1.2 We only collect personal information by lawful and fair means and not in an unreasonably intrusive way. We may collect your personal information:

(a) when you provide directly to us through your dealings with us (for example, information you submit on our website, through our app or when you speak with our staff);
(b) from other people who you provide your personal information to who are involved in helping us provide our goods or services to you (for example, our delivery and logistics agents or payment processors).

1.3 We take reasonable steps to ensure that you are made aware at or before the time of collection of your personal information (or if that is not practicable, as soon as practicable afterwards) of the matters referred to in Australian Privacy Principle 5.2 to the extent reasonable in the circumstances. Those matters will usually include:

(a) the identity of Elsema and how to contact us;
(b) the purpose and circumstances of the collection;
(c) the fact that you are able to gain access to the information;
(d) the organisations (or the types of organisations) to which Elsema usually discloses information of that kind;
(e) any law that requires the particular information to be collected;
(f) the main consequences (if any) for you if all or part of the information is not provided; and
(g) if we collected your information from a third party rather than directly from you, the fact that we have done so.

1.4 In general we do not collect sensitive information without consent. Sensitive information includes information such as racial or ethnic origin, political and religious beliefs, trade union membership, criminal history and health information.

1.5 Where it is reasonable and practicable to do so, we collect personal information about you directly from you unless you are not capable of providing the information.

(a) to enable you to use our products, website or mobile app;
(b) to manage our relationship with you, such as managing delivery, trouble-shooting or payment arrangements;
(c) to conduct our ordinary internal business, marketing and operational processes, such as account management, business development and (if applicable) disclosing relevant information to a potential buyer or investor to consider acquiring us or our business;]

2.2 If we are in doubt as to whether a particular use or disclosure is permitted, we will seek consent to disclose personal information.

2.3 There are some other limited situations set out in the Australian Privacy Principles where we may be authorised or required to use or disclose your personal information for another purpose (such as where we are required to use or disclose information under an Australian law or court order).

2.4 When using or disclosing personal information, we consider the source of the information – e.g. how and when it was collected, and what you knew at the time of collection. This will assist us in identifying the purpose of collection, and therefore the permitted use of the personal information.

2.5 We will only use your personal information (other than sensitive information) to send direct marketing material, such as newsletters, if you would reasonably expect us to use the information for marketing (or you have consented to that use) and have not opted out of receiving direct marketing. You can opt out at any time by using the mechanism we include in our direct marketing material or by contacting us using the details below.

2.6 Our staff are trained to comply with our obligations under the Privacy Act and this Policy.

3.2 If we become aware that personal information is incorrect or incomplete, we will endeavour to correct it.

4.1 We take reasonable steps to protect personal information from misuse and loss from unauthorised access, modification or disclosure. For example, we use passwords for access to computer records and keep hard copy files secure.

4.2 We destroy or de-identify personal information which is no longer required. Most records are destroyed or de-identified after 7 years.

5.2 We include a brief statement with respect to privacy on forms used to collect personal information, and mail-outs/newsletters etc, to make individuals aware of our privacy obligations.

5.3 We publish the Privacy Policy on our website and keep it up to date.

5.4 On request, we will explain to individuals in general the types of personal information we hold, for what purposes, and how we collect, hold, use and disclose the information. Our staff are trained to handle general inquiries of this nature, however, if the individual wishes to have access to specific information, they will be referred to the Director.

(a) providing access would have an unreasonable impact on the privacy of other individuals; or
(b) the request for access is frivolous or vexatious; or
(c) providing access would reveal the intentions of Elsema in relation to negotiations with an individual in such a way as to prejudice those negotiations; or
(d) providing access would be unlawful.

6.2 We only accept written requests for access to personal information. Requests are directed to the Director and you may be required to provide proof of identity before the personal information is released to you.

6.3 If you are incapable of requesting access to personal information, then a person acting on your behalf may request access. This person may be the authorised attorney or some other person who is responsible for you. We take reasonable steps to ensure that the person has the authority to make a request for access.

6.4 If you can establish that personal information is incorrect, incomplete or not up to date, then we will endeavour to correct the information.

6.5 If we disagree that the personal information is incorrect, then we may refuse to alter the information. In this case, if you request it, we will make a note of your objection on the file.

6.6 If we deny access or refuse to correct personal information, we will provide you with reasons for this decision.

7.2 If we consider that it is not appropriate to allow you to remain anonymous or use a pseudonym then we will explain to you the consequences of remaining anonymous or using a pseudoynm. For example, we may not be able to provide you with particular goods or services.

8.2 If we need to disclose personal information about you to an overseas recipient, then (except where the Australian Privacy Principles do not require us to do so) we will only do so:

(a) after taking such steps as are reasonable in the circumstances to ensure that the overseas recipient does not breach the Australian Privacy Principles; or
(b) with your consent (after informing you that if we do so we may not be in a position to ensure that the overseas recipient does not breach the Australian Privacy Principles and Australian Privacy Principle 8.1 will not apply); or
(c) if we reasonably believe that the overseas recipient is subject to a law, or binding scheme, that has the effect of protecting the information in a way that, overall, is at least substantially similar to the way in which the Australian Privacy Principles protect that information and there are mechanisms you can access to take action to enforce that protection.

9.2 Elsema will not collect sensitive information about you unless you have consented, it is required by law or we are otherwise permitted to do so under the Australian Privacy Principles.