This Privacy Policy of Prime Safety Vaults Pty Ltd (ACN 692 007 426) trading as “Prime Safety Vaults” (Prime Safety Vaults, us, we, our) sets out our procedures regarding the handling of personal information, including the collection, use, disclosure and storage of information, as well as the rights available to you to access and correct that information. We operate a Vault Facility wherein customers can be licensed a safety deposit box for the purpose of storing their non-prohibited valuables (Services). Our Services are provided physically at our Truganina location at 41 Tallis Cct, Truganina, with our website with the domain name www.primesafetyvaults.com.au allowing customers to lodge an enquiry with us.
We will handle personal information in accordance with the Privacy Act 1988 (Cth) (the Privacy Act) and the Australian Privacy Principles (APPs). We may collect Personal Information and Sensitive Information in order to conduct our business, to provide and market our Services and to meet our legal obligations, specifically under the Anti-Money Laundering and Counter-Terrorism Financing Act 2006 (Cth) (AML/CTF Act).
By engaging our Services or by providing any Personal Information or Sensitive Information to us, you consent to the collection, use and disclosure of your Personal Information and Sensitive Information as set out in this Privacy Policy. We are committed to protecting and ensuring the confidentiality and security of any Personal Information and Sensitive Information that we may collect, use and hold.
From time to time, we may revise or update this Privacy Policy or our information handling practices. If we do so, the revised Privacy Policy will be published on our website.
The types of information
The Privacy Act defines types of information, including Personal Information and Sensitive Information.
(a) Personal Information
Personal Information means information or an opinion about an identified individual or an individual who is reasonably identifiable:
(i) whether the information or opinion is true or not; and
(ii) whether the information or opinion is recorded in a material form or not.
If the information does not disclose your identity or enable your identity to be ascertained, it will in most cases not be classified as ‘Personal Information’ and will not be subject to this Privacy Policy.
(b) Sensitive Information
Sensitive Information is defined in the Privacy Act as including information or opinion about such things as an individual's racial or ethnic origin, political opinions, membership of a political association, religious or philosophical beliefs, membership of a trade union or other professional body, criminal record or health information.
Sensitive Information will be used by Us only:
for the primary purpose for which it was obtained;
for a secondary purpose that is directly related to the primary purpose; and
with your explicit consent or where its collection, use or disclosure is required or authorised by law.
The types of Personal Information we collect and hold
The types of Personal Information we may collect and hold include (but is not limited to) Personal Information from you, such as:
Visitors of our website:
Usage data: device identifiers, log data, IP address, and cookie/analytics data as described below.
Users of our Services:
Identity and contact information, including your name, date of birth, residential address, telephone number and email address;
Government-issued identification documents and identity verification information;
Customer due diligence, beneficial ownership and compliance information;
Company, trust, partnership and other entity information;
Information relating to authorised representatives, attorneys, executors, administrators and other persons authorised to act on your behalf;
Payment, billing and insurance-related information;
Information relating to the assets proposed to be stored with us, where reasonably required for security, insurance, compliance or operational purposes;
Biometric information used for identification, authentication or access control purposes;
CCTV footage, access records, visitor logs and other security-related information;
Communications, enquiries, complaints and correspondence with us; and
Any other information reasonably required to provide our Services, comply with legal obligations, manage risk, protect our premises and customers, or operate our business.
You are not obliged to provide Personal Information to us. However, if you do not provide us with the necessary Personal Information, we will not be able to supply our Services to you. Personal Information and Sensitive Information are collected for customer due diligence, ongoing customer due diligence, beneficial ownership verification, sanctions screening and other obligations arising from the Company’s status as a reporting entity under the AML/CTF Act.
In some circumstances, you may provide to us, and we may collect from you, Personal Information about a third party. Where you provide the Personal Information of a third party, you must ensure that the third party is aware of this Privacy Policy, understands it and agrees to accept it.
Where we need to collect Sensitive Information to provide specific Services, such as biometric templates, we will only do so with your consent or as otherwise permitted by law. Biometric information is collected for automated biometric verification. If applicable, you authorise us to obtain this information from a third party, unless the collection is required or authorised by Australian law or a court or tribunal order, or unless the collection is otherwise not prohibited under Australian law. We will not use or disclose Sensitive Information for any purpose other than the purpose for which it was collected unless required or authorised by law.
Anonymity and Pseudonymity
Owing to AML/CTF obligations and security requirements, you cannot choose to remain anonymous or use a pseudonym when dealing with us.
How Personal Information and Sensitive Information are collected and held by us
We collect Personal Information and Sensitive Information in the following ways:
when you provide Personal Information or Sensitive Information in the registration form or any other form or provide it in correspondence by email, telephone or through our website;
automatically via cookies, pixels, automated syncing and similar technologies;
in person, for example, when you engage with our employees, contractors, facilitators, agents, or customer service representatives;
from third parties such as, but not limited to, identity verification providers, insurers and public and government registers like ASIC; and
in the course of providing our Services to you.
We store Personal Information and Sensitive Information in computer storage facilities and paper-based files in Australia, with backups and disaster recovery systems also maintained there. We implement reasonable technical and organisational measures in accordance with APP 11 to protect Personal Information from misuse, interference and loss, and from unauthorised access, modification or disclosure, including encryption, access controls, multi-factor authentication, network security monitoring, incident response procedures, vendor oversight, staff training and data minimisation practices.
We take steps to protect your Personal Information and Sensitive Information against loss, unauthorised access, use, modification or disclosure. Some examples of the steps we take to protect your Personal Information and Sensitive Information include:
ensuring strong computer and network security protocols, including firewalls, encrypted connections, identification codes, access privileges, and password protection measures to control access to our IT systems;
imposing restrictions on physical access to paper files;
implementing continuous maintenance and monitoring of security systems to ensure Personal Information and Sensitive Information remains secure during transmission and storage;
requiring any third parties engaged by us to handle your Personal Information and Sensitive Information in a manner consistent with Australian law and contractual requirements; and
taking reasonable steps to destroy or de-identify Personal Information and Sensitive Information after we no longer need it for our business or to comply with the law.
We store, process, and retain your Personal Information and Sensitive Information only for as long as we need it for the purposes described in this Privacy Policy. When we no longer need your information, we take reasonable steps to destroy or de-identify it, unless we are required or authorised by law to retain your information for a longer period.
We retain Personal Information for the periods required by applicable law.
The Australian Privacy Principles (APP):
(a) permit you to obtain access to the Personal Information or Sensitive Information we hold about you in certain circumstances (APP 12); and
(b) allow you to correct inaccurate Personal Information or Sensitive Information subject to certain exceptions (APP 13).
Where you would like to obtain such access, please contact Us in writing on the contact details set out at the bottom of this Privacy Policy.
Collection of Personal Information through activity
Information that may identify you as a user may be gathered during your use of our Services.
Our website may include pages that use ‘cookies’. A cookie is a unique identification number that allows the server to identify and interact more effectively with your computer or device. The cookie assists us in identifying what our visitors find interesting on our website.
A cookie may be allocated each time you use our website. Cookies do not generally identify you personally on their own, but they may identify your device and may become associated with you when linked with other information we hold. Cookies allow us to understand how visitors interact with our website and to improve functionality and performance.
You can configure your access to our website to refuse cookies. If you do so, you may not be able to use all or part of our website.
Data Breaches
We maintain a written data breach response plan that complies with the Privacy Act. Where we have reasonable grounds to suspect that an eligible data breach may have occurred, we will promptly contain and investigate the incident, take reasonable steps to mitigate harm and preserve evidence, and carry out an assessment in a reasonable and expeditious manner and, where required by law, within 30 days.
If we become aware of reasonable grounds to believe an eligible data breach has occurred, we will notify the Office of the Australian Information Commissioner (OAIC) and affected individuals as soon as practicable, in line with the Privacy Act. If direct notification is not practicable, we will publish a notification. We will keep records of the incident, our assessment, and our response, and take reasonable steps to prevent a recurrence.
The purposes for which we collect, hold, use and disclose Personal Information and Sensitive Information
We collect, hold, use and disclose Personal Information for a variety of business purposes, including:
Providing and supporting our Services: to operate and improve the functionality of Services and our website, process and respond to enquiries, provide support to users, and any other ancillary function to provide our Services;
Quality and safety: fraud prevention, abuse monitoring, compliance with the AML/CTF Act and security;
Improving our business, products and Services: including analytics and research;
Marketing by us: to promote our business, products and Services;
Enquiries and complaints: to handle and respond to enquiries, complaints and feedback;
Disclosures to:
Service providers as set out in this Privacy Policy, only where necessary, with appropriate safeguards and your consent where required by law, including identity verification, hosting, storage, communications, payments and analytics providers, noting that these providers are contractually restricted in their data access and use who assist us and are bound by appropriate confidentiality, privacy and security obligations; and
Legal, safety and corporate transactions: to comply with laws, detect/prevent fraud or security incidents, enforce our terms, respond to lawful requests from regulators, courts and law enforcement, and in connection with mergers, acquisitions or reorganisations.
We collect, hold, use and disclose Sensitive Information for a variety of business purposes, including:
Providing and supporting our Services: to conduct identity verification in compliance with the AML/CTF Act and any other ancillary function to provide our Services;
We use your information for the purpose we collected, outlined above, or a related purpose you would reasonably expect, or as permitted or required by law. Otherwise, we will ask for consent or rely on another APP exception.
Direct marketing
We also collect, hold, use and disclose your Personal Information to:
notify you about the details of new services and products offered by us;
send you our newsletters and other marketing publications;
administer our databases for client service, marketing and accounting purposes;
otherwise promote our business; and
to comply with our legal requirements regarding the collection and retention of information concerning the products and services that we provide.
We will only send you direct marketing communications where you have consented or where you would reasonably expect to receive such communications from us. We will not disclose your Personal Information to third parties for their own marketing purposes unless you expressly opt in.
You may opt out of receiving direct marketing communications from us at any time and at no cost by using the unsubscribe facility in our communications or by contacting us using the details set out below. We will action your opt-out request as soon as reasonably practicable.
We may use your Personal Information (but never Sensitive Information) to contact you about our Services, updates, and promotions.
Disclosures to Third Party Service Providers
We may disclose your Personal Information and Sensitive Information to third parties who work with us in our business to provide, promote, market or improve the Services we provide, including:
identity verification providers;
cloud hosting providers;
insurers;
security contractors;
law enforcement;
AUSTRAC;
cybersecurity and monitoring partners;
consultants and payment processors;
data storage providers;
analytics providers;
professional advisers who assist us in operating our business and delivering our Services; and
other linked service providers.
We use third-party payment service providers to process transactions securely. These providers may collect and store your payment details in accordance with their own privacy policies.
We may also combine your Personal Information and Sensitive Information with information available from other sources, including the entities mentioned above, to help us provide better services to you.
Where we share information with third parties, we require that there are contracts in place that only allow use and disclosure of Personal Information and Sensitive Information to provide the service and that protect your Personal Information and Sensitive Information in accordance with Australian law. Otherwise, we will disclose Personal Information and Sensitive Information to others if you have given us permission, or if the disclosure relates to the main purpose for which we collected the information and you would reasonably expect us to do so.
Cross-border disclosure
We generally store Personal Information in Australia but may disclose it to overseas service providers from outside Australia. Before disclosing Personal Information to an overseas recipient, we will comply with APP 8 by taking reasonable steps in the circumstances to ensure the recipient does not breach the APPs in relation to the information, unless an exception under APP 8.2 applies, including where you have provided informed consent to the disclosure or the disclosure is required or authorised by law.
We may use analytics services provided by third-party service providers to help us analyse how visitors and enquirers use our website. These providers may record data such as approximate geographical location, device information, internet browser, operating system and IP address. This information may identify a device or become associated with an individual when combined with other information. The providers use the information on our behalf to evaluate use of our website, compile activity reports and provide related analytics and internet-usage services. Their handling of the information is subject to their own privacy practices and our contractual arrangements with them.
We may disclose your Personal Information and Sensitive Information to overseas recipients, including analytics service providers, identity verification providers, our cloud hosting providers, email and communications platforms, payment processors, and other technology service partners who assist us in providing our Services. These recipients may be located in countries including, but not limited to, the United States, the United Kingdom, member states of the European Union, Singapore and other jurisdictions in which our service providers operate.
Where we rely on your consent to an overseas disclosure, you acknowledge and agree that APP 8.1 will not apply and that we will not be accountable under section 16C of the Privacy Act for the overseas recipient’s handling of the Personal Information.
How we handle requests to access your Personal Information and Sensitive Information
You may request access to, or correction of, your Personal Information or Sensitive Information under the Privacy Act. You may also ask us to delete or de-identify information, although we may be unable to do so where we are required or authorised by law, or have another legitimate need, to retain it. You can make a request by contacting us using the details set out in this Privacy Policy.
We will respond to any such request for access as soon as reasonably practicable. Where access is to be given, we will provide you with a copy or details of your Personal Information and Sensitive Information in the manner requested by you where it is reasonable and practicable to do so.
We will not charge you a fee for making a request to access your Personal Information or Sensitive Information. However, we may charge you a reasonable fee for giving you access to your Personal Information and Sensitive Information.
In some cases, we may refuse to give you access to the information you have requested or only give you access to certain information. If we do this, we will provide you with a written statement setting out our reasons for refusal, except where it would be unreasonable to do so.
Before providing access to Personal Information or Sensitive Information or making any corrections, we may need to verify your identity to ensure the security of your information. We aim to respond to all access and correction requests within 30 days, or otherwise within a reasonable period.
How we handle requests to correct your Personal Information and Sensitive Information
We will take such steps (if any) as are reasonable in the circumstances to make sure that the Personal Information and Sensitive Information we collect, use or disclose is accurate, complete, up to date and relevant for the purpose of its use or disclosure.
If you believe the Personal Information or Sensitive Information we hold about you is inaccurate, irrelevant, out of date or incomplete, you can ask us to update or correct it. To do so, please contact us using the contact details listed below.
Where we correct Personal Information or Sensitive Information that we previously disclosed to another entity, we will take reasonable steps to notify that entity of the correction, unless it is impracticable or unlawful to do so.
We may ask you to verify your identity before acting on any of your requests.
How to contact us or make a complaint
If you have any questions about this Privacy Policy, if you wish to correct or update information we hold about you or if you wish to request access or correction of your Personal Information or Sensitive Information or make a complaint about a breach by us of our privacy obligations (including the way we have collected, disclosed or used your Personal Information or Sensitive Information), please contact:
Prime Safety Vaults Pty Ltd (ACN: 692 007 426)
Privacy officer: Ravi Thakkar
Address: 41 Tallis Cct Truganina Victoria
Email: info@primesafetyvaults.com.au
We will acknowledge and investigate any complaint about the way we manage information as soon as practicable. We will take reasonable steps to remedy any failure to comply with our privacy obligations. If we agree that your complaint is well founded, we will, in consultation with you, take appropriate steps to rectify the problem. We will take reasonable steps to remedy any failure to comply with our privacy obligations.
If you remain dissatisfied with the outcome, you may refer the matter to the Office of the Australian Information Commissioner (OAIC): www.oaic.gov.au.