The Spa at Salt Privacy Policy

1 About this privacy policy

This document sets out the policy of HTTC Spa Pty Ltd CAN 646 136 692, relating to the privacy of your personal information (Privacy Policy). The Spa at Salt is committed to protecting the privacy of the personal information it collects and receives. The Spa at Salt is bound by the Australian Privacy Principles (APP) contained in the Privacy Act 1988 (Cth) (Act). This Privacy Policy applies to all your dealings with The Spa at Salt whether at the Spa, The Spa at Salt head office or via The Spa at Salt website (www.thespaatsalt.com.au). 

This Privacy Policy seeks to explain:

• the kinds of personal information The Spa at Salt collects & holds;
• how The Spa at Salt collects and holds your personal information;
• why The Spa at Salt collects, holds, uses and discloses your personal information;
• how you may access and seek the correction of your personal information as held by The Spa at Salt;
• how you may complain about a breach of the APPs or a registered APP code (if any) that The Spa at Salt are bound by, and how The Spa at Salt will deal with such a complaint; and
• if The Spa at Salt is likely to disclose your personal information to overseas recipients and the countries in which such recipients are likely to be located (if it is practicable to specify those countries in this policy).

By using The Spa at Salt website www.thespaatsalt.com.au, completing any membership application forms, personal information forms, you accept this Privacy Policy and expressly consent to The Spa at Salt’s collection, use and disclosure of your personal information in the manner described in this Privacy Policy.

2 Your Personal Information

The Spa at Salt only collects personal information (being information that identifies or could reasonably identify an individual) where The Spa at Salt considers it to be reasonably necessary for The Spa at Salt’s services, functions and activities. The Spa at Salt collects personal information to deliver our products and service to members and customers including in circumstances when:

• processing and managing membership applications;
• facilitating members & casual Spa access;
• conducting marketing activities, research & special offers;
• accurately identifying who is using The Spa at Salt’s services;
• communicating with members, casual visitors, website visitors to The Spa at Salt’s website and online enquiries;
• profiling our members & their interests;
• operating The Spa at Salt’s business; and / or

 The types of information The Spa at Salt collects includes:

• name, age, gender, date of birth & next of kin;
• health information (height, weight, medical conditions);
• license and banking details;
• contact details (including phone, fax and e-mail);
• views and opinions; and
• responses to forms and surveys (if any).

3 Your Sensitive Information

Sensitive information is information about you that reveals your racial or ethnic origin, political opinions, religious or philosophical beliefs or affiliations, membership of a professional or trade association, membership of a trade union, details of health, disability, sexual orientation or criminal record. It is The Spa at Salt’s policy to only collect your sensitive information where it is reasonably necessary for The Spa at Salt functions or activities and either you have consented or The Spa at Salt  are required or authorised under law to do so.

4 How The Spa at Salt collects your personal information

The Spa at Salt will solicit your personal information by lawful and fair means directly from you unless it is unreasonable or impracticable to do so.

The Spa at Salt will collect directly personal information:

• by email;
• over the telephone (including calls and SMS);
• via social media and over the intranet (including surveys);
• by written correspondence (such as letters, faxes);
• on hard copy forms (including registration forms, competition entry forms and surveys);
• in person; or
• through The Spa at Salt website (online purchases, web form submission or participation in a live chat);
• electronic systems such as applications and use of any security surveillance cameras.

The Spa at Salt may collect information from third parties including:

• your therapist;
• market researchers & direct marketing providers;
• parents or guardians of underage members;
• our current members (refer a friend);
• the Australian Tax Office (ATO) and the Australian Securities and Investment Commission (ASIC); and
• public sources (directories, membership lists, professional and trade associations, ASIC, bankruptcy or court registry searches).

5 Using your personal information

The main purposes for which The Spa at Salt collects, holds, uses and discloses personal information are to provide services and benefits to members and casual visitors, and to grow The Spa at Salt’s membership.

The Spa at Salt collects information to service its members and casual visitors. The Spa at Salt can use your information to:

• process applications for memberships;
• understand The Spa at Salt’s members’ needs and requirements;
• manage & run The Spa at Salt website & social media platforms;
• providing you with information about The Spa at Salt services;
• delivering or enhancing The Spa at Salt’s products and services;
• help The Spa at Salt maximise the benefits provided to members and casual visitors;
• any other purpose directly related to The Spa at Salt’s business and for which you have provided consent (where it is reasonably required by law).

The Spa at Salt’s website requires subscriptions or registrations to use certain services, functions or content. You will know what information is being collected via these processes when you complete the relevant forms and provide the required details prior to submitting the application. The Spa at Salt will collect data relating to any transactions you carry out through The Spa at Salt’s website and the fulfilment of your order. The Spa at Salt may also use your data to monitor for any unauthorised use of The Spa at Salt’s website, content or subscriptions to The Spa at Salt’s services.

6 Purpose of collection

If The Spa at Salt collects personal information for a purpose (the primary purpose), The Spa at Salt will not use or disclose the information for any other purpose (the secondary purpose) unless:

• you would have consented to the use or disclosure of your personal information; or
• in relation to the use or disclosure of your personal information:
  • you would reasonably expect The Spa at Salt to use or disclose your information for the secondary purpose and the secondary purpose is directly related to the primary purpose;
  • use or disclosure is required or authorised under Australian law or a court/tribunal;
  • a permitted situation exists in relation to The Spa at Salt’s use or disclosure of the information;
  • a permitted health situation exists in relation to use or disclosure of the information; or
  • The Spa at Salt reasonably believes that the use or disclosure of the information is reasonably necessary for one or more enforcement related activities conducted by, or on behalf of, an enforcement body.

If The Spa at Salt uses or discloses your information because The Spa at Salt reasonably believes that the use or disclosure of your information is reasonably necessary for one or more enforcement related activities conducted by, or on behalf of, an enforcement body, The Spa at Salt will make a written note of the use or disclosure.

7 Do you have to provide personal information?

You can refuse to provide personal information. However, a refusal may mean that the service you requested is not provided or membership will be refused or forfeited.

8 Sharing your personal information

The Spa at Salt may use and disclose personal information for related purposes to third parties. Types of organisations to whom The Spa at Salt may disclose your personal information includes:

• government bodies such as ATO, ASIC, Australian Prudential Regulatory Authority and the police or courts (as required by law);
• various law enforcement agencies and governments for security, customs and immigration purposes;
• banking service providers;
• rewards partner program providers;
• professional or government organisations; and
• The Spa at Salt’s contracted service providers including:
  • information technology service providers;
  • planning research and development providers;
  • marketing and communications agencies;
  • mailing houses, freight and courier services;
  • printers & distributors of marketing material;
  • debt collectors and banks;
  • therapists; and
  • external advisers (recruiters, auditors & lawyers).

The Spa at Salt does not rent, sell or exchange your personal information to third parties without your prior approval.

9 Government Identifiers

The Spa at Salt does not, adopt, use or disclose government related identifiers (such as a Medicare number or license number) as The Spa at Salt’s own identifier for you unless:

• it’s required/authorised by law or court/tribunal order;
• it’s reasonably necessary to verify your identity;
• it’s reasonably necessary to fulfil The Spa at Salt’s obligations; or
• The Spa at Salt reasonably believes it is reasonably necessary for one or more enforcement related activities.

10 Cookies

To improve The Spa at Salt’s services, The Spa at Salt sometimes collects de-identified information from web users. The information collected does not identify an individual but does help The Spa at Salt to analyse and improve its web services. When you visit The Spa at Salt’s website, a record of your visit is logged and the following data is supplied by your browser:

• your IP address and/or domain name;
• your operating system (type of browser & platform);
• the date, time and length of your visit; and
• the resources you accessed or downloaded.

The Spa at Salt uses this information to customise the website for visitors and to collect data for analysis, quality control, administration and improving the website. It is not used for any other purpose. Aggregated data may be shared with third parties.

You can stop your browser from accepting new cookies or disable cookies altogether by changing your browser preferences.

11 Links to other websites

Links to third party websites that The Spa at Salt does not operate or control are provided for your convenience. The Spa at Salt is not responsible for the privacy or security practices of those websites. Third party websites should have their own privacy and security policies which The Spa at Salt encourages you to read before supplying any personal information to them.

12 Direct Marketing

If The Spa at Salt holds your information, The Spa at Salt may use or disclose that information (other than sensitive information) for direct marketing if:

• The Spa at Salt collected the information from you; and
• you would reasonably expect The Spa at Salt to use or disclose the information for that purpose; and
• The Spa at Salt provided you with a simple way to opt out of receiving direct marketing from The Spa at Salt; and
• you have not made such an opt out request to The Spa at Salt. The Spa at Salt may also use or disclose your information (other than sensitive information) for direct marketing if:
• The Spa at Salt collected the information from you and you would not reasonably expect The Spa at Salt to use or disclose the information for that purpose or someone other than you; and
• either:
  • you have consented to the use or disclosure of the information for that purpose; or
  • it is impracticable to obtain that consent; and
• The Spa at Salt provided you with a simple way to opt out of receiving direct marketing from The Spa at Salt; and
• in each direct marketing communication with you:
  • The Spa at Salt includes a prominent statement that you can request to opt out; or
  • The Spa at Salt otherwise draws your attention to the fact that you can request to opt out; and
  • you have not made such a request to The Spa at Salt.

The Spa at Salt can use or disclose your sensitive information for the purpose of direct marketing, if you have consented to the use or disclosure of that information for direct marketing. The Spa at Salt may also use or disclose your personal information for direct marketing if:

• The Spa at Salt are a contracted service provider for a Commonwealth contract; and
• The Spa at Salt collected your information, in order to meet an obligation under that contract; and
• the use or disclosure is necessary to meet (directly or indirectly) such an obligation.

If The Spa at Salt has collected the personal information that The Spa at Salt used to send you direct marketing material from a third party, you can ask The Spa at Salt to notify you of its source of information. It is The Spa at Salt’s policy is to do so unless it is unreasonable or impracticable.

13 How to opt out of direct marketing

If The Spa at Salt uses or discloses your personal information for the purpose of direct marketing, you may request not to receive direct marketing communications from The Spa at Salt.

If the Spa at Salt uses or discloses your personal information for the purpose of facilitating direct marketing by other organisations, you may request that The Spa at Salt does not use or disclose your information for this purpose.

The Spa at Salt will give effect to your request not to receive direct marketing from The Spa at Salt or an entity facilitated by The Spa at Salt within a reasonable time after the request is made.

14 Protecting your personal information

The Spa at Salt stores information in different ways, including paper and electronic form. The Spa at Salt takes reasonable steps to protect it from misuse, interference, loss, unauthorised access, modification or disclosure including:

• secure password protected databases for storage;
• confidentiality requirements of staff;
• security firewalls for access to The Spa at Salt’s systems;
• servers kept at a secure location with limited access;
• document storage security requirements;
• granting access only to verified individuals;
• access controls for The Spa at Salt’s buildings;
• limited the provision of personal information to third parties and subject to guarantees about use; and
• training staff to deal with the information.

The Spa at Salt cannot guarantee that personal information will be protected against unauthorized access or misuse and The Spa at Salt does not accept any liability for the improper actions of unauthorised third parties.

The Spa at Salt will retain your personal information for as long as necessary to fulfil The Spa at Salt’s obligations to you, to protect its legal interests, to comply with laws or as otherwise stated to you when The Spa at Salt collects your personal information.

Once the Spa at Salt is no longer required to retain your personal information, The Spa at Salt will take reasonable steps to destroy your personal information or to ensure that your personal information is de-identified.

15 Disclosing your personal information overseas

The Spa at Salt may disclose your personal information to other third party service providers operating outside Australia who work with The Spa at Salt or one of The Spa at Salt’s suppliers, agents, or partners. The Spa at Salt may also store your personal information on servers based overseas or in the “cloud” or other types of networked or electronic storage.

Before disclosing your personal information to an overseas third party, The Spa at Salt will first take reasonable steps to ensure that the overseas recipient:

• does not breach the Australian Privacy Principles in relation to your personal information; or
• the recipient of the information is subject to a law, or binding scheme, that has the effect of protecting your personal information in a way that is substantially similar to the way in which the Australian Privacy Principles protect the information.

Personal information may be disclosed by The Spa at Salt to other The Spa at Salt entities and third parties in jurisdictions including: Australia, New Zealand, United States of America and the Netherlands. The European Commission has recognized each of these countries as providing adequate protection of personal information.

If your personal information is collected using a document that references this Privacy Policy, you are taken to consent to the disclosure, transfer, storing or processing of your personal information outside of Australia.

You acknowledge and understand that by providing such consent:

• The Spa at Salt will not be required to take steps as are reasonable in the circumstances to ensure that such third parties comply with the APPs;
• if the overseas recipient handles your personal information in breach of the APPs:
  • The Spa at Salt will not be liable under the Act; and
  • you will not be able to seek redress under Act.
• the overseas recipient may not be subject to any privacy law or principles similar to the APPs;
  • you may be unable to seek redress overseas;
  • the overseas recipient is subject to a foreign law that could compel the disclosure of personal information to a third party, such as an overseas authority.

If you withdraw consent, The Spa at Salt will not rely on this consent when dealing with your personal information going forward.

16 Anonymity

You have the option of not identifying yourself or using a pseudonym when dealing with The Spa at Salt provided that is it lawful and practicable.

The Spa at Salt will try to accommodate a request for anonymity if possible. However, your right to anonymity does not apply in relation to a matter if:

• The Spa at Salt is required/authorised by law or court/tribunal order to deal with identified individuals; or
• it is impracticable for The Spa at Salt to deal with individuals who have not identified themselves.

It is The Spa at Salt’s policy to enable you to access The Spa at Salt’s website and make general phone queries without having to identify yourself and to enable you to respond to The Spa at Salt’s surveys anonymously.

In some cases, however, if you don’t provide The Spa at Salt with your personal information when requested, The Spa at Salt may not be able to respond to your request or provide you with our service. For example, you must identify yourself to become a The Spa at Salt member.

17 Accessing to your personal information

You have the right, upon request, to access any of The Spa at Salt’s records containing your personal information. To request access to your personal information please contact the Privacy Officer, set out at the end of this Policy.

The Spa at Salt will respond to your request to access your personal information within a reasonable period of time.

On the basis that it is reasonable and practicable to do so, The Spa at Salt will give you access to the information requested.

If the Spa at Salt refuses your request to access personal information, The Spa at Salt will provide a written notice setting out the reasons for the refusal & how you can complain about the refusal.

Reasons for a refusal may include if it:

• poses a serious threat to the life, health or safety;
• would have unreasonable impact on privacy of others;
• is frivolous or vexatious;
• relates to legal proceedings;
• reveals The Spa at Salt’s intentions or prejudice any negotiations;
• would be unlawful;
• is required or authorised by law or court/tribunal order;
• is likely to prejudice enforcement related activities; or
• relates to a commercially sensitive decision process.

When you make a request to access personal information, The Spa at Salt will require you to provide some form of identification (such as a driver’s licence or passport) so The Spa at Salt  can verify that you are the person to whom the information relates.

18 Help The Spa at Salt keep your personal information accurate

The Spa at Salt will take reasonable steps to ensure The Spa at Salt’s records of personal information are accurate, up to date and complete.

However, the accuracy of information depends to a large extent on the information you provide. If you do not give The Spa at Salt all the personal information The Spa at Salt may require, or the personal information provided is inaccurate or incomplete, then the products, services and information The Spa at Salt provide may be affected.

If you think there is something wrong with the information The Spa at Salt holds about you please contact the Privacy Officer to:

• let The Spa at Salt know if there are any errors; and
• keep The Spa at Salt up-to-date with any changes, and The Spa at Salt will try to correct your personal information.

The Spa at Salt will respond to your request to correct your personal information and in a reasonable period of time. If The Spa at Salt refuses your request, The Spa at Salt will provide you with a written notice setting out the reasons for the refusal and mechanisms available to complain about the refusal.

If The Spa at Salt refuses to correct your personal information, you may request that The Spa at Salt associate your information with a statement that the information is inaccurate, out of date, incomplete, irrelevant or misleading. The Spa at Salt will take reasonable steps to make the statement visible to users of your personal information.

If The Spa at Salt does correct your personal information and The Spa at Salt has previously disclosed your personal information to a third party, upon your request, The Spa at Salt  will notify that third party of the correction unless it is impracticable or unlawful to do so.

19 Resolving your privacy issues

If you have any issues you wish to discuss with The Spa at Salt or if you’re concerned about how The Spa at Salt has collected or managed your personal information please contact the Privacy Officer.

For information about privacy or if your concerns are not resolved, contact the Office of the Australian Information Commissioner at www.oaic.gov.au and on 1300 363 992.

20 Changes and access to this privacy policy

The Spa at Salt may, from time to time, review and update this privacy policy to take account of new laws and changes to The Spa at Salt’s operations. Changes to this Privacy Policy will not affect The Spa at Salt’s use of previously provided information.

This Privacy Policy is available on The Spa at Salt’s website at www.thespaatsalt.com.au. A printed Privacy Policy can be obtained free of charge by contacting the Privacy Officer.

21 The Spa at Salt Privacy Officer

The Spa at Salt’s privacy officer can be contacted at:

• Email: info@thespaatsalt.com.au
• Telephone: 02 6674 3233
• Post: The Spa at Salt, 2 Bells Boulevard, Kingscliff, NSW 2487