Privacy Policy

---

▪ Australian Privacy Principles (APPs) means the 13 principles set out in Schedule 1 of the Privacy Act 1988 (Cth), which govern the handling of personal information by organisations covered by the Act.

▪ CCTV means closed-circuit television, referring to the video surveillance systems operated at SAG's yards and worksites.

▪ De-identification means the process by which personal information is altered so that an individual is no longer reasonably identifiable from that information.

▪ Individual means any natural person whose personal information is collected, held, used, or disclosed by SAG.

▪ OAIC means the Office of the Australian Information Commissioner, the independent regulator responsible for privacy and freedom of information in Australia.

▪ Overseas recipient means a person or organisation located outside Australia who receives personal information disclosed by SAG.

▪ Personal information has the meaning given under the Privacy Act – that is, information or an opinion about an identified individual, or an individual who is reasonably identifiable, whether the information is true or not, and whether recorded in a material form or not.

▪ Privacy Act means the Privacy Act 1988 (Cth), as amended from time to time, including by the Privacy and Other Legislation Amendment Act 2024.

▪ Sensitive information has the meaning given under the Privacy Act, and includes health information, information about racial or ethnic origin, religious beliefs, sexual orientation, criminal record, and certain other categories of information that attract a higher level of protection under the APPs.

▪ SAG means Shaping Australia Group.
 

1. Our Commitment to Privacy

Shaping Australia Group (SAG, we, us, our) is committed to protecting the privacy of personal information we hold. This policy explains how we collect, use, store, and disclose personal information, and how individuals can access or correct their information or raise a privacy concern with us.

This policy is prepared in accordance with the Privacy Act 1988 (Cth) (Privacy Act) and the Australian Privacy Principles (APPs), including changes introduced by the Privacy and Other Legislation Amendment Act 2024.

This policy applies to our offices, yards, and worksites, our website, and our social media pages.

2. What Personal Information We Collect

The personal information we collect depends on our relationship with the individual. 

This may include:

▪ Employees and job applicants – name, contact details, date of birth, tax file number, superannuation details, bank account details, emergency contact information, employment history, qualifications, licences, certifications, performance and conduct records, and health information relevant to fitness for work (such as medical clearances or injury reports).

▪ Clients, subcontractors, and suppliers – names, business details, contact details (phone, email, address), ABN, and information relating to contracts, quotes, invoices, and correspondence.

▪ Website visitors – information submitted through enquiry or contact forms, such as name, email address, phone number, and the content of any message or enquiry.

▪ Social media followers and contacts – information shared with us via comments, messages, or direct messages on our social media pages (such as Facebook, Instagram, or LinkedIn), to the extent that information is made available to us by the platform.

▪ Visitors to our premises and worksites – CCTV footage captured at our yards and worksites for security and safety purposes.

We do not seek to collect sensitive information (such as health information, or information about race, religious beliefs, or criminal history) except where it is reasonably necessary for our functions – for example, health information relevant to a worker's fitness for duty, or a Working with Children Check where required for a role.

3. How We Collect Personal Information

We collect personal information directly from individuals wherever possible, including:

▪ When a person applies for a role with SAG, or is engaged as an employee, contractor, or subcontractor

▪ When a person contacts us by phone, email, or through our website enquiry form 

▪ When a person interacts with us via our social media pages

▪ Through CCTV systems operating at our yards and worksites

▪ When a person provides their details to us as part of a business relationship (e.g. as a client, supplier, or subcontractor)

We may also collect personal information from third parties, such as recruitment agencies, referees, or previous employers (with consent where required), or from publicly available sources.
 

4. Why We Collect, Use, and Disclose Personal Information

We collect, hold, use, and disclose personal information for purposes including:

▪ Recruiting, employing, and managing our workforce, including payroll, superannuation, training, and performance management

▪ Complying with our legal obligations, including under workplace health and safety, taxation, and employment laws

▪ Managing relationships with clients, subcontractors, and suppliers, including quoting, contracting, invoicing, and ongoing communication

▪ Responding to enquiries made via our website or social media

▪ Maintaining the security of our premises, yards, and worksites through CCTV

▪ Marketing and promoting SAG's services, where appropriate and in accordance with applicable consent requirements

We will only use or disclose personal information for the purpose it was collected, a directly related purpose a person would reasonably expect, or as otherwise permitted or required by law.

5. Disclosure of Personal Information

We may disclose personal information to:

▪ Our employees, contractors, and related entities, where necessary for the purposes described above

▪ Service providers who assist us in operating our business, including IT, software, payroll, and accounting providers

▪ Government and regulatory bodies, where required or authorised by law (for example, the Australian Taxation Office, Fair Work Commission, or WHS regulators)

▪ Professional advisers, such as lawyers, accountants, or insurers, where reasonably necessary

We do not sell personal information to third parties.

6. Overseas Disclosure of Personal Information

Some of the platforms and service providers we use to operate our business – including software for accounting, document management, and communications (such as Microsoft and Xero) – may store or process personal information on servers located outside Australia, including in the United States.

Where personal information is disclosed to an overseas recipient, SAG takes reasonable steps to ensure that recipient does not breach the APPs in relation to that information, including by relying on the data handling and security practices of established providers. However, individuals should be aware that, in some circumstances, an overseas recipient may not be subject to privacy obligations equivalent to those under Australian law, and the protections in APP 8 may not apply to certain overseas disclosures permitted by law.

7. Website, Cookies and External Links

7.1. Our Website

SAG's website at shapeaus.com.au may collect personal information when visitors submit an enquiry or contact form, request a callback, or otherwise interact with the site. This information is used solely to respond to the enquiry or request and, where relevant, for the purposes described in this policy.

7.2. Cookies

Our website may use cookies and similar tracking technologies to improve the functionality and user experience of the site, and to understand how visitors interact with our content. Cookies are small text files placed on a visitor's device by their browser when they visit our site.

The types of cookies we may use include:

▪ Essential cookies – necessary for the website to function correctly and cannot be disabled

▪ Analytics cookies – used to collect anonymised information about how visitors use our site (such as pages visited and time spent on site), to help us improve its content and performance

▪ Preference cookies – used to remember a visitor's settings or preferences to improve their experience on return visits

Visitors may disable cookies through their browser settings at any time, however doing so may affect the functionality of certain parts of our website. By continuing to use our website, visitors consent to our use of cookies in accordance with this policy. 

SAG does not use cookies to collect sensitive personal information, and does not sell or share cookie data with third parties for advertising purposes.

7.3. External Links

Our website and social media pages may contain links to third-party websites, platforms, or services that are not owned or controlled by SAG. These links are provided for convenience only.

SAG is not responsible for the privacy practices, content, or security of any third-party website or platform. Once a visitor leaves our website or is directed to a third-party platform – including social media platforms such as Facebook, Instagram, or LinkedIn – their use of that platform is governed by that platform's own privacy policy and terms of use, not this policy.

We encourage all visitors to review the privacy policies of any third-party websites they visit.

7.4. Social Media

SAG maintains pages on third-party social media platforms. When individuals interact with our pages – by following, commenting, liking, sharing, or sending direct messages – those platforms collect and handle personal information in accordance with their own privacy policies, which SAG does not control and is not responsible for.

Any personal information that SAG itself receives through social media interactions (such as the content of a direct message) will be handled in accordance with this policy. We encourage individuals not to share sensitive personal information through social media channels and to use the contact details provided in this policy for any privacy-related matters.

8. CCTV

SAG operates CCTV systems at certain yards and worksites for the purposes of security, asset protection, and workplace health and safety. Signage is displayed at relevant locations where CCTV is in operation.

CCTV footage is stored securely, access is restricted to authorised personnel, and footage is retained only for as long as reasonably necessary for the purposes described above, unless required for a longer period (for example, in connection with an investigation, incident, or legal proceeding).

9. Storage and Security of Personal Information

SAG takes reasonable steps to protect personal information from misuse, interference, loss, unauthorised access, modification, or disclosure. 

These steps include:

▪ Restricting access to personal information to employees who need it to perform their role

▪ Using secure systems and platforms for storing electronic records

▪ Storing physical records in secure locations

▪ Taking reasonable steps to destroy or de-identify personal information when it is no longer needed for any purpose for which it maybe used or disclosed under the APPs, unless retention is required by law

10. Data Breaches

If SAG becomes aware of a data breach involving personal information that is likely to result in serious harm to an individual, we will take steps in accordance with the Notifiable Data Breaches scheme under the Privacy Act, including notifying affected individuals and the Office of the Australian Information Commissioner (OAIC) where required.

11. Access and Correction

Individuals may request access to the personal information SAG holds about them, and may request that we correct that information if it is inaccurate, out of date, incomplete, irrelevant, or misleading.

Requests for access or correction should be directed to the HSEQ and Compliance Manager (contact details below). We will respond to requests within a reasonable period. In most cases, access will be provided free of charge, although a reasonable fee may apply to cover the cost of retrieving and providing certain information.

We may decline a request for access or correction in certain circumstances permitted by the Privacy Act, and will provide reasons for doing so where required.

12. Privacy Complaints

If an individual believes SAG has breached the Privacy Act or the APPs, they may make a complaint by contacting the Privacy Officer using the details below:

Shaping Australia Group

Attention: The Privacy Officer 

4/25 Pintu Drive, Tanah Merah QLD 4128

Email: admin@shapeaus.com.au

We will acknowledge the complaint, investigate it, and respond within a reasonable timeframe.

If an individual is not satisfied with our response, they may refer their complaint to the Office of the Australian Information Commissioner:

▪ Website: www.oaic.gov.au

▪ Phone: 1300 363 992

Individuals should also be aware that, since 2025, a statutory tort for serious invasions of privacy allows individuals to take direct legal action in certain circumstances involving intentional or reckless conduct, separately from making a complaint to the OAIC.

13. Responsibilities

13.1.Top Management

Top Management are responsible for:

▪ Ensuring SAG meets its obligations under the Privacy Act and APPs

▪ Approving this policy and any material changes to it

▪ Ensuring adequate resources are available to implement and maintain privacy practices across SAG

▪ Overseeing the implementation of this policy across SAG

▪ Ensuring privacy obligations are factored into new processes, systems, or activities that involve personal information

▪ Reviewing this policy annually and recommending updates as required

▪ Escalating serious or unresolved privacy matters to the OAIC or legal advisers where required

13.2.Privacy Officer

The Privacy Officer is appointed by Top Management and acts as the designated contact point for all privacy-related matters at SAG. 

The Privacy Officer is responsible for:

▪ Receiving, acknowledging, and managing requests for access to or correction of personal information

▪ Receiving and managing privacy complaints from individuals

▪ Coordinating SAG's response to suspected or confirmed data breaches, including notifications to affected individuals and the OAIC where required

▪ Maintaining records of privacy complaints, access requests, and data breach assessments

▪ Coordinating privacy awareness for SAG employees

▪ Liaising with the OAIC and other regulatory bodies where required

13.3.Relevant Managers and Supervisors

Relevant Managers and Supervisors are responsible for:

▪ Ensuring personal information within their area is collected, stored, and handled in accordance with this policy

▪ Escalating suspected privacy breaches or complaints to the Privacy Officer promptly

▪ Ensuring workers under their supervision understand and comply with this policy

13.4.All Workers

All workers who handle personal information in the course of their role are responsible for:

▪ Collecting, using, storing, and disclosing personal information only in accordance with this policy and SAG's lawful purposes

▪ Keeping personal information secure and not sharing it with unauthorised persons

▪ Reporting any suspected privacy breach, unauthorised access, or loss of personal information to their Relevant Manager or the Privacy Officer immediately

▪ Completing any privacy training required by SAG

14. Changes to this Policy

SAG may update this policy from time to time to reflect changes in our practices or in privacy law. The current version of this policy is available on our website.

15. Review

This policy will be reviewed annually, or earlier if required by changes to legislation, to ensure it accurately reflects SAG's practices.