ISPT (referred to in this policy as ‘ISPT’, ‘we’, ‘us’ or ‘our’) and business partners who act on our behalf are committed to protecting your privacy and complying with our obligations under the Privacy Act 1988 (Cth) (Privacy Act) and Australian Privacy Principles (APP), in respect of the collection, storage, use and disclosure of personal information.
This Policy sets out the principles that we adopt to manage the personal information of our customers and their employees, service providers, agents, contractors, investors, and visitors and potential visitors to our properties (‘you’).
- why we collect personal information;
- the types of personal information we collect and how we use that information;
- who may collect personal information;
- how we collect and hold personal information;
- how we keep personal information secure;
- the circumstances in which we may disclose personal information;
- how you may access personal information held by us and seek correction; and
- how you may complain about a breach of privacy, and how we will deal with such a complaint.
1. Why do we collect personal information?
We collect and use personal information about you primarily to provide you access to and use of our channels, products and services, to manage our relationship with you and to allow us to communicate with you.
Examples of why we may collect your personal information include:
- to enter into contracts with goods or service providers to conduct our business;
- to facilitate the use of our products and services;
- to participate in marketing promotions, surveys, competitions and other engagement activities;
- for internal administrative purposes, such as procedural assessments, risk management, accounting, billing, customer service and product and service reviews;
- in connection with the management of access and security at our properties;
- for marketing and promotional purposes;
- to provide you with personalised communications;
- to measure and analyse customer or visitor behaviour in order to improve our properties and otherwise in connection with our business;
- to better understand your needs and deliver improved services and an enhanced experience before, during and after your visit to our properties;
- to comply with our legal obligations; and
- for other purposes for which you would reasonably expect us to use that information.
We may also use information we collect about you to obtain further details from available sources via our trusted data service providers, where it may help us to improve our communications and customer service to you and to deliver an enhanced, personalised shopping experience.
Additionally, analytics may be conducted on personal information provided directly by you, as well as third party sources and third-party social-networking sites (including but not limited to Facebook, Instagram, LinkedIn and/or Twitter). This may be for the purpose of better marketing, determining your preferred products/ services and to better understand your needs in order to deliver improved services and an enhanced experience before, during and after your visit to our properties. We may share information we collect about you with our affiliates, agents and trusted business partners for this purpose.
2. What personal information do we collect and how do we use it?
The following are examples of personal information which may be collected and circumstances in which that information may be used:
From Visitors to our properties
ISPT, or one of our trusted business partners, may collect your personal information when you are visiting our properties in a number of different ways. These include:
- In connection with competitions or signing up to email or mobile newsletters (either while in our properties or online), you may provide us with your contact details. Your name and address are automatically entered into our database when you enter competitions. We collect these details to contact competition winners and communicate with our visitors and to inform them about events, activities and promotions in our properties and as part of our other activities. You will have the option to opt out from receiving this information.
- When you hire equipment from us, or apply to use certain restricted spaces at our properties, you may provide us with certain information, including your contact details. We collect this information to ensure there is a record of the hirer, but may use this information for marketing and promotional activity and to enable you to be informed about upcoming events, activities and promotions both in our properties and as part of our other activities.
- When entering our properties and car parks, customers’ or visitors’ personal information, vehicle and car park licence plate details and images may be collected by us under video and camera surveillance. We may also collect customers’ or visitors’ personal information and images from third parties (e.g. the police or retailers). This information may be used by us in connection with the management and security of our properties and may be provided to law enforcement, government bodies or in litigation (including, without limitation, where the information may be required for use in litigation relative to or affecting us or where we have been subpoenaed to provide that information), ISPT staff and subcontractors, third parties who provide us with services from time to time, insurers and retailers for those purposes.
- When customers park in our properties or car parks with a ticketless parking system or car locator functionality, customers consent to provide us with their car licence plate details and, in some circumstances, other information including name, email address and telephone number. These details are used for measuring and analysing car parking dwell times and shopper behaviour in order to improve our services, for the purposes of managing car parking at our properties and also to assist customers to locate their cars including via online and mobile applications.
- Where devices are enabled to connect to, or are identifiable by, in-centre infrastructure (for example, in-centre Wi-Fi networks or blue tooth transmitter (beacon) infrastructure), we and our third party providers may automatically collect data from those devices including usage, type of device and location and proximity of your wireless device in our properties, arrival and departure time from our properties, and other data which users consent to us collecting from time to time.
- Audience measurement information collected passively using in-centre technologies such as SmartScreen Advertising Units which utilise image processing software to aggregate data such as visitor numbers and demographics. These technologies do not identify individual visitors, or record or retain images of individual visitors.
From Users of our Wi-Fi Services and mobile applications
When you log on to Wi-Fi Services or download any mobile apps provided at our properties, use mobile applications developed by us or third party applications utilising our infrastructure (Mobile Services), you may be required to provide certain personal information, including your contact details, to access the service.
When you register to use any Mobile Service, we may collect:
- your name;
- your email address;
- your date of birth;
- your telephone number or residential address.
- the domain name from which you accessed our Wi-Fi,
- your MAC address and device name;
- the date and time you accessed our Wi-Fi;
- your data usage;
- type of device and location and proximity of your wireless device in the property, arrival and departure times;
- cookies which enable tracking or provide other information regarding your interaction with the Wi-Fi;
- the web browser that you are using and the URL of any webpage you accessed using our Wi-Fi;
- other audience measurement information which may be collected passively using various technologies that identify the demographic, age group and gender of shoppers; and
- if you sign on via a third-party social-networking site (including but not limited to Facebook, Instagram, LinkedIn and/or Twitter), publicly accessible social media posts and any personal information we obtain from those sites.
We collect this information (and may use or hold this information) for the following purposes:
- to improve our Wi-Fi network and its functionality and your in-centre experience;
- for the purposes of and incidental to your use of the in-centre Wi-Fi services; and
- to enable users to be informed about upcoming events, activities and promotions, both in our properties and as part of our other activities, sponsor customer promotions, and other activities, which will usually be notified to users as they sign in to use those facilities.
In addition to the purposes set out above, this information may be used by us in connection with the management and security of our properties generally, to obtain feedback about a visitors’ experiences at a property (including with our customers), and may be provided to law enforcement and government bodies (including, without limitation, where the information may be required for use in litigation relative to or affecting us), insurers, our staff and subcontractors, third parties who provide us with services from time to time and customers for these purposes.
From our Customers and their Staff
We may collect the following types of personal information from customers, guarantors and/or individuals related to customers during negotiations for, and during the term of, the lease/licence for premises, kiosks and other activities at its properties:
- name, address and date of birth;
- contact and insurance details;
- next of kin or emergency contact person(s) details;
- information as to customers’ financial standing and retailing experience (or the financial standing and retailing experience of the customer’s director(s) or guarantor(s); and
- other financial and trading information.
We use this information to:
- evaluate whether we should enter into a lease, licence or other agreement with a customer;
- to assist us in the preparation documentation to formalise the lease, licence or other agreement;
- to manage our relationship with customers in connection with the management and security of our properties; and
- in order to monitor the performance of a tenancy and property.
Where in connection with your tenancy we require a credit check, we will obtain your consent to this and hence may collect and share information about you with credit reporting agencies.
Occasionally, the information may also be made available to others in connection with these activities, in order for those people to provide services to us or as required by law, as well as to third parties in connection with any transactions involving the property.
If a customer provides us with direct debit or direct credit details, we will only disclose those details to the relevant institutions to facilitate the on boarding and ongoing delivery of that service.
When entering one of our properties, the personal information and images of customers and their staff may be collected in the same way as any other visitor to the property. This information may be used by us in connection with the management and security of our properties and may be provided to law enforcement, government bodies or in litigation (including, without limitation, where the information may be required for use in litigation relative to or affecting us, or if where we have been subpoenaed to provide that information), insurers, our staff and subcontractors, third parties who provide ISPT with services from time to time and other customers for those purposes. This information is held securely and in a format, which is access controlled unless it is necessary to use this information for these purposes.
Where customers or their employees sign up to use or access our products, services or channels, we may also collect information for the purposes of maintaining our relationship with you and to provide services offered through that channel. These channels may be operated by us, or by one of our trusted business partners. For further information in relation to how these channels collect, manage and use your personal information, please refer to the Terms & Conditions and privacy information available on that channel.
From our Agents, Contractors and Suppliers
From potential employees of ISPT
If you are seeking employment with us, we may collect personal information about you in connection with your employment. This information may include your name, date of birth, contact information, and any other information you provide, or provided on your behalf, as part of our induction and compliance processes. This information will be used for the purposes of our recruitment process and, if successful, managing your employment, in accordance with the requirements of the Privacy Act. You need to ensure this information is up to date, in accordance with our policies and procedures.
From investors and their officers, employees and agents
If you are an officer, employee or agent of an investor in ISPT, we may collect personal information from you from time to time, including when you register for, access or use the ISPT investor portal. ISPT may collect personal information about you in connection with the provision of services to you, either directly from you or from the investor. This information may include your name, username, email address and any other information you provide, or is provided on your behalf, as part of our registration and compliance processes. Such information will be used by us for business related purposes, including management of the provision of the services in question.
From users of our website
When you use, access or become a registered user of https://ispt.net.au/ or any associated site or other site operated or maintained by us from time to time (website(s)), including when you use services offered by a website or subscribe to our email newsletters service from time to time, we may ask for information including:
- your name;
- your email address;
- your date of birth; and
- your telephone number or residential address.
The website is an Australian based website, and it is not intended to provide services to EU residents, and its terms may not be fully consistent with the General Data Protection Regulation. If you are an EU resident and you choose to use the Website then you do so at your own risk, and on the terms of our website.
- We may also collect the following information from you when you access our website or use services offered by our website:
- the fully qualified domain name from which you accessed our websites, or alternatively, your IP address;
- device ID number (MAC address);
- the date and time you accessed each page on our websites;
- the URL of any webpage from which you accessed our websites;
- publicly accessible social media posts and content and any personal information you allow us to collect by linking your account on our website with a third-party social-networking site including but not limited to Facebook, Instagram, LinkedIn and/or Twitter;
- the URL from any webpage from which you accessed our website (the referrer);
- cookies which enable tracking or provide other information, including your visits to and interaction with our web sites; and
- the web browser that you are using and the pages you accessed.
We are collecting this information (and may use or hold this information) for the following purposes:
- so that we can tell which web pages are the most popular and where visitors spend most of their time;
- to improve our website or functionality provided by the website or in-centre experience;
- for the purposes of and incidental to your use of our website (if applicable);
- to measure visitor numbers, characteristics and demographics, and analyse visitor behaviour in order to continuously improve our properties and for use otherwise in connection with our business;
- to send to you special deals and discounts, surveys and other marketing materials based on your location or known web usage;
- for other purposes to which you, either expressly or impliedly, consent to, and for the purposes set out in these terms and conditions, we may provide this information to our agents, contractors, service providers, joint venture and commercial partners and regulatory authorities, and may transfer your personal information to others in countries outside Australia (including to those that operate or host our data or cloud servers outside of Australia, including the United States of America and countries located in regions such as the European Union and Asia).
- We may use the anonymised data for the purposes set out above and to inform our promotional and marketing strategies, as well as research and profiling purposes including visitor demographics, interests and behaviours based on personal information and other information provided to us. This research may be compiled and analysed on an aggregate basis, and we may share this aggregate data with our affiliates, agents and business partners. This aggregate information does not identify you personally. We may also disclose aggregated information in order to describe our services to current and prospective business partners, and to other third parties for other lawful purposes.
- We may connect information you provide to us for one purpose with other information for use for one or more of the above purposes. If you access or log-in to an in-centre Wi-Fi service, and we already hold other information (both personal or non-personal) that can be associated to you or the device on which you are accessing the Wi-Fi service (including, but not limited to a device ID number (MAC address)), then that information may be linked with personal information we hold about you as set out in this policy, and will be treated in the same manner as the personal information to which it has been linked.
3. Who collects the personal information?
Personal information may be collected directly by us, our agents or by our trusted business partners acting on our behalf, such as property management companies, technology providers and trusted data service providers. Information may also be collected by us on behalf of other people as set out in notices given to you, or consents given by you, at or prior to the time the personal information is collected.
4. How do we collect personal information?
We will only collect personal information by lawful and fair means.
If it is reasonable and practical to do so, we will collect personal information directly from you. We may also collect personal information from other companies that are able to disclose it to us, if it is not practical to collect it from you. For example, we may obtain personal information from trusted data sources to help us identify additional information about people who might be interested in hearing about particular products and services.
Cookies and third party websites
- the Network Advertising Initiative opt-out provided through ww.networkadvertising.org/choices/DAA;
- the Digital Advertising Alliance opt-out provided ;through www.aboutads.info/choices/; or
- the Interactive Advertising Bureau (EU) opt-out provided through youronlinechoices.eu.
5. How is your personal information stored, kept secure and maintained?
We will take all reasonable steps to protect personal information held from misuse or loss and from unauthorised access, modification or disclosure. This includes restricting access to hardcopy and electronic records via physical and logical security methods. This information is only made available to our staff on a ‘need to know’ basis and for the purposes outlined above or to other people as outlined in this policy who have agreed to treat that information confidentially.
Personal information may be held securely on our electronic databases (which may be on a database maintained by a cloud hosting service provider or other third party database storage), or otherwise in hard copy form in secure storage facilities. These databases are protected by a firewall as well as host-based security. Your personal information may be transmitted over the Internet once it has been stored in a database and may also be transferred across borders to recipients in foreign countries other than Australia, including the United States of America, and may be stored on servers, using databases or via cloud technology in a number of countries other than Australia, including the United States of America and countries in regions such as , the European Union and Asia, where doing so is part of ISPT’s ordinary business practices relating to the storage of data and where permitted by law.
If ISPT ever has a requirement to transmit such data over the Internet (for example, to make an off-site back up) it will be in encrypted form. By providing us with your personal information, you consent to these transfers.
Where personal information is held with a third party, ISPT will ensure that appropriate technical and organisational measures are in place to protect the security of that information and to ensure that it is managed in accordance with the Privacy Act. ISPT maintains responsibility for your information at all times. As such, we ensure by all reasonable means, any third parties we use are subject to controls which protect your information from unauthorised use and disclosure and limit access and limit their use or disclosure of your personal information to the agreed purpose only.
We will keep your personal information for only as long as is reasonably necessary to achieve the purpose for which we collected it. Where we no longer require the personal information for a permitted purpose, we will take reasonable steps to destroy or de-identify it.
Whilst we will use all reasonable endeavours to keep your personal information in a secure environment, this security cannot be guaranteed due to the nature of the Internet. If you reasonably believe that there has been unauthorised use or disclosure of your personal information please contact ISPT via the details below.
In the unlikely event that there is an unauthorised use or disclosure of your personal information requiring disclosure (Data Breach), we will comply with our obligations under the Privacy Act and, if required, notify you of the Data Breach and will undertake an investigation into how the Data Breach occurred and its likely severity. As part of this, we will use commercially reasonable endeavours to work with you and the Office of the Australian Information Commissioner to limit the impact, and any reoccurrence, of such Data Breach.
Right to anonymity
At the point of collection, and when dealing with us, you may have the opportunity to remain anonymous where it is reasonable and practical to do so. It must still be practicable for us to perform the required services. Some exceptions do apply where it is a legal requirement for our business to deal with accurately identified individuals.
6. When will we disclose your personal information?
We will only disclose the personal information we have about you in limited specific circumstances, such as:
- when you agree to the disclosure;
- in relation to or for the purposes we collected it;
- when disclosure is required or authorised by law; or
- as permitted by the Privacy Act.
To the extent permitted by law, we may also disclose information about you to:
- our associated entities and related bodies corporate;
- trusted business partners for marketing purposes;
- third parties who we engage to provide related services from time to time;
- our staff, agents and subcontractors in connection with the management and security of our properties;
- government agencies as part of our statutory obligations;
- in the course of litigation; or
- as otherwise permitted by law.
By accessing and using our channels and services, you consent to the use and disclosure of your personal information by and to our business partners for the purpose of allowing them to directly market products and services.
We aim to use your personal information to send advertising that is customised or more relevant to your interests, characteristics or general location. This doesn’t necessarily mean you’ll get more advertising. It just means that the advertising that you see will hopefully be more relevant to you. For example, we may use your contact details to provide you with information about promotions at our properties or those of our customers.
You may request to not receive such material by following the unsubscribe instructions that will be contained on any such material. Upon request, we will arrange for your details to be removed from our databases as soon as reasonably practicable. You agree and acknowledge that even if you opt out of receiving marketing material, we may still send you essential information that we are required to send you relating to the services we provide.
Unsolicited personal information
If we receive personal information about you that we did not ask for either directly from you, from someone on your behalf, or through someone on our behalf, and we determine that we could have collected this information from you had we asked for it, we will take reasonable steps to notify you, as soon as practicable, that we have collected your personal information. If we could not have collected this personal information from you (or if you do not agree to us collecting information in this way), we will lawfully de-identify or destroy that personal information. Any unsolicited information provided by you, someone on your behalf or someone on our behalf, will be used for the purposes for which it was provided.
7. How can you access your information?
You have rights to access, update or correct your personal information held by us. We will take all reasonable steps to ensure that personal information held by us is accurate, complete and up to date. If you wish to access your information, or you believe that any of your personal information is inaccurate, please contact your relevant Centre or Property Manager, or the ISPT Risk & Compliance Officer (Privacy Officer) via the contact details below. We will respond to you and take all reasonable steps to correct it within a reasonable timeframe.
8. Enquiries and Complaints
- visiting our website at https://ispt.net.au/;
- visiting an ISPT Centre and requesting a copy from the Property Manager; or
- calling our Privacy Officer on 03 8601 6666.
If you believe we have breached our privacy obligations or your privacy rights in any way, please contact the Privacy Officer. We will respond to your complaint as soon as possible, and within a reasonable timeframe.
The contact details for our Privacy Officer are as follows:
ISPT Privacy Officer
Level 11, 8 Exhibition St
Melbourne VIC 3000
Telephone: 03 8601 6666
If you think we have not resolved a complaint satisfactorily, we will provide you with information about the further steps you can take. You can also contact the:
Officer of the Australian Information Commissioner
GPO Box 5218, Sydney NSW 2001
Phone: 1300 363 992
Email: firstname.lastname@example.org or www.oaic.gov.au
 In this policy, “ISPT” means ISPT Pty Ltd (ABN 28 064 041 283), ISPT Operations Pty Ltd (ACN 633 106 733) and any related bodies corporate from time to time, and the owners of properties managed by those entities.