Privacy Policy

Scope of policy and source of obligation
In the course of Ballarat Clarendon College’s activities, we manage and protect personal information in accordance with the Privacy Act 1988 (Cth) (Privacy Act) and the 13 Australian Privacy Principles (APPs), as well as the requirements of the Health Records Act (Vic) (the Health Privacy Principles).

Scope of policy
This policy outlines the circumstances in which we obtain personal information, how we use and disclose that information and how we manage requests to access and/or change that information.

What is personal information and how do we collect it?
Personal information is information or an opinion about an individual from which they can be reasonably identified. We collect personal information where the information is reasonably necessary for one or more of our functions or activities, including the provision of education, boarding, pastoral care, extracurricular activities, employment, fundraising, visitors, and affiliated bodies. If it is reasonable and practical to do so, we collect personal information directly from the individual.

We may collect and hold:

• Contact Information including names, residential addresses, email addresses, phone numbers, next of kin details and other contact details.
• Identity Information including dates of birth, government identifiers (such as Medicare numbers), photographic images, and videos.
• Financial Information including bank account details, directorships, and property ownership.
• Tax File Numbers.
• Sensitive Information (particularly in relation to student and parent records) including attendance records, employment references, religious beliefs, nationality, country of birth, professional memberships, family court orders, and criminal records.
• Health Information (particularly in relation to student and parent records) including medical records, disabilities, immunisation details, and psychological reports.

Generally, we will seek consent from the individual in writing before we collect their sensitive information (including health information).

Collection of personal information
We will collect personal information where the information is reasonably necessary for one or more of our functions or activities. If it is reasonable and practical to do so, we collect personal information directly from the individual.

How we collect information
Clarendon, where possible, collects personal information through the following means:

• enrolment forms;
• confirmation of place forms;
• health information disclosure forms;
• scholarship applications;
• employment application forms;
• email correspondence;
• telephone calls;
• face-to-face meetings;
• financial transactions;
• our website;
• CCTV surveillance;
• Orah; or
• Hub.

We may also collect personal information from other people (for example, a third-party administrator, referees for prospective employees) or independent sources. However, we will only do so where it is not reasonable and practical to collect the personal information from the individual directly.

We collect non-personal information through our website, including the type of internet browser, operating system used, domain name, number of visits, time spent on website and pages viewed. We use ‘cookies’ and other data collection methods to analyse and improve our website, and marketing campaigns. We do not use this information to personally identify individuals. We use platforms such as Google Analytics to capture this data.

Unsolicited information
We may be provided with personal information without having sought it through our normal means of collection. This is known as ‘unsolicited information’ and is often collected by:

• misdirected postal mail – letters, notes, documents;
• misdirected electronic mail – emails, electronic messages;
• employment applications sent to us that are not in response to an advertised vacancy; and
• additional information provided to us which was not requested.

Unsolicited information obtained by Clarendon will only be held, used and or disclosed if it is considered as personal information that could have been collected by normal means. If that unsolicited information could not have been collected by normal means, then we will destroy, permanently delete or de-identify the personal information as appropriate.

Collection and use of sensitive information
We only collect sensitive information if it is:

• reasonably necessary for one or more of the following functions or activities, and we have the individual’s consent:
• it is necessary to lessen or prevent a serious threat to life, health or safety;
• another permitted general situation; and
• another permitted health situation.

We may share sensitive information with all affiliated and associated bodies, but only if necessary for us to provide our products or services or perform our functions.

How we use and disclose personal information
Clarendon only uses and discloses personal information that is reasonably necessary for the purpose for which it was collected (the primary purpose) or for a secondary purpose if an exception applies.

The primary purposes for which we use or disclose personal information include, but are not limited to:

• providing education, pastoral care, extra-curricular and health services;
• satisfying our legal obligations including our duty of care, child protection and government obligations;
• keeping parents informed as to Clarendon community matters through correspondence, newsletters and magazines;
• classroom displays;
• marketing, promotional and fundraising activities;
• supporting the activities of Clarendon associations, such as the Old Collegians;
• supporting the activities of Ballarat and Clarendon College Foundation Limited;
• supporting community-based causes and activities, charities and other causes in connection with Clarendon’s functions or activities;
• helping us to improve our day-to-day operations including training our staff;
• systems development, developing new programs and services, undertaking planning, research and statistical analysis;
• Clarendon administration including for insurance purposes;
• the employment of staff; and
• the engagement of volunteers.Common exceptions under which we may use or disclose personal information for a secondary
  purpose include:
• when an individual would reasonably expect us to use or disclose information for a secondary purpose that is related (or directly related in the case of health and sensitive information) to the primary purpose of collecting the information;
• for secondary purposes to which an individual has consented;
• for a permitted general situation or health situation;
• where reasonably necessary for one or more enforcement related activities by or on behalf of an enforcement body.We may share personal information to the following related bodies corporate, but only if necessary for us to provide our services.We may disclose personal information to the following categories of recipients:
• government agencies and regulators (including the Victorian Registration and Qualifications Authority, the Office of the Australian Information Commissioner and the Department of Education);
• other schools (for example, where a student transfers);
• parents and carers of students;
• visiting teachers, counsellors, psychologists and coaches;
• our service providers, including IT, insurance and medical providers (as relevant);
• recipients of Clarendon publications (such as newsletters and magazines); and
• any other categories of recipients notified from time to time in accordance with this policy.
  
  Overseas disclosure of personal informationClarendon may disclose personal information to overseas recipients only when it is necessary. This includes:
• facilitating overseas student or staff trips; or
• where required by our cloud service providers who store our data.
  Locations include but not limited to the USA, NZ, UK, Europe, and Asia.We will take all reasonable steps not to disclose an individual’s personal information to overseas recipients unless:
• we have the individual’s consent (which may be implied when appropriate);
• we have satisfied ourselves that the overseas recipient is compliant with the APPs, or a similar privacy regime;
• we form the opinion that the disclosure will lessen or prevent a serious threat to the life, health or safety of an individual or to public safety; or
• we are taking appropriate action in relation to suspected unlawful activity or serious misconduct.Storage and security of personal information
  Clarendon stores personal information in a variety of formats including, but not limited to:
  
• databases;
• staff personal or service issued devices, including laptop computers;
• third party storage providers such as cloud storage facilities; and
• paper based files.Clarendon takes all reasonable steps to protect the personal information we hold from misuse, loss, unauthorised access, modification or disclosure.These steps include, but are not limited to:
• Restricting access and user privilege of information by staff depending on their role and responsibilities.
• Ensuring staff do not share personal passwords.
• Communication and training for password hygiene.
• Restricted access to CCTV.
• Ensuring hard copy files are stored in lockable filing cabinets in lockable rooms. Staff access is subject to user privilege.
• Ensuring access to Clarendon’s premises are secured at all times.
• Implementing physical security measures around the school buildings and grounds to prevent break-ins.
• Ensuring our IT and cyber security systems, policies and procedures are implemented and up to date.
• Ensuring staff comply with internal policies and procedures when handling the information.
• Undertaking due diligence with respect to third party service providers who may have access to personal information, including customer identification providers and cloud service providers, to ensure as far as practicable that they are compliant with the APPs or a similar privacy regime.
• The destruction, deletion or de-identification of personal information we hold that is no longer needed, or required to be retained by any other laws.

Our public website may contain links to other third-party websites outside of Clarendon. Clarendon is not responsible for the information stored, accessed, used or disclosed on such websites and we cannot comment on their privacy policies.

Responding to data breaches
Clarendon will take appropriate, prompt action if we have reasonable grounds to believe that a data breach may have, or is suspected to have occurred. This will include complying with our breach assessment and notification obligations.

Quality of personal information
We take all reasonable steps to ensure the personal information we hold, use and disclose is
accurate, complete and up-to-date, including at the time of using or disclosing the information.
If Clarendon becomes aware that the personal information we hold is incorrect or out of date, we
will take reasonable steps to update the incorrect or out of date information.

Access to and correction of personal information
You may submit a request to access the personal information we hold about you or request the
correction of personal information by contacting the Privacy Officer using the details at the end
of this policy. Upon receiving such a request, we will take steps to verify your identity and
respond within 30 days or a reasonable period.

If we decline a request, you will be notified accordingly. Where appropriate, we will provide the
reason/s for our decision. If the request relates to a change of personal information, an
individual may make a statement about the requested change, and we will attach this to their
record.

Complaints
You can make a complaint about how Clarendon manages personal information by contacting the Privacy Officer in writing using the details at the end of this policy. We will acknowledge receipt of the complaint within two business days, and provide a substantive response within a reasonable time (usually no longer than 30 days). We may seek further information from you to investigate the complaint.
Clarendon does not charge a fee for the handling of complaints.

If you are not satisfied with our response, you may refer the complaint to the Office of the
Australian Information Commissioner (OAIC). A complaint can be made using the OAIC online Privacy
Complaint or by mail, fax or email.

A referral to the OAIC should be a last resort once all other avenues of resolution have been
exhausted.

How to contact us
Clarendon can be contacted about this Privacy Policy or about personal information generally, by:

• Emailing privacy@Clarendon.vic.edu.au;
• Calling (03) 53308200;
• Writing to our Privacy Officer at 1425 Sturt Street, Ballarat VIC 3350.If practical, you can contact us anonymously (that is, without identifying yourself) or by using a pseudonym. However, if you choose not to identify yourself, we may not be able to give you the information or provide the assistance you might otherwise receive if it is not practical to do so.
  
  Changes to our privacy and information handling practices
  Clarendon may update this Privacy Policy from time to time to reflect changes in our practices or legal obligations. We will publish the updated policy on our website at www.clarendon.vic.edu.au and on Hub.