Keyton Holding Pty Limited as trustee for Keyton Trust ABN 44 349 706 307 (Keyton, we, our, us) is a leading owner, operator and developer of retirement living villages in Australia.  We recognise and respect the importance of your privacy and that you have a right to control how your Personal Information is collected and used by us.

This Privacy Policy applies to all your dealings with us.  By applying for employment or becoming an employee or otherwise communicating with us, you accept the terms of this Privacy Policy and consent to the collection, use and disclosure of your Personal Information by us as described in this Privacy Policy.

The purpose of this Privacy Policy is to provide you with information on how we collect, use, store and disclose your Personal Information.  If you require any further information about our privacy practices, we welcome you to get in touch with us using the contact details set below.

Key definitions

In this Privacy Policy:

APPs means the Australian Privacy Principles under the Privacy Act which govern the standards, rights and obligations around the collection, use and disclosure of Personal Information, privacy governance and accountability, integrity and correction of Personal Information and the rights of individuals to access their Personal Information.

Online Platforms means the online platforms including any applications or apps we operate and any of our other websites or social media pages (including Facebook, Instagram and LinkedIn) managed by us.

Personal Information has the meaning given to it under the Privacy Act.

Privacy Act means the Privacy Act 1988 (Cth), as amended from time to time.

Privacy Officer means our first point of contact for all privacy related inquiries and matters, who can be contacted using the details set out in section 16 below.

Privacy Policy means this document setting out the policy of Keyton relating to the privacy and handling of your Personal Information.

Sensitive Information has the meaning given to it under the Privacy Act.

Services means the retirement living and related services provided by us to individuals including real estate, housing, hospitality, entertainment, property and garden maintenance, exercise and wellness services.

What is Personal Information?

Personal Information is defined in the Privacy Act as information or opinion about an identified individual (or an individual who is reasonably identifiable) whether the information or opinion is true or not and whether the information or opinion is recorded in material form or not.

Sensitive Information is a subset of Personal Information that is afforded higher levels of protection under the Privacy Act.  It includes information or opinion about an individual's racial or ethnic origin, political opinion, religious beliefs, sexual orientation, criminal record or health information.  

Employment and recruitment

If you send us an application to be considered for employment, whether advertised or unsolicited, this information may be used to assess your application or suitability for employment with us. This information may be disclosed to our related bodies corporate and service providers for purposes such as aptitude and psychological testing or other human resources management activities.

As part of the application process, you may be asked for your consent to the use and disclosure of certain Personal Information about pre-employment testing.  We may also ask you to consent to the disclosure of your Personal Information to those people who you nominated to provide references.  A refusal to provide any of this information, or to consent to its proposed disclosure, may adversely impact the success of your application.

This Privacy Policy does not apply to our handling of information about our employees.  Our handling of employee records is exempt from the APPs under the Privacy Act if the act or practice is directly related to:

either a current or former employment relationship between us and the individual; and
an employee record held by us relating to the individual.

For information about our practices relating to employee records, please contact our Privacy Officer using the contact details listed below.

Types of Personal Information we collect

Depending on the nature of your relationship with us, the Personal Information we collect may include:

Candidate contact details
Candidate resumes
Candidate references
Candidate interview notes
Candidate academic transcripts
Employee’s personal and emergency information about terms and conditions of employment
wage or salary details
leave balances
records of work hours
records of engagement, resignation or termination of employment information about training, performance and conduct
taxation, banking or superannuation details
union, professional or trade association membership information.

How we collect Personal Information

To provide our tailored and personalised Services, we collect Personal Information and Sensitive Information from you in various ways. Our general policy is to collect information from you directly and not from third parties. If we do need to collect information (i.e. medical information from pre employment medicals or police checks they will be held in a secure location.

By providing us with your information (including Sensitive Information such as health information) or nominating someone else to provide it, you consent to us collecting your information. 

We may occasionally collect Personal Information through:

our Online Platforms (including your interactions with us on our social media platforms and apps managed by us);
forms (hardcopy and electronic) filled out by you when applying for work or accepting an employment offer
third party service providers including training providers, payroll providers or other services to Keyton.

Please note that we will primarily collect Sensitive Information (including health information) directly from you and with your consent except in permitted general situations under the Privacy Act where it is unreasonable or impracticable to do so. 

We only collect and handle your Personal Information that is provided by you, with your consent or where otherwise permitted by law.  We will assume that you have consented to us collecting all information that is provided to us in accordance with this Privacy Policy unless you tell us otherwise at the time you provide it to us.

Please note that if you provide us with Personal Information about a third party you represent to us, and we collect it on the basis that, the person agrees to us collecting and handling their Personal Information in accordance with this Privacy Policy.

Use of Personal Information

Our main purposes for collecting, holding, using and disclosing Personal Information are the following:

Recruitment activities
Making offers of employment
Employing people
Payment of wages and benefits
Management of work and non-work-related injuries and illness

Disclosure of Personal Information

Generally, we will only use or disclose your Personal Information for the purpose for which it was collected (known as the "primary purpose").  For example, this might be to draft your employment contract.

Sometimes, we may be required to disclose your Personal Information to third parties in certain circumstances including:

where disclosure is required or permitted by law;
to our related entities, in accordance with the Privacy Act;
if disclosure will prevent or lessen a serious or imminent threat to someone's life or health; or
where it is reasonably necessary for an enforcement related activity.

In regard to Sensitive Information (which includes your health information), we will only ever use or disclosure your Sensitive Information with your consent, for the primary purpose for which it was collected or for another purpose directly related to the primary purpose where you would reasonably expect it to be used or disclosed for such a directly related purpose.

Unless we notify you otherwise, we do not make cross border disclosures to entities outside Australia, although some of the data servers where our electronic information and files are stored may be located overseas.  

Storage and security

We take the security of your Personal Information seriously.  Your Personal Information is stored in a manner that strives to protect it from misuse, loss and from unauthorised access, modification or disclosure.  Our people are aware of the importance we place on protecting your privacy and their role in helping us to do so.

When Personal Information that we collect is no longer required, we will remove or de-identify the Personal Information as soon as reasonably possible.  We will, however, retain Personal Information for as long as necessary to comply with any applicable law for the prevention of fraud, for insurance and governance purposes, in our IT back-up, for the collection of any monies owed and to resolve disputes.

Here are some examples of the things we do to protect your information.

Method	Examples
Staff obligations and training	We regularly train and assess our staff in how to keep your Personal Information safe and secure. Our staff are required to keep your Personal Information secure at all times and are bound by internal processes and policies which confirm this. Access to Personal Information is controlled through access and identity management systems. We have security professionals who monitor and respond to (potential) security events across our network.
System Security	We store your Personal Information in secured systems which are in protected and resilient data centres. We have technology that prevents malicious software or viruses and unauthorised persons from accessing our systems.
Service providers and overseas transfers	When we send information overseas or use service providers that handle or store data, we require them to take steps to keep your information safe and use it appropriately. We control where information is stored and who has access to it.
Building security	We use a mix of access cards, alarms, cameras, and other controls to protect our offices, villages and buildings.
Our websites and apps	When you log into our Online Platforms, we encrypt data sent from your computer or device to our system so no-one else can access it.
Destroying or de-identifying data when no longer required	We aim to keep Personal Information only for as long as we need for our business or to comply with the law.  When we no longer need Personal Information, we take active steps to destroy or de-identify it.

Access to and correction of Personal Information

You are always welcome to request that we provide you with access to the Personal Information we hold about you by contacting us using the details listed below.  Generally, we will provide you with access to the information unless applicable laws allow us to refuse, or prevent us from giving you, access to the Personal Information we hold about you.  We will never unreasonably refuse requests to access Personal Information.

Where we agree to provide you with access to your Personal Information, we may make this conditional on us recovering our reasonable costs of doing so. No fee will be incurred for requesting access, but if your request for access is accepted, you will be notified of the fee payable (if any) for providing access if you choose to proceed with your access request.

You may also lodge a request to correct Personal Information we hold about you if you believe it is inaccurate, incomplete, irrelevant, misleading or out of date.  

Our Online Platforms

Our Online Platforms use cookies to help enhance your online experience. Cookies are pieces of information that a website transfers to your computer’s hard disk for record keeping purposes and are a necessary part of facilitating online transactions. Most web browsers are set to accept cookies. We use them because cookies are useful to estimate our number of visitors and determine overall traffic patterns through our websites.

We may also collect statistical information regarding the use of our Online Platforms via tools such as Google Analytics 4, including the domains and device types from which website users visit, IP addresses, the dates and times of visits, activities undertaken on our Online Platforms and other clickstream data. In addition, we sometimes use web beacon technology to monitor internet activity on our websites. A web beacon is a clear-pixel image that generates an anonymous de-identified notice of a website’s visit when viewed.  A web beacon usually works in conjunction with a cookie.

If you do not wish to receive any cookies you may set your browser to refuse cookies.  However, this may mean you will not be able to take full advantage of the services on our Online Platforms.  If you set your browser to refuse cookies, a web beacon may still be able to generate a notice of your visit but it will not be associated with the information contained in cookies.

Third parties

Where reasonable and practicable to do so, we will collect your Personal Information only from you. However, in some circumstances we may be provided with information about you by third parties. In such cases, we will take reasonable steps to ensure that you are made aware of the information provided to us by the third party and about your rights under this Privacy Policy.

Our Online Platforms may sometimes contain links to other websites operated by third parties for your convenience. We cannot provide any guarantees regarding a third party's information handling policies or the content of third-party websites you may visit.  Before disclosing your Personal Information on any other platform, we recommend that you examine the terms and conditions and privacy policy of the relevant platform. Please note that we are not responsible for any practices on linked platforms that might breach your privacy.

Notifiable data breaches

Australia has notifiable data breach scheme in operation. We are committed to adhering to this scheme as an important step in preventing and managing serious privacy breaches. 

A "data breach" means unauthorised access, disclosure, alteration, loss, or destruction of Personal Information—or, an action which prevents us from accessing Personal Information on either a temporary or permanent basis.  An "eligible data breach", in accordance with the Privacy Act, occurs when there is a data breach that is likely to result in serious harm to any of the individuals to whom the information relates and we are unable to prevent the likely risk of serious harm with remedial action. 

We, including all our people, take breaches of privacy very seriously.  If we suspect a privacy breach has occurred, our priority is to contain and assess the suspected breach. In doing so, we will:

take any necessary immediate action to contain the breach and reduce the risk of harm; 
determine the cause and extent of the breach;
consider the types of information involved, including whether the personal information is sensitive in nature; 
analyse the nature of the harm that may be caused to affected individuals;
consider the person or body that has obtained or may obtain personal information as a result of the breach (if known); and 
determine whether the Personal Information is protected by a security measure.

If we believe an eligible data breach has occurred, we will, as soon as practicable, notify the Office of the Australian Information Commissioner (OAIC) and all affected individuals or, if it is not possible to notify affected individuals, provide public notice of the breach (in a manner that protects the identity of affected individuals). 

Attention: Privacy Officer

Keyton

Level 45, Bourke Place

600 Bourke Street

Melbourne VIC 3000

Email: Privacy@keyton.com.au 

We will endeavour to assess and respond to your query within 30 days. More information about your rights and our obligations in respect to privacy and information on making a privacy complaint are available from the Office of the Australian Information Commissioner at:

Website: www.oaic.gov.au 

Post: GPO Box 5218 Sydney NSW 2001

Email: enquiries@oaic.gov.au