In this Privacy Policy, ‘us’, ‘we’ or ‘our’ means WA Return Recycle Renew Ltd (ACN 629 983 615) (WARRRL). We are a not-for-profit organisation established to administer and operate the Containers for Change container deposit scheme (Scheme) in Western Australia. We are appointed as the Coordinator of the Scheme under the Waste Avoidance and Resource Recovery Act 2007 (WA) (WARR Act).
We are committed to protecting your privacy and handling your personal information responsibly. This Privacy Policy explains how we collect, hold, use and disclose your personal information, and how you can access or correct your personal information or raise a privacy concern. We handle personal information in accordance with the Privacy Act 1988 (Cth) (Privacy Act) and the Australian Privacy Principles (APPs).
When you provide personal information to us, we will collect, hold, use and disclose that information as described in this Privacy Policy, any relevant collection notice, and as otherwise permitted or required by law.
Personal information is information or an opinion about an identified individual, or an individual who is reasonably identifiable. This may include, for example, your name, contact details, date of birth, address or postcode, information about your interactions with us or the Scheme, and financial information such as bank account or payment details.
What personal information do we collect?
The personal information we collect about you will depend on how you interact with us and participate in the Scheme. Depending on the circumstances, we may collect:
- your name, address, email address, telephone number and other contact details;
- your date of birth or age, where relevant;
- copies or details of identity documents, such as a passport or driver’s licence, where required;
- bank account, transaction and payment information;
- device identifiers, device type, IP address, approximate location, browser and connection information, website usage information and standard web log information;
- details of your transactions and interactions with us, including through our websites and applications;
- your preferences and settings for our websites and applications;
- details of products or services we have provided to you, or that you have enquired about, and information reasonably necessary to provide those products or services or respond to your enquiries;
- information you provide when interacting with chatbots, AI-enabled services or other automated systems made available by us;
- information you provide through other websites, applications, social media accounts or services where you have permitted that information to be shared with us; and
- other personal information reasonably necessary for us to provide our services, administer the Scheme or perform our functions.
We collect personal information by lawful and fair means and only where reasonably necessary for our functions or activities. Where reasonably practicable, we collect personal information directly from you.
We do not typically collect or hold sensitive information. Sensitive information may include information about health, racial or ethnic origin, sexual orientation, religious or philosophical beliefs, political opinions, trade union membership, criminal records, biometric information or genetic information.
Where sensitive information is reasonably necessary for one or more of our functions or activities, we will collect it with your consent where required, or otherwise in accordance with the Privacy Act.
How and when we collect
We may collect personal information directly from you when you:
- use one of our websites, applications or online services;
- register or maintain an account with us;
- participate in or transact through the Scheme;
- return eligible beverage containers;
- send us an enquiry, request assistance or provide feedback;
- enter a competition, promotion or survey;
- communicate with us by telephone, email, chat, chatbot, AI-enabled service or another communication channel;
- share information with us through another application, service, website or social media platform; or
- otherwise deal with us in connection with the Scheme or our business.
We may also collect personal information from third parties, including Scheme participants, Refund Point Operators (RPOs), payment facilitators, service providers, suppliers, contractors, government agencies, publicly available sources and recruitment agencies.
In our capacity as Scheme Coordinator, we may collect personal information from parties involved in operating the Scheme. For example, an RPO may provide us with information relating to a container return or payment.
If we collect personal information about you from a third party, we will take reasonable steps, where required, to notify you of the collection and the circumstances in which we collected it.
If you choose not to provide personal information that we reasonably require, we may not be able to provide certain services, respond to your request or facilitate your participation in the Scheme.
Why do we collect, use and disclose personal information?
We may collect, hold, use and disclose personal information to administer the Scheme, provide and improve our services and support our business functions. This may include:
- verifying your identity;
- enabling transactions, payments, refunds and orders;
- facilitating your participation in the Scheme, including container returns and refund payments;
- meeting our statutory obligations under the WARR Act and other applicable laws;
- providing access to and monitoring the use of our websites, applications and online services;
- operating, protecting, maintaining and improving our systems, websites, applications, services and user experience;
- performing analytics, research, reporting and service improvement activities;
- sending service, support and administrative communications, reminders, technical notices, updates and security alerts;
- responding to enquiries, feedback, requests and complaints;
- administering rewards, surveys, competitions, promotions and events;
- protecting our systems, users, staff and the Scheme from fraud, misuse, security threats and unlawful activity;
- complying with legal and regulatory obligations, resolving disputes and enforcing agreements;
- assessing employment applications and managing employment relationships;
- conducting marketing in accordance with applicable law; and
- other purposes explained to you at the time of collection, purposes for which you have provided consent, or purposes otherwise required, authorised or permitted by law.
We may use artificial intelligence (AI), automated systems and data analytics to support our operations, improve our services and assist our employees in performing their duties.
Where these technologies process personal information, we will handle that information in accordance with applicable privacy laws and our privacy, security and information governance requirements. We take reasonable steps to ensure personal information is used only for authorised purposes, appropriate safeguards are applied, and access is limited to those who require it.
We do not intentionally use sensitive or personal information to train publicly available AI models. Where AI services are provided by third parties, we take reasonable steps to assess their privacy and security practices before using those services.
Do we use your personal information for direct marketing?
We may use your personal information to send you marketing or promotional communications where permitted by law. These communications may be sent by email, SMS, mail or other channels.
You can opt out of receiving direct marketing communications at any time by using the unsubscribe or opt-out facility provided in the communication, or by contacting us using the details at the end of this Privacy Policy.
If you opt out of direct marketing, we may still contact you for non-marketing purposes, including to respond to your correspondence, administer your participation in the Scheme, provide transaction or service information, communicate with contractors or suppliers, or provide notices required by law.
To whom do we disclose your personal information?
We may disclose personal information where reasonably necessary for the purposes described in this Privacy Policy, including to:
- our employees and authorised personnel;
- Scheme participants, including RPOs and the State of Western Australia;
- third-party suppliers and service providers that support our websites, applications, technology, payments, communications, logistics, professional services or business operations;
- professional advisers, auditors, insurers, consultants and agents;
- payment system operators and financial institutions;
- business partners involved in delivering Scheme-related services, promotions or initiatives;
- specific third parties authorised by you;
- government agencies, regulatory bodies, law enforcement agencies and other persons where required, authorised or permitted by law; and
- other parties where reasonably necessary to administer the Scheme or facilitate our dealings with you.
Where appropriate, we require service providers and other third parties handling personal information on our behalf to protect that information and use it only for authorised purposes.
Disclosure of personal information outside Australia
Some of our service providers may store, process or access personal information outside Australia. The countries involved may change as our service providers and technology arrangements change.
Where we disclose personal information to an overseas recipient, we take reasonable steps as required by the Privacy Act to ensure that the information is handled in a manner consistent with the APPs, unless an exception under the Privacy Act applies.
Where practicable and appropriate, relevant collection notices may provide further information about overseas disclosures associated with a particular service.
Using our website and cookies
When you use our websites or online services, we may collect information about your use of those services, including pages visited, the date and time of your visit, IP address, device and browser information, and interactions with website content.
We may use cookies and similar technologies to operate our websites, remember preferences, understand how our services are used, improve functionality and support analytics or marketing activities. Some information collected through these technologies may constitute personal information.
You can manage or disable cookies through your browser settings. Some parts of our websites or online services may not function as intended if cookies are disabled.
Security
We may hold personal information electronically and, in some circumstances, in hard copy. We take reasonable steps to protect personal information from misuse, interference and loss, and from unauthorised access, modification or disclosure.
Our safeguards may include administrative, technical and physical controls appropriate to the nature and sensitivity of the information, including access controls, identity and authentication controls, encryption, monitoring, vulnerability and patch management, endpoint security, security awareness and other protective measures.
No method of electronic transmission or storage can be guaranteed to be completely secure. You can help protect your information by keeping account credentials confidential, using strong and unique passwords, and notifying us if you become aware of suspected unauthorised access to your account or personal information.
Retention and disposal
We retain personal information only for as long as reasonably necessary for the purposes for which it was collected, to meet our operational requirements, or as required or permitted by law.
When personal information is no longer required, we take reasonable steps to securely destroy it or de-identify it, subject to any legal, regulatory, contractual or recordkeeping requirements.
Links to third-party websites
Our websites may contain links to websites or services operated by third parties. Unless expressly stated otherwise, we are not responsible for the privacy practices or content of those third parties. We encourage you to review the privacy information provided by a third party before providing personal information to it.
Accessing or correcting your personal information
You may request access to personal information we hold about you by contacting us using the details below. We may need to verify your identity before providing access.
In some circumstances, the Privacy Act permits us to refuse or limit access. If this occurs, we will generally provide you with written reasons, where required by law, and information about available complaint mechanisms.
If you believe the personal information we hold about you is inaccurate, out of date, incomplete, irrelevant or misleading, you may ask us to correct it. We will take reasonable steps to correct the information where required.
If we correct personal information that we previously disclosed to another organisation or agency subject to the Privacy Act, you may ask us to notify that entity of the correction. We will take reasonable steps to do so unless it would be impracticable or unlawful.
Personal information about employees
When you apply for employment or another position with us, we may collect information including your name, contact details, employment history, qualifications and information obtained through relevant background, reference and eligibility checks. We may collect this information from you, recruitment agencies, referees, previous employers and other relevant third parties.
We may also collect personal and sensitive information about employees where reasonably necessary for the employment relationship, including information about health, right to work in Australia, emergency contacts, background checks or other employment-related matters.
We handle employee information in accordance with applicable legal requirements and our internal policies. Some acts and practices relating directly to current or former employee records may be exempt from the Privacy Act.
Making a complaint
If you have a concern or complaint about how we have handled your personal information or believe we may have breached the Privacy Act or the APPs, please contact us using the details below. Please provide enough information for us to understand and investigate your concern.
We will acknowledge and investigate privacy complaints and respond within a reasonable period. If you are not satisfied with our response, we will provide information about further steps that may be available to you. You may also be able to make a complaint to the Office of the Australian Information Commissioner (OAIC).
Changes to this Privacy Policy
We may update this Privacy Policy from time to time to reflect changes to our practices, technologies, legal obligations or operations. The current version will be published on our website and will include the date it was last updated.
Contact Us
For questions about this Privacy Policy or our privacy practices, to request access to or correction of your personal information, or to make a privacy complaint, please contact:
Privacy Policy Officer — [email protected]; 13 4CHANGE (13 42 42)
Effective: 19 February 2024