1. About this privacy policy

NorthSeat Pty Ltd (ABN 67 690 779 072) ("we", "us", "our") is committed to protecting your privacy.

We handle personal information as described in this policy and comply with privacy laws that apply to us. This policy also describes the privacy practices we commit to follow where a particular legal requirement does not apply.

This Privacy Policy explains how we handle personal information that we collect and use in the course of our business, including through our website, through client engagements, and through our products and services (including DirectorLens, Governance Tension Points Playbook, and any future offerings).

This policy explains our information-handling practices. It is not a request for blanket consent. Where consent is required, we will seek it for the particular collection, use or disclosure.

2. What information we collect

We may collect and hold personal information about you that is reasonably necessary for us to conduct our business and provide our services.
The types of personal information we may collect include (but are not limited to):
1. your name;
2. your contact details (including email address, phone number and mailing address);
3. your organisation and job title;
4. information about your interactions with us, including through our website and social media platforms;
5. information you provide to us through our client onboarding process, proposals, Statements of Work, or during the course of our engagement;
6. payment and transaction details for services or products you purchase from us;
7. information about your use of our products and services, including assessment responses, scores, comments and observations about identifiable individuals where these are supplied to us; and
8. any other personal information that you provide to us.

3. How we collect personal information

We collect personal information in a variety of ways, including:
1. directly from you when you engage with us, make an enquiry, or provide information to us in the course of a client engagement;
2. through our client onboarding process, proposals, Statements of Work, or other business documents;
3. when you use our website, digital platforms, or social media channels;
4. when you subscribe to our newsletters or marketing communications;
5. when you purchase products or services from us (including through online platforms);
6. when you participate in surveys, events or promotions that we conduct; and
7. from third parties, where you have consented to the disclosure of your personal information to us, or where otherwise permitted by law.
Website and cookies
1. Our website may use cookies and similar technologies to enhance your browsing experience, analyse website traffic, and support marketing activities.
2. You can choose to disable cookies or manage your cookie preferences through your browser settings.
3. We do not use cookies to collect sensitive personal information.

4. How we use personal information

We use personal information for purposes that are reasonably necessary for, or directly related to, our business activities and functions, including to:
1. provide our consulting services, products, and offerings to you (including DirectorLens, Governance Tension Points Playbook, and any future offerings);
2. manage our client relationships and communications;
3. respond to your enquiries or requests;
4. process payments and manage transactions for products or services;
5. deliver marketing communications in accordance with the Spam Act 2003 (Cth) and applicable laws. You can opt out of receiving these communications at any time by using the unsubscribe facility included in our messages or by contacting us directly;
6. conduct events, promotions, surveys or market research;
7. develop and improve our services, products, and client experience;
8. manage our website and digital platforms;
9. comply with our legal and regulatory obligations; and
10. carry out any other purpose which is disclosed to you and to which you have consented.
Assessments
1. Where we collect information for a board or organisational assessment, we will explain at or before collection the assessment purpose, whether responses can identify participants, who will receive individual or aggregated results, and any consequences of not providing information.
2. We will not describe information as anonymous if individuals can reasonably be identified.
3. We ask participants to avoid unnecessary personal or sensitive information about themselves or others and will seek consent where required by law.
Retention of personal information
1. We retain personal information for as long as necessary to fulfil the purposes for which it was collected, or as required by law.
2. When personal information is no longer needed, we take reasonable steps to securely destroy or de-identify it.
Children’s privacy
1. Our services are designed for business and professional use.
2. We do not knowingly collect personal information from individuals under 18 years of age

5. Disclosure of personal information

We may disclose your personal information to third parties where reasonably necessary to carry out our business activities or to comply with legal obligations.
The types of third parties to whom we may disclose personal information include:
1. our service providers, contractors, and advisers who assist us in operating our business and providing our services (including IT services, cloud storage providers, payment processors, marketing providers, and professional advisers);
2. third party platforms that we use to deliver products or services (including online sales platforms, and any future platforms we may use);
3. government and regulatory authorities and law enforcement agencies, where required or authorised by law;
4. any other third party where you have consented to the disclosure or where otherwise permitted by law; and
5. for a client-commissioned assessment, the commissioning organisation and the report recipients identified in the assessment collection notice, to the extent explained in that notice and permitted by law.
We take reasonable steps to ensure that third parties to whom we disclose personal information handle that information in a manner consistent with the Privacy Act and this Privacy Policy.

6. Overseas disclosure of personal information

We may disclose personal information to third parties located outside Australia where this is reasonably necessary to provide our services, operate our business, or comply with legal obligations.

We may use third party service providers and platforms that store data on servers located in countries outside Australia, including (but not limited to) the United States, the United Kingdom, the European Union, and other countries from time to time.

We take reasonable steps to ensure that any overseas recipients of personal information handle that information in a manner consistent with the Privacy Act and this Privacy Policy.

This notice does not waive any protection or accountability required by applicable privacy law. If we need your consent to a particular overseas disclosure, we will explain that disclosure separately and seek that consent.

7. Security of personal information

We take reasonable steps to protect personal information that we hold from misuse, interference, and loss, and from unauthorised access, modification, or disclosure.

These steps include the use of physical security, access controls, information security technologies, and operational policies and procedures to safeguard information.

No system can be guaranteed to be completely secure. Nothing in this policy limits any right or remedy available to you under applicable law.

8. Access to and correction of personal information

You may request access to personal information that we hold about you, or request that we correct any personal information that is inaccurate, out of date, incomplete, irrelevant, or misleading.

We will respond to such requests within a reasonable period and in accordance with the requirements of the Privacy Act.

Requests for access or correction should be made using the contact details set out in this Privacy Policy.

In certain circumstances, we may refuse to provide access to personal information in accordance with the Privacy Act. If we do so, we will provide you with written notice that sets out the reasons for refusal (except where it would be unreasonable to do so) and how you may complain about the refusal.

9. Data breach notification

We take data breaches very seriously and have procedures in place to respond to any actual or suspected data breach involving personal information.

We will promptly assess suspected breaches and take reasonable steps to contain them and reduce harm. Where the Notifiable Data Breaches scheme applies and a breach is notifiable under that scheme, we will notify affected individuals and the OAIC as required. Where the scheme does not apply, we will notify affected individuals of a breach likely to cause serious harm unless doing so would be unlawful.

If you believe that your personal information may have been involved in a data breach, please contact us immediately using the contact details set out in this Privacy Policy.

Our breach response process covers containment, assessment, notification where required or appropriate, and steps to reduce the risk of recurrence.

10. How to make a privacy complaint

If you have a concern about the way we have handled your personal information, or believe that we have failed to handle your personal information in line with this Privacy Policy or the standards we align with under the Privacy Act and Australian Privacy Principles, you may make a complaint to us.

Complaints should be made in writing using the contact details set out in this Privacy Policy.

We aim to respond to a complaint within 30 days. If we need more time, we will explain why and advise when you can expect a response. If you are not satisfied, you may contact the Office of the Australian Information Commissioner at www.oaic.gov.au. The OAIC can investigate complaints within its legal jurisdiction; its ability to deal with your complaint depends on whether the relevant law applies to the conduct concerned.

11. How to contact us

If you have any questions about this Privacy Policy, or if you wish to request access to or correction of your personal information, or make a privacy complaint, please contact us at:

NorthSeat Pty Ltd
Email: liam@northseat.com.au
Postal address:
P.O. Box 2676
Toowoomba, QLD 4350