Latest update: 29 May 2018

This privacy policy sets out how Aurecon collects, uses and manages personal data.

Aurecon views personal privacy as an important issue and is committed to respecting the privacy and security of personal information provided to or collected by Aurecon.

This policy also forms part of the terms of use of Aurecon’s websites. This policy may be updated from time to time and can be viewed on Aurecon’s website: www.aurecongroup.com.

Aurecon

Aurecon is an engineering and infrastructure advisory company, with its holding company registered in Melbourne, Victoria, Australia.

Aurecon has subsidiary and related companies that conduct business in locations throughout Australia, New Zealand, Asia, Middle East and Africa. The locations or countries in which Aurecon operates can be viewed here.

Information collected

In the conduct of its functions and activities, Aurecon may collect and hold personal information about an individual, including but not limited to name, date of birth, gender, business or home address, contact details, occupation, professional qualifications and experience, employer, financial information and Aurecon internet webpages accessed.

Aurecon collects, uses and manages personal information in accordance with this privacy policy and in compliance with the relevant data protection and privacy laws and regulations in areas where it operates.

The purpose of collecting personal information

Personal information will be collected and used or disclosed by Aurecon for the purposes of conducting its business activities, for pursuing its legitimate interest, for legal or regulatory compliance activities as required by law or good business practice or for the purposes for which the information is provided. Aurecon pursues a range of legitimate interests including but not limited to:

• recruitment and employment opportunities;
• promotion of Aurecon's services, including details of events and seminars;
• performing its professional services and duties;
• assessing prospective clients and projects, including risk and creditworthiness;
• handling or defending complaints, disputes or claims;
• undertaking research relating to professional services activities;
• passing information to Aurecon’s related companies, credit agencies, government agencies and legal and professional service providers where appropriate; and
• compliance with the relevant statutory obligations, including government reporting and specific local law requirements.

Processing of personal information

Aurecon collects and processes a wide range of personal data as part of operating its business. The basis for processing personal data includes but is not limited to:

• the consent given by an individual to Aurecon to process the individual’s personal information;
• performance of professional services and duties in terms of a contract to which an individual is a party;
• compliance with a legal obligation that Aurecon as the controller is required to meet in terms of relevant privacy and data protection laws and regulations;
• processing is necessary to protect an individual’s vital interests or the vital interests of another person; and
• processing is necessary for the purposes of the legitimate interests pursued by Aurecon or by a third party, except where such interests are overridden by: security interests, an individual’s fundamental rights and freedoms and the protection of personal information from serious harm, all of which require protection of personal data in particular where the data subject is a child

Recipients of personal data

Aurecon as a global business holds information and data in numerous countries. It may therefore transfer personal information or data to Aurecon offices or locations and in data centres in any country, but only for the above mentioned lawful purposes and subject always to this privacy policy and the laws of the relevant country.

Period of retention of personal information

Aurecon does not store or retain an individual’s personal information for any longer than is required in accordance with Aurecon’s legitimate interest to do so or for the period necessary to comply with our legal obligations related to the storage of specific types of records and/or information.

Security and internet websites

Aurecon takes reasonable security measures to protect personal information, but unauthorised access remains a possibility. Aurecon will not take responsibility for anyone outside of Aurecon’s control breaching its security measures. Aurecon may make non-Aurecon websites available through hyperlinks on its website which are not subject to Aurecon's privacy policy. Aurecon is not responsible for those sites and the privacy policy; conditions of use and security of those websites should be assessed by the user before use.

Rights as a data subject

At any stage while Aurecon is in possession of or, processing of an individual’s personal data, the individual will with regard to the management of the information have the following rights:

• to request a copy of the personal data held by Aurecon (right of access);
• to have personal data corrected (right of rectification);
• in certain circumstances to have personal data erased from records (right to erasure);
• to restrict the processing of personal data (right to restriction of processing);
• to object how personal data is processed (right to object);
• to have personal data transferred to an individual or to another business in certain circumstances (the right of portability).

If processing of personal information is based on consent, an individual can withdraw his/her consent for Aurecon to process his/her personal data at any time by contacting Aurecon at data@aurecongroup.com or at the relevant office address or telephone number listed at www.aurecongroup.com. Aurecon will review or process the request or matter and provide a response as soon as practicable.

Consequences of not providing personal information

An individual is not obligated to provide their personal information, however as this information is required for Aurecon to provide an individual with its services and deal with legitimate interests, Aurecon may not be able to offer the individual services without it.

Removal or change of person details and complaints

If a person wishes to view, correct, update or remove personal details held by Aurecon, or has any questions, concerns or complaints regarding privacy or Aurecon’s management of personal information, Aurecon may be contacted at data@aurecongroup.com or at the relevant office address or telephone number listed at www.aurecongroup.com. Aurecon will review or process the request or matter and provide a response as soon as practicable. Aurecon respects the right of individuals to remain anonymous.

If an individual remains dissatisfied then he/she also has the right to take any complaints about how Aurecon process personal data to privacy protection agencies in the areas where Aurecon operates.

The contact details for a range of privacy protection agencies can be found via this link.

Australia has nominated the Office of the Australian Information Commissioner (OAIC) as the primary Supervisory Authority; Website: https://www.oaic.gov.au/.

Automated decisions

Aurecon does not make decisions based solely on the automated processing of data, including profiling, which produce legal effects that significantly affect the individuals involved.

If automated decisions are made, affected persons will be given an opportunity to express their views on the automated decision in question and object to it.