This policy statement outlines Valvoline’s (“we
“) stance on the privacy of personal information.
Valvoline understands that privacy is an important issue for individuals. Valvoline believes that due respect for individual privacy not only protects an important right of the individual but is a powerful tool in the creation of healthy relationships with its customers, suppliers and staff.
We aim to enhance the level of trust in those relationships by:
1. complying with the letter of privacy law, including the Australia Privacy Principles set out in the Privacy Act (1988) (Cth);
2. complying with the spirit of privacy law, and where a choice of approach is available to Valvoline, by adopting wherever possible the approach that maximises the privacy of personal information; and
3. continuing to comply with all other privacy related obligations, such as those contained in other legislation and obligations of confidentiality.
It is the responsibility of all Valvoline staff and contractors to comply with privacy laws and this policy. Valvoline requires that its staff and contractors familiarise themselves with and accept and adopt this policy. Staff are to do everything within their power to cause Valvoline to meet its privacy obligations and to achieve the benefits referred to above.
Valvoline will regard non-compliance with this policy most seriously. Violation of this policy will lead to disciplinary procedures being imposed, including the possibility of dismissal.
1. SOME IMPORTANT TERMINOLOGY EXPLAINED
“Collection” means any acquisition of personal information by Valvoline, whether direct from the individual or from someone else.
“Direct Marketing” means when we contact you with promotional material or other advertising that is not specifically related to a transaction between Valvoline and the individual (such as telemarketing and advertising via email, SMS or post).
“Disclosure” means releasing personal information outside Valvoline.
“Personal Information” means information or an opinion about an identified individual or an individual who is reasonably identifiable. It does not matter whether the information or opinion is true or justifiable or not. It does not matter whether the information or opinion is recorded in a material form or not. Personal information relates to individuals (“natural persons”), not companies. However, personal information can include information within a business context.
Personal information also includes sensitive information.
“Primary Purpose” is the original and main purpose of collecting personal information. Any collection by us can have only one primary purpose. “Privacy Act” means the Privacy Act 1988 (Cth), as amended by the Privacy Amendment (Enhancing Privacy Protection) Act 2012 (Cth) and includes the Australian Privacy Principles, or “APPs”.
“Secondary Purpose” means any purpose other than the primary purpose of collecting personal information.
“Sensitive Information” is personal information concerning an individual’s:
. racial or ethnic origin; or
. political opinion; or
. membership of a political association or political opinions; or
. religious beliefs or affiliations; or
. philosophical beliefs; or
. membership of a professional or trade association; or
. membership of a trade union; or
. sexual orientation or practices; or
. criminal record; or
. health information about an individual; or
. genetic information about an individual that is not other health information; or
. biometric information that is to be used for the purpose of automated biometric verification or biometric identification; or
. biometric templates.
“Use” of information means any use and would include adding personal information to a database or using it to send direct marketing materials to an individual. Use does not include mere disclosure of information.
2. CONSENT AND OUR APPROACH TO IT
In some cases Valvoline may not make certain use of personal information or disclose it without the consent of the individual.
Valvoline aims at all times to give the individual sufficient information to enable the individual to make an informed decision about whether or not to give consent. We will explain all relevant matters fully and adequately.
Where we need consent as a requirement of the Privacy Act and the Australian Privacy Principles, prior to collecting, using or disclosing the personal information, we will inform the individual of the following:
. what we wish to do with the information;
. the purpose of collecting the information; and
. any other relevant matter.
We will not seek wider consent than what we need to fulfil the stated purpose and activity of collecting, using or disclosing the information.
We will endeavour at all times to give the individual sufficient time to determine whether or not to give consent.
We will not put undue pressure on an individual to give consent. We believe that for consent to be valid it must be voluntary.
We will, wherever possible, obtain express consent from individuals. We will avoid relying on implied consent, wherever possible.
Finally, Valvoline understands that consent, in the context of privacy, and in the absence of a legally binding agreement, cannot be irrevocable and can be withdrawn by the individual at any time.
3. WHAT KIND OF PERSONAL INFORMATION WE COLLECT
(a) Personal Information
The types of personal information Valvoline will collect from you will depend on the circumstances in which that information is collected. We will normally collect:
a) your contact details (i.e. your name, address, phone numbers, facsimile numbers and email addresses);
b) information regarding prior dealings with Valvoline;
c) information regarding your company and its directors (if applicable);
d) photographs of your vehicle(s) or registration plate(s) (if applicable); and
e) responses to marketing surveys and trade promotions (if applicable). The aforementioned information will normally be collected for the purpose of enabling Valvoline to fulfil its obligations to customers in supplying goods and services or to suppliers who are supplying Valvoline with goods and services.
If we collect information other than your personal contact details, that will normally be for the purpose of assessing the demographics and makeup of Valvoline’s market or the market for Valvoline’s products generally.
We will not collect personal information unless it is necessary for our activities or functions.
We will not collect personal information in an unfair or intrusive manner.
When collecting personal information we will make the individual aware of Valvoline’s identity and how to contact us. The role of privacy officer has been created within Valvoline to act as a first contact for individuals concerned about privacy issues. We will also make the individual aware of his/her rights of access to personal information held by Valvoline and the purposes for which the information is collected. We will also advise of the consequences if information is not provided.
We will collect information direct from the individual in preference to collecting it from other persons because this will make it more likely that the information is correct and that the individual has consented to giving it to us. We may also collect personal information through:
a) our websites;
b) orders for products or services;
c) Application for Approved Buyer Status forms;
d) trade promotions;
e) marketing surveys; and
f) company credit information reports.
(b) Sensitive information
Generally, we will not collect sensitive information from individuals. If we do we will make the individual aware of the purpose of such collection and obtain consent to do so where the information is reasonably necessary for, or directly related to, one or more of our functions. We may also collect sensitive information without your prior consent where:
. the collection of the sensitive information is required or authorised by or under an Australian law, or a court or tribunal order;
. it is unreasonable or impracticable to obtain your consent to the collection, use or disclosure of sensitive information; and we reasonably believe that the collection, use or disclosure is reasonably necessary to lessen or prevent a serious threat to the life, health or safety of any individual, or to public health or safety; or
. we have reason to suspect that unlawful activity, or misconduct of a serious nature, that relates to our functions or activities has been, is being or may be engaged in, and we reasonably believe that the collection, use or disclosure of sensitive information is necessary in order for us to take appropriate action in relation to the matter.
. we believe that the disclosure is reasonably necessary to assist any entity, body or person to locate a person who has been reported missing; or
. the collection, use or disclosure is reasonably necessary for the establishment of a legal or equitable claim or for confidential alternative dispute resolution.
4. THE PURPOSES OF COLLECTING THE PERSONAL INFORMATION AND WHAT WE DO (AND WILL NOT DO) WITH IT
We will only use and disclose your personal information in accordance with the Privacy Act and this policy.
We will generally collect personal information to enable us to contact our customers, suppliers, business partners and others with whom we have business relationships. This will enable us to perform our contractual obligations, to monitor and administer our contracts and their fulfilment.
For customers that wish to trade with Valvoline on a delayed payment basis, we will collect personal information via an Application for Approved Buyer Status form for the purpose of:
a) assessing your (or your organisation’s) request for deferred payment terms (approved buyer status);
b) contacting you so as to enable us to manage your account and to fulfil our obligations to you or your organisation;
c) (if applicable) interacting with you as a guarantor of your organisation’s obligations to Valvoline;
d) recovering monies owing to Valvoline from time to time; and
e) retaining your information on our database so that we can advise you of services and products which we reasonably believe you may be interested in from time to time.
We may disclose personal information submitted with the Application for Approved Buyer Status form to organisations that provide us with financial services such as our bank, information technology services, marketing and promotional services and professional advice, such as legal practitioners and accountants. We may also disclose that personal information to any person or organisation who may be interested in buying the whole or part of our business.
We may also disclose personal information to affiliated third party suppliers of vehicle-related goods that we sell in order to facilitate these transactions and deliver these third party products that you might order via our shared distribution network.
We also collect personal information to enable us to carry out marketing initiatives and market analysis.
Wherever we use personal information for a purpose other than the primary purpose of collection, we will only use or disclose the information if the primary and secondary purposes are related and the individual would have a reasonable expectation that we would use the information or disclose it for the secondary purpose or if we obtained the consent of the individual to do so, or if such use or disclosure is otherwise required under the Privacy Act.
If you do not provide us with the information we request, we may not be able to fulfil the applicable purpose of collection, such as to supply goods or services to you, or to assess your request for delayed payment terms, or to create a credit account for you, or to enter you into a trade promotion.
5. WHAT WE DO TO ENSURE THE ACCURACY OF YOUR PERSONAL INFORMATION
It is our policy to ensure that when personal information is collected from an individual it is accurately recorded. It is also our policy to collect personal information direct from the individual wherever possible since this is likely to generate greater accuracy.
Valvoline will conduct periodic checks of its personal information and may from time to time contact the individual to update and correct any errors. Individuals have the right of access to the personal information held by Valvoline and will have the opportunity to correct any inaccuracies (as to which, see below).
Valvoline must respond promptly to any request for correction of data and must act within a reasonable period to correct data that is discovered by Valvoline to be inaccurate.
6. WHAT WE DO TO ENSURE THE SECURITY OF YOUR PERSONAL INFORMATION
It is not appropriate in this policy to provide specific details of security measures adopted by Valvoline to protect information held by it. To do so could compromise those security measures.
Valvoline will use an appropriate combination of physical measures including physical barriers, alarm systems and access technology with administrative protocols to exclude unauthorised intruders from gaining access to information.
Only those persons with a need to know personal information will have access to it.
To maintain the integrity of information, Valvoline has acquired and will continue to acquire up-to-date computer virus prevention technology and makes use of other appropriate technology, such as “fire-walls” to exclude unauthorised access or hacking into its computer system.
Wherever the sensitivity of personal information warrants, Valvoline will use encryption to prevent unauthorised persons from gaining access to Valvoline’s electronic communications. Where a facsimile transmission is to be sent containing sensitive personal information, it is our policy to contact (usually by telephone) the individual prior to sending it.
7. INDIVIDUALS’ ACCESS AND CORRECTION RIGHTS
Valvoline will provide individuals access to the personal information which Valvoline holds about them. The rights of access and correction will be advised when personal information is collected.
You can contact Valvoline by phone on (02) 8603 2300 – ask for the Privacy Officer; or by mail to Suite 603, Level 6 , 2 Burbank Place, Baulkham Hills NSW 2153, attention: Privacy Officer, or via email at email@example.com.
Valvoline will not require reasons from individuals for wanting access to their personal information as a prerequisite of providing that information. Individuals are not required to give reasons.
Depending on the circumstances, such as where the request is sensitive or complex, Valvoline may use a written request form. In simpler cases, Valvoline will accept a request for access by telephone or in person.
Valvoline will respond to requests for access as soon as possible and will acknowledge the request within 14 days and deal with it within 30 days at the latest.
Valvoline will not charge individuals for access to their personal information.
Valvoline will provide an appropriate area where inspection of personal information can take place with privacy and convenience. We will provide the print-out or photocopy of the personal information for the review of the individual. We will allow the individual to make notes and to take photocopies away. If the individual requires an explanation, one will be provided by a suitably qualified officer of Valvoline within a reasonable period of time.
In some circumstances it may be appropriate and lawful for Valvoline to deny access, including if:
. we reasonably believes that giving access would pose a serious threat to the life, health or safety of any individual, or to public health or public safety;
. providing access would have an unreasonable impact on the privacy of another individual;
. the request is frivolous or vexatious;
. the information relates to existing or anticipated legal proceedings between Valvoline and the individual, and the information would not be accessible by the process of the legal discovery in those proceedings;
. giving access would reveal Valvoline’s intentions in relation to negotiations with the individual and prejudice those negotiations for Valvoline;
. we have reason to suspect that unlawful activity, or misconduct of a serious nature, that relates to Valvoline’s functions or activities has been, is being or may be engaged in; and giving access would be likely to prejudice the taking of appropriate action in relation to the matter;
. providing access would be unlawful or if denying access is required or authorised under Australian law or a court/tribunal order;
. giving access would be likely to prejudice one or more enforcement related activities conducted by, or on behalf of, an enforcement body; or
. giving access would reveal evaluative information generated within the entity in connection with a commercially sensitive decision-making process.
If you wish to have your personal information deleted, please let us know in the same manner as referred to above and we will take all reasonable steps to delete it unless we need to keep it for legal reasons.
8. USE OF GOVERNMENT IDENTIFIERS
Valvoline will not use government identifiers such as tax file numbers or Medicare numbers as a means of identifying a person from whom the identifier has been collected, unless an exception under the Privacy Act applies.
9. ANONYMITY AND PSEUDONYMITY
Wherever practicable, and in line with Valvoline’s commitment to collection of personal information only so far as it is necessary, Valvoline will give individuals the option of dealing anonymously or by pseudonym when communicating with Valvoline.
Clearly this will not be practicable or appropriate where contractual relationships are created and in many other situations (such as where we are required or authorised by law). However, where Valvoline does not need personal identifiers, it will not collect them.
10. SENDING PERSONAL INFORMATION TO FOREIGN COUNTRIES
We may disclose personal information outside of the jurisdiction from which it was collected. In the conduct of our business, we currently only transfer to, hold or access information personal information from Australia. This policy will be amended in the event that Valvoline opts to disclose personal information abroad.
Valvoline will generally transfer personal information to foreign countries only where:
. the personal information will be protected by a law or contract upholding privacy principles similar to those contained in the Privacy Act and specifically in the Australian Privacy Principles. Wherever possible, if the local law in the foreign country does not protect privacy principles, Valvoline will seek to impose those principles on the recipient by contractual measures;
. the individual consents; or
. the transfer is necessary for the performance of a contract between Valvoline and the individual or is in the interests of the individual.
We will endeavour to take all reasonable steps to keep secure any information which we hold about you, and to keep this information accurate, up to date and complete. When we no longer need to use your information, we will take steps to properly de-identify or destroy it.
If you wish to complain about our use of your personal information or a potential breach of the Australian Privacy Principles, please contact us by phone on (02) 8603 2300, or by mail to Suite 603, Level 6 , 2 Burbank Place, Baulkham Hills NSW 2153, attention: Privacy Officer, or via email at firstname.lastname@example.org. If you are unhappy with our handling of your complaint, the complaint may then be taken to the Australian Commercial Disputes Centre or the Office of the Australian Information Commissioner.
12. ELECTRONIC COMMUNICATION AND OUR WEBSITE
Special issues arise when personal information is collected or communicated by electronic means. Valvoline has a separate email policy governing the use of email by its staff. Part of that policy is designed to protect the privacy of personal information about individuals.
The Valvoline web site will contain a privacy notice and at each point within the web site where personal information is collected, the required disclosure concerning collection and use of personal information will be placed.
We sometimes use cookie technology on our website to provide information and services to website visitors. Cookies are pieces of information that a website transfers to your computer’s hard disk for record keeping purposes and are a necessary part of facilitating online transactions. Most web browsers are set to accept cookies. Cookies are useful to estimate our number of members and determine overall traffic patterns through our websites.
13. OUR OUTSOURCING OF SOME INFORMATION MANAGEMENT TASKS
Valvoline understands that contracting management of information technology out to a contractor such as Primur does not relieve Valvoline of its obligations under the Privacy Act and the Australian Privacy Principles.
Valvoline will remain primarily responsible for such compliance. Valvoline will monitor Primur and any outsourcing contractor’s compliance with this policy.
Last updated: February 2014
Valvoline Australia Pty Ltd (ABN 86 000 446 855) Suite 603, 2 Burbank Place Baulkham Hills NSW 2153 AUSTRALIA
(02) 8603 2300