Privacy statement

This privacy policy has been prepared to facilitate compliance with the Privacy and Data Protection (PDP) Act 2014 to inform stakeholders of how we manage personal information.

The Office of the Victorian Information Commissioner (OVIC) recommends a ‘layered’ approach when publishing privacy policies. This means users initially see a ‘summary’ only but have the option to click on a link to a more detailed version of the policy. This is reflected in this document by the use of headings ‘policy summary’ and ‘policy- detailed content’, respectively.

Policy summary

This summary sets out an overview of how the Building and Plumbing Commission manages personal information.

We collect, hold, use, and disclose personal information to carry out our functions under the Building Act 1993(Vic) and the Domestic Building Contracts Act 1995 (Vic).

We do not use or disclose your personal information for purposes other than what it was collected for, unless permitted or required by law. We only collect information from you that is necessary to carry out our functions, from you directly, if practicable.

You can contact via the privacy email or call 1300 067 088 to:

• Make a privacy enquiry
• Contact the Privacy Officer
• Make a privacy complaint
• Discuss access and correction of your information

In addition to this summary, we also publish more detailed information concerning privacy, including:

• Our main functions and the types of personal information we generally collect to fulfil those functions
• How we use and share the personal information we collect, including the types of third parties with whom we may share the information
• Whether collection of personal information is compulsory or optional
• How we secure and manage access to the personal information, and for how long it may be stored
• How privacy is protected if the information is transferred or stored outside Victoria
• The date and version of the policy
• How an individual can contact the organisation, request access to the information held about them, or make a privacy complaint

Policy – Detailed Content

This Privacy Policy is a general statement of how personal information is managed. We have other guidance materials, including other policies, procedures and guidelines that support the organisation to comply with privacy requirements.

We are established by the Building Act 1993 (Vic) and administer the scheme of domestic building dispute resolution under the Domestic Building Contracts Act 1995 (Vic).

This policy sets out how we handle personal and health information that is collected in the course of carrying out functions under the Building Act, the Domestic Building Contracts Act, and other applicable legislation.

We are committed to protecting the privacy and facilitating access to personal and health information according to the principles in the Privacy and Data Protection Act 2014 (Vic), Health Records Act 2001 (Vic) and the Freedom of information Act 1982 (Vic) and other related laws.

What is 'personal information'?

Personal information means information or an opinion about an identifiable individual. The sort of personal information we collect includes name, address, telephone and email contact details, complaint details and information we need to process various types of transactions, such as applications and
renewals of registration and collection of building levies.

'Health information' is information able to be linked to a living or deceased person about a person's physical, mental, or psychological health; such information is generally only provided to our staff members or by persons subject to disciplinary inquiries.

How we collect personal information

We collect personal information when you:

• submit a paper or online form
• write or email us
• contact us by telephone
• complete applications, complaints, surveys

We may get personal information about you from other people or organisations when performing our functions. For example, when we:

• investigate a complaint
• receive documents from building practitioners, Councils, or other government agencies
• receive levy payments from a Building Surveyor
• obtain your contact details from another person or from a publicly available document such as a newspaper.
• provide building insurance and manage claims
• are required to resolve a domestic building dispute through conciliation

Whenever we collect personal information, we will take steps to ensure that you know why we are collecting the information, what we intend to do with it and to whom we need to disclose it, unless a lawful exemption applies.

Where we do not collect information directly from you, we will take reasonable steps to let you know that we have the information, unless a lawful exemption to doing so applies.

Why we collect your personal information and what we do with it

We collect personal information for reasons connected with the regulation, enforcement and provision of insurance under the Building Act 1993 (Vic) and to facilitate the resolution of building disputes under the Domestic Building Contracts Act 1995 (Vic). This can include collection for activities such
as:

• management of statutory building and plumbing industry related public registers
• management of the registration of building and plumbing professionals
• management of complaints relating to building and plumbing professionals and quality of their work, appeals, hearings, disputes, investigations and prosecutions
• management of the building permit levy system
• providing and managing domestic building insurance policies and claims
• management of developer bonds
• resolving disputes between building owners and builders
• handling enquiries, visitors, and the receipt of unsolicited information
• conducting site inspections
• managing personnel and human resources
• research, surveys and compilation or analysis of statistics

Some of our work involves the 'indirect' collection of personal information – that is, where personal information is collected or received about you, but from someone else or from some other source. For example:

• If a complaint is made about you, we record this information on a database
• If a consumer enquiry is received, we may record the enquiry and related details
• We may receive information from other government agencies such as WorkSafe or Victoria Police when we are investigating breaches of the Building Act 1993 (Vic).

We may be permitted or required to collect your personal information by or under a law. The collection notices provided at the point in time your information is collected will explain in more detail when the collection of personal information is permitted or required by law.

Some of our work requires us to collect sensitive personal information. The most common example is when we ask Victoria Police for a criminal record check to assess an application for registration or for prosecution. When taking prosecution action, we do not need your permission to do this.

We receive many enquiries from the public seeking information about building and plumbing professionals. A register is maintained of plumbing practitioners and of building practitioners. Both registers are maintained under the Building Act 1993 (Vic) and give effect to the proper oversight and supervision of the plumbing and building industries.

Part of regulating building and plumbing practitioners is the confirmation of the registration of building professionals and the registration or licensing of plumbing professionals and detailing any restrictions or limitations on a licensed or registered person to specific areas of practice or competencies.

Recruitment and employment

We collect, hold, use, and disclose personal information for recruitment and employment related matters, where permitted or required under law, including internal or external auditing.

Recruitment and employment related matters includes receiving and assessing employment applications, conducting probity and reference checks and interviews, suitability assessment, onboarding, collecting information related to gender for gender reporting under the Gender Equality Act, and ongoing employment
matters such as those concerning remuneration, WHS, learning and development, probation and conduct matters. This personal information is only collected and retained to the extent necessary to conduct these activities and is destroyed in line with record keeping requirements.

How we share your personal information

We may need to share personal information within the BPC, with other government agencies, Courts and Tribunals, members of the community and other building practitioners and will only do so where it is lawful. Other entities we may communicate and share personal information with include Consumer Affairs
Victoria, the Department of Environment, Land, Water and Planning, Victorian Managed Insurance Authority and local Councils.

We may also need to disclose your personal information to third parties acting on your behalf, for example your solicitor or interpreter. In this circumstance, we would only disclose your personal information to these third parties with your written consent.

Examples of circumstances where we disclose your personal information outside the BPC include:

• If we hold your details in connection with registration or as a result of disciplinary matters, personal information about you may appear on the relevant public register, accessible in person and on the internet
• Confirmation that a building practitioner is or was legally permitted to undertake regulated work at a specific period in time and details of the insurance required by law.

Data quality and data security

Under the PDP Act, we have a responsibility to protect your personal information. We take reasonable steps to make sure that your personal information is protected from misuse, loss, and unauthorised access, modification, or disclosure. Access to systems, applications, and the information that we collect
is limited to authorised personnel only.

Further, any personal information that we collect and use for identifying user trends (for example, IP address) is aggregated and anonymised when generating reports.

Access and correction

You may request access to, or correction of, documents which we hold that contain your personal information. Requests for access and correction are managed in accordance with the Freedom of Information Act 1982 (Vic).

We will, to the extent possible, assist you to access and amend records. In some circumstances, however, it may not be appropriate for access to be granted or amendments to be made. This could occur where the access or correction requirements under the FOI Act are not met.

For information on how to make a request for access or correction, please refer to the contact details section below.

Staying anonymous

Most of the things we do require you to provide us with personal information. However, where it does not affect the proper performance of our functions and is lawful, we will not require you to provide personal information.

For instance, if you make an enquiry about a consumer protection law, we can help you over the telephone or by email without the need for you to give us any of your personal details. Additionally, if you need a copy of one of our publications or our public data, you can download it from our website.

Privacy enquiries and concerns

You can raise privacy concerns by email. You can also contact us by phone by calling 1300 067 088.

You can also use the 'contact us' function on this website, but you should note that your complaint may then need to be allocated within the BPC.

You can also discuss your concerns with the Office of the Victorian Information Commissioner (OVIC).

Automatic data collection through our website

You can access the BPC's website, and browse our website without disclosing your personal information. We do not collect personal information when you visit or browse. Where you submit an email automatically generated from the website, or complete and submit a form online, your personal information will be managed in accordance with the policy set out in this document. Email addresses are not added to mailing lists without your consent.

Use of cookies. We use first-party cookies and JavaScript code to collect information about visitors to this website. We use these to track how our visitors interact with the website, including where they came from, what they did on the site and whether they completed any transactions on the site. If
you do not want to have cookies placed on your computer, you can disable them using your web browser. You will need to customise each web browser you use to turn off cookie tracking.

If you opt out of using cookies, you will still have access to all the information and resources provided on our website, though some features may not work as expected.

Automatic collection by third party software vendors

Our website uses several online tools to measure website use, which are provided by third party software vendors. We use these tools to help us make our site better. Much of the information collected this way relates to the computer that is used to interact with our website rather than the person using
it.

We use software by third parties, including:

• Google Analytics
• Google Tag Manager

For further information on how these third-party software vendors handle your personal information, please review their privacy policies. Personal information may be provided to third parties when accessing our website. Information that may be shared with third parties includes:

• network location and IP address
• the date and time of your visit to our website
• the types of web browser (e.g., Internet Explorer, Google Chrome, Safari) and operating system (e.g., Windows 10, Mac OS X etc.) you are using
• JavaScript support, screen resolution and screen colour processing ability
• Referring site details (such as the URL that you came through to arrive at our website)
• Page visited and the time spent on each page
• Documents downloaded and search terms used
• The forms accessed on our website
• Personal identifiable information
• Unique device identifier
• Cookies and data about which page you visited
• Device information, hardware model, operating system information, app version, app usage, debugging information, browser information
• Geo-location information (if enabled by user)
• May assign a unique user identifier

Third-party software vendors may alter how they collect and handle personal information at any time.

Email subscription service

The personal information we collect via the email subscription system is your email address.

In addition to using the information for the purpose of providing our email subscription service you have requested, we may also use or disclose the personal information that we collect about you for the following purposes:

• Research
• The compilation or analysis of statistics
• Those in the public interest
• Any other purposes required or authorised by law – other than by publication of the information in a form that identifies an individual, if it is impracticable to get that individual's consent before the use or disclosure and in the case of disclosure, where we believe the recipient of any of
  the information will not disclose it.

We may preserve the content of any electronic message that we receive. Any personal information contained in that message will only be used or disclosed in ways set out in this privacy policy. We will not use that information to add you to a mailing list without your consent.

Links to external websites

Our website privacy statement does not extend beyond this website. When following links to other sites from our website, we recommend that you read the privacy statement of that site to familiarise yourself with our privacy practices.

Online payments

If you make a payment using our website, we may process your payment via a third-party electronic payments service provider. We take reasonable steps to protect the security of your personal information. Before using these facilities, you should ensure that you are using a web browser that supports 128-bit encryption. In many web browsers, you can confirm that your session is encrypted by the appearance of a locked padlock symbol at the foot of your browser.