The purpose of this policy is to protect the privacy and confidentiality of all personal information utilised by Tourism WA.
This policy applies to:
- All websites operated by Tourism WA.
- The activities of all Tourism WA personnel. For the purpose of this policy, this includes: employees, board members, individuals assigned or seconded to Tourism WA, contractors, consultants and any individuals or groups undertaking activity for or on behalf of the Tourism WA.
(note separate numbering to allow for external publication)
- Tourism WA is committed to protecting your privacy and the confidentiality of your personal information.
- This Privacy Statement applies to all websites operated by Tourism WA. This Statement explains, in further detail, the types of personal information we collect, how we collect, use and disclose this information, the steps we take to protect information, how you can access and change your personal information and how you can make a privacy complaint.
- Tourism WA processes personal information both as a Processor and as a Controller, as defined in the European Union General Data Protection Regulation (Regulation (EU) 2016/679) (GDPR),
- Tourism WA is not responsible for the content, policy or practices of websites operated by third parties that are linked to this website. Links to third party sites do not constitute sponsorship, endorsement or approval by Tourism WA of the content, policies or practices of those third party sites. When you follow a link from this website to another website, we recommend you read and consider the privacy statement of that website.
- In accordance with the Privacy Act, this Statement uses the following definitions:
- An entity “collects” personal information only “if the entity collects the personal information for inclusion in a record or generally available publication“.
- Direct marketing involves the use and/or disclosure of personal information to communicate directly with an individual to promote goods and services. A direct marketer may communicate with an individual through a variety of channels, including telephone, SMS, postal mail, e-mail and online advertising.
- An entity “discloses” personal information “when it permits that information to become known outside the entity and releases it from its effective control”.
- An entity “holds” personal information “if the entity has possession or control of a record that contains personal information”.
- “Personal information” means information or an opinion about an identified individual, or an individual who is reasonably identifiable.
- “Primary purpose” refers to the particular purpose for which the information in question was collected.
- “Secondary purpose” is any purpose other than the primary purpose for which we have collected your personal information.
- “Sensitive information” means information or an opinion about an individual’s personal preferences or characteristics (such as race, ethnicity, political views, memberships, religious or philosophical beliefs and sexual preference), health information and/or biometric information.
- An entity “uses” personal information “where personal information is handled, or an activity is undertaken with the information, within the entity”.
- In accordance with the Privacy Act, this Statement uses the following definitions:
What kinds of information do we collect and/or hold?
What kinds of information do we collect?
- The types of personal information that Tourism WA may collect and hold includes the following:
- full name, postal address, e-mail address, telephone and fax numbers;
- date of birth, gender and marital status;
- any other information you provide to us by any means; and
- information associated with web browsing, such as your IP address.
- Generally, the kinds of information that Tourism WA will collect and/or hold will depend on the kind of project or development we are concerned with – essentially, the purpose of the activity we are conducting. Accordingly, the kinds of information we record will usually simply extend to your name, and applicable contact details.
- On occasion we may collect and/or hold other kinds of information – such as when we run a promotional event or a competition. When we do this, we will disclose our intention to do so to you.
- The types of personal information that Tourism WA may collect and hold includes the following:
How do we collect your personal information and how do we hold it?
How do we collect your personal information?
- Tourism WA is bound by the State Records Act 2000 (WA) (the State Records Act) and the Tourism WA State Records Plan (the Tourism WA SRP) which is made pursuant to that legislation. The State Records Act and the Tourism WA SRP apply to all records generated by Tourism WA.
- Tourism WA may collect personal information from or about you in a number of circumstances, including:
- from publicly available sources of information;
- when you use our services or contact us directly;
- when you sign up to receive information from us;
- when you take part in one of our competitions and/or promotions;
- when you use our website and/or via software, such as cookies and web/tracking pixels (also known as “web beacons”);
- when you provide or offer services to us;
- from third parties;
- from our own records at Tourism WA; and
- when legally required to do so.
- Protecting the privacy of children is especially important. Tourism WA will not knowingly collect personal data from children under the age of 16 without obtaining parental consent.
- You can browse the general content of Tourism WA’s website anonymously, without disclosing your personal information. However, some functionality on this website may require you to provide personal information.
- For example, when you register your interest or otherwise in the course of us providing services to you, Tourism WA may need to collect personal information which may include your name, address, telephone/mobile phone number, e-mail address, credit card details, your business name, your user ID or password.
- Subject to legal constraints or obligations, Tourism WA will, at all times, take reasonable steps to collect your personal information directly from you, unless:
- it is unreasonable or impracticable for us to do so; or
- you consent to the collection of the information from someone other than you.
- Tourism WA only collects (and holds) sensitive information when knowingly and voluntarily submitted by you. Although Tourism WA will rarely hold and/or collect this kind of information, the information Tourism WA may hold includes your racial or ethnic background, your family status and/or financial information about you, such as your tax file number. Subject to any legal constraints or obligations, Tourism WA will, at all times, take reasonable steps to obtain your express consent where Tourism WA proposes to handle your sensitive information.
Notification of collection
- When Tourism WA collects personal information about you, it will take reasonable steps to notify you or to otherwise ensure you are aware of certain matters. These matters include our identity as an organisation and contact details, the context of the collection, whether the collection is required or authorised by law, the purposes of the collection, Tourism WA’s usual disclosure of personal information, information about our Privacy Statement and whether Tourism WA is likely to disclose your personal information to overseas recipients.
- Tourism WA will take reasonable steps to provide this notification before, or at the time it collects your personal information. If it is not possible for it to do so, Tourism WA will take reasonable steps to provide notification as soon as practicable after collection.
- In the event we receive your personal information from a third party, via referral and/or via a purchase list, we will take reasonable steps to inform you of that and seek your consent to our collection of that information. Should you refuse to consent to that collection, we will take reasonable steps to destroy or de-identify that information.
- When you browse and make use of Tourism WA’s social media pages (such as Facebook, Twitter, YouTube and Instagram), you are using an external site and are therefore subject to the privacy policies and practices of that site. If you have any questions or concerns regarding that site’s privacy policies and practices, you should review the privacy statement of the relevant site. Tourism WA does not exercise any control over the management of those sites. Tourism WA does not endorse, and is not accountable for, any views expressed by third parties using those sites.
- Tourism WA records all information posted to its social media pages and uses that information for the purposes of administering the pages, for record keeping, for considering and/or addressing any comments made and for running competitions and campaigns. No attempt will be made to further identify social media subscribers except where requested and authorised by law.
How do we hold and store your information?
- All of the personal and sensitive information we collect is stored locally on our network storage and on a locally based cloud system. All information is backed up daily to tape which is held onsite in a safe environment. Information storage is maintained by our Information Systems Branch.
- At this stage in time, Tourism WA does store personal or sensitive information through a third party local data storage cloud based system and a New Zealand based local cloud system.
- Tourism WA also maintains a number of hardcopy collections of records and electronic databases for use by staff, these include:
- project files (e.g. land acquisition, land planning, land development, land disposal);
- administration files (e.g. finance, strategic planning, information technology);
- human resource management files; and
- a library collection.
- Current files are held on site or with project managers, whilst non-current files are archived to an offsite commercial storage facility.
- The library collection consists of books, journals and reports produced by or for Tourism WA in relation to its projects. The collection is maintained onsite with non-current documents archived in a similar manner to files. Access to the library collection is on a similar basis to that for files.
- Tourism WA strives to ensure the security, integrity and privacy of the personal and sensitive information of its clients. Tourism WA takes reasonable steps to protect the security of all personal information.
- Tourism WA personnel are required to respect the confidentiality of personal information and the privacy of individuals.
- Tourism WA use a variety of physical and electronic security measures, including restricting physical access to our offices and firewalls and secure databases to keep personal information secure from misuse, loss or unauthorised use or disclosure. In relation to personal information provided through Tourism WA websites, unfortunately, no data transmission over the Internet can be guaranteed to be totally secure.
- Tourism WA continually reviews its various security measures in order to ensure that they are up to date and fit for purpose.
- Unsolicited personal information is information received where the entity has taken no active steps to collect the information. When and where Tourism WA receives unsolicited information Tourism WA will need to determine whether the unsolicited information should properly be retained as a record of Tourism WA. Where Tourism WA determines that the unsolicited information is not properly a record of Tourism WA, Tourism WA will destroy the information as soon as practicable, so long as it is lawful and reasonable to do so.
Information retention and destruction practices or obligations
- The State Records Act and the Tourism WA SRP determine when Tourism WA will retain or destroy records of personal information.
- your server address;
- your top-level domain name (e.g. .com, .gov, .uk, etc);
- the date and time of your visit to Tourism WA’s site;
- the pages accessed and documents downloaded by you;
- the previous site(s) visited by you; and
- the type of browser used by you.
Most of the information collected by cookies will not be sufficient to identify you – this is because the information collected will be very “general” in nature, relating to your interests (i.e. the products you have looked at) and the websites you have visited previously. Information collected via cookies will only be deemed to be “personal information” for the purposes of the Privacy Act 1988 (Cth) if you or any other individual are identified or reasonably identifiable.
Tourism WA will not facilitate the merging of personally-identifiable information with non-personally identifiable information collected through any cookies, tracking/web pixels or Google advertising products or features, unless it has robust notice of and the relevant party’s consent to that merger.
Third party cookies
- Third party cookies are sent by different organisations (such as businesses which provide content such as advertising) to the owner of the website you are visiting – so in this instance this means by organisations other than Tourism WA.
- Third party cookies are used on Tourism WA’s website to enable remarketing and reporting for impression assisted visits, website conversions, user demographics and user interests.
- The third party cookies we use on our website include (but are not limited to):
- Google Analytics Advertising Features: Tourism WA also uses Google Analytics Advertising Features. By enabling the Advertising Features, Tourism WA enables or permits Google Analytics to collect data about the traffic to Tourism WA’s website via the use of Google advertising cookies and identifiers, in addition to the data collected through the standard Google Analytics feature.The Google advertising cookies are used to, among other things: select advertising for users based on what is relevant to them, to improve reporting on campaign performance and to avoid showing ads the user has already seen.
- YouTube: We embed videos or insert links to videos from YouTube from time to time on our website. As a result, when you visit a page with content embedded from or linked to YouTube, you may be presented with cookies from these websites.
- Facebook tracking/web pixel: The Facebook tracking/web pixel is a piece of code provided by Facebook that is placed on or within a website to alert Facebook when a “conversion” is complete – that is, when a party clicks on a Facebook advertisement and then connects with website(s) of the party responsible for the advertisement.For example, if an e-commerce company wishes to pay affiliates based on how many items are purchased on their site, they would need some way to correlate the purchases on their site with the advertisements that were viewed or clicked on the affiliate site – the pixel enables the e-commerce company to do this.Tourism WA makes use of this tracking/web pixel to run and facilitate the campaigns and competitions it runs via Facebook. The tracking/web pixel allows Tourism WA to track the “conversions” that happen as a result of Tourism WA’s Facebook advertisements.
How can I manage, reject and/or delete cookies?
- If you want to control or opt out of the operation or application of Google Analytics and/or the Google Analytics Advertising Features, you should refer to Google’s guide(s) on opting out of those features at: http://www.google.com/intl/en/policies/privacy/.
The purpose of our collection, holding of, use or disclosure of personal information
How and in what circumstances will Tourism WA use or disclose my personal information?
- Tourism WA may, in certain circumstances, collect, hold, use and/or disclose your personal and/or sensitive information.
- Tourism WA will be taken to have disclosed personal information when it permits that information to become known outside Tourism WA and where it releases it from its effective control. For example, Tourism WA would be said to have disclosed your personal information where:
- it shares your personal information with another entity;
- it publishes your personal information on the internet so it is accessible by others;
- where one of its staff reveals your personal information in the course of a conversation with a person who does not work for Tourism WA; or
- where one of its staff members sends a document containing your personal information to someone who is not you.
- In the event Tourism WA discloses information, Tourism WA will make a written record of the use or disclosure.
- Your personal and/or sensitive information will only be used and disclosed for the primary purpose for which it was submitted or for such other secondary purposes that are related to that purpose, unless we disclose other uses in this Privacy Statement or at the time of the collection of that information.
- When collecting your information we will inform you of the primary purpose of our collection and/or any anticipated secondary purpose that may arise. The purpose of our collection will vary from project to project, depending on the nature of the project and the nature of your involvement and/or interest in the project.
- Tourism WA will use and disclose your personal information to provide our services to you or to fulfill administrative functions associated with these services.In general, we will use and disclose your personal information for the following purposes:
- to notify you about an event you may wish to be involved in;
- to communicate with you with respect to an existing event or booking;
- to provide and market our services;
- to help us manage and enhance our services;
- to purchase from you;
- for any purpose for which the information was provided; or
- any other purpose related to any of the above.
- We will only make use of or disclose your personal information for a secondary purpose if:
- you have consented to the use or disclosure of that information; or
- you would reasonably expect Tourism WA to use or disclose the information for the secondary purpose; or
- the use or disclosure of that information is required or authorised by or under legislation or court/tribunal order; or
- a “permitted general situation” exists in relation to the use or disclosure of the information by Tourism WA; or
- Tourism WA reasonably believes that the use of the information is reasonably necessary for one or more enforcement related activities conducted by, or on behalf of, an enforcement body.
- Apart from the primary and secondary purposes outlined above, personal information may be disclosed in special situations where Tourism WA have reason to believe that doing so is necessary to identify, contact or bring legal action against anyone damaging, injuring, or interfering (intentionally or unintentionally) with our rights or property, users, or anyone else who could be harmed by such activities. It may also be used as required by legislation in Western Australia, including the Freedom of Information Act 1992 (WA) (the FOI Act). Finally, Tourism WA may disclose personal information when it believes in good faith that the law requires disclosure.
- Tourism WA will not use or disclose your personal information for the purpose of direct marketing, unless:
- we collected the information from you;
- we obtained your consent to the use or disclosure of the information for that purpose (except where it was impracticable to do so); and
- you would reasonably expect Tourism WA to use or disclose the information for that purpose; and
- we provide you with an easy to use means of opting out of receiving any further direct marketing communications; and
- you have not requested that we cease sending you direct marketing communications.
- As mentioned above, Tourism WA makes use of a number of Google Analytics Advertising Features, including remarketing. The Remarketing feature allows Tourism WA to reach people who have previously visited its website and to match users with appropriate advertising.
- If you would like to control or opt out of the application of the Google Analytics Advertising Features, you should refer to Google’s guide(s) on opting out of those features.
- Tourism WA will only make use of your sensitive information for direct marketing purposes if you have consented to the use or disclosure of that information for that purpose.
- If you receive direct marketing communications from Tourism WA or from an associated entity, you are entitled to:
- request that you receive no further direct marketing communications for Tourism WA
- and/or the associated entity; and
- request that Tourism WA disclose the source of the information.
- Tourism WA will take reasonable steps to facilitate a request by you to opt-out of receiving direct marketing communications. This may be a request to opt-out of receiving certain communications or to opt-out altogether.
- Tourism WA will not charge you for making such a request or for giving effect to such a request.
- Tourism WA will take reasonable steps to give effect to such request within a reasonable period of time after the request is made and will reply to a request for the source of the information in a reasonable period of time (unless it is unreasonable or impracticable for us to do so).
- We may use your e-mail address to send you Tourism WA publications, newsletters, seminars or events. We may also contact you by e-mail to seek your opinion or comment on our website and our service offerings.
- Tourism WA, at all times, aims to comply with the terms of the Spam Act 2003 (Cth) and will not send unsolicited commercial electronic messages or “spam”.
- All commercial electronic messages sent by Tourism WA include information about the individual or organisation who authorised the sending of the message.
- You can unsubscribe from our e-mails at any time. You can also contact us and instruct us not to send further information to you.
Disclosure to overseas recipients
- Generally, Tourism WA does not disclose the personal and/or sensitive information of its customers to overseas recipients.
- However, there is a possibility that, on occasion, your personal information may be disclosed to an overseas recipient. The location of any recipients will vary depending on the project or purpose concerned.
- In the event that a particular project or development will or may involve the disclosure of personal or sensitive information to an overseas recipient, Tourism WA will take reasonable steps to inform you of that potential use or disclosure as soon as possible. As part of our notification process, Tourism WA will inform you of the location and/or identity of that recipient.
- Similarly with other third party recipients and/or partners of Tourism WA, we will take reasonable steps to ensure and/or encourage any overseas recipients to comply with privacy policies and regulations which are similar to or more strenuous than those required by applicable Australian legislation. However, it is not possible for Tourism WA to compel them to do so.
- Should you have any queries about the potential disclosure of your personal information to an overseas recipient, please contact our Freedom of Information and Privacy Officer.
Who can access my personal information and what conditions apply to their use of my personal information?
- As a general rule, your personal and sensitive information will only be accessed and/or viewed by Tourism WA staff and officers, as and when it is appropriate or necessary. However, your personal information may also be accessed, from time to time, by:
- Tourism WA contractors;
- Tourism WA project partners; or
- Tourism WA suppliers.
- Where a party, other than an employee or officer of Tourism WA, has access to the personal information of individuals, they will be required to comply with applicable privacy legislation and, where appropriate, to enter into Privacy Agreements with Tourism WA.
- The access and use of your personal or sensitive information by a third party will be restricted to the purpose for which it was first collected and/or to a closely related secondary purpose.
- In some limited circumstances we may also need to use or disclose personal information for other specific purposes, including:
- where Tourism WA reasonably believes that the use or disclosure of the information is reasonably necessary for one or more enforcement related activities conduct by or behalf of an enforcement body; or
- where required to do so by or under a law of Western Australia, a law of the Commonwealth or a court or tribunal order, for example pursuant to the FOI Act or in response to a subpoena.
How can you access your personal information and/or seek the correction of your personal information?
How can I access my personal information?
- You can make a request for access to your personal information informally in writing or pursuant to the terms of the FOI Act. If you are in the EU, you may request access pursuant to the terms of Article 15 of the GDPR. Tourism WA aims to, whenever possible, facilitate informal requests for personal and/or sensitive information.
- Tourism WA will take reasonable steps to respond to a request for access within a reasonable period of time after the request is made (within 45 days) and to give access to the information in the manner requested by the individual, if it is reasonable and practicable to do so.
- In the event that Tourism WA refuses to give you access to the personal information requested by you, we will give you a written notice which sets out the reasons for the refusal (except to the extent that it would be unreasonable to do so) and the mechanisms available to you to complain about the refusal.
- Requests for access may be lodged in the following ways:
Level 9, 2 Mill Street
PERTH WA 6000
PERTH WA 6847
Contact: FOI Coordinator
Telephone: 08 9262 1700
Fax: 08 9262 1702
- Tourism WA reserves the right to impose minimal charges for providing you with your personal information if it forms the view that your request is unfounded or excessive. The scale of fees and charges set out in the Freedom of Information Regulations 1993 (WA) will apply to a request under the FOI Act.
- Should you experience difficulty in determining the correct route through which to request access to your personal information, please contact our Freedom of Information and Privacy Officer and they will provide you with assistance.
Request for correction of personal information
- You can make a request for the correction and/or amendment of your personal information informally in writing or pursuant to the terms of the FOI Act.
- Applications to have personal information held by Tourism WA corrected or amended should:
- be made in writing to the Freedom of Information and Privacy Officer;
- provide enough information to determine what changes are required; and
- provide your current contact details.
- In the event Tourism WA refuses to correct your personal information, Tourism WA will give you a written notice which sets out the reasons for the refusal (except to the extent it would be unreasonable to do so) and the mechanisms available to you to complain about the refusal.
- Tourism WA will take reasonable steps to respond to a request for access within a reasonable period of time after the request is made (within 45 days) and will not charge you for the making of the request or for the correction of the personal information.
Your rights in the EU
- Subject to legal constraints, including Tourism WA’s obligations under the State
Records Act, if you are in the EU your principal rights under the GDPR are:
- the right to be informed;
- the right to access;
- the right to rectification;
- the right to erasure, i.e to be forgotten;
- the right to restrict processing;
- the right to object to processing;
- the right to data portability; and
- right to not be subject to automated decision making.
- You can read the relevant laws and guidance from the regulatory authorities under the GDPR for a full explanation of these rights.
- Subject to legal constraints, including Tourism WA’s obligations under the State
Notifiable data breaches
- We are committed to protecting information we hold about you, and to compliance with the Notifiable Data Breaches scheme.
- Where we become aware of a potential data breach which is likely to result in serious harm to any individuals about whom we hold information, we will:
- investigate the suspected breach and determine scope of any breach that has occurred and the risk of harm to affected individuals whose information may have been compromised;
- notify you and the Privacy Commissioner of the potential breach; and
- take steps to minimise any harm caused to affected individuals as a result of the breach.
How can I complain about a breach or give feedback on how Tourism WA deals with my personal information?
- Should you wish to provide Tourism WA with feedback with respect to its management of your personal information, to complain about a breach of Tourism WA’s privacy obligations or the FOI Act or to appeal a decision with respect to a request for access to or the correction of personal information, please contact us at the address set out at paragraph 86 below.
- Tourism WA will take reasonable steps to respond to your complaint and/or feedback within 45 days.
- In the event that you wish to have a decision refusing access to your personal information and/or refusing to correct your personal information reviewed or to lodge a complaint with respect to the management of your personal information, please contact us on the contact details as set out at paragraph 86 below.
Queries and Feedback
- If you have any queries relating to this Privacy Statement, or you have any feedback, please contact Tourism WA:
- by email at firstname.lastname@example.org;
- via these Contact us forms:
- by calling us on +61 8 9262 1700, or contacting us by facsimile on +61 8 9262 1735.
Further Information & Support
Information Management Team within Corporate and Business Services
|Process Custodian||Chief Information Officer|
|Approval Date||April 2019|
|Next Review Date||August 2021|
|Version||Date of Issue||Approved By||Description of Change|
|1.0||April 2019||Executive Director, Corporate and Business Services||First policy version (supersedes existing Privacy Statement). Includes GDPR