Privacy Policy

Your privacy

Protecting your privacy is very important to us. We have prepared this policy to help you understand how we aim to protect the privacy of the personal information we collect.

Income Asset Management Group Ltd (“IAM”) is required to comply with the Australian Privacy Principles (“APPs”) contained in the Privacy Act 1988 (“Privacy Act”). This Privacy Policy (“the Policy”) details how we manage the collection, storage and sharing of your personal information in accordance with these principles, and outline your rights in respect of the personal information we obtain.

The Policy has been developed and made public on this website to inform you of your rights and our obligations and to ensure that we comply with the Privacy Act.

In this Privacy Policy:

• ‘Personal information’ means information or an opinion relating to an individual, which can be used to identify that individual;
• ‘Sensitive information’ is personal information that includes information relating to a person’s racial or ethnic origin, political opinions, religion, trade union or other professional or trade association membership, sexual preferences and criminal record, and also includes health information.

Personal information we collect

To allow us to provide you with the services and activities detailed in this website it is necessary for us to collect and hold personal information about you. Primarily this is to help us identify you when you are dealing with us and to provide transactional services. This personal information may include:

• your name and date of birth;
• your contact details including your address, phone number(s) and email;
• your identity documents (including driver’s licence, passport or other);
• information required by product issuers (e.g. occupation, mother’s maiden name);
• your Tax File Number;
• your bank account details;
• your holdings of term deposits or other cash products; and
• information you provide to IAM, by telephone, by email or otherwise.

We will not collect sensitive information unless the individual has consented or an exemption under the APPs applies. These exceptions include if the collection is required or authorised by law or necessary to take appropriate action in relation to suspected unlawful activity or serious misconduct.

Your rights to privacy

Anonymity

You have the option of not identifying yourself, or of using a pseudonym, when dealing with us in relation to the following matters:

• When you browse the website, we do not collect your personal information; and
• You can make a general inquiry without providing your personal details by telephone.

The option of remaining anonymous however is very limited given the nature of information needed for us to provide our services to you.

Right to refuse

You also have the right to refuse to provide us with personal information if we request it. However, if you choose to do so, you may not meet the minimum requirements for us to provide you with the full services you could receive if you had provided us with this information.

How we collect and hold personal information

Collection of personal information

The means by which we may collect personal information include:

• Phone, which may include recording telecommunications with your consent;
• Online forms and tools that may include your Internet Protocol (IP) address;
• Email when you provide information to us via email, or ask to be on an email list, including the email address itself;
• Written material you provide to us in writing or by facsimile.

At times it may not be practical or reasonable to collect personal information directly from you. In these
cases, we may collect personal information from the following third parties:

• Third parties you refer us to and authorise us to talk to;
• Information that is publicly available; and
• Product issuers which may include banks, credit unions and non-bank financial institutions

In some circumstances we may access mailing lists to obtain information to conduct market research. We use reputable mailing list companies who are also bound by the Privacy Act. We do not keep a record of any information about you from those lists unless you contact us. The information on those mailing lists remains the property of the company from whom the list was provided.

Circumstances where we may collect your personal information without consent

The Privacy Act does permit us to collect personal information without consent, where required by law or court order, and also in respect of the following situations:

• We are legally required to collect certain personal information to meet the requirements of the Anti-Money Laundering and Counter-Terrorism Financing Act 2006 though normally this is collected directly from you with your consent.

Information collected from our website

Disposing of unsolicited information collected

We may receive personal information about you when we have taken no active steps to collect that information. This is known as ‘unsolicited’ personal information. In the event that we ‘collect’ unsolicited personal information, and if we determine that we could not have lawfully collected that information under Privacy Law if we were to request it, we will destroy or de-identify this information, if it is both lawful and reasonable to do so.

How your personal information is held

IAM recognises how important the security of personal information is to clients. We will at all times seek to ensure that the personal information we collect and hold is protected from inference, misuse or loss, and unauthorised access, modification or disclosure. IAM’s employees must respect the confidentiality of the personal information we collect.

Any personal information received is held by IAM on your behalf. Your personal information may be held in paper-based and electronic files. We will take all reasonable steps to ensure that your personal information is protected from:

• Misuse, interference and loss; and
• Unauthorised access, modification or disclosure.

With respect to paper-based information, we have physical security controls at their premises and in respect of electronic files have secure electronic networks.

Purposes for which we collect, hold, use and disclose personal information

The purpose of collecting, holding, using and disclosing your personal information is so that we can provide you with the services and benefits that IAM offers. Unless you have agreed, we will only use and disclose your personal information for:

• The purpose for which it was given to us; and
• Related purposes which you would reasonably expect.

IAM may disclose personal information as follows:

• Information may be disclosed to third party electronic verification providers for the purpose of identifying you, in which case the information will be limited to your identity particulars;
• To evaluate, effect, manage and administer the services provided by us;
• To inform you of other products and services offered by other entities that provides services on our behalf. This includes marketing and promotion by way of direct mail, telemarketing, email, SMS and MMS messages. However, you may at any time “opt out” of receiving direct marketing;
• When engaging third party providers to perform services for IAM which involves third parties handling personal information;
• To research, develop and improve our services, including testing and improving systems for the management of the services provided;
• For security and audit purposes, service monitoring, internet traffic monitoring, trouble shooting, maintenance, to protect against and identify security breaches, inappropriate behaviour, fraud and unauthorised access to the IT systems of IAM;
• For communication purposes where contact details are received by us because you sent these to enable us to respond to your request;
• To conduct our business and perform other management and administration tasks;
• To manage any legal actions concerning IAM;
• To consider any concerns or complaints an individual may have;
• To help us improve the services offered to our client, and to enhance our overall business;
• To product issuers for which we may act as agents for the purpose of complying with anti-money laundering and counter terrorism financing laws; and
• Where required to do so by law.

Sensitive information will be used and disclosed only for the purpose for which it was provided or a directly related secondary purpose, unless the individual agrees otherwise, or where certain other limited circumstances apply (e.g. if required by law).

We engage other people to perform services for us, which may involve that person handling personal information we hold. In these situations, we prohibit that person from using personal information about you except for the specific purpose for which we supply it. We prohibit that person from using your information for the purposes of direct marketing their products or services.

We may also use your personal information, including your contact details, to provide you with information about products and services, which we consider may be of interest to you.

Who might we disclose personal information to?

We may disclose personal information to:

• a related entity of IAM;
• an agent, contractor or service provider we engage to carry out our functions and activities, such as our lawyers, accountants, debt collectors or other advisers;
• organisations involved in a transfer or sale of all or part of our assets or business;
• organisations involved in managing payments, including payment merchants and other financial institutions such as banks;
• regulatory bodies, government agencies, law enforcement bodies and courts;
• financial product issuers and credit providers; and
• anyone else to whom the individual authorises us to disclose it or is required by law.

We may also collect personal information from these organisations and individuals, and will deal with that information in accordance with this Policy.

Other organisations that are contracted to provide services to IAM may also receive compile and store personal information on our behalf, without acquiring rights in or to the information. These include:

• Auditors – that are required by law to review IAM accounts for compliance with accounting standards and internal controls;
• Regulators – that monitor compliance with legislation such as the Australian Taxation Office (ATO), the Australian Prudential Regulation Authority, Authority (APRA), the Australian Securities and Investments Commission (ASIC) and AUSTRAC (where disclosure is required by law).

Information released to the above and other organisations is kept private and secure. Unless disclosure is required by law, we ensure parties who receive information about participants have appropriate systems in place to comply with applicable privacy laws before permitting them to handle information.

Accessing and correcting your personal information

You have the right to access your own personal information that is held by us, and if this information is incorrect, request that we correct this information.

Accessing your personal information

To access your personal information, you may contact us by phone or in writing and request that we provide this information to you. You will be required to provide acceptable proof of identity with your request before we will be able to provide you with access to ensure your personal information is protected.

We will provide access within 30 days of the individual’s request. If we refuse to provide the information, we will provide reasons for the refusal.

We will require identity verification and specification of what information is required. An administrative fee for search and photocopying costs may be charged for providing access.

Exceptional circumstances may arise which prevent us from providing you with access to your personal information because of reasons outlined in the Australian Privacy Principles and the Privacy Act. In these cases we will advise you in writing why we cannot provide you with the information and mechanisms available to you should you want to lodge a complaint.

To access your personal information you may call us on: 1300 784 132

Correcting your personal information

If you believe the personal information we hold about you is incorrect, you may also notify us of this by using the contact details above. If the information is confirmed to be incorrect, we will take reasonable steps to correct the information within 30 days, unless you agree otherwise, and provide a confirmation to you that the correction has been made. We do not charge you for correcting the information.

In the exceptional circumstances, we have received a request to correct your personal information but are unable to implement the correction you have requested, we will advise you in writing of the grounds of refusal and mechanisms available should you wish to lodge a complaint.

Inquiries and complaints

IAM takes the privacy of your information seriously and you may contact IAM Group:

• If you have any questions, concerns or complaints about this Privacy Policy, or our use of your personal information; or
• If you believe that the privacy of your personal information has been compromised or is not adequately protected.

Once a complaint has been lodged, we will respond to you within a reasonable timeframe to address your complaint.

Contact details:
During business hours Monday to Friday
Phone: 1300 784 132
Post: Attn: Privacy Officer
Income Asset Management Group Ltd
GPO Box 6, Brisbane QLD 4001
E-mail: [email protected]

If you are not satisfied with the result of your complaint to IAM you can also refer your complaint to the Office of the Australian Information Commissioner.

You can contact the Office of the Australian Information Commissioner:

• by telephoning – 1300 363 992;
• by writing to – Director of Complaints, Office of the Australian Information Commissioner, GPO Box 5218, Sydney NSW 2001;
• by emailing – [email protected].

Sending information overseas

We will not send personal information to recipients outside of Australia unless:

• we have taken reasonable steps to ensure that the recipient does not breach the Act, and the;
• the recipient is subject to an information privacy scheme similar to the Privacy Act; or
• the individual has consented to the disclosure.

We use Microsoft Office 365 to send personal information to our services providers and third-party contractors. Accordingly, your personal information may be held overseas, depending on the location of Microsoft’s data storage centres. It is not practical to list all the countries in which Microsoft’s data storage centres are located, however, they may include Australia, Brazil, Canada, European Union, Germany, India, Japan, South Korea, Norway, South Africa, Sweden, Switzerland, United Arab Emirates, United Kingdom, and United States.

Direct marketing

IAM does not use personal information for the purposes of direct marketing, unless:

• the personal information does not include sensitive information; and
• you would reasonably expect us to use or disclose the information for the purpose of direct marketing; and
• we provide a simple way of opting out of direct marketing; and
• you have not requested to opt out of receiving direct marketing from us.

If you would not reasonably expect us to use or disclose the information for the purpose of direct marketing, we may only use or disclose that information for direct marketing if you have consented to the use or disclosure of the information for direct marketing or it is impracticable to obtain that consent.

In relation to sensitive information, IAM may only use or disclose sensitive information about an individual for the purpose of direct marketing if you have consented to the use or disclosure of the information for that purpose.

You have the right to request to opt out of direct marketing and we must give effect to the request within a reasonable period of time.

You may also request that IAM provides you with the source of your information. If such a request is made, IAM must notify you of the source of the information free of charge within a reasonable period of time.

Identifiers

We will not use identifiers assigned by the Government, such as a tax file number, Medicare number or provider number, for our own file recording purposes, unless one of the exemptions in the Privacy Act applies. IAM endeavours to avoid data-matching, being the comparison of data collected and held for two or more separate purposes in order to identify common features in relation to individuals, as a basis for further investigation or action in relation to those individuals.

Updates to this policy

This Policy will be reviewed from time to time to take account of new laws and technology, and changes to our operations and the business environment.

Responsibilities

It is the responsibility of management to inform employees and other relevant third parties about the IAM Privacy Policy. Management must ensure that they advise IAM’s employees and other relevant third parties of any changes to the Privacy Policy.

It is the responsibility of all employees and other relevant parties to ensure that they understand and comply with this Privacy Policy.

Non-compliance and disciplinary actions

Privacy breaches must be reported to management by employees and relevant third parties. Ignorance of the IAM Privacy Policy will not be an acceptable excuse for non-compliance. Employees or other relevant third parties that do not comply with IAM’s Privacy Policy may be subject to disciplinary action.