Australia Post

No relevant claims found in policy.

No specific findings.

Comprehensive disclosure of primary and secondary purposes with specific examples, clear marketing opt-out mechanisms, and detailed explanation of analytics and insights generation. Strong specificity across all key areas with explicit consent mechanisms, though some reliance on inferred consent for marketing reduces the score slightly.

Strong privacy governance framework with mandatory PIAs, dedicated Privacy Office with clear escalation processes, named contact officer with multiple channels, and supplier accountability measures. However, lacks specific review timeframes and relies on vague 'from time to time' language for updates.

Claims demonstrate comprehensive and specific data collection disclosures with granular enumeration of data types (contact, financial, identity, location, usage), clear collection methods, purposes, and appropriate handling of sensitive areas like children's data and location consent. The disclosures exceed basic requirements by providing detailed examples and specific technical methods, though could be slightly more comprehensive in legal basis statements.

The claims provide comprehensive coverage with specific named recipients (GBG Australia, AUSTRAC, ACIC), detailed purposes for each sharing scenario, clear contractual obligations on suppliers, and specific countries for overseas disclosure. While generally strong, some categories remain somewhat broad (suppliers, agents, partners) preventing a perfect score.

Claims contain only generic security commitments and basic third-party requirements without any specific technical measures, encryption details, breach notification procedures, or certifications. The disclosures are minimal and lack the concrete security specifics required for higher scoring under APP 11.

The policy provides specific country names (Japan, USA, Singapore, EU, New Zealand, India, Philippines) and describes concrete safeguards including contractual requirements for suppliers to comply with Australian privacy law and commitments to manage information consistently with local requirements. However, it lacks detail on adequacy mechanisms or binding corporate rules that would elevate it to the highest tier.

The policy provides comprehensive and specific disclosures covering all key consumer rights areas with clear mechanisms, specific timeframes (30 days for access requests), multiple contact methods, and proper OAIC escalation procedures. While it could be enhanced with correction process timeframes and more detailed deletion procedures for general users, the overall quality is very strong with practical implementation details.

The claims reveal various automated processing activities (tracking, profiling, preference analysis) but lack specific disclosure about automated decision-making that significantly affects individuals. While some opt-out rights are mentioned for marketing, there's no transparency about decision logic, human review processes, or comprehensive opt-out mechanisms for automated decisions.

The policy provides adequate parental consent mechanisms and deletion rights, but lacks specificity on age thresholds, detailed verification processes, and comprehensive child-specific protections. The disclosures are reasonably clear but fall short of proactive, detailed safeguards expected for higher scores.