NEM

Policy provides clear scope, contact information, and section structure with annual review commitment. However, lacks specific version dating and comprehensive definitions section.

Comprehensive list of primary purposes with marketing opt-out mechanisms and commitment to Privacy Act compliance for secondary uses. Clear business necessity requirement stated.

Annual review commitment with multiple contact points for different purposes and complaint handling process. However, lacks notification requirements for changes and formal governance framework.

Adequate disclosure of data types and collection methods including cookies/web beacons, but lacks granular enumeration and specific legal basis beyond business necessity.

Clear general policy against routine disclosure with specific exceptions and named international recipients (NZ/Asia). However, lacks detailed contractual safeguards and specific third-party categories.

Generic commitment to 'reasonable physical and technological security measures' with employee confidentiality requirements, but lacks specific encryption, certifications, or breach notification details.

Adequate disclosure of transfers to specific regions (NZ/Asia) with general safeguard commitments, but lacks detailed adequacy mechanisms or binding corporate rules.

Strong coverage of access, correction, deletion, and complaint rights with specific contact details and OAIC escalation pathway. Missing specific response timeframes.

No relevant claims found in policy.

No relevant claims found in policy.

No specific findings.