1.0 PURPOSE AND SCOPE

Skillset Limited (Skillset) requires personal information to carry out the functions and activities of the organisation. Skillset is committed to managing personal information in an open and transparent manner and in accordance with the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs).

This Policy explains how Skillset collects, holds, uses and discloses personal information, and how individuals can access and correct their information or make a complaint regarding a privacy breach.

This Policy applies to all records of personal information, about any individual, held in any form by Skillset.

2.0 DEFINITIONS

Privacy: a fundamental human right encompassing an individual's right to control their personal information; including how it is collected, used, and disclosed. It encompasses the protection of personal data from misuse, unauthorised access, and unwarranted intrusion.

Personal information: any information or an opinion about an identified individual or an individual who can be reasonably identified from the information or opinion. Information or an opinion may be personal information regardless of whether it is true.

Sensitive information: is a type of personal information about an individual’s: racial or ethnic origin, political opinions or associations, religious or philosophical beliefs, trade union membership or associations, sexual orientation or practices, criminal record, health or genetic information, some aspects of biometric information.

Health information: is a subset of sensitive information; being any information or opinion about the health (including illness, disability or injury) of an individual, the individual’s expressed wishes about the future provision of health services, or a health service provided, or to be provided, to an individual.

3.0 POLICY 

Skillset supports:
• privacy, as a human right.
• lawful, fair, open and transparent collection practices and management of personal information.
• processes which aim to ensure personal information is accurate, complete, current and secure.
• all individual’s rights to see and where necessary, correct personal information about themselves.
• limiting the collection and use of personal information.

4.0 PURPOSE OF PERSONAL INFORMATION COLLECTED, HELD AND USED

Skillset collects, holds, uses and discloses personal information for purposes connected with our operations, including:
a) Delivering and administering services, programs, and supports.
b) Managing relationships with people and organisations.
c) Managing employment (including recruitment, HR, payroll, WHS, training) and assessing suitability.
d) Operating, securing, monitoring and improving Skillset’s website and digital services, including responding to online enquiries and analysing usage (website specific Terms and Conditions can be found on Skillset’s website, here https://skillset.com.au/terms-conditions/).
e) Marketing and communications services, including providing information about our operations, industry updates, opportunities to be involved with Skillset. Individuals can opt out at any time by using the unsubscribe function or contacting us using the details in this policy.
f) Processing payments and managing account related transactions.
g) Quality assurance, audits, reporting, governance and continuous improvement.
h) Managing requests, enquiries, feedback, disputes and complaints.
i) Promoting safety, security and protection of people, premises, systems and assets.
j) Providing and administering IT systems and accounts.
k) Meeting legal and regulatory obligations.

Skillset will generally use or disclose personal information only for the purpose it was collected (or a related purpose you would reasonably expect), unless otherwise required or permitted by law.

5.0 TYPES OF PERSONAL INFORMATION 

Skillset collects personal information that is reasonably necessary for the purpose in which it is collected, including the reason a person seeks to be involved with Skillset and may include:
a) Personal information such as name, signature, address, phone number, date of birth, gender, photographs/video, emergency contact details, resumes, applications, work history, work preferences, references.
b) Sensitive information such as race or ethnic origin, Australian working rights, trade union membership or associations, criminal history record, some aspects of biometric information.
c) Employment records such as contracts, agreements, attendance, hours of work; performance, conduct and management records; payroll/remunerations details, memberships and associations, superannuation, taxation and bank details; training, qualifications.
d) Health information such as information or opinion about an individual’s health including illness, disability, injury, work capacity assessments, accessibility and related adjustments, medical screens, workplace incident and injury reports, workers’ compensation records, fitness for work or medical clearance information.
e) Assessments and opinions formed during recruitment or engagement processes, including interview notes and assessments relating to an individual’s skills, experience, suitability, job readiness, presentation, or alignment with role requirements.
f) Information regarding interactions and communication with Skillset, including enquiries, emails, phone calls, meetings, services provided, payment and billing details applications submitted, complaints and feedback, usage of online services, and records of access and attendance.
g) Information from use of Skillset’s website, social media, or cookies including the day and time sites are visited, whether an individual has visited the website previously, internet protocol (IP) address, location, and web preferences.
h) Surveillance and CCTV records which may contain personal information.

6.0 COLLECTION OF PERSONAL INFORMATION

Individuals can choose not to disclose their personal information to Skillset. However, if personal information is not provided (or cannot be provided) it may not be possible to deliver the requested information or services, maintain employment (if applicable), or maintain an effective and viable relationship with Skillset.

Individuals also have the option of remaining anonymous or using a pseudonym. However, an individual’s identity and personal information is a material factor in Skillset’s ability to deliver (and administer) services, programs, and supports.

Collection of personal information is conducted solely by lawful and fair means, including:
• Directly from an individual, including information provided via interactions in person or online, telephone, email, text, forms, portals, surveys, social media, or at events.
• Indirectly from third parties where permitted (e.g., referees, training partners, funding bodies, service providers, public sources, social media).
• From devices/systems used to maintain security and safety (e.g. building access logs, CCTV security cameras, IT equipment and security and system monitoring), where applicable.
• Through the Skillset website and digital services, including online forms, cookies or analytics tools, user data, and log files.
• Departments and Agencies of Commonwealth and State Governments of Australia for services under contractual arrangements.
• Other means such as financial transactions with Skillset, interactions with Skillset at events, participating in competitions, promotions, meetings, and from individuals engaged with Skillset (e.g. in order to provide a reference, or as an emergency contact).

Skillset will not collect information through covert means, for example through covert surveillance or secreted recordings.

Skillset takes reasonable steps to notify individuals at or before the time personal information is collected, or as soon as practicable afterwards, about the purpose of collection, any consequences of not providing the information, how the information may be used or disclosed, and how individuals may access or correct their personal information or make a privacy complaint. Notification is provided through collection statements/notices, verbal explanations, signage, or links to this Privacy Policy.

Some of Skillset’s operations support young people under the age of 18. Skillset is committed to protecting the privacy of children and young people and manages their personal information carefully and respectfully. Personal information is collected only where reasonably necessary to support participation in programs and services. Where appropriate and having regard to the age and capacity of the individual, Skillset will involve a parent or guardian or seek appropriate consent.

6.1 Analytic, Session and Cookie Tools

Skillset uses a range of tools provided by third parties, including Google Analytics to collect or view website traffic information. The tools collect information about website usage, including pages visited, time spent on the site, device and browser details, IP addresses and approximate location information, to help us maintain, secure and improve website performance. These tools have their own privacy policies. Individuals can ‘opt out’ of the collection of this information using the Google Analytics Opt-out Browser Add-on.

6.2 Social Networking Services

Social networking services such as LinkedIn, Facebook, Instagram, TikTok and YouTube are utilised by Skillset to communicate with the public. Use of social networking services is optional, however if an individual communicates with Skillset using these services, we collect the personal information provided to us. Social networking services may also handle personal information for their own purposes. These sites have their own privacy policies.

7.0 UNSOLICITED INFORMATION

Skillset may also receive personal information without having sought it (known as unsolicited information), for example, by misdirected mail, emails, messages, letters, notes, documents or where additional information, not requested, was provided.

Unsolicited personal information will only be held, used and/or disclosed if it is considered that it could have been collected by normal means. If that unsolicited information could not have been collected by normal means Skillset will destroy, permanently delete or de-identify the personal information as appropriate.

8.0 DISCLOSURE OF PERSONAL INFORMATION

Skillset may disclose an individual’s personal information for any of the purposes for which it is collected or for a lawfully related purpose, including disclosure to:
• Skillset employees, contractors and authorised representatives (on a need-to-know basis).
• Skillset clients, employers including potential employers, education providers or partner organisations (where necessary to assist individuals to access or maintain employment, training or education opportunities).
• References and emergency contacts.
• Partners we work with to deliver services (where relevant and permitted).
• Contracted Service Providers (CSP’s), which may include IT professionals, digital platform software and data platform providers, record management, email/collaboration tools, payment processors, CRM/LMS providers, background checking and screening agents, auditors, insurers, legal and professional advisers.
• Related entities and related bodies corporate (as those terms are defined in the Corporations Act 2001 (Cth))
• Regulators, courts, government agencies, or other bodies where required or authorised by law.
• Other parties with your consent or as permitted by law.

Skillset takes reasonable steps to ensure third parties handle personal information appropriately and securely; for example: only using reputable service providers, using contracts and agreements requiring privacy/confidentiality, only sharing required information.

8.1 Disclosure of Personal Information Overseas

Skillset will not generally send personal information out of Australia. The exception to this is website traffic information disclosed to Google Analytics when individuals visit Skillset’s websites and use of social network services. Google stores information in all countries it operates, including the United States and other countries. For further information see Google Data Centres and Google Locations. When communication by Skillset is conducted through social network services, the social network provider may collect and hold personal information overseas. These sites have their own privacy policies.

9.0 HOW PERSONAL INFORMATION IS HELD

Skillset maintains personal information electronically and sometimes in physical form. Skillset takes reasonable steps to protect personal information from misuse, interference and loss, and from unauthorised access, modification or disclosure, including:
• access controls, MFA where feasible, and role-based permissions.
• employee suitability screening, confidentiality obligations and privacy training.
• secure storage, encryption where appropriate, and secure disposal practices.
• monitoring, incident response procedures and supplier security checks.
• undertaking due diligence with respect to third party service providers who may have access to personal information, including cloud service providers, to ensure as far as practicable that they are compliant with the Australian Privacy Principles.

Personal information is retained in accordance with our records management and retention requirements, including legal, regulatory and funding obligations, and is securely destroyed or de-identified when no longer required. Skillset will take reasonable steps to securely destroy or de-identify personal information held, when it is no longer needed and when lawfully authorised or required to do so.

Data protection measures are never completely secure and, despite the measures Skillset has in place, the complete security of personal information cannot be guaranteed. Individuals can protect their personal information, for example, by protecting any usernames and passwords provided. Skillset must be notified of any possible security breaches.

In situations where a Notifiable Data Breach occurs, Skillset must notify affected individuals and the Office of the Australian Information Commissioner, in accordance with the Privacy Act and Skillset’s Security Incident Response Procedure.

Personal information given to Skillset must not be stored or transferred on any employees’ personal device.

10.0 ACCESS AND CORRECTION

Individuals may request access to the personal information that Skillset holds about them. Requests for access should be made in writing using the contact details provided in this policy. Skillset will respond to requests within a reasonable timeframe, generally within 30 business days, and will take reasonable steps to verify the identity of the person making the request before granting access. Access will generally be provided free of charge, however Skillset may charge a reasonable fee to cover the cost of locating, retrieving or copying the information.

In some circumstances, access may be refused, where permitted under the Privacy Act 1988 (Cth), including but not limited to, where providing access could: have an unreasonable impact on the health and safety of others or the privacy of others; prejudice legal or law enforcement activities; prejudice the taking of appropriate action in relation to suspected misconduct or unlawful actions; or where the request is frivolous or vexatious. If access is refused, Skillset will provide written reasons for the refusal and explain the available options to complain or seek review.

Skillset takes reasonable steps to ensure that the personal information it holds is accurate, up to date, complete, relevant and not misleading. If an individual believes that the personal information Skillset holds about them is incorrect or requires updating, they may request that the information be corrected by contacting Skillset using the details provided in this policy.

Where Skillset is satisfied that the information requires correction, reasonable steps will be taken to correct the information within a reasonable period. If Skillset does not agree to make a requested correction, Skillset will provide written reasons for the decision and, where requested, will take reasonable steps to associate a statement with the information noting that the individual considers it to be inaccurate, out of date, incomplete, irrelevant or misleading.

Individuals may request to have their personal information deleted by Skillset. Such a request can be made in writing at any time and Skillset will evaluate if the request should be granted. Such action is subject to any legal obligations Skillset may have to retain the information.

11.0 COMPLAINTS AND FURTHER INFORMATION

Further information about this Privacy Policy or Skillset’s handling of personal information can be requested by contacting Skillset using the details below.

Individuals who wish to provide feedback or make a privacy complaint are encouraged to use the Contact Us Form available on the Skillset website and select “Feedback”. All submissions made through this form are reviewed and responded to by Skillset.

Skillset will manage all complaints received in accordance with SLPOL043 – Feedback and Complaints Policy, which is available on the Skillset website.

Where an individual is not satisfied with Skillset’s response to a complaint, assistance from the Office of the Australian Information Commissioner can be sought.

Privacy complaints may also be made by contacting Skillset by phone on 1300 853 525.

12.0 NON-COMPLIANCE

Failure to comply with this Skillset Policy may result in disciplinary action, up to and including the termination of employment or termination of contractual arrangements.

SLPOL016:4