Privacy Statement
ExcelPlas respects your privacy and is committed to handling personal information openly, securely and in accordance with Australian privacy law.
This Privacy Statement explains how ExcelPlas (ExcelPlas, we, us or our), collects, holds, uses and discloses personal information. It is our APP Privacy Policy under the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs), and addresses the Notifiable Data Breaches scheme.
It applies to our polymer, plastics and materials testing, analysis, consulting, research, quality assurance and related laboratory services; sample and chain-of-custody processes; website and online systems; dealings with clients, prospective clients, suppliers, contractors, consultants and other business contacts; recruitment and workplace activities (subject to applicable exemptions); and other business and administrative activities. It does not apply to information that is not personal information, including information that has been effectively de-identified.
Kinds of personal information we collect and hold
Depending on how you interact with us, we may collect your name, title, position, organisation, contact details, signature and identity-verification information; authorised representative details; client, supplier, contractor and consultant records; account, contractual and procurement information; and records of instructions, approvals, meetings and business communications.
Billing, correspondence and project information
We may collect billing names and addresses, purchase orders, account and invoice details, payment and reconciliation records, transaction histories and limited bank details where required. We do not intend to retain unnecessary full payment-card details; card payments may be processed by an authorised payment provider under its security and privacy practices.
We may also collect information on enquiries, quotation and service requests, correspondence, telephone records, instructions, feedback, surveys, concerns and complaints, together with our responses and follow-up actions.
For laboratory and consulting work, we may collect the details of people who submit, deliver or collect samples; project and technical contacts; authorised recipients; sample submission, chain-of-custody, delivery, collection and courier records; project instructions, reference numbers and authorisations; and information in test requests, technical records, reports, photographs, labels and supporting materials. This may include information about a product, workplace, site, process, incident or technical issue that identifies an individual, and details needed for sample integrity, traceability, security and reporting accuracy.
Samples usually concern products or materials, but associated documents or project circumstances may contain personal information.
Website, premises and workforce information
When you use our website or online services, we may collect IP addresses, browser, device and operating-system information, pages and links accessed, dates and times, approximate location, referring sites, session and interaction data, cookies and similar identifiers, and records used for security, fraud prevention, diagnostics and administration. Technical data may become personal information when combined with other information.
If we use CCTV, building-access controls or visitor systems, we may collect images, video, visitor and contact details, arrival and departure times, vehicle registrations, sign-in records, access logs and information needed for safety, security and emergency management.
For applicants, workers and contractors, we may collect application and interview materials, employment history, qualifications, references, licences, training and work-eligibility records; permitted screening information; payroll, tax, superannuation and bank details; emergency contacts; and performance, attendance, safety and other workplace records needed to administer the relationship.
The Privacy Act exempts certain employee records directly related to a current or former employment relationship. Where it applies, some handling may fall outside the APPs, but ExcelPlas will handle employment information responsibly and meet other applicable legal obligations.
Sensitive information
We collect sensitive information only where reasonably necessary for our functions or activities and permitted by law, including with consent where required.
Depending on the circumstances, this may include health, medical, disability or accessibility information; professional or trade association membership; criminal-record information for an appropriate authorised check; biometric information if a legally permitted system is implemented; or sensitive information you voluntarily include in correspondence or supporting material.
We do not seek unnecessary sensitive information and may lawfully delete, de-identify or securely dispose of it.
How we use and disclose personal information
We collect, hold, use and disclose personal information where reasonably necessary for our functions and activities, including the purposes below.
Laboratory services and quality
We use personal information to respond to enquiries and prepare quotations; assess and deliver testing, analysis, consulting and research; create client and project records; receive, identify, store, track, return or dispose of samples; maintain traceability and chain-of-custody; communicate about requirements, methods, results and status; prepare and distribute reports, certificates and advice; engage specialist providers; maintain audit trails; and manage variations, repeat work and follow-up services.
We also use information to maintain service quality, accuracy and consistency; conduct technical reviews and audits; meet laboratory standards, accreditation conditions and quality systems; support accreditation and external assessments; calibrate and validate equipment and systems; train personnel; monitor performance; and investigate errors, non-conformances and corrective actions.
Where practical, we remove or minimise personal information before using material for training, quality improvement or research.
Business administration and client service
We use information to manage client, supplier and contractor relationships; administer agreements, purchase orders and services; verify authority; process invoices, payments, refunds and reconciliations; keep financial, tax and business records; obtain professional advice; manage operations, risk, governance and recordkeeping; consider protected business transactions or structural changes; and enforce legal and contractual rights.
How we collect personal information
We collect personal information directly from you when you contact or engage us, request a quotation, submit a sample, visit our premises, use our website, make a payment, attend an event, complete a form or apply for a role. We may also collect it from your employer or associated organisation; authorised representatives, agents, project contacts or advisers; suppliers, contractors, consultants, specialist laboratories and technical providers; website, email, portal, cookie, access-control, visitor or CCTV systems; public sources; referees and recruiters; regulators, government or law-enforcement bodies; and other sources you authorise or the law permits.
If we receive unsolicited personal information that we could not lawfully collect, we will take reasonable steps to destroy or de-identify it unless it is a Commonwealth record or must otherwise be retained by law.
What happens if information is not provided?
You may choose not to provide requested information, but we may then be unable to respond fully, quote or perform work, verify authority, accept or trace samples, deliver reports, administer accounts, process payments, provide access, meet safety, accreditation, contractual or legal requirements, or assess an employment or engagement application.
We request only information reasonably necessary for the activity or otherwise required or permitted by law.
How we store and protect personal information
Personal information may be held in electronic and physical records, including laboratory management systems, business systems, email accounts, databases, secure cloud services, technical files, financial records and controlled paper files.
We take reasonable steps, appropriate to the information and circumstances, to protect personal information from misuse, interference, loss and unauthorised access, modification or disclosure.
Safeguards may include physical security; role-based and least-privilege access; authentication, passwords and multi-factor authentication; encryption where appropriate; network, endpoint and email security; logging, monitoring, backups and recovery; secure configuration, patching and maintenance; confidentiality and training; supplier assessment and contractual protections; secure hosting and storage; access restrictions; and secure disposal, destruction or de-identification.
No transmission or storage system is completely secure. Please contact us promptly if you believe information provided to ExcelPlas has been compromised.
Cookies and online services
Our website may use cookies and similar technologies for functionality, preferences, sessions, performance, analytics, diagnostics, security and measuring communications or content. You can control cookies through your browser, although disabling them may affect website features.
Third-party analytics, hosting, security or content providers may collect technical information and online identifiers under their own privacy practices.
Who we may disclose personal information to
Where reasonably necessary for the purposes in this Statement, or as required or permitted by law, we may disclose personal information to clients and authorised personnel; related companies (meaning companies within the Halliwell Group); specialist laboratories and testing facilities; scientific, engineering and technical consultants; contractors, subcontractors and project providers; couriers, logistics and storage providers; IT, cybersecurity, cloud, telecommunications, software, laboratory-system, equipment, maintenance and calibration providers; payment, banking, accounting and administration providers; professional advisers; recruitment, screening, payroll and workforce providers; auditors and accreditation or certification bodies; regulators, agencies, courts, tribunals and law enforcement; emergency, safety and security providers; prospective business purchasers, investors and advisers subject to confidentiality safeguards; and other recipients you authorise or the law permits.
We take reasonable steps to limit disclosures to information relevant to each recipient’s authorised role or purpose.
Accessing your information
You can make a written request to access the personal information we hold about you. If we aren’t able to meet your request for access, we’ll let you know why.
You have the rights to the following information:
- The purpose(s) for which we are processing your information.
- The categories of personal information we hold about you.
- The recipients or categories of recipient to whom the personal data have been or will be disclosed.
- The period for which we will store your information; or the criteria used to determine that period.
Further rights
To make rectification or restriction of the way in which we are processing your information; or to object to us processing it.
To request erasure of your personal information provided it is no longer necessary for the purposes for which it was collected; or where there is no legal basis for us processing it.
Where we have collected information about you from sources other than yourself, information about those sources.
To ask us whether any decisions are being taken about you by automated means and if this is happening; information about the logic involved and any significant consequences on you.
To ask us about the appropriate safeguards we take if we transfer your information to a third country or international organisation.
You can exercise any of these rights at any time by writing to the Data Protection Officer Liz Tubb at compliance@halliwellglobal.com
Keeping your information accurate
We take reasonable steps to ensure that the personal information we collect and store, use or disclose is accurate, up-to-date and complete. However, we rely on you to advise us of any changes to your information to help us do so. If you believe your personal information is not accurate, up-to-date or complete, then please let us know. If you’d like to request access to or seek correction of your personal information, please contact us.
Complaints about how we handle your personal information
If you have a complaint about our handling of your personal information or an alleged breach of the privacy principles contained in the Privacy Act 1988, please contact us and provide us with the details of your complaint / the alleged breach as well as any supporting evidence. You can contact us via the below options:
- by email to the Data Protection Officer Liz Tubb at compliance@halliwellglobal.com
- by registered mail to:
ExcelPlas Pty Ltd
274–276 Wickham Road
Highett VIC 3190
Australia
We will promptly acknowledge the complaint, carefully investigate it and determine the steps that we will undertake to resolve your complaint. We will contact you if we require any further information and will provide you with our determination once it is made. If you are unhappy with our determination, we will provide you details on how to take the complaint further.
Transfer of information overseas
We may transfer your personal information overseas if your insurer is not resident in Australia. For example, we may transfer information via email our representatives, which includes all companies within the Halliwell Group, who are located overseas. The Halliwell Group Companies are most commonly located in New Zealand, UK, Europe and USA. You should tell us if you object to any such transfer.