Purpose 

The purpose of the Privacy Policy is to explain how Creative Australia protects individuals' privacy by outlining how we collect, use, disclose, and manage personal information in compliance with the relevant privacy laws.

Policy statement 

Creative Australia (ABN 38 392 626 187) (us, we, our) is committed to protecting the privacy of the personal information we collect from both internal and external stakeholders (you, your).   

This Privacy Policy outlines how we handle personal information in accordance with the Australian Privacy Principles (APPs) contained in the Commonwealth Privacy Act1988 (Privacy Act) and the Australian Government Agencies Privacy Code (Privacy Code). 

‘Personal information’ means information or an opinion about an identified individual, or an individual who is reasonably identifiable, whether the information or opinion is true or not and whether the information or opinion is recorded in a material form or not. 

This Privacy Policy also sets out how we process personal data related to individuals located in the European Union (EU), in line with our obligations under the General Data Protection Regulation (GDPR). 

Collectively we refer to the above legislation as the “Privacy Laws”.

If you have any further questions or if you wish to receive more information on our information practices and use of our Privacy Policy, please contact our Privacy Officer at: privacyofficer@creative.gov.au

Scope 

This policy applies to all Creative Australia officials.[1]

Collecting personal information

Creative Australia collects personal information to fulfil its functions as set out under Section 11 of the Creative Australia Act 2023.

The types of personal information we collect includes contact details such as the name, email, phone and mailing address of individuals. We may also collect date of birth, identification details, professional, education and employment information, Australian Business Numbers (ABNs), tax file numbers, bank details and payment transactions. 

If you apply to us for a grant, we may also collect personal information such as video, audio, photographs, images, biographical information etc that you submit as part of the application process.

If it is reasonable and practical to do so, we will collect personal information directly from you. This will include contact details and other information relevant to providing our  services to you. This may occur in a number of ways, such as when you make a grant funding application, register to attend a function, subscribe to our communications, provide contract services, make an employment application or otherwise contact us regarding the functions of Creative Australia. 

We may also collect personal information from third parties such as our related agencies, credit reporting agencies, your representatives or publicly available sources of information.  Sometimes we collect personal information about you from a grant applicant where they have included letters of support or information about individual(s) they will be working with on their project.

We only collect personal information that we deem is reasonably necessary for the purposes and functions of Creative Australia. These include:

• providing our services and fulfilling our functions under the Creative Australia Act 2023 (Cth) in supporting and promoting the arts;
• keeping you informed of relevant upcoming events, grants, funding initiatives and outcomes as well as our activities in general;
• improving our website and other services;
• conducting research into and about the arts and the programs we administer;
• marketing our services, developing and identifying new projects and conducting fundraising;
• evaluating the programs, support and funding we provide, including via surveys and interaction with recipients of our services;
• allowing the functions and services offered on the website to be provided to you;
• complying with our legal obligations;
• if otherwise permitted or required by law; or
• for other purposes with your consent, unless you withdraw your consent.

If we receive personal information about you that we did not ask for, from someone other than you, and we determine that we could have collected this information from you had we asked for it, we will notify you, where appropriate, that we have collected your personal information. If we could not have collected this personal information, we will lawfully de-identify or destroy that personal information.

Depending on the services we provide to you, we may collect sensitive information revealing your race, ethnic origin, political opinions, religious or philosophical beliefs, trade union memberships or details of health or disability. Generally, we will collect your sensitive information: 

• where you have given express consent for us to do so and the information is reasonably necessary for us to provide our services to you or otherwise carry out our functions or activities;
• the use of this information is required or authorised under Australian law or a court or tribunal order; or
• when the information is necessary for the establishment, exercise or defence of a legal claim. 

If we are unable to collect personal information we reasonably require, we may not be able to provide our services or do business with you or the organisation with which you are connected.

Cookies

When you visit our website, the server may attach a "cookie" to the memory of your computer or device. A “cookie” assists us to store information on how visitors to our website use it and the pages that may be of most interest. This information may be used to make assumptions about who uses your computer or device and to provide users of your computer or device with information that we think may interest the users of your computer or device. You should be able to configure your computer or device so that it disables “cookies” or does not accept them if you wish. However, this information is not linked to any personal information you may provide and will not be used to identify you. 

Use and disclosure of information

We may use personal information about you to provide you with our services, as well as the purposes set out above. 

To deliver the services that we provide to you, we may disclose your personal information to our related agencies, third party service providers, suppliers and other organisations. We take reasonable steps to ensure that these organisations are bound by privacy obligations in relation to the protection of your personal information. 

In the event of a security incident involving unauthorised access, use or disclosure of personal information where a third party with whom we share personal information is involved, we will seek to work cooperatively with them to protect the personal information we have shared with them.

Direct marketing 

We may use personal information about you for the purpose of providing you with information about our services. This could include sending you information about new initiatives and programs, grant funding, our services or special events. We may send this information via post, telephone or any form of electronic communication. We may use any email address or other personal information you provide to us at any time for this purpose.

You can, at any time, opt out of receiving marketing material by contacting our Privacy Officer. If you opt out of receiving marketing material, we will still send you essential information that we are legally required to send you relating to the services we provide. If you opt out of receiving marketing material from us, this removal from our distribution lists may take several business days after the date of your request to be removed.

Accuracy and correction of your information

All reasonable steps are taken by us to ensure that your personal information held by us is accurate, up-to-date, complete, relevant and not misleading. If you believe that any of your personal information is not accurate, not up-to-date, incomplete, irrelevant or is misleading, please contact our Privacy Officer at: privacyofficer@creative.gov.au and we will take all reasonable steps to correct it within a reasonable time.

Third Parties and your information

Although our website may link directly to websites operated by third parties (Linked Sites), Linked Sites are not operated by us. We encourage you to always read the applicable privacy statement or policy of any Linked Site on entering the Linked Site. We are not responsible for the content or practices of the Linked Sites nor their privacy policies regarding the collection, storage, use and disclose of your personal information.

Disclosure of information overseas

From time to time we may transfer any of your personal information to people in other countries to fulfil the purposes and functions of Creative Australia. 

An example would be where we are required to pass the list of applications in a particular funding round to an overseas third party to assist us in making the final funding decision (e.g. an overseas studio residency program). 

In many cases the transfer will be necessary for the performance of our contract with you or for the implementation of measures taken in response to a request by you or for the performance of a contract with a third party.

Storage and security

Creative Australia stores personal information in a variety of ways including email, electronic databases, electronic record management systems and cloud-based software.

We will use reasonable endeavours to keep your personal information in a secure environment, by employing appropriate technical, administrative and physical procedures. These measures are designed to assist in your personal information not being accessed by unauthorised personnel, or from being lost or misused. If you reasonably believe that there has been unauthorised use or disclosure of your personal information, please contact our Privacy Officer at: privacyofficer@creative.gov.au

If we no longer need your personal information for the purposes for which we collected it, unless we are required by law or a court or tribunal order to retain it, we will take reasonable steps to destroy or de-identify your personal information.

Notwithstanding the reasonable steps taken to keep information secure, breaches may occur. In the event of a security incident we have in place procedures to promptly investigate the incident and determine if there has been a data breach involving personal information, and if so, to assess if it is a breach that requires notification. If it is, we will notify affected parties in accordance with Privacy Law requirements.

Access to information we hold about you

To request access to the personal information we hold about you, please contact our Privacy Officer. We will respond to your request within 30 days and, where reasonable and practicable, give access to the information in the manner you request. This will be subject to any requirements under the Privacy Laws. 

Anonymity and pseudonymity

You have the option to either not identify yourself or to use a pseudonym when you contact us, unless it is impracticable for us to communicate with you in that manner or unless we are required or authorised under law, or a court or tribunal order, to deal with individuals who have identified themselves.

Persons located in the EU

If you are located in the EU, the GDPR[2] provides for additional rights in relation to your personal information that we process.  We take these rights into account when processing your personal information, including:

• Erasure: You have the right to request that we delete personal information we hold about you in certain circumstances, including where the information is no longer required.
• Objection: Depending on the circumstances in which we collected your personal information, you may have the right to object to our processing of your personal information.
• Portability: Depending on the circumstances, you have the right to receive and have transmitted to other data controllers any personal information we hold in a commonly used and machine-readable format, where technically feasible.
• Restriction: You have the right to restrict our processing of your personal information in certain circumstances, including where the accuracy of the information is contested, the processing is unlawful, or the information is no longer required.
• Review: Unless necessary for the purpose of performing a contract between us, authorised by law or otherwise explicitly consented to by you, you can exercise your right not to be subject to decisions based on automated processing (such as online profiling).
• Withdrawal: Where we process your personal information based on your consent, you have a right to withdraw that consent at any time. You can withdraw consent by contacting our Privacy Officer or EU Representative, whose details are set out at the end of this Policy.

These rights are subject to certain restrictions and exemptions.

Whenever we collect your personal information, we will endeavour to obtain your consent to process your information for the purposes outlined in this Privacy Policy. We rely on this consent as the lawful basis to process your information, however, under GDPR, we may also process your information if the processing is necessary for:

• the performance of, or entering into, a contract with you;
• compliance with our legal obligations;
• protecting the vital interests of an individual;
• performing a task in the public interest; or
• the purposes of legitimate interests pursued by us or a third party.

Contacting us

If you have any questions, wish to access or correct your personal information, seek to exercise your rights in respect of your personal information held by us, or make a complaint about how we handle your personal information, please contact us in writing:

          The Privacy Officer
          Creative Australia
          Level 5, 60 Union Street, Pyrmont NSW 2009 

or by sending an email to us at privacyofficer@creative.gov.au

If you contact us and are not satisfied with our response, you may make a complaint to:

          Office of the Australian Information Commissioner 
          GPO Box 5218 
          Sydney NSW 2001

or by sending an email to enquiries@oaic.gov.au.
 

[1] Section 13(2) of the Public Governance, Performance and Accountability Act 2013 (PGPA Act) defines an "official" of a Commonwealth entity as a person who is in, or forms part of, the entity. This includes individuals who are officers, employees, or members of the entity. 

[2] The General Data Protection Regulation (GDPR) is a European Union law focused on data privacy and protection. It establishes rights for individuals regarding their personal data and places obligations on organisations that collect or process this data, including those located outside the EU.