Arcadia Privacy & Confidentiality Policy - Effective 6 December 2022

The collection, use, disclosure and handling of sensitive and confidential information is a necessary and regular process in the course of Arcadia’s business operations. This policy explains how Arcadia approaches sensitive
and confidential information, and the obligation relating to individuals, whether or not they are employees. Nothing in this policy limits any of our legal obligations including to the Privacy Act 1988 (Cth) (Privacy Act), and the Australian Privacy Principles.

1. Arcadia’s Commitment
From time to time, Arcadia is required to collect, hold, use and/or disclose personal information relating to individuals (including, but not limited to, Arcadia’s employees, candidates, contractors, and suppliers) and Arcadia data and information in the performance of its business activities.
Arcadia only collects information that is reasonably necessary for one or more of its business functions or activities by lawful and fair means. Arcadia may also collect, hold, use and/or disclose information if consent is obtained, or if required or authorised under law.
All records containing personal information and data will be accessed and used only for the purpose for which the information was collected. Arcadia and any of its employees will not disclose a record that contains personal information to any other person or agency unless consent to do so is obtained.
Arcadia and its employees will take such steps (if any) as are reasonable in the circumstances to ensure that the personal information that it collects and has access to is accurate, up-to-date, and complete. Arcadia will protect the personal information it holds from misuse, interference, loss and from unauthorised access, modification, or disclosure. The security of information is of upmost importance, Arcadia information should not be stored on external drives or devices that can be easily misplaced or lost.

2. Employee Obligations
Under the Corporations Act 2001 (Cth) and Privacy Act 1988 (Cth) obligations are imposed on all employees,
these include:
  /   take steps as are reasonable in the circumstances to notify individuals that information is being collected;
  /   not to make improper use of information acquired by you by virtue of your position so as to gain personal advantage (or advantage to anyone else) or cause detriment to Arcadia or the owner of the information; and
  /   not to allow unauthorised or improper publication of information which may be protected under the Corporations Act 2001 (Cth) or Privacy Act 1988 (Cth).

All employees that collect or handle any personal or sensitive information must do so in a way that complies with:
  /   all laws regulating privacy and confidentiality which apply to Arcadia; and
  /   all of Arcadia’s policies and all reasonable directions by Arcadia.

3. Employer Obligations
The Fair Work Act requires all employers to keep certain personal information about employees. This information includes:
  /   the employee’s personal and emergency contact details
  /   information about terms and conditions of employment
  /   wage or salary details
  /   leave balances
  /   records of work hours
  /   records of engagement, resignation or termination of employment
  /   information about training, performance and conduct
  /   taxation, banking or superannuation details
  /   union, professional or trade association membership information.
The Australian Privacy Principles apply to personal information about unsuccessful job candidates. This can include applicants’ resumes, contact details, references and academic transcripts.

4. Additional Employee Information
Arcadia collects additional personal information from candidates and employees in relation to medical history (including dietary requirements) and diversity. This is information is used in relation to Arcadia’s obligation to provide a safe working environment, as well as providing an inclusive working environment. ‘Personal information’ is defined as any ‘information or an opinion about an identified individual, or an individual who is reasonably identifiable:
  /   whether the information or opinion is true or not; and
  /   whether the information or opinion is recorded in a material form or not’.

Arcadia only collects information that is reasonably necessary for one or more of its business functions or activities by lawful and fair means.

5. Information and Cyber Security
Practices and employee obligations to mitigate information and cyber security risks are contained in Arcadia’s Information Technology & Security Policy.

6. Third Parties
Arcadia uses third parties in relation to undertake and support business operations. These third parties
support and operate in areas within Arcadia such as (but not limited to):
  /   Finance & Payroll
  /   Human Resources & Recruitment
  /   Information Technology
  /   Business Development and Client Relationships

Arcadia may share personal and sensitive information of previous, current or potential employees with these third parties (for example, bank details to process payroll), only as is reasonable and lawful to undertake business operations.

7. Confirmation of Employment & References
Any written confirmation of employment will need to be explicitly requested directly by the respective employee to which the reference relates to, and only prepared by the People & Culture Manager (or Accounts Manager in absence of). Written confirmation of employment will only contain factual and objective information in relation to the employee’s tenure with Arcadia.

Verbal references should only be given by a current/previous manager and should focus on the employment relationship – such as their skills, performance, conduct, their type of employment and length
of employment. It is not appropriate to disclose private information about a current or former employee.

8. Confidentiality
All employees have an explicit obligation outlined in employment agreements in relation to confidentiality, intellectual property and privacy. Employee access to confidential information should only be on an as needs
basis. Confidential Information refers to all non-public information or material, either orally or in writing, concerning any aspect of Arcadia, Arcadia’s affairs or its stakeholders.

All employees owe a duty of confidentiality to current, former and potential clients of Arcadia.

If employees access or become aware of unnecessary or inappropriate access, disclosure or risk to sensitive or confidential information, they have an obligation to notify the People & Culture Manager or a Director immediately.

9. Raising Concerns
If you have any questions or concerns regarding your privacy, or if you would like to make a complaint about a possible breach of this Privacy & Confidentiality Policy or the Australian Privacy Principles, you may direct your correspondence to:

People & Culture Manager
Arcadia Landscape Architecture
Jones Bay Wharf
Suite 70, 26-32 Pirrama Road
Pyrmont NSW 2009

We take all complaints seriously and will respond to your complaint within a reasonable period.
If you believe that we have not adequately handled your complaint, you may complain to the Office of the Australian Information Commissioner whose contact details are as follows:

Office of the Australian Information Commissioner
GPO Box 5218
Sydney NSW 2001
t: 1300 363 992
e: enquiries@oaic.gov.au