1. Purpose
The purpose of this privacy policy (Policy) is to provide information about the privacy practices of MTC FutureReady Limited (ACN 166 455 385) (MTC, we us or our) and our related entities, as defined in the ‘scope’ below. This Policy will set out how we manage your personal and sensitive information, the circumstances where we may disclose your information, and how you may gain access, request correction, or make a privacy complaint.
This Policy is MTC’s statement of intent to operate within the following Australian privacy laws:
•the Privacy Act 1988 (Cth) (Privacy Act);
•the Australian Privacy Principles, contained in the Privacy Act (APPs);
•the Privacy Amendment (Notifiable Data Breaches) Act 2017 (Cth), incorporated into the Privacy Act (Notifiable Data Breach Scheme); and
other applicable laws that impose specific obligations relating to the handling of personal and sensitive information, including: the Freedom of Information Act 1982 (Cth), and applicable NSW State–based laws such as the Privacy and Personal Information Protection Act 1998 (NSW).
2. Scope
This Policy applies to our current or past staff, volunteers, contractors, MTC Board and Committee members, and suppliers handling personal and sensitive information, which is collected during the course of business, on behalf of MTC, including our related entity, MTC Recruitment Limited (ACN 145 727 859) In this Policy, references to ‘MTC’ include our related entities.
3. References
Privacy Act 1988 (Cth)
Privacy Amendment (Notifiable Data Breaches) Act 2017 (Cth)
Freedom of Information Act 1982 (Cth)
Privacy and Personal Information Protection Act 1998 (NSW)
Office of the Australian Information Commissioner- APP Guidelines
Standards for Registered Training Organisations 2015
4. Policy
4.1 Kinds of personal and sensitive information collected and held.
(a) Personal information is information or an opinion, whether true or not and whether recorded in a material form or not, about an individual who is identified or reasonably identifiable. Typically, the types of information would include:
Contact details: Name, email address, telephone number, mailing or residential address,
Personal details: Date of birth, occupation and work and education history,
Online information: Information provided directly by you using MTC’s website or other online platforms and may include photographs,
Educational results: academic transcripts, qualifications, certifications, licences, training records, assessment results, competency outcomes, course completion status, attendance records, skills assessments, and any other information relating to your education, training or professional development,
Employment Information: professional history such as your previous positions and professional experience, or whether you hold required authorisations or licences,
Financial Data: bank account and payment card details (through our third party payment processor, who stores such information and we do not have access to that information),
Government documents: Your government-issued identification and proof of address documents.
Technical and Usage Data: when you access any of our websites or platforms, details about your internet protocol (IP) address, login data, browser session and geo-location data, statistics on page views and sessions, device and network information, acquisition sources, search queries and/or browsing behaviour, access and use of our website (including through the use of Internet cookies or analytics), and communications with our website.
(b) Sensitive information is a sub-set of personal information that is given a higher level of protection. Sensitive information means information relating to your racial or ethnic origin, political opinions, religion, trade union or other professional associations or memberships, philosophical beliefs, sexual orientation or practices, criminal records, health information or biometric information. The sensitive information MTC collects, is only collected for a particular purpose which is reasonably necessary for MTC to provide the most appropriate service and assistance. Examples of the types of sensitive information, and the circumstances in which we will collect it, include:
Background checks: As required by a particular situation, such as those needed for pre-employment checks including police checks or working with children or vulnerable people checks. In this instance, we may collect sensitive information such as your criminal record.
Cultural background: Where assistance, such as interpreter services, may be needed to provide appropriate services. In this instance, we may collect sensitive information such as your racial or ethnic origin.
Medical information: Where a medical condition, injury or disability may need to be considered to ensure suitable employment opportunities or activities are identified. In this instance, we may collect sensitive information such as your medical conditions, injuries, disabilities, or medications, as well as medication preferences.
Membership information: Where information about membership of a professional or trade may provide accreditation necessary for employment or education opportunities. In this instance, we may collect sensitive information such as your membership of trade unions, or of your membership of professional or trade associations.
4.2 How personal information is collected and held.
(a) MTC will collect your personal and sometimes sensitive information, only as necessary and to provide the range of services to you as part of the specific program provided.
(b) Where practical and reasonable, MTC will obtain your consent and agreement to collect, use and disclose personal information directly from you at the commencement of MTC providing our services. This information is usually collected during group and individual meetings and classroom and other activities. This collection will generally outline:
the types of personal information being collected, and
the reasons for collection and the situations where the information may be shared or disclosed to other parties outside MTC’s operation.
(c) MTC will not collect your sensitive information without your consent, except where the collection is required or authorised by law.
(d) Where impractical and/or unreasonable to collect personal and/or sensitive information from you directly, MTC may also collect personal and/or sensitive information indirectly from other parties, such as from:
referring Government agencies and departments such as Centrelink, and
secure Government department databases, and
referring service providers.
4.3 Purposes for which MTC collects, holds, uses, and discloses personal and/or sensitive information.
(a) MTC’s main function and activities involve the provision of services to clients by assisting them in securing employment, providing training and support to improve their employability skills or to provide a pathway to further education. The clients we assist include a diverse range of people from various age groups, including young school age students, and working aged people from many different backgrounds, experiences, and circumstances.
(b) Where you are a client, as a result of our provision of services, we hold a wide range of information relating to you. We come into contact with you in carrying out our activities, and we cannot function without obtaining and retaining information with regard to you. It is essential that we collect, hold, and use the information in the ongoing conduct of our activities.
(c) MTC also uses the personal information which it collects from you for the following purposes:
Developing marketing activities, to provide information about MTC’s services,
Providing appropriate individual service and achieving outcomes,
Record keeping purposes, and
Monitoring the quality of service and identifying improvements to our delivery of services.
(d) MTC collects, holds, uses and discloses sensitive information for the following purposes:
any purposes you consent to,
the primary purpose for which it is collected,
secondary purposes that are directly related to the primary purpose for which it was collected, including disclosure to the below listed third parties as reasonably necessary to work with you as a customer or supplier of our business, and
if otherwise required or authorised by law.
(e) MTC collects, holds, uses, and discloses your personal and/or sensitive information for several purposes associated with the provision of government funded programs and to provide appropriate assistance to you.
4.3.1 Information used for Marketing Purposes
(a) MTC may use your personal information to send you communications and information about our services for direct marketing purposes, if either we have obtained your consent, or you could reasonably expect us to use the information for that purpose. We will use your preferred method of communication where known. MTC will provide an ‘opt-out’ option in relation to receiving marketing communications.
(b) MTC will only use your sensitive information to send you communications and information about our services for direct marketing purposes if we have obtained your consent.
(c) MTC may also contact you to request your participation in providing content for marketing and promotional materials associated with MTC programs and services. MTC will obtain your written consent, including an option to remain anonymous or to use a pseudonym to protect your identity.
4.4 Our disclosures of personal information to third parties
(a) MTC may share or disclose your personal information (excluding sensitive information) to third parties when providing services. This means that we may disclose personal information (excluding sensitive information) to:
Internal parties: our employees, contractors and/or related entities including employment service programs, education service programs and youth service programs,
Service providers: IT service providers, data storage, web-hosting and server providers, marketing or advertising providers, professional advisors, bankers, auditors, our insurers and insurance brokers, payment systems operators or processors, and service providers including consultants and computer maintenance providers,
Business partners: our existing or potential agents or business partners, and corporate partnerships,
Employers and educational institutions: employment service programs will disclose information with a range of employers offering work experience or job vacancies; education service programs will disclose information with other vocational training providers, NCVER, regulatory bodies and employers; youth service programs will disclose information to volunteers providing mentoring, with employers offering work experience or job vacancies, with schools and other educational institutions,
Mergers and acquisitions: if we merge with, or are acquired by, another company, or sell all or a portion of our assets, your personal information may be disclosed to our advisers and any prospective purchaser's advisers and may be among the assets transferred,
Legal and regulatory bodies: courts, tribunals and regulatory authorities, in the event you fail to pay for goods or services we have provided to you; courts, tribunals, regulatory authorities and law enforcement officers, as required or authorised by law, in connection with any actual or prospective legal proceedings, or in order to establish, exercise or defend our legal rights,
Data processors: third parties to collect and process data, such as analytics providers and cookies, and
Other parties as required by law: any other third parties as required or permitted by law, such as where we receive a subpoena.
(b) MTC may be required to disclose your personal and/or sensitive information to other parties where you have agreed or where:
MTC is permitted by the Government department administering or regulating the program delivered by MTC,
required by laws, including the social security laws,
a court or tribunal order,
MTC is required to contact emergency services, or to speak with your family, partner or support person where we reasonably believe there is a serious risk to the life, health or safety of you or another person and it is impracticable for us to obtain your consent, or
where a duty of care exists.
4.5 Overseas disclosures
(a) MTC stores your personal information in Australia. Occasionally, MTC may use overseas facilities or contractors to process personal and/or sensitive information which is collected and used as part of the delivery of our services. Where MTC uses overseas facilities or contractors, MTC requires them to store personal and/or sensitive information in Australia. However, some contractors or facilities may store limited personal information on overseas servers where onshore storage is not practicable or possible. In such cases, MTC requires these contractors to have appropriate data handling and security arrangements in place equal to or more stringent than those required by Australian law. Notwithstanding the foregoing, MTC remains responsible for the handling of your personal information by overseas facilities and contractors. Our commitment to safeguarding your privacy remains unchanged, regardless of storage location.
(b) We take reasonable steps to:
ensure that overseas service providers are subject to privacy laws which impose obligations which are substantially similar to those contained in the Privacy Act, and
ensure the security of personal and/or sensitive information that is disclosed overseas, and to protect it against loss, misuse or unauthorised access, destruction, use, modification, or disclosure.
4.6 How we contact you
(a) MTC may contact you in a variety of ways, including by post, email, SMS, and telephone call. We will not send you any commercial electronic messages such as SMS or emails unless this is permitted by the applicable marketing laws including the Spam Act 2003 (Cth).
(b) Any commercial electronic message that we send will identify the sender (by the specific entity) and will include our contact details. The message will also provide an unsubscribe facility. If you do not wish to receive commercial electronic messages from us, please let us know. Our contact details are provided at the end of this Policy.
(c) MTC may also record telephone conversations for quality, compliance, and training purposes. MTC will always seek your express consent prior to any recording. You have the option to opt-out of phone recordings if you do not consent to such recording.
(d) MTC uses CCTV systems to record images and videos for security purposes. We may disclose the footage taken by the CCTV systems to enforcement authorities to investigate any issues that take place at MTC's premises.
4.7 Your Rights and controlling your personal and/or sensitive information
(a) Your Choice: MTC will take reasonable steps to ensure that your personal and/or sensitive information is accurate, complete, up-to-date, and relevant to the purpose of the use or disclosure. You do not have to provide personal information to us, however, if you do not, it may affect our ability to work with you as a customer or supplier of our business.
(b) Access: You may request access to the personal information that we hold about you. An administrative fee may be payable for the provision of such information. Please note, in some situations, we may be legally permitted to withhold access to your personal information. If we cannot provide access to your information, we will advise you as soon as reasonably possible and provide you with the reasons for our refusal and any mechanism available to complain about the refusal. If we can provide access to your information in another form that still meets your needs, then we will take reasonable steps to give you such access
(c) Correction: We will take reasonable steps to promptly correct any information found to be inaccurate, out of date, incomplete, irrelevant or misleading. Please note, in some situations, we may be legally permitted to not correct your personal information. You are encouraged to help us keep your personal and/or sensitive information accurate, complete, and up to date by contacting your consultant at the local office where you are registered or through MTC’s contact details listed in this Policy. If we cannot correct your information, we will advise you as soon as reasonably possible and provide you with the reasons for our refusal and any mechanism available to complain about the refusal. We reserve the right to take reasonable steps to ensure, when requests for correction to personal and/or sensitive information are made, that:
the requests relate to the purpose for which the information is held, and
the corrected information is accurate, up to date, complete, relevant, and not misleading, and
that the person seeking access to and correction is in fact the individual to whom the data relates, or is otherwise entitled to access the data.
4.8 Cookies, website and online presence
(a) MTC occasionally uses website analytics platforms to:
track website traffic information, including IP addresses, to improve website design for marketing purposes, and
collect responses to client surveys, to improve the delivery of MTC services.
(b) MTC's website (www.mtcfutureready.org.au) uses ‘cookies’ (small summary files with unique identification numbers) which are sent to your computer to assist the browsing session and saves your ‘cookie’ identification and preferences for future sessions. You may have the option to configure your web browser to opt out of receiving ‘cookies’ or to reject at each session.
(c) MTC utilises several social media platforms such as: Facebook, LinkedIn, and YouTube to publish content and as a communication channel for use in marketing and promotion of MTC’s programs and services. Each of these platforms provide options regarding user privacy settings, which you may customise to restrict access to any content or information which may be viewed, collected, and used by other people using the platform.
(d) Third Party Websites: MTC is not responsible for the privacy practices, data collection methods and security used by these sites. We encourage you to read the privacy policies of any website you link to from our website or emails.
4.9 Data Security
(a) MTC provides secure storage of the records held which contain your personal and sometimes sensitive information, as follows:
Hard-copy paper records are stored in lockable filing cabinets which are only accessible to authorised MTC personnel,
Soft-copy electronic records are stored within the following secure systems:
password controlled Government department databases,
approved third party data storage services, and
password controlled networked files, which are protected from unauthorised access and are regularly backed-up to prevent loss.
(b) MTC regularly monitors both its hard-copy and soft-copy files containing personal and sometimes sensitive information to ensure the appropriate level of security is maintained. This occurs through both physical and automated auditing and monitoring activities.
(c) MTC has an obligation as part of the Notifiable Data Breach Scheme to notify the Privacy Commissioner and the affected individuals, should a data breach occur under the following circumstances:
where there is a loss or potential loss of personal and/or sensitive information, and
where there is a risk of unauthorised access to or disclosure of data containing personal and/or sensitive information, and
there is likely to be serious harm caused in relation to an individual or group of individuals.
4.10 Data Security
(a) MTC uses artificial intelligence and large language models in our business operations, including AI tools provided by third parties. We only use these technologies when legally permitted and necessary for our business. For example, MTC will use AI tools to improve and optimise our services and operations, and to automate routine tasks.
(b) When we work with third-party AI providers, we require they handle your personal information in accordance with privacy laws through contractual requirements and appropriate safeguards.
(c) While we use AI technologies, we do not use your personal and/or sensitive information to train any third-party AI models.
4.11 Complaints about a privacy breach
(a) MTC has established processes for handling feedback, questions, or complaints about MTC’s privacy practices. MTC should be contacted in the first instance as follows:
Privacy Officer
MTC FutureReady Limited
334-336 Illawarra Road
Marrickville, NSW 2204
(T) 1300 232 663
(E) privacy@mtcfutureready.org.au
(W) www.mtcfutureready.org.au using the ‘Contact Us’ option
(b) MTC will acknowledge the receipt of any feedback, questions or complaints received within 24 hours and provide a formal response after investigation within 5 business days (being days which are not Saturdays, Sundays, or public holiday in New South Wales).
(c) All other concerns relating to the Privacy Act and APP’s, may be referred for resolution to:
The Office of the Australian Information Commissioner
GPO Box 5218
Sydney, NSW 2000
(T) 1300 363 992
(E) enquiries@oaic.gov.au
(W) www.oaic.gov.au
4.12 Amending this policy
(a) We have the right to amend this Policy at any time by posting a revised version on our website.
(b) If we have your email address on our mailing list, then we will email that address with notice of any changes to this Policy. If we use your information in a method substantially different from that communicated when it was collected, we will endeavour to seek your consent, and give you the option to cease using our services.
4.13 Policy administration
(a) The General Manager Risk and Quality is responsible for reviewing and updating this Policy and is responsible for seeking legal advice as needed when maintaining this Policy.
(b) The executive leadership team of MTC (ELT) has responsibility for the management of legal compliance obligations within its area of control including promoting, monitoring, and upholding a positive legal compliance culture and identifying the need to engage the General Manager Governance Risk and Compliance for support and/or training.
(c) The Chief Executive Officer of MTC (CEO) has overall responsibility for ensuring MTC fulfils its legal obligations and effectively manages any risk exposure that may result from compliance failures and providing formal assurance to MTC’s board as to the state of compliance at MTC.
4.14 Consultation and Approval
The CEO, the General Manager Governance, Risk and Compliance and MTC’s legal counsel were consulted in the development of this Policy.
The Policy has been approved by the CEO.