Personal information includes any information or opinion about an identified individual or an individual who can be reasonably identified from their information. The information or opinion will still be personal information whether it is true or not and regardless of whether Findex have kept a record of it.
We may collect personal information about the following individuals:
The above listed are referred to as ‘individuals’ in this policy.
The information that Findex seeks to collect will depend on the products or services that it recommends or provides. If an individual does not allow Findex to collect all of the information requested, Findex may not be able to deliver all of those services effectively. Whereby Findex receives unsolicited personal information about individuals, if possible, Findex will return the unsolicited personal information to the person who provided it. In all other cases, we destroy the information, unless the personal information is relevant to Findex’s purposes for collecting personal information.
Findex will not collect any personal information except when the individual has knowingly provided that information to us or authorised a third party to provide that information to us.
Findex may ask for identification information. This information may include but is not limited to name, address, contact details, date of birth, and tax file number.
We will not use identifiers assigned by the Government, such as a tax file number, Medicare number or provider number, for our own file recording purposes.
Findex may collect and hold additional personal information about individuals. This could include transaction information or making a record of queries or complaints an individual makes and, if they make an insurance claim, collecting additional information to assess the claim.
The collection of sensitive information is restricted by the Privacy Act. This includes information about religion, racial or ethnic origin, political opinions, criminal record, and sexual orientation. It also includes health information and biometric information.
Generally, Findex only collects this sort of information if it is necessary to provide a specific product or service and the individual has consented to that collection. For example, we may collect health information about the individual to process a claim under an insurance policy or collect voice biometric information to verify identity or authorise transactions.
Findex may be unable to provide its services if it does not have all the relevant information it requires to deliver such services.
The main reason Findex collect, use, hold and disclose personal information is to facilitate the provision of its service offerings. This includes:
Findex may also use information to comply with legislative or regulatory requirements in any jurisdiction, prevent fraud, crime or other activity that may cause harm in relation to its products or services and to help run the business. Findex may also use information to tell individuals about products or services that it feels may interest them.
Findex understands the importance of a holistic service offering, whereby its clients can see their goals, needs and expectations being met. This approach encompasses:
Findex collects most of the personal information directly from the individual. This can be done electronically. (see section "Does Findex collect personal information electronically?" of this policy for more information).
Findex also collects personal information about an individual from other areas of its business including sharing information amongst its subsidiaries and related parties or from third party organisations. This may happen without the individual’s direct involvement. For instance, Findex will collect personal information about an individual from:
Findex is required or authorised to collect:
Findex strives to maintain the relevance, reliability, accuracy, completeness and currency of the personal information we hold and to protect its privacy and security. Much of the information Findex holds about an individual will be stored electronically in secure data centres, which are located in Australia, and owned by either Findex or external service providers. This does not include third parties backing up or mirroring their data in overseas jurisdictions. Some information Findex holds about an individual will be stored in paper files and these files will be held in secure offsite storage.
Findex use a range of physical and electronic security measures to protect the security of the personal information they hold. For example:
Findex take reasonable steps to destroy or permanently de-identify any personal information after it can no longer be used.
Findex may provide personal information about individuals to external organisations. To protect personal information, Findex enter into contracts with their service providers that require them to comply with the Privacy Act. These contracts oblige them to only use the personal information Findex disclose to them for the specific role they ask them to perform.
Generally, Findex disclose personal information to organisations that help them with their business. These may include:
We may also disclose an individual’s personal information to others where:
In relation to credit information held by us, we will only use and disclose credit information for the following purposes:
We will only disclose credit information to the following recipients:
If and when Findex collect credit card or other payment details, we will not store them. The card details will be passed directly via a secure encrypted SSL connection directly to the bank’s payment getaway.
Furthermore the page that transmits card details has been through thorough checks and has been deemed to be PCI DSS compliant by an Approved Scanning Vendor.
Findex may disclose an individual’s personal information to a recipient which is located outside Australia. This includes:
Some encrypted data may be backed up or mirrored in overseas jurisdictions by third parties.
We will not send personal information to recipients outside of Australia unless:
Findex will use personal information to offer individuals products and services they believe may interest them, but will not do so if the individual tells them not to. Findex may offer individuals products and services by various means, including mail, telephone, email, SMS or other electronic means, such as through social media or targeted advertising through Findex’s website.
Findex may also disclose an individual’s personal information to external companies who assist Findex to market their products and services to the individual, such as a mailing house.
If individuals do not wish to receive marketing offers from Findex, they must expressly request Findex not to do so.
Findex will collect information from individuals electronically, for instance through internet browsing, mobile or tablet applications.
Each time an individual visits one of Findex’s websites, Findex collects information about the individual’s use of the website, which may include the following:
Findex uses technology called cookies whenever an individual visits a Findex website. Cookies are small pieces of information stored on the individual’s hard drive or in memory. Cookies can record information about an individual’s visits to the site, allowing it to remember them the next time they visit and provide a more meaningful experience.
One of the reasons for using cookies is to offer individuals increased security. The cookies Findex send to an individual’s computer cannot read their hard drive, obtain any information from their browser or command their computer to perform any action. Cookies are designed so that they cannot be sent to another site, or be retrieved by any non-Findex site.
Findex won't ask individuals to supply personal information publicly over Facebook, Twitter, or any other social media platform that we use. Sometimes Findex may invite individuals to send their details to them via private messaging, for example, to answer a question. individuals may also be invited to share their personal information through secure channels to participate in other activities, such as competitions.
Findex uses security procedures and technology to protect the information we hold. To prevent misuse or unlawful disclosure of sensitive information, Findex has implemented internal policies which cover staff conduct, continuous training and monitoring of staff, and the inclusion of checks in the Audit function. If other organisations provide support services, we require these organisations to appropriately safeguard the privacy of the information provided to them. Where the personal information we collect is no longer required, we delete the information or permanently de-identify it in accordance with relevant laws and our internal records management policy.
Under the Privacy Act, individuals have a right to seek access to information which we hold about them; although, there are some exceptions to this. They also have the right to ask us to correct information about them which is inaccurate, incomplete or out of date. To do so, they must contact Findex.
We do not charge for receiving a request for access to personal information or for complying with a correction request. We do however reserve the right to charge you for all reasonable costs and outgoings specifically incurred in meeting your request for information. In processing an individual’s request for access to their personal information, a reasonable cost may be charged if they have requested access more than once within twelve months. This charge covers such things as locating the information and supplying it to them.
There are some circumstances in which Findex are not required to give individuals access to their personal information. If Findex refuse to give an individual access to or to correct their personal information, Findex will give them a notice explaining the reasons why, except where it would be unreasonable to do so. If we refuse an individual request to correct their personal information, the individual also has the right to request that a statement be associated with their personal information noting that they disagree with its accuracy. If Findex refuses an individual’s request to access or correct their personal information, we will also provide them with information on how they can complain about the refusal.
Due to the Privacy Amendment (Notifiable Data Breaches) Act 2017, Findex is legally required to notify affected individuals of any eligible data breaches. To comply with this legal requirement, Findex has implemented a Data Breach Response Plan (See Appendix) in order to deal with actual or potential data breaches as well as the notification process to be followed when notifying affected individuals.
If an individual is concerned about how their personal information is being handled or if they have a complaint about a breach by Findex of the Australian Privacy Principles, they must contact Findex.
Findex will acknowledge the complaint as soon as practical after receipt of the individual’s complaint. Findex will let the individual know if they need any further information from the individual to resolve their complaint.
We aim to resolve complaints as quickly as possible. We strive to resolve complaints within five business days but some complaints can take longer to resolve. If a complaint is taking longer, we will let the individual know what is happening and a date by which they can reasonably expect a response.
If the individual is unhappy with our response, there are other bodies they can go to.
The Credit and Investments Ombudsman (CIO) can consider most privacy complaints involving providers of financial services.
CIO can be contacted at:
Credit and Investments Ombudsman Ltd
PO Box A252
South Sydney NSW 1235
Phone: 1800 138 422
Under the Privacy Act, an individual may complain to the Office of the Australian Information Commissioner about the way Findex handled their personal information.
The individual can contact Findex by:
Findex’s Privacy Officer can also be contacted in relation to privacy concerns by writing to Level 17, 181 William Street, Melbourne VIC 3000 or emailing firstname.lastname@example.org