Skip to content
EthicSure

Privacy Policy

Purpose

The purpose of this Privacy Policy is to establish EthicSure's framework for the collection, use, storage, disclosure, access, correction and protection of personal information.

EthicSure respects the privacy of individuals and is committed to handling personal information in accordance with the Privacy Act 1988 (Cth) and the Australian Privacy Principles. The Australian Privacy Principles govern standards, rights and obligations relating to the collection, use and disclosure of personal information, governance and accountability, integrity and correction of personal information, and individuals' rights to access their personal information.

This Policy supports EthicSure's commitment to integrity, transparency, accountability and responsible information management. It also supports the integrity, independence, credibility and reputation of the EthicSure Scheme by ensuring that personal information is managed lawfully, fairly and securely.

Scope

This Policy applies to EthicSure, including the Managing Director, Scheme Manager, members of the EthicSure Technical Oversight Committee, employees, contractors, consultants, auditors, Certification Bodies, service providers and any person acting on behalf of EthicSure.

This Policy applies to personal information collected, held, used or disclosed in connection with EthicSure's governance, Scheme administration, certification-related activities, audit activities, stakeholder engagement, employment or contractor arrangements, complaints, appeals, investigations, website use, digital platforms and other operational activities.

This Policy should be read in conjunction with the Code of Conduct, Compliance Policy, Risk Management Policy, Records and Document Control Policy, Data Protection and Confidentiality Policy, Whistleblower Policy, Scheme Rules and any relevant operational policies or procedures.

Policy Statement

EthicSure is committed to protecting the privacy of individuals and managing personal information in a lawful, transparent and responsible manner.

EthicSure will only collect personal information where it is reasonably necessary for its functions, activities, governance obligations, Scheme operations, certification-related activities, stakeholder engagement or legal and regulatory requirements.

EthicSure will take reasonable steps to ensure that personal information is collected fairly, used only for authorised purposes, disclosed only where permitted or required, stored securely, kept accurate and protected from misuse, interference, loss, unauthorised access, modification or disclosure.

EthicSure will ensure that individuals are able to request access to, or correction of, their personal information and can raise concerns or complaints about how their personal information has been handled.

Legislative and Governance Drivers

This Policy is established having regard to the following legislative and governance drivers:

Privacy Act 1988 and Australian Privacy Principles

The Privacy Act 1988 and Australian Privacy Principles establish requirements for the management of personal information by covered organisations. The OAIC explains that the Australian Privacy Principles apply to organisations or agencies covered by the Privacy Act and provide a principles-based framework that allows organisations to tailor personal information handling practices to their business model and the needs of individuals.

The OAIC's guidelines on the Australian Privacy Principles outline the mandatory requirements of the APPs, how the OAIC interprets the APPs and matters the OAIC may take into account when exercising its powers under the Privacy Act.

EthicSure Governance Framework

This Policy supports EthicSure's broader governance, compliance and risk management framework. EthicSure's Compliance Policy states that EthicSure is committed to managing personal and sensitive information in accordance with applicable privacy obligations, including controls over information held about employees, contractors, committee members, participants, Certification Bodies, auditors, stakeholders and other individuals connected with the EthicSure Scheme.

Scheme Integrity and Stakeholder Confidence

Effective privacy management supports stakeholder confidence in the EthicSure Scheme. Privacy controls help protect confidential information, Scheme-related information, audit information, stakeholder records and personal information connected with EthicSure's governance and operational activities.

What is Personal Information

Personal information is defined in the Privacy Act as information or an opinion about an identified individual, or an individual who is reasonably identifiable, whether the information or opinion is true or not, and whether the information or opinion is recorded in a material form or not.

Collection of Personal Information

We collect personal information in the following ways:

  • directly from you, via our website, digital platforms and social media accounts, or by telephone, email or in person;
  • if you use our services;
  • through your other dealings with us, including your enquiries, feedback, questions, complaints, or employment applications;
  • from third parties in connection with any relevant standard, certification, accreditation or assurance scheme, including standard owners;
  • from third party service providers;
  • from publicly available sources of information;
  • from government and other agencies, where necessary depending on the nature of our relationship (e.g. from credit reporting agencies);
  • from industry peak bodies and professional bodies; and
  • via any other method permitted by law.

The types of information EthicSure collects will depend on the nature of our relationship with you. It includes the following:

  • addresses, telephone numbers, email addresses of contractors (including auditors), clients, members, and licensees;
  • information obtained in audit, certification or assurance processes;
  • information obtained in relation to training services we provide, including student identifiers and course details; and
  • other information for our business purposes, as legitimate for our functions or activities.

You do not need to give us personal information, but if you don't, we may not be able to provide you with services.

More generally, we will not collect personal information in a way that would be unlawful or where such information is unnecessary or unrelated to our business activities.

Unsolicited Personal Information

If EthicSure receives unsolicited personal information, EthicSure will determine whether the information could have been collected under the Privacy Act and the Australian Privacy Principles. If the information could not have been collected, EthicSure will destroy or de-identify the information as soon as practicable, where it is lawful and reasonable to do so. If EthicSure retains unsolicited personal information, it will deal with that information in accordance with this Policy and the Australian Privacy Principles.

Collection Notification

At or before the time EthicSure collects personal information, or as soon as practicable afterwards, EthicSure will take reasonable steps to notify individuals of relevant matters, including the purpose of collection, the consequences if information is not provided, the usual disclosures of the information, whether disclosure to overseas recipients is likely, how individuals may access or correct their personal information, and how privacy complaints may be made and handled.

Use and Disclosure of Personal Information

EthicSure uses and discloses personal information for our business purposes, including:

  • to provide you with the information and services you or your organisation request;
  • to undertake business activities in connection with relevant standard, certification, accreditation or assurance scheme;
  • to provide you with information about the services we provide;
  • to process employment applications;
  • to improve and manage our business and services;
  • to customise your experience when using our website and services;
  • to address and answer any enquiries or questions that you might have;
  • in accordance with applicable laws (including the APPs), regulations, statutory instruments and industry standards.

EthicSure may disclose personal information to employees, related bodies corporate and third parties where reasonably necessary for EthicSure's functions or activities, where the individual has consented, or where permitted or required by law. Such third parties include:

  • external service providers;
  • the owners or operators of any relevant standard, certification, accreditation or assurance scheme;
  • government, statutory and regulatory bodies, organisations, or committees to which EthicSure provides services;
  • industry peak bodies and professional bodies;
  • companies with which EthicSure has information exchange agreements;
  • specialist advisers to provide legal, administrative, financial, insurance, research, marketing, or other services; and
  • any other authorised person including standard owners associated with product, process, or service certifications.

Anonymity

Where practical and lawful, individuals may choose not to identify themselves or may use a pseudonym when dealing with EthicSure.

However, there may be circumstances where EthicSure cannot deal with an individual anonymously or pseudonymously. For example, identification may be required to administer Scheme participation, manage an audit or certification matter, investigate a complaint, verify authority, meet legal obligations or provide a requested service.

Privacy Information Management

Most personal information collected by EthicSure is stored within Australia using web services and data facilities managed by EthicSure or contracted managed service providers.

For the purposes of EthicSure's business activities, including in connection with standards, accreditations, assurance schemes and training services, EthicSure may disclose personal information to overseas recipients where it is consistent with the purposes or requirements of the relevant standard, certification, accreditation or assurance scheme. Before disclosing personal information to an overseas recipient, EthicSure will take reasonable steps to ensure the recipient does not breach the Australian Privacy Principles in relation to that information, unless an exception applies. EthicSure may also use contractual measures and other controls to support compliance with the Privacy Act and this Policy.

Marketing

Unless you opt out, EthicSure may use or disclose your personal information for direct marketing where permitted by law, including with your express or implied consent. Direct marketing communications will include a simple means to opt out, and EthicSure will action opt-out requests within a reasonable time.

Government-Related Identifiers

EthicSure will not adopt a government-related identifier of an individual as its own identifier, or use or disclose a government-related identifier, unless permitted or required by law.

Quality of Personal Information

EthicSure will take reasonable steps to ensure that the personal information it collects is accurate, up to date and complete. EthicSure will also take reasonable steps to ensure that personal information it uses or discloses is accurate, up to date, complete and relevant, having regard to the purpose of the use or disclosure.

Security of Information

EthicSure may hold your personal information in a number of different formats, including software programs (located both onsite and offsite, including in the cloud), databases, filing systems and in offsite backup storage.

EthicSure takes all reasonable steps to protect personal information from misuse, interference, loss, unauthorised access, modification, disclosure or other misuse. Suspected or eligible data breaches will be managed in accordance with the Data Protection and Confidentiality Policy and any relevant incident response procedures. EthicSure will take reasonable steps to destroy or de-identify personal information when it is no longer needed, unless retention is required or permitted by law, Scheme governance, audit, certification, complaints, appeals, dispute, insurance or recordkeeping requirements. However, we cannot ensure the security of any information that you transmit to us over the internet and you do so at your own risk.

Statistical Information

When accessing the EthicSure's websites or other digital platforms (for example, social media), EthicSure will keep a record of visits and log the following information for statistical purposes:

  • the server addresses;
  • the top-level domain name;
  • the site visit date and time;
  • the pages accessed and documents downloaded;
  • the previously visited site; and
  • the type of browser.

EthicSure will not attempt to identify users or their browsing activities based on the above statistical information.

However, in the event of an investigation, a law enforcement agency or other government agency may exercise its legal authority to inspect the EthicSure or service provider's data.

Cookies

The EthicSure websites only use session cookies during a search query of the respective website. The website statistics for the sites are generated from the web logs as outlined above.

When the browser is closed, the session cookies set by the EthicSure website are destroyed and no personal information is retained through those session cookies.

Cookies can be either "persistent" or "session" based. Persistent cookies are stored on the computer, contain an expiration date, and may be used to track browsing behaviour. Session cookies are short-lived, used only during a browsing session, and expire when exiting the browser.

You can choose to accept or decline cookies. Most web browsers automatically accept cookies, but you can usually modify your browser settings to decline cookies if you prefer. This may, however, prevent you from using the full capabilities of the website.

We may also use third-party analytics tools, such as those provided by Meta and Google Analytics, to provide us with information about how you use our website. These analytics tools may place or access cookies on your device, which allows them to monitor your web browsing activity. More information regarding the services provided by Meta and Google, including their privacy policies and information about opting out is available on their websites.

Sensitive Information

Generally, we do not collect sensitive information as defined in the Privacy Act. Sensitive information is a subset of personal information. As defined in the Privacy Act, sensitive information includes personal information or an opinion about an individual's racial or ethnic origin, political opinions, membership of a political association, religious beliefs or affiliations, philosophical beliefs, membership of a professional or trade association, membership of a trade union, sexual orientation or practices, criminal record, health information, genetic information, biometric information used for automated biometric verification or identification, or biometric templates.

We will only collect sensitive information if you have given your consent for us to do so and the information is reasonably necessary for us to carry out our functions or activities, or as otherwise permitted under the Privacy Act.

Any sensitive information held by EthicSure will only be used and disclosed for the purpose that you provided it for.

Automated Decision Making

EthicSure may use computer programs, including machine learning and other artificial intelligence processes, to automate or assist with some functions and operational activities. Where personal information is used in automated decision-making or decision-support processes, EthicSure will manage that use in accordance with applicable privacy obligations, governance controls and this Policy.

EthicSure may use artificial intelligence tools to assist with assessment activities, including assessing whether auditors have addressed relevant Scheme criteria. In doing so, EthicSure may use personal information collected during an audit or certification-related process.

EthicSure will not use automated decision-making to make the final decision regarding the outcome of any audit or certification-related matter. Final decisions will remain subject to appropriate human review, oversight and governance controls. EthicSure will seek to be transparent about how artificial intelligence and automated decision-support tools are used, including by reviewing this Policy as privacy law, regulatory guidance and technology practices evolve.

Personal Information Access

At any time, you may request access to personal information about you that EthicSure holds by contacting us using the details below. We will endeavour to process your request within a reasonable time. We will generally give you access to your personal information, and if we do not, we will take reasonable steps to meet your needs (for example by letting you know generally the kind of information we hold about you). We will also give you the reasons why your request has been refused and advise you on avenues to make a complaint.

Correction of Personal Information

Individuals may request that EthicSure correct personal information it holds about them if the information is inaccurate, out of date, incomplete, irrelevant or misleading. EthicSure will take reasonable steps to correct personal information where appropriate and will respond to correction requests within a reasonable time.

Privacy Policy Changes

EthicSure will review this Policy periodically and may amend it from time to time to reflect changes in legislation, regulatory guidance, governance requirements, Scheme operations, privacy practices, technology, risk exposure or organisational arrangements.

Material changes to this Policy will be reviewed and approved in accordance with EthicSure's governance framework. Updated versions of this Policy will take effect from the date of approval or publication, unless otherwise stated.

Other Websites and Apps

Our websites, platforms, apps and social media pages may contain links to other websites or apps (including social media platforms) of interest. Please note that we do not have any control over those websites or apps. We are not responsible for the protection and privacy of any information which you provide whilst visiting such websites or apps and such websites or apps are not governed by this privacy policy. You should exercise caution and look at the privacy policy applicable to the website or app in question.

Complaints Regarding Privacy

Please notify EthicSure if you have any complaints relating to EthicSure's handling of your personal information. EthicSure will acknowledge and investigate privacy complaints in accordance with its legal obligations and will respond within a reasonable time. If you are not satisfied with EthicSure's response, you may contact the Office of the Australian Information Commissioner.

Privacy Policy Contact Details

If there are any questions or notifications regarding privacy or personal information, or if you wish to correct your personal information, please contact:

EthicSure Privacy Contact

Email: privacy@ethicsure.com.au

Telephone: 07 3097 9780

For further information about privacy issues in Australia, see the Office of the Australian Information Commissioner's website at www.oaic.gov.au.

ETH112 · Version 1 · 9 September 2026