IT Factory Australia — Privacy Policy 

1. About this policy 

IT Factory Pty Ltd (ABN 14 137 802 272), trading as IT Factory Australia (“IT Factory”, “we”, “us”, “our”), is bound by the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs). This policy explains how we collect, hold, use and disclose personal information, including through our website www.itfactory.com.au. 

It applies to customers, business clients and their staff, people who buy from our online store, website visitors, suppliers, contractors and job applicants. It does not cover our handling of employee records, which are exempt under the Privacy Act. 

Our services include IT asset disposition (ITAD), secure data sanitisation and destruction, device collection and logistics, refurbishment and resale of IT equipment, IT installation and field services, and equipment storage.  

By using our website or services, you acknowledge that your personal information will be handled as described here. If you do not provide information we ask for, we may not be able to give you a quote, process an order or provide a service. 

2. Personal information we collect 

We only collect personal information that is reasonably necessary for our functions and activities. Depending on how you deal with us, this may include: 

We do not usually collect sensitive information (such as health information or criminal records). If we need it, for example a police check for a role or site requiring one, we will only collect it with your consent or where the law allows. 

You can deal with us anonymously or under a pseudonym for general enquiries. For quotes, orders and services we need to identify you. 

3. How we collect it 

We collect personal information directly from you where we reasonably can: through our website forms and online store, by email and phone, in person, and through contracts and paperwork. We may also collect it from your employer or organisation when they engage us, from our contractors and logistics partners, and from public sources such as business directories. 

If we receive personal information we did not ask for, we will destroy or de-identify it if we could not lawfully have collected it. 

Cookies and website technologies 

Our website uses cookies and similar technologies to keep your shopping cart and login working, remember your preferences, protect forms from spam and understand how the site is used. These may include: 

• Essential cookies for the online store, checkout and account login 

• Google reCAPTCHA, which collects device and usage data to block spam and abuse, under Google’s Privacy Policy 

• Analytics tools such as Google Analytics, which report site usage in aggregate [confirm which tools you use, and remove any you don’t] 

You can block or delete cookies in your browser settings. Some parts of the site, such as checkout, may not work without them. 

Our website may link to other sites. We are not responsible for their privacy practices. 

4. How we use and disclose personal information 

We use personal information to: 

• respond to enquiries and prepare quotes 

• process online orders, payments, deliveries, returns and warranty claims 

• arrange collections, installations, storage and other services, and keep chain-of-custody and data destruction records 

• manage our accounts, invoicing and supplier and contractor arrangements 

• run, secure and improve our website and services 

• send service updates and, with your consent, marketing (see section 5) 

• assess job applications 

• meet our legal, tax, environmental and regulatory obligations 

We may disclose personal information to: 

• couriers, freight and logistics providers 

• payment processors and our bank 

• IT, website hosting, cloud software, email and accounting providers 

• contractors who carry out work for us, such as field technicians 

• recyclers and downstream processing partners, where needed to complete a service 

• our professional advisers, insurers and debt collectors 

• government bodies, courts or law enforcement where required or authorised by law 

We require these parties to handle personal information only for the purpose we provide it. We do not sell personal information. 

Overseas disclosure 

Some of our service providers, such as cloud software, email, analytics and payment providers, may store or process information outside Australia. We take reasonable steps to make sure they handle it consistently with the APPs. 

Data on devices you send us 

Computers, phones, hard drives and other equipment you give us may contain personal information. We do not access, copy or use that data except as needed to provide the agreed service. Data-bearing devices are sanitised using [NIST SP 800-88] or physically destroyed, and certificates of sanitisation or destruction are available on request. Please back up anything you need before handing over equipment. 

Automated decision-making 

We do not use computer programs to make, or substantially and directly assist in making, decisions that could significantly affect your rights or interests. If this changes, we will update this policy as required by APP 1.7 to 1.9.  

5. Direct marketing 

We may send you news, offers and stock updates by email or SMS where you have consented or would reasonably expect it, in line with the Spam Act 2003 (Cth). Every message includes an easy way to unsubscribe, or you can contact us to opt out. We do not share your details with other businesses for their marketing. 

6. Storage and security 

We hold personal information in secure cloud systems, business software and, in some cases, paper records at our premises. We protect it with measures such as access controls, passwords and multi-factor authentication, staff confidentiality obligations, secure facilities, and encrypted connections (HTTPS) on our website. 

When we no longer need personal information, and are not required by law to keep it, we take reasonable steps to destroy or de-identify it. Business and tax records are generally kept for at least 7 years. 

7. Data breaches 

We follow the Notifiable Data Breaches scheme under the Privacy Act. If a breach is likely to cause serious harm, we will notify the people affected and the Office of the Australian Information Commissioner (OAIC). 

8. Access and correction 

You can ask to access the personal information we hold about you, or ask us to correct it if it is inaccurate, out of date, incomplete or misleading. Contact us using the details below. We will respond within 30 days. We do not charge for a request, though we may charge a reasonable fee for providing access. If we refuse, we will tell you why in writing and how to complain. 

9. Complaints 

If you think we have breached the Privacy Act or the APPs, please contact our Privacy Officer in writing. We will acknowledge your complaint and aim to resolve it within 30 days. 

If you are not satisfied with our response, you can complain to the OAIC at www.oaic.gov.au or on 1300 363 992. 

10. Contact us 

Privacy Officer, IT Factory Pty Ltd 

• Email:   accounts@itfactory.com.au 

• Phone: 1300 589 579 

• Post:    3 Allen Place, Wetherill Park, NSW, 2164 

11. Changes to this policy 

We may update this policy from time to time. The current version is always on our website.