- Introduction
Talk Money is a financial capability program managed by EY on behalf of Ecstra Foundation Limited (“Ecstra”) delivered to young people in schools across Australia (the “Program”). In this Privacy Notice, “we” describes EY and Ecstra together.
This Privacy Notice describes the practices that Ecstra and EY follow in relation to the Program and its website www.talkmoney.org.au (the “Website”) with respect to the privacy of all individuals whose personal information is collected, used, and stored because of their use of the Website or participation in the Program.
Ecstra and EY respect your privacy and are committed to complying with the Australian Privacy Principles contained in the Privacy Act 1988 (“Privacy Act”).
We may modify this Privacy Notice from time to time by publishing it on the Website. We encourage you to check the Website periodically to ensure that you are aware of our current policy as described in this Privacy Notice.
- Who manages the Website and the Program?
The Privacy Act contains certain exemptions in relation to certain acts undertaken in relation to employee records and related bodies corporate. Where appropriate we make use of relevant exemptions in the Act.
“EY” refers to one or more of the member firms of Ernst & Young Global Limited (“EYG”), each of which is a separate legal entity and can act as a data controller in its own right. The information you provide is being collected by Ecstra and EY in EY’s capacity as a service provider to Ecstra. The EY entity that is acting as data controller by collecting, processing, and storing your personal data in connection with the Program (including via the Website) is Ernst & Young.
In relation to any information accessible to EY, the personal data you provide may be shared by Ernst & Young with one or more member firms of EYG (see “Who can access your information” section below).
The Website is hosted on Ecstra’s servers in Australia. However, your personal information may be transferred overseas or stored overseas for a variety of reasons including those identified in this Privacy Notice. It is not possible to identify each and every country to which your personal information may be sent. If your personal information is sent to a recipient in a country with data protection laws which are at least substantially similar to the Australian Privacy Principles, and where there are mechanisms available to you to enforce protection of your personal information under that overseas law, we will not be liable for a breach of the Australian Privacy Principles if your personal information is mishandled in that jurisdiction. If your personal information is transferred to a jurisdiction which does not have data protection laws as comprehensive as Australia’s, we will take reasonable steps to secure a contractual commitment from the recipient to handle your information in accordance with the Australian Privacy Principles.
- Why do we need your information?
We may collect personal information from you when you submit an enquiry or expression of interest through the Website, participate in the Program, or when we have other business dealings with you in connection with the Program.
The ways in which we may collect this information may be via the Website, program booking forms, program evaluation surveys, email correspondence or in-person as part of the program delivery program at your school or workplace.
Your personal data processed in connection with the Program may be used as follows:
- To respond to your enquiry or expression of interest in the Program;
- To contact you in order to book the Program;
- To provide you with Program resources;
- To contact you to invite you to events or for other direct marketing purposes.
- To provide to you and improve our products and services;
- To communicate with you, and build and maintain our relationships with you;
- To conduct, monitor and analyse our business and internal operations;
- To identify and develop new products and services you may be interested in;
- To send you updates, publications, marketing, event details and new product or service offerings (however, if you do not want to receive marketing emails from us, you can opt out at any time using the contact details set out below);
- To perform analytics on the Program, the Website (however, our analytics are always conducted on a de-identified basis);
- To comply with applicable laws and our other regulatory, accounting, reporting or other obligations;
- To protect, exercise or defend our legal rights; and
- To process and respond to your other requests, enquiries or complaints.
Ecstra and EY rely on the fact that you have given your consent to the collection of your personal data for one or more specific purposes.
The provision of your personal data to Ecstra and EY is optional. However, if you do not provide all or part of your personal data, we may be unable to carry out the purposes for collecting as listed above.
- What type of personal data is collected?
Personal information includes information or an opinion (whether true or not) about an identified or a reasonably identifiable individual.
Ecstra and EY may collect personal information from you when:
- you inquire about the Program;
- you subscribe to one of our online services, newsletters, mailings lists or the Website;
- you register for or attend a Program event or seminar; or
- either Ecstra or EY has other business dealings with you.
The types of personal information we may collect from you include:
- general personal or business details such as your name, job title, contact number, address, email address and other demographic information;
- only where relevant and with your consent, sensitive information (eg where you register for a Program event or seminar we may ask you for information about your health, any disabilities and special dietary needs, and in relation to demographic information collected in Program-related surveys).
Ecstra and EY will generally endeavour to collect your information directly from you. However, in some circumstances we may collect your information from third parties, such as your school or from a publicly available record.
This information is sourced from you directly unless it is unreasonable or impracticable to do so.
- Sensitive Personal Information
Sensitive personal information may describe your racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic data, biometric data, data concerning health or data concerning sex life or sexual orientation. Other than as described in paragraph 4, Ecstra and EY do not intentionally collect any sensitive personal data from you via the Website or otherwise in connection with the Program. Other than as described in paragraph 4, Ecstra’s and EY’s intentions are not to process such information.
- Who can access your information?
From time to time, Ecstra and EY may disclose your information to:
- our service providers, agents and contractors that provide services to us and/or help us to provide and market the Program and our other services to you;
- specific third parties authorised by you to receive information held by us; and
- other persons, including government agencies, regulatory bodies and law enforcement agencies; or as otherwise required or authorised by law.
The access rights detailed above involves transferring personal data in various jurisdictions (including jurisdictions outside the European Union) in which EY operates (EY office locations are listed at www.ey.com/ourlocations). In circumstances where EY does so, EY will process your personal data provided in connection with the Program (including via the Website) in accordance with applicable law and professional regulations in your jurisdiction. Transfers of personal data within the EY network are governed by EY’s Binding Corporate Rules (www.ey.com/bcr).
- Data retention
In relation to information collected by EY connected with the Program, including via the Website, that information will be retained in accordance with EY Global Records Retention policies and procedures. Your personal data will be retained by EY in compliance with privacy laws and regulations. After the end of the data retention period as specified in the EY Global Records Retention policies and procedures, your personal data will be deleted by EY.
Information and personal data collected by Ecstra in connection with the Program, including via the Website, will be retained by Ecstra in compliance with relevant privacy laws and regulations.
- Security
Ecstra and EY may hold your personal information in either electronic or hard copy form. We use a variety of physical and electronic security measures to keep your personal information secure from misuse, interference, loss or unauthorised use or disclosure. For example, we restrict physical access to our offices, employ firewalls and secure databases, password protect our IT systems, frequently update our anti-virus software and conduct regular audit and data integrity checks. All of our employees are also bound to keep your personal information secure and treat it as confidential.
However, we cannot guarantee the security of your personal information. The internet is not a secure environment. If you do use the Internet to send us any information, including your email address, please be aware that it will be sent at your own risk.
The Website and electronic newsletters may also contain links to other websites operated by third parties. Unless expressly stated otherwise, neither Ecstra nor EY are responsible for the privacy practices or the content of those linked websites. The privacy policies that apply to those other websites may differ from our policy as described in this Privacy Notice, so we encourage individuals to read them before using those websites.
- Controlling your personal data
Neither Ecstra nor EY will transfer your personal data to third parties (other than any external parties referred to in section 6 above) unless we have your permission or are required by law to do so.
You are legally entitled to request details of Ecstra’s and EY’s personal data about you. To confirm whether your personal data is processed by or to access your personal data collected in connection with the Program, contact your usual Program representative or email your request to [email protected] or [email protected].
- Rectification, erasure, restriction of processing or data portability
You can confirm your personal data is accurate and current. You can request rectification, erasure, restriction of processing or a readily portable copy of your personal data by contacting your usual Program representative or by sending an e-mail to [email protected] or [email protected].
- Our Privacy Statement
Our Privacy Statement provides more information about how we manage and protect the personal information we hold about individuals.
- Complaints
If you are concerned about an alleged breach of privacy law or any other regulation in connection with the Website and/or the Program, contact your usual Program representative, or EY’s Global Privacy Officer, Office of the General Counsel, 6 More London Place, London, SE1 2DA, United Kingdom or via email at [email protected] or [email protected]. Alternatively you may contact Ecstra at [email protected]
An EY Privacy Officer or Ecstra Privacy Officer (as appropriate) will investigate your complaint and provide information about how it will be handled and resolved.
If you are not satisfied with how either or both of Ecstra and/or EY resolved your complaint, you may lodge a complaint with the Office of the Australian Information Commissioner (OAIC) at [email protected] or on 1300 363 992. More information is available on the OAIC’s website at https://www.oaic.gov.au/.
- Contact us
If you have additional questions or concerns, contact your usual Program representative or email [email protected].
Date last revised: January 2022
