Snapshot 80347
Normalized text
Scripts and page chrome removed; this is what change detection compares.
AC3 Privacy Policy
August 2026
AU +61 2 9199 0888 | info@ac3.com.au | NZ 0800 258 773 | info@ac3.co.nz ac3.com.au | ac3.co.nz
Version 0.1
Notices
Copyright ©2026 Australian Centre for Advanced Computing and Communication Pty Ltd (“AC3”).
ABN 27 095 046 923.
All Rights Reserved.
AC3 Privacy Policy - Version: 7.2
Release for General Use Page |1
Version 0.1
Table of Contents
Notices ................................................................................................................................................................ 1
Executive Summary .......................................................................................................................................... 3
Management of Personal Information ............................................................................................................ 4
Collection and Storage .................................................................................................................................... 4
Employees, Contractors, Suppliers and Customers .................................................................................. 4
Job Applicants .............................................................................................................................................. 5
Customers and Their Employees ................................................................................................................. 5
Quality of Personal Information ....................................................................................................................... 6
Data Security ...................................................................................................................................................... 6
Access to Restricted Information ................................................................................................................ 7
Direct Marketing ................................................................................................................................................ 7
Disclosure and Retention of Personal Information ......................................................................................... 7
Website Browsing............................................................................................................................................... 8
Access and Correction of Personal Information ........................................................................................... 9
BYOD Policy........................................................................................................................................................ 9
Complaints ......................................................................................................................................................... 9
Access to This Policy ....................................................................................................................................... 10
Contact Information ........................................................................................................................................ 10
Policy Information............................................................................................................................................ 11
Compliance Applicability .......................................................................................................................... 11
Document Credentials .................................................................................................................................... 12
Document Control ...................................................................................................................................... 12
AC3 Privacy Policy - Version: 7.2
Release for General Use Page |2
Version 0.1
Executive Summary
AC3’s Privacy Policy sets out how AC3 manages Personal Information that we may receive or
collect, use and disclose.
“Personal Information” in this policy has the meaning as set out in the Privacy Act 1988 (Cth).
Personal information is any information or opinion about an identified individual, or an individual who
is reasonably identifiable: whether the information or opinion is true or not, and whether the
information or opinion is recorded in a material form or not.
We are committed to ensuring the proper, open and transparent management and use of all
Personal Information we collect and handle in accordance with applicable privacy laws, including
the Australian Privacy Principles and the New Zealand Privacy Principles.
All our employees and contractors have responsibilities in respect of this privacy policy, which will be
regularly communicated.
This policy reflects and operates within the context of The AC3 Way, components of which are
represented in the image below. AC3’s Vision and Purpose direct our collective action i.e. Ways of
Being, which is underpinned by our intention, Ways of Thinking. Working with these components, we
strive to be the company everyone wants to work with and for.
This policy forms part of your employment agreement or engagement; any breach of this policy
may result in disciplinary action which could lead to termination of employment or engagement
with AC3. Because we’re always looking for ways to Better It, we reserve the right to vary or rescind
this policy at any time.
AC3 Privacy Policy - Version: 7.2
Release for General Use Page |3
Version 0.1
Management of Personal Information
We are strongly committed to ensuring that we are open and transparent about the way we
manage Personal Information. The AC3 Privacy Policy covers:
1. The kinds of Personal Information that we collect and hold;
2. How, and the purposes for which we collect, hold and use Personal Information;
3. Who we disclose Personal Information to;
4. How you may access Personal Information about yourself that we hold and seek the correction
of such information;
5. How you may complain about a privacy issue or alleged breach of the Australian Privacy
Principles and how we will manage such a complaint; and
6. Whether we are likely to disclose Personal Information to overseas recipients.
Collection and Storage
We will only collect Personal Information that is necessary for our functions and activities. We will only
collect Personal Information by lawful and fair means and not in an obtrusive way.
We collect and hold different categories of information depending on the nature of your interaction
with us.
Employees, Contractors, Suppliers and Customers
We generally collect Personal Information directly from our employees, contractors, customers and
suppliers. Depending on the nature of your interaction with us, this Personal Information may include
names and contact details so that we can contact you. For employees and contractors, we may
also collect certain sensitive information, such as a tax file number, next of kin name and contact
details, banking and superannuation details, remuneration details, employment checks (reference
checks, Police Checks, Working with Children Checks, etc.), injuries and attendance records.
The purpose of collecting such information is so we can meet our employer obligations (such as
payroll and making superannuation contributions) to contact next of kin in an emergency, and to
ensure that our people (employees and contractors) have the skills, experience, qualifications and
clearances required to perform services for us and our customers. All Personal Information about
employees and contractors will be held securely. Secure storage methods include, but are not
limited to, locked filing cabinets with restricted access (for physical documents), and approved
cloud-storage services, with relevant access and other security controls (for electronic records).
We may also collect feedback and information from third parties relating to our employees,
contractors and suppliers’ performance of services for us. This information is collected for the
purposes of monitoring our contractors and suppliers’ performance of services and to ensure that
we can provide the highest quality products and services to our customers.
AC3 Privacy Policy - Version: 7.2
Release for General Use Page |4
Version 0.1
Job Applicants
If you apply for a position at AC3 we may collect your name, contact details and any information
that you have provided us as part of your job application. This may include information contained in
your CV, your driver’s license and/or passport. We may also collect Personal Information relating to
you from third parties you have identified as referees or references in your job application. We may
also require you to undertake criminal record check (Police Check), Working with Children Check
and/or other pre-employment checks that are required for either ours or our customer requirements.
This information is solely used for the purposes of determining your suitability for the role that you
have applied for.
Customers and Their Employees
When you become a customer, we may collect Personal Information from you such as your name,
contact details and email address.
As part of our due diligence on customers that request commercial credit from us, we may use a
credit monitoring & reporting company to provide us with credit information (credit reporting
agency). We will only use or disclose your credit-related information for the primary purposes for
which it was collected or as consented to, or as otherwise set out below:
1. To review the customer’s credit score and assess the terms we offer to the customer;
2. Lodge defaults with the credit reporting agency after having followed the proper process;
3. Periodically reviewing credit-related information for existing customers to ensure continued credit
worthiness;
4. Disclose that information to our Related Bodies Corporate if required, or a person who manages
credit, to process an application or manage credit or discuss an enquiry with you or for related
internal management purposes that are directly related to the provision or management of
commercial credit;
5. The administration and management of our products and services, including charging, billing;
6. Third parties, such as external debt collectors or external dispute resolution providers in relation to
any complaints or disputes concerning the credit offered to you;
7. Other credit providers where you have consented and where permitted by law; and
8. Other persons where required or authorised by law.
In addition to using and disclosing credit-related information as set out above, all customer Personal
Information collected by us is solely used for our business functions and activities. It may be used for
the following purposes:
1. For billing purposes and order fulfilment (e.g. invoicing);
2. To contact you in relation to our provision of services to you;
3. To respond to your requests, enquires, complaints and/or other customer service related
activities;
4. To maintain your account details;
5. To provide technical support – for example, account creation, password reset;
6. To provide you with information in relation to our products, services or other information that you
may have requested;
7. To streamline and personalise your experience while dealing with us; and
AC3 Privacy Policy - Version: 7.2
Release for General Use Page |5
Version 0.1
8. To undertake customer satisfaction surveys and to tailor our information, services or products to
improve and enhance those services and products provided to the customer.
We may also collect from our customers Personal Information relating to its employees and
customers, for example, payroll information. This Personal Information is solely used so that we can
facilitate provision of the services our customers have requested.
We may use de-identified Personal Information derived from:
1. Our customers and our customers’ employees; and
2. Customers use of our products and services in order.
to create anonymous demographic and customer usage information. We will then use this
anonymous, aggregated information to develop new and or more appropriate services and
products to offer to our customers.
Quality of Personal Information
We will ensure, to the extent reasonably possible, Personal Information collected, used or disclosed is
accurate, up-to-date, complete, and relevant. If we become aware that any Personal Information
we hold is inaccurate, we will take prompt steps to update and correct our records.
If you believe the information we hold is in-accurate, not up-to-date, incomplete or irrelevant, you
can ask us to correct the information. Refer to the “Access and Correction of Personal Information”
section below.
Data Security
We take active measures to ensure the security of Personal Information we hold against misuse,
interference, loss and unauthorised access, modification, or disclosure.
All Personal Information is stored at secure premises. Electronic Personal Information is stored using
the highest quality data management tools and IT security systems and controls, including passwords
and firewalls.
When we no longer require Personal Information, it is securely destroyed and disposed of.
Our security systems are regularly reviewed and internally and externally audited so that we can
identify any potential security weaknesses and take steps to promptly rectify them. We are certified
to ISO 27001 Information Security Management Systems and ISO 9001 Quality Management Systems
standards.
AC3 Privacy Policy - Version: 7.2
Release for General Use Page |6
Version 0.1
Access to Restricted Information
Our employees and contractors while employed or engaged, may have access to Restricted
Personal Information about our Customers while working on our Customers’ IT Systems.
Restricted Personal Information includes but is not limited to:
Personal Information our Customers hold about their customers and/or clients;
Criminal Records, such as criminal convictions, spent criminal convictions, and other
corrective services records;
Personal Information about children and children-at-risk; and
Personal Information which is protected at law by the Privacy Act and/or other legislation.
Prior to being granted access to IT Systems that contain Restricted Personal Information, we require
relevant employees to undergo Police and other relevant Checks to ensure there is not a prohibited
reason preventing them being in contact with such Restricted Personal Information.
Under no circumstance is such Restricted Personal Information permitted to be used, disclosed,
collected, stored. or illegally accessed by our employees. Nothing in this policy gives permission to
employees to breach the privacy of Restricted Personal Information.
We take breaches or suspected breaches of information privacy very seriously, and not just as a
breach of this policy but as a breach of relevant legislation. As a result, any breach or suspected
breach of policy and/or legislation will be treated as such, with immediate referral after becoming
aware to relevant law enforcement authorities for investigation, and or disciplinary action, up to and
including termination of employment may result.
Direct Marketing
From time to time, AC3, our related bodies corporate and third parties who provide services to AC3,
may also use your personal information to tell you about products and services we think may be of
interest and value to you. We may contact you by various means including, but not limited to,
telephone, email, or other electronic means (such as social media).
If you do not want to receive direct marketing offers from us, you can opt-out at any time, by
contacting marketing@ac3.com.au or unsubscribing directly from marketing emails using the
unsubscribe function on those emails.
Disclosure and Retention of Personal Information
As part of providing our services, we may disclose Personal Information to third party suppliers and
contractors of services, banks, or other financial institutions, and to customers. In these cases, we
expect these organisations to protect the privacy of that Personal Information.
AC3 Privacy Policy - Version: 7.2
Release for General Use Page |7
Version 0.1
In particular, if a customer requires us to provide Personal Information about our staff (employees
and contractors) who will be providing services to our customers (for example, Police Clearance
Certificates, Working with Children Checks, professional experience/qualifications), this Personal
Information is subject to the relevant customer signing a Non-Disclosure Agreement about the
collection, use, storage and retention of such Personal Information.
Other than in the cases outlined above, we will not disclose Personal Information to any other third
party unless we have reasonable grounds to believe:
The individual has authorised the disclosure;
The safety of the individual, or the safety of others in the community is at risk; and
We are required or permitted by law to do so (includes responsibilities related to statutory
reporting and preventing breaches of the law).
As a provider and user of cloud services, we generally retain Personal Information on servers within
Australia. However, we may also disclose Personal Information overseas, including to:
AC3 Group Members based in New Zealand and support staff based in South Africa,
Indonesia, France and the Philippines; and
Service providers or other third parties located in the United Arab Emirates, United States
Canada, Pakistan and Thailand.
Unless we have an individual’s consent or an exception under Australian privacy law applies, we will
take all reasonable steps to ensure that no person or entity, including any overseas entity, breaches
any privacy laws applicable either locally or in the country where the entity is located.
We will store any credit information provided to us, or which we obtain about you, with any other
personal information we may hold about you, which shall include but is not limited to the use of
paper files, electronic files and databases.
We only retain Personal Information for as long as required by law and needed for our business
functions and activities. It is then securely destroyed and disposed of.
Website Browsing
Accessing our websites will result in some information being logged including the time of access,
your IP address and the pages that have been viewed or accessed.
Our websites may contain links to external websites. We are not responsible for the content or
privacy policies that govern such external websites.
AC3 Privacy Policy - Version: 7.2
Release for General Use Page |8
Version 0.1
Access and Correction of Personal Information
Subject to verification of your identity, if we hold Personal Information about you, you may make a
request to access, update or correct this Personal Information.
Access and correction requests should be made in writing to one of the contact addresses below.
We will endeavour to respond to written requests for access and correction of Personal Information
within 10 business days after a request is received by us unless extenuating circumstances exist.
We will take all reasonable steps to ensure that Personal Information is accessed by
employees/contractors only to the extent necessary for us to undertake our business activities.
BYOD Policy
As part of our Bring Your Own Device (BYOD) Policy, we may use a Mobile Device Management
(MDM) solution which may install software onto employees’ Personal Electronic Devices to enforce
the BYOD policy and make management of company confidential data easier and keep personal
data separate from work-related data.
We take our employee’s privacy seriously, therefore any MDM solution we select will, as far as
reasonably practical, prevent us from accessing your personal data (including personal messages,
photos, emails, internet usage, phone calls and other personal data contained on your Personal
Electronic Device), and where not reasonably practicable to prevent us from accessing your
personal data on your Personal Electronic Device, our policy is that we will not access your personal
data. Any breach of our policy will be treated as such.
Complaints
All complaints relating to the handling and management of Personal Information by us or any
breach of the applicable privacy laws, including the Australian Privacy Principles should be
addressed to one of the contact addresses below.
To deal with complaints appropriately, please include the information listed below together with
your complaint:
A summary of the privacy concern or alleged breach;
Any action, or inaction, we have taken, or failed to take, regarding the matter; and
Copies of any relevant documentation in connection with the complaint, including any
communications that we have had with you.
AC3 Privacy Policy - Version: 7.2
Release for General Use Page |9
Version 0.1
Our Privacy Officer will investigate the complaint and where necessary, refer the complaint to the
relevant department that the complaint relates to or refer the complaint to an external investigator
contracted by us. We will endeavour to respond to complaints within 20 business days, unless
extenuating circumstances exist.
We will take immediate steps to redress proven privacy concerns or breaches.
If you are not satisfied with our response and your complaint relates to a privacy concern or alleged
breach, you may take your complaint to the Office of the Australian Information Commissioner
(Telephone: 1300 363 992) or the New Zealand Privacy Commissioner (Telephone 0800 803 909).
Access to This Policy
This policy can be viewed on our website at www.ac3.com.au.
You can also request a copy of this policy from one of the contact addresses below.
Contact Information
The Privacy Officer, AC3
Level 7, 477 Pitt Street. Haymarket 2000 NSW
Email: privacy@ac3.com.au
AC3 Privacy Policy - Version: 7.2
Release for General Use Page |10
Version 0.1
Policy Information
Compliance Applicability
This policy helps AC3 meet compliance obligations for the following controls:
Standard Control Reference Control Description
The organisation should identify and meet the
requirements regarding the preservation of
5.34 - Privacy and
ISO27001:2022 privacy and protection of PII according to
protection of PII
applicable laws and regulations and
contractual requirements.
Background verification checks on all
candidates to become personnel should be
carried out prior to joining the organization
and on an ongoing basis taking into
consideration applicable laws, regulations and
ISO27001:2022 6.1 - Screening ethics and be proportional to the business
requirements, the classification of the
information to be accessed and the
perceived risks. Verification should take into
consideration all relevant privacy [and] PII
protection [legislation].
Acronyms
Term Meaning
BYOD Bring Your Own Device
MDM Mobile Device Management
Definitions
Term Meaning
Personal information is any information or opinion about an
identified individual, or an individual who is reasonably identifiable:
whether the information or opinion is true or not, and whether the
Personal Information
information or opinion is recorded in a material form or not. Personal
Information for the purposes of this policy includes credit-related
information where the context permits.
Australian Centre for Advanced Computing and Communication
We/Our/Us Pty Limited and Australian Centre for Advanced Computing and
Communication Pty Limited NZ (“AC3”) and associated entities.
You/Your An eligible person covered by this policy.
AC3 Privacy Policy - Version: 7.2
Release for General Use Page |11
Version 0.1
Document Credentials
Any enquiries regarding this document should be directed to:
Name: Tristan Williams
Position: Privacy Officer
Email: tristan.williams@ac3.com.au
Document Control
Preparation
Version Date Change By (Name, Position)
V1 06/04/2011 Created I Halforty
General revision to clarify purpose
V1.1 18/11/2011 I Halforty
and requirements
Update to comply with Australian
V2 23/06/2015 Warren Hackett, QA Manager
Privacy Principles
V2.1 09/05/2017 Re-formatted Bindi Kelly, Administration Assistant
Nadja Lorenz, People & Culture
V2.2 22/05/2020 Updated template & language
Coordinator
Updated to refer to credit-related
V2.3 19/06/2020 Margarita Donaghey, Legal
information
Warren Hackett, Corporate QA
V2.4 17/07/2020 Change of document owner
Manager
Adding phone number of NZ Warren Hackett, Corporate QA
V2.5 19/10/2020
Privacy Commissioner Manager
Minor wording updates & added Tristan Williams, Senior Compliance
V2.6 14/06/2023
compliance applicability Officer
Updates to directing marketing
and disclosure/retention sections Tristan Williams, Compliance and
V7 21/11/2023
based on feedback from 2.6 Legal Counsel
review
Tristan Williams, Compliance and
V7.1 10/11/2025 Minor updates
Legal Counsel
Removed reference to use
V7.2 12/08/2026 Tristan Williams, Legal Counsel
restriction on page 2
AC3 Privacy Policy - Version: 7.2
Release for General Use Page |12
Version 0.1
Reviewers
Version Date By (Name, Position)
V2 08/10/2015 Kathy Seymour, Head of People & Culture
03/07/2017 Kathy Seymour, Head of People & Culture
V2.1
06/07/2017 Warren Hackett, QA Manager
V2.2 25/05/2019 Warren Hackett, Corporate Quality Assurance Manager
V2.3 02/07/2020 Kathy Seymour, Head of People & Culture
V2.4 13/11/2020 James Meharg, Head of Corporate Services
V2.5 16/11/2020 AC3 IS&Q Management System Committee
Damien Luke, Head of Cyber Security
31/07/2023
Emma Flanery, General Counsel
03/08/2023
V2.6 Stephanie Challinor, GM Customer Experience & Alliances & Ash
05/09/2023
Baker, Marketing Manager
27/09/2023
Parul Shah-Batra, Head of People & Culture
V7 21/11/2023 Christina Temme, GM Finance & Corporate Services
V7.1 17/11/2025 Christina Temme, CFO
V7.2 13/08/2026 Christina Temme, CFO
Approvals
Version Date By (Name, Position)
V1 Harry Kassianou, Managing Director
V2 09/10/2015 Simon Xistouris, CEO
V2.1 10/07/2017 Simon Xistouris, CEO
V2.2 17/07/2020 Simon Xistouris, CEO
V2.5 16/11/2020 Simon Xistouris, CEO
V7 21/11/2023 Christina Temme, GM Finance & Corporate Services
V7.1 17/11/2025 Christina Temme, CFO
V7.2 13/08/2026 Christina Temme, CFO
AC3 Privacy Policy - Version: 7.2
Release for General Use Page |13
Version 0.1
Classification
Classification Description
Release for General Use A document that can be released without approvals
Related Documents
Document Name
AC3 Code of Conduct
AC3 IT Acceptable Use Policy
AC3 Anti-Discrimination and Harassment Policy
AC3 Managing Underperformance and Misconduct Policy
AC3 Social Media and Media Policy
AC3 Bring Your Own Device Policy
Next Review
New Review Date Responsible Officer
2 years from most recent review Privacy Officer
AC3 Privacy Policy - Version: 7.2
Release for General Use Page |14
Version 0.1
End of Document
AC3 Privacy Policy - Version: 7.2
Release for General Use Page |15