µç¾º²©²ÊÍƼö

This Policy sets out the requirements for privacy across µç¾º²©²ÊÍƼö Group Holdings Pty Ltd (µç¾º²©²ÊÍƼö) and entities it controls (the Group).

This Policy applies to all employees of the Group, third parties engaged by the Group, and all alliances and joint ventures in all jurisdictions.

The objectives of this Policy are to treat personal information in accordance with the Privacy Act 1988 (Cth) (the Privacy Act) and the Australian Privacy Principles (APPs).  Any personal information outside Australia, will be treated in accordance with the applicable law.

Personal information is any information (including an opinion) which can be used to identify an individual. Sensitive information is a subset of personal information which includes information about an individual’s race or ethnicity, political or religious beliefs, membership of a professional or trade association, membership of a trade union, sexual preferences, criminal record and health information.

Personal information will not be shared, sold or disclosed by µç¾º²©²ÊÍƼö other than in accordance with this Policy, without an individual’s permission, or in accordance with the Privacy Act.

µç¾º²©²ÊÍƼö only collects, holds, uses or discloses personal information where it is reasonably necessary to:

• enable µç¾º²©²ÊÍƼö to deliver services or information to individuals or to an organisation;
• maintain or establish a business relationship, including with a customer, supplier, contractor, or employee;
• enable µç¾º²©²ÊÍƼö to assist to provide services; or to improve, and better understand preferences in respect of µç¾º²©²ÊÍƼö services; and
• fulfil its legal or regulatory obligations.

µç¾º²©²ÊÍƼö generally collects personal information directly from the individual to whom it relates, except where that individual has consented to µç¾º²©²ÊÍƼö collecting the personal information from a third party, the law otherwise permits µç¾º²©²ÊÍƼö to do so, or where it is unreasonable or impracticable to collect it directly. µç¾º²©²ÊÍƼö only collects sensitive information directly from individuals with their consent, or where required, it is authorised or otherwise permitted to collect the information from a third party by law. 

Personal information may also be collected from, and disclosed to, third parties in the course of business activities. For example, during a recruitment process steps may be taken to verify the accuracy and completeness of the information and, in appropriate circumstances, health checks, credit checks or criminal records checks may be carried out. 

An individual has the option, where lawful and practicable, not to be identified when communicating or entering into transactions with µç¾º²©²ÊÍƼö (including by the use of a pseudonym). However, in most circumstances, it will be impracticable for µç¾º²©²ÊÍƼö to do business with an individual or provide the services required by an individual unless personal information is provided.

Personal information will be stored in µç¾º²©²ÊÍƼö’ systems for immediate business and administration purposes, as detailed above, and may be used or disclosed for the purpose for which it was collected, or for a related purpose which someone may reasonably expect. Sensitive information will only be disclosed for a purpose which is directly related to the purpose for which it was collected.

Personal information may be disclosed between related bodies corporate within µç¾º²©²ÊÍƼö Group Holdings worldwide, and used by those entities for the same purposes for which the collecting company is entitled to use it.

µç¾º²©²ÊÍƼö may also disclose or use personal information (including to overseas recipients):

• to third party service providers and business associates, including our joint venture and alliance partners, who provide services in connection with its business. These third parties may be located locally or overseas.
• with the individual’s consent;
• where required, authorised or permitted to do so by law;
• to a person authorised to act on the individual’s behalf; or
• as required by law and specifically to any government agency if µç¾º²©²ÊÍƼö believes in good faith that it must do so to comply with the law or that doing so is required to prevent, detect, investigate or remedy improper conduct potentially affecting it.

Where µç¾º²©²ÊÍƼö holds or transfers personal information outside Australia, it will meet the safeguards set out in the Privacy Act. Where personal information is held or disclosed overseas, all reasonable steps will be taken to ensure that the recipient will handle the information in a manner consistent with the Privacy Act and in the case of the European Union the GDPR (please refer to the Privacy Collection Statement on the µç¾º²©²ÊÍƼö website (thiess.com) for further details).

µç¾º²©²ÊÍƼö is committed to:

• safeguarding all personal information provided to µç¾º²©²ÊÍƼö;
• ensuring that personal information remains confidential and secure; and
• taking all reasonable steps to ensure that personal privacy is respected.

µç¾º²©²ÊÍƼö maintains physical, electronic and procedural safeguards to protect personal information from misuse, interference, unauthorised access, modification or disclosure, and loss or corruption by computer viruses and other sources of harm. Access to personal information is restricted to those employees, joint venture partners, subsidiary companies and third parties who need to know that information.

In accordance with the Privacy Act, µç¾º²©²ÊÍƼö is required to notify you and the Australian Information Commissioner if it becomes aware of a data breach (such as an unauthorised disclosure of or unauthorized access to data, or a loss of data) where that breach is reasonably likely to result in serious harm. This will apply even if your data is being held offshore.

In most circumstances, µç¾º²©²ÊÍƼö will make available to an individual upon their request any personal information held about them. Requests to access personal information may be made at any time. µç¾º²©²ÊÍƼö will respond to a request within a reasonable time, and in the manner requested, unless there is a legal or administrative reason preventing µç¾º²©²ÊÍƼö from do so. In some cases a reasonable fee may be charged for providing access.

Reasonable steps will be taken to ensure the personal information held is accurate, complete, up to date, relevant and not misleading before it is used or shared.

An individual may request that personal information be corrected or supplemented if the individual believes the information held by µç¾º²©²ÊÍƼö is inaccurate or misleading. If µç¾º²©²ÊÍƼö agrees, the change will be made. If µç¾º²©²ÊÍƼö disagrees, µç¾º²©²ÊÍƼö will advise the individual and include a notation on the record that the information’s accuracy is disputed.

If personal information changes, or if an individual believes that the personal information held by µç¾º²©²ÊÍƼö is no longer accurate or complete or has been the subject of a data breach, the individual should contact the Privacy Officer.

A cookie is a small text file downloaded onto a computer or mobile device when a website is accessed, including the µç¾º²©²ÊÍƼö website. Cookies are widely used to make websites work, or work more efficiently, as well as to provide information to the website’s owners and third parties.

Cookies allow a website to recognise a computer or mobile device. Cookies do not identify the individual but do identify the computer or mobile device used to access the Internet, and can therefore be used to collect information about the individual’s use of the Internet. Cookies do not allow access to any information stored on the individual’s computer or mobile device.

Cookies are used to collect information, where available, about a computer or mobile device for system administration purposes, such as IP address, operating system and browser type. Information collected through the use of cookies will only be used to evaluate µç¾º²©²ÊÍƼö’ website effectiveness and to improve user experience. Cookies are not used to identify an individual or to send targeted advertising.

µç¾º²©²ÊÍƼö’ website provides hyperlinks to websites owned and controlled by others. µç¾º²©²ÊÍƼö is not responsible for the privacy practices of these websites. By accessing or using µç¾º²©²ÊÍƼö’ website, an individual consents to the collection, use and disclosure of personal information as described in this Policy, as amended from time to time.

By email privacy@thiess.com
By post The Privacy Officer, 179 Grey St, South Bank, Queensland 4101  

µç¾º²©²ÊÍƼö will respond to requests to correct or supplement personal information within a reasonable time period.

Records management policies govern the archiving and destruction of records which include personal information.

If unsolicited personal information is received, reasonable steps will be taken to destroy or de-identify that personal information. 

If an individual has a question, concern or complaint regarding the way in which personal information is handled, or believes that µç¾º²©²ÊÍƼö has breached its obligations under the Privacy Act or has failed to comply with this Policy, they should make a complaint in writing to the µç¾º²©²ÊÍƼö Privacy Officer.

µç¾º²©²ÊÍƼö will review and respond to any complaint as soon as possible, and generally within 30 days of receiving it. 

If an individual is not satisfied with µç¾º²©²ÊÍƼö’ response, the complaint can be referred to the Office of the Australian Information Commissioner (OAIC). The OAIC will generally only consider a complaint if the individual has first written to µç¾º²©²ÊÍƼö and given µç¾º²©²ÊÍƼö a reasonable opportunity to resolve the complaint (usually 30 days).