
If you reside in the European Union or EFTA States:
You can confidentially contact our EU Representative on the above contact details.
If you wish to raise a concern about our use of your information you have the right to do so with your local supervisory authority. See a link to all the supervisory authorities here: http://ec.europa.eu/justice/article-29/structure/data-protection-authorities/index_en.htm).