Privacy Statement

On this page:

• Privacy Legislation
• Our legal basis for processing your personal information
• How we collect your information
• Requests to provide information
• Automatic collection through the website - Use of cookies
• Automatic collection by third party software vendors
• Use and disclosure of web analytics data
• Links from melbournepolytechnic.edu.au website
• Security of your personal information
• Access and correction

Melbourne Polytechnic is committed to protecting your privacy. We handle your personal information in accordance with the Privacy and Data Protection Act 2014 (Vic) (PDP Act), Public Records Act 1973 (Vic), Health Records Act 2001 (Vic).

This Privacy Statement applies to information collected through the Melbourne Polytechnic website (www.melbournepolytechnic.edu.au) and provides general information about how Melbourne Polytechnic collects and processes personal information. It should be read in conjunction with other collection statements available on the website policies portal.

Specific privacy collection notices provided to you at the time your personal information is collected further detail how your personal information will be processed. For information about our broader collection, use, and disclosure of personal information, please contact the relevant service as indicated in the section access & correction below.

We may update this privacy statement from time to time. Any changes to this privacy statement will be published on this website.

Privacy legislation

Your personal information will be managed in accordance with our privacy obligations. We are governed by applicable privacy laws, including the Privacy and Data Protection Act 2014 (Vic) and the Health Records Act 2001 (Vic) when processing your personal and health information. To the extent that they apply to our activities, we are also subject to the requirements of the Privacy Act 1988 (Cth) and the European Union General Data Protection Regulation 2016/679 (which relates to individuals located in the European Economic Area). (Together, ‘Privacy Laws’).

For the purposes of this statement, health and personal information are referred to collectively as “personal information” (sometimes known as “personal data”), which is defined broadly in the Privacy Laws as recorded information or opinion that relates to an identified or identifiable individual.

The “processing" of personal information refers to all activities relating to the management of personal information by the University, from its collection and use, through to its storage and disposal, and everything in between.

Our legal basis for processing your personal information

Our lawful basis for processing your personal information is that it is necessary for the pursuit of our legitimate interests in delivering our core functions, such as teaching, learning and research, and provide you with the services you have requested.

How we collect your information

We collect and process personal information through lawful and fair means and in a non-intrusive way. We will collect your personal information directly from you wherever possible. However, where this is not practicable, we may collect information you have provided through other avenues, as detailed in the specific privacy collection notice provided to you at the time your personal information is collected. We only process personal information as necessary, for specified purposes, and in accordance with the relevant Privacy Laws. The purpose and lawful basis for collecting your personal information is detailed in the specific privacy collection notices for particular activities.

We will only use or disclose your personal information under the following circumstances:

• for the purpose for which it was collected
• for a related purpose which you might reasonably expect
• where you have consented to the disclosure
• if we are required or permitted to do so by law
• where it is necessary for the pursuit of our legitimate interests (such as facilitating teaching,
  learning and research)
• where we have engaged a contracted service provider or partner to perform legitimate functions on our behalf, such as those outlined in the privacy collection notice.

Where relevant, examples of third parties we provide personal information to, and for what purposes, are captured in the privacy collection notice provided to you at the time your personal information is collected. We do not sell your personal information to third parties under any circumstances or permit third parties to sell on the information we have shared with them.

There are 3 main ways that we may collect personal information from you:

1. Requests to provide information

In most circumstances, you will know if we are collecting personal information from you because
you will be requested to provide it. For instance, if you submit a form to contact us through the
website, we will ask you to provide your name and email address.

2. Automatic collection through the website

Some personal information is automatically collected as a result of your visit to our website. This
information is collected using software techniques such as web server log file analysis, cookies
and web beacons.

3. Automatic collection by third party software vendors

We use some third-party software that collects information about your interaction with our
website.

When you visit our website, your web browser automatically sends certain information to these
software providers.

This statement covers each of these instances of personal information collection in more detail
below.

Requests to provide information

We may collect personal information that you choose to give us, or which may be required to
access a particular service. This includes information collected via online forms (including enquiry
and application forms), events registration, or when subscribing to receive newsletters.
The information you provide by completing an online form on melbournepolytechnic.edu.au is
collected by the Umbraco content management system (CMS) and is stored on the Microsoft
Azure infrastructure in Sydney, Australia. The information stored on the CMS expires after a
period of seven (7) days.

Types of personal information

• Personal information: Recorded information or data about an identifiable or easily identifiable
individual.

• Sensitive information: Personal information about an individual's race or ethnicity, political opinions, religious or philosophical beliefs, sexual orientation or practices, criminal record, or memberships details, such as trade union or professional, political or trade associations, genetic data and biometric data.

• Health information: Information about an individual's physical, mental or psychological health

Automatic collection through the website - Use of cookies

We use first-party cookies and JavaScript code to collect information about visitors to this website. We use these to track how our visitors interact with this website, including where they came from, what they did on the site and whether they completed any transactions on the site.

If you don't want to have cookies placed on your computer, you can disable them using your web browser. You will need to customise each web browser you use to turn off cookie tracking.

If you opt out of using cookies, you will still have access to all the information and resources provided by this website, though some features may not work as expected.

This website uses several online tools to measure website use, which are provided by third party software vendors. We use these tools to help us make our site better.

We use software by third parties, including:

• Google Analytics
• Google Tag Manager
• HotJar
• YouTube
• Facebook
• Acuity
• Eventbrite
• Google Optimize
• Monsido

For further information on how these third-party software vendors handle your personal information, please review their privacy policies. Personal information may be provided to third parties when accessing this website. Information that may be shared to third parties includes:

• network location and IP address
• the date and time of your visit to our website
• the types of web browser (e.g. Internet Explorer, Google Chrome, Safari) and operating system
  (e.g. Windows 10, Mac OS X etc.) you are using
• Flash version, JavaScript support, screen resolution and screen colour processing ability
• Referring site details (such as the URL that you came through to arrive at our website)
• Page visited and the time spent on each page
• Documents downloaded and search terms used
• The forms accessed on our website
• Unique device identifier
• Cookies and data about which page you visited
• Device information, hardware model, operating system information, app version, app usage, debugging information, browser information
• Geo location information (if enabled by user)
• May assign a unique user identifier

The information we disclose to some of our third-party vendors may travel outside Victoria. We take steps to ensure that when your personal information travels, privacy protections travel with it. Third party software vendors may alter how they collect and handle personal information at any time.

Use and disclosure of web analytics data

We use web analytics data for statistical purposes, such as to analyse, measure, and report on data about our website traffic and visits. This information helps us understand general user trends at an aggregate level, and improve our website, content, and user experience.

We may also use this information for security audits to protect against threats from hackers or
other security purposes.

We do not use this information to identify you or match it with any other personal information
that we may collect from you, unless required to do so as part of an internal investigation or for a
law enforcement-related purpose, in accordance with the PDP Act.

Your site visit data is collected under the authority of Information Privacy Principle 1.1 of the PDP
Act for the purposes stated above.

Disclosure of web analytics data

Apart from the third-party tools described in this Privacy Statement, we do not disclose your site
visit data to any other third parties without your consent, unless we are required or authorised to
do so by law. In the event of an investigation into suspected unlawful or improper activity, a law
enforcement or government agency may use its legal authority to inspect our web server’s records
(e.g. in relation to hacking or abusive messages).

Can I opt out of the collection of web analytics data?

You cannot opt out of the automatic collection of information that is used for analytical purposes,
however you may choose to disable cookies or delete any individual cookie. If you choose to
disable cookies, the website may not function fully and your ability to browse, read, and download
information contained on our website may be impaired. However, you may still access our
services by contacting our office via other methods such as telephone, email, or mail.

You can enable a “Do Not Track” setting on your browser to help protect your privacy. When Do
Not Track is tuned on, your browser will send a Do Not Track request to the sites you visit, and to
the third parties whose content is hosted on those sites. However, many websites will still collect
and use your browsing data regardless of the Do Not Track Request. This depends on individual
sites’ privacy practices. Sending a Do Not Track request does not guarantee privacy protection.

Instructions on how to enable the Do Not Track setting:

• Google Chrome
• Internet Explorer 11
• Mozilla Firefox
• Safari

You can also opt out of tracking and website analytics using a Google browser plugin.

Links to melbournepolytechnic.edu.au websites

This privacy statement does not apply to any external websites that are linked on the edu.au
website.

This is what an external link looks like

We are not responsible for the privacy practices or content of external websites. When you visit
other websites, we recommend you read the privacy statements or policies of these websites
before providing personal information.

Security of your personal information

Under the PDP Act, we have a responsibility to protect your personal information. We take all  reasonable steps to ensure that any personal information we (or third parties operating on our
behalf) collect, transmit, store or otherwise process, is accurate and complete, and that appropriate technical and organisational measures are implemented and maintained to protect it from accidental or unlawful destruction, misuse, loss, alteration, or unauthorised access or disclosure.

Access to systems, applications, and the information that we collect is limited to
authorised staff members only.

Further, any personal information that we collect and use for identifying user trends (for example,
IP address) is aggregated and anonymised when generating reports.

Melbourne Polytechnic uses personal and sensitive information to deliver our core functions, and
comply with our obligations with respect to the provision of education and research. We use your
information for the primary purpose for which it was collected, a related secondary purpose that
you may reasonably expect (with the exception of sensitive information), as required by law, or
with your permission or consent.

The laws in some jurisdictions require us to tell you about the legal ground we rely on to use or
share your personal information. These legal grounds may include, but are not limited to, meeting
our contractual commitments to you, for a legitimate interest, to comply with law, or to perform
a public task. We will always consider your rights when using your personal information.

We may use and process your information for:

Education and education support: admission, enrolment, content delivery and learning activities,
assessment, graduation, services (e.g. library, wellbeing, support), handling disputes,
investigations, audits, data analysis and improvements, general administration and enquiry
management.

Research and research support: including participant data, administration and commercialisation.

Community and industry engagement: website operation, addressing enquiries and requests,
marketing, customer relations, mailing lists and newsletters, event invitations, alumni and donor
relations.

Employment and employee support: recruitment (including referees), payroll, health and safety,
learning and development for staff and other Human Resources programs, contractors and
volunteers.

Operational management and finances: financial management, processing fees, IT security and
management, data analysis, legal and professional services, analysing and improving our courses,
educational opportunities, business and services.

Infrastructure and facilities: access and management systems, CCTV, identity management,
security and emergency response, including to lessen or prevent threats to safety.

Transacting between Melbourne Polytechnic entities to deliver and improve our services.
For a secondary purpose or where otherwise permitted by law, such as the provision of
information to government departments or agencies.

Access and correction

You may request access to, or correction of, documents that contain your personal information which are in our possession, unless this would have an unreasonable impact on the privacy of others or would contravene our other legislative obligations. For information on how to make a request for access or correction, please contact us via the details below.

For access to personal information that we hold about you, you should contact the department that holds the information in the first instance. In some circumstances, the department or area of the University that holds that information may need to liaise with our Legal and Risk area before determining whether they can provide the information directly to you.

In some cases, requests for access or correction will be handled in accordance with the Freedom of Information Act 1982 (Vic). Further information about this process is available on our Freedom of Information Factsheet.

If the lawful collection of your personal information is based on your consent, you have the right to withdraw your consent at any time. However, this will not affect the lawfulness of our processing of your information prior to you withdrawing your consent.

For further information about how we manage personal information and details of how to make an enquiry or lodge a complaint, please contact the below services.

To protect your privacy and the privacy of others, Melbourne Polytechnic requires appropriate evidence of your identity before it can consider a request for access or correction.