Privacy Policy

1. About this policy

This privacy policy applies to Lighthouse Infrastructure Management Holdings Pty Ltd ACN 636 842 665 and its related bodies corporate or associated entities as defined under the Corporations Act 2001 (Cth) (Lighthouse, we, our, us). We recognise the importance of ensuring the confidentiality and security of personal information.

When you trust us with your personal information, you expect us to protect it and keep it safe. We are bound by the Privacy Act 1988 (Cth) (Privacy Act) and other privacy laws and have strict obligations to protect your personal information in accordance with the Australian Privacy Principles (APPs). These principles govern how we can collect, use, hold and disclose your personal information, as well as ensuring the quality and security of your personal information. In some cases, we may be exempt from some or some aspects of these laws, in which case we may rely on those exemptions despite this policy. For example, the Privacy Act includes an exemption for the handling of employee records in some circumstances.

This Policy can be downloaded from our website www.lighthouseinfrastructure.com. It explains how we manage your personal information. Upon collection, we may provide further details on how we will manage your personal information.

If you would like more information about how we protect your privacy, please contact us at [email protected].

2. Meaning of words

In this Privacy Policy:

‘Disclosure’ of information means providing information to persons outside Lighthouse;
‘Individual’ means any natural persons whose personal information we collect, use or disclose;
‘Privacy Officer’ means the contact person within Lighthouse for questions or complaints regarding Lighthouse’s handling of personal information;
‘Sensitive information’ is personal information relating to a person’s racial or ethnic origin, political opinions, religion, trade union or other professional or trade association membership, sexual preferences or practices, genetics, biometric information, philosophical beliefs and criminal record, and also includes health information; and
‘Use’ of information means use of information within Lighthouse.

3. What is personal information?

Personal information includes any information or opinion, about an identified individual or an individual who can be reasonably identified from their information. The information or opinion will still be personal information whether it’s true or not and regardless of whether we have kept a record of it.

The information that we seek to collect about you will depend on the products or services that we provide. If you do not allow us to collect all of the information we request, we may not be able to deliver all of those services effectively.

4. ‌What kind of personal information do we collect and hold?

The kinds of personal information we collect and hold about individuals include name, address, date of birth, contact details (e.g. phone numbers, email addresses), occupation, payment details (e.g. bank account), taxation information, identification details (e.g. drivers’ licence), and details of your transactions, interactions and communications with us.

For job applicants, we may also collect information about qualifications, skills, experience, character and screening checks (including health, reference, background, directorship, financial probity, identity, eligibility to work, vocational suitability and criminal record checks). For staff, in addition to these, we may collect information about training, emergency contact details, performance, conduct, use of our IT and communications resources, payroll matters, drug/alcohol tests, leave and tax/financial affairs.

In the event that Lighthouse is subject to a Victorian government direction or order regarding collection of information regarding attendance and/or visitors to the office, then only the information required under the Direction will be collected on entry. This will include name and contact details (e.g. phone numbers, email addresses) and time and date of attendance. The information will be stored securely and disposed of in accordance with Government directions or orders in place at the time (e.g. 28 days). This information will only be made available to relevant health authorities when required to do so for the purposes of contact tracing.

The collection of sensitive information is restricted by the Privacy Act. This includes information about your religion, racial or ethnic origin, political opinions, criminal record and sexual orientation. It also includes health information and biometric information. Generally, we only collect this sort of information if it is necessary to provide you with a specific product or service and you have consented to that collection. Under the APPs, Lighthouse may also collect sensitive information where an exception applies, e.g. if the collection is required or authorised by law or necessary to take appropriate action in relation to suspected unlawful activity or serious misconduct.

5. ‌For what purposes do we collect, hold, use and disclose personal information?

The main reason we collect, use, hold and disclose personal information is related to providing our products and services. This includes:

Checking whether you are eligible for the product or service;
Verifying your identity and personal information;
Providing and tailoring the product and service;
Improving our products and services;
Helping manage the product or service and maintain our records; and
Recruiting, training and managing our staff.
To comply with State government directions or orders.

We may also collect, use and disclose your personal information:

to comply with legislative or regulatory requirements in any jurisdiction;
to prevent or deal with fraud, crime or other activity that may cause harm in relation to our products or services;
to help us run our business;
to tell you about products or services you may be interested in; and
in connection with any acquisition or potential acquisition of our business.

6. How we collect personal information

We collect most personal information directly from you. We may also collect personal information about you from other people or organisations. This may include but is not limited to the following methods:

directly from applications and forms relating to using our services or employment opportunities;
from information disclosed to us by individuals by phone, or by sending us correspondence (including letters, faxes and emails) or visiting us in person;
from third party sources, such as identity verification service providers, financial institutions, fund recipients, or referrers;
from your employer;
from your representatives (including your legal adviser, asset consultant, financial adviser, trustee or attorney);
from other organisations, who jointly with us, provide products or services to you; and
from the parties listed in section 11.

7. What laws require or authorise us to collect personal information?

We are required or authorised to collect:

Certain identification information about you by the Anti-Money Laundering and Counter-Terrorism Financing Act 2006 (Cth) and Anti-Money Laundering and Counter-Terrorism Financing Rules Instrument 2007 (no. 1);
Your Tax File Number, if you choose to provide it, by the Income Tax Assessment Act 1936 (Cth); and
For staff, certain personal information pursuant to laws including but not limited to the Fair Work Act, Superannuation Guarantee (Administration) Act, the Income Tax Assessment Act and other tax laws, Corporations Act, occupational health and safety acts and workers compensation acts.
State or territory government’s Directions or Orders for the purposes of contact tracing for COVID-19.

8. ‌Who do we collect personal information about?

The personal information we may collect and hold includes (but is not limited to) personal information about clients, potential clients, service providers or suppliers, prospective employees, employees and contractors and other third parties who we may have contact with.

9. ‌Website collection

We collect personal information from our web site www.lighthouseinfrastructure.com when we receive emails. We may also use third parties to analyse traffic at that web site, which may involve the use of cookies. Information collected through such analysis is anonymous.

Our web site may use Google services such as Google Analytics from time to time. For more about how Google collects and processes data, please see Google’s privacy policy and their information at www.google.com/policies/privacy/partners/.

10. How are we allowed to use and disclose personal information?

We may use and disclose personal information for the primary purposes for which it is collected, for reasonably expected secondary purposes which are related to the primary purpose and in other circumstances authorised by the Privacy Act.

We may use and disclose sensitive information only for the purpose for which it was provided or a directly related secondary purpose, unless the individual agrees otherwise, or where certain other limited circumstances apply (e.g. if required by law).

We engage other people to perform services for us, which may involve that person handling personal information we hold. In these situations, we are required to implement appropriate steps to protect the information where the Privacy Act applies, for example we may need to prohibit that person from using the personal information except for the specific purpose for which we supply it.

11. ‌Who do we disclose your personal information to, and why?

We may disclose personal information to:

a related entity of Lighthouse;
your organisation or representatives;
an agent, contractor or service provider we engage to carry out our functions and activities, such as our lawyers, accountants or other advisors and providers of recruitment, payroll, superannuation, training, information broker, data storage, auditing, delivery, data processing, research, investigation, insurance, surveillance, website and technology services;
organisations involved in managing payments, including payment merchants and other financial institutions such as banks;
training and education providers (e.g. to confirm qualifications);
referees and other employers seeking references;
regulatory bodies, government agencies, law enforcement bodies and courts;
financial product issuers and credit providers; and
anyone else to whom the individual authorises us to disclose it or as required by law.

We may also collect personal information from these organisations and individuals, and will deal with that information in accordance with this Policy.

12. Sending information overseas

Some of the third parties to which we disclose personal information are located outside Australia. These recipients may be located in the United States, United Kingdom, South Korea, Japan, Malaysia, Taiwan, United Arab Emirates and Singapore.

Under the Privacy Act, where applicable, we must not send personal information to recipients outside of Australia unless:

we have taken reasonable steps to ensure that the recipient does not breach the APPs;
the recipient is subject to an information privacy scheme similar to the Privacy Act;
the individual has consented to the disclosure; or
another exception applies.

13. ‌Management of personal information

Lighthouse recognises how important the security of personal information is to clients and individuals. We will at all times seek to take appropriate steps designed to protect the personal information we collect and hold from interference, misuse or loss, and unauthorised access, modification or disclosure. Lighthouse employees must respect the confidentiality of the personal information we collect.

Personal information is held in paper files and electronically, both at our premises and with the use of service providers. The steps we take to protect the security of personal information depend on the circumstances, but may include secure areas for paper files, system access controls (e.g. passwords), encryption of transmitted data and printing restrictions.

Where we no longer require personal information for a permitted purpose, the APPs, where applicable, require us to take reasonable steps to destroy or de-identify it.

14. Notifiable Data Breaches

Lighthouse is subject to the Notifiable Data Breaches scheme under the Privacy Act. A Notifiable Data Breach occurs when there is unauthorised access to, unauthorised disclosure of, or loss of the personal information held by Lighthouse, and where the breach is likely to result in serious harm to an individual.

In accordance with the Notifiable Data Breaches scheme, Lighthouse has implemented the Data Breach Response Procedure, which requires Lighthouse to:

determine whether a data breach has occurred;
contain the data breach, and take remedial action where appropriate;
notify individuals, the Australian Information Commissioner and (if necessary) members of the public, of the data breach; and
identify any learning outcomes for Lighthouse which flow from the data breach, and incorporate those outcomes into our privacy procedures and privacy training for employees.

15. Do we use or disclose information for marketing?

We may use your personal information to offer you a product and services we believe may interest you, but we will not do so if you tell us not to. These products and services may be offered by a member of the Lighthouse Group or one of its preferred suppliers.

We may offer you products and services by various means, including by mail, telephone, email, SMS or other electronic means such as through social media or targeted advertising through Lighthouse or non-Lighthouse Group websites.

We may also disclose your personal information to companies outside of Lighthouse who assist us to market our products and services to you. If you don’t want to receive marketing offers from us please contact us at [email protected]

16. Access to and correction of personal information

ou can request access to your personal information we hold about you. You can also ask for corrections to be made. To do so, please contact us. There is no fee for requesting that your personal information is corrected or for us to make corrections. In processing your request for access to your personal information, a reasonable cost may be charged. This charge covers such things as locating the information and supplying it to you.

There are some circumstances in which we are not required to give you access to your personal information. If we refuse to give you access to or to correct your personal information we will give you a notice explaining our reasons except where it would be unreasonable to do so.

If we refuse your request to correct your personal information, you also have the right to request that a statement be associated with your personal information noting that you disagree with its accuracy. If we refuse your request to access or correct your personal information, we will provide you with information about how you can complain about the refusal.

17. ‌Changes to our privacy policy

We may change the way we handle personal information from time to time for any reason. If we do so, we will update this Privacy policy. An up to date version is available at www.lighthouseinfrastructure.com

18. ‌Contacts

If you would like more information about how we handle your personal information or our approach to privacy, or to make a complaint please contact the Privacy Officer at:

by telephoning: +61 3 8678 0200
by writing to:
Lighthouse Privacy Officer
Lighthouse Infrastructure Management Holdings Pty Ltd
Level 5, 1 Collins Street
Melbourne VIC 3000, Australia
by emailing: [email protected]

What if I am not satisfied with the response?

If you are not satisfied with the result of your complaint to Lighthouse you can also refer your complaint to the Office of the Australian Information Commissioner whose contact details can be found at https://www.oaic.gov.au/contact-us .

Dated: 31 May 2024 | Download PDF