2.1 This Policy applies to all Personal or Sensitive Information we collect from

(a) Council Members, Staff, applicants, residents, alumni, consultants, volunteers and others who come into contact or do business with the College, and

(b) includes Personal or Sensitive Information we gather from our Website, online portals or CCTV.

3.1 In this Privacy Policy, the following expressions mean:

• “we”, “us” and “our” refers to the College.

• “you” and “your” refer to each individual person whose Personal Information we may handle from time to time.

• “Personal Information” means any information or an opinion about an identified individual, or an individual who is reasonably identifiable: o

  • Whether the information is true or not; and

  • Whether the information is recorded in a material form or not.

• “Sensitive Information” is a form of Personal Information and is information or an opinion about an individual’s racial or ethnic origin, political opinions, membership of a political association, religious beliefs or affiliations, philosophical beliefs, membership of a professional or trade association, memberships of a trade union, sexual orientation or practices, criminal record, health, genetic information or biometric information.

4.1 The type of Personal Information we collect includes, but is not limited to:

(a) Name

(b) Date of birth

(c) Contact details (e.g. phone, email, address)

(d) Nationality

(e) Indigenous Heritage

(f) Gender

(g) Religious background

(h) Next of kin and/or emergency contact details

(i) Health or impairment information

(j) Bank account/ credit card details

(k) Tax file number

(l) Criminal history

(m) Employment details (including employment history)

(n) Primary ID information (e.g. driver’s licence, passport number)

(o) Visa information

(p) Enrolment information and academic record

4.2 We will only collect Personal or Sensitive Information if we consider it necessary for our core business of providing residential accommodation and related educational, academic and pastoral support. The type of information we collect depends on the circumstances and our relationship with the Individual. The purposes for which we collect Personal Information includes, but is not limited to:

(a) assist us in delivering our services, including but not limited to providing accommodation, wellbeing, academic and pastoral support,

(b) ensure we comply with our legal obligations,

(c) ensure we comply with our reporting obligations,

(d) maintain safety and wellbeing,

(e) recruit staff, residents and volunteers,

(f) inform and communicate College programs, services and events (unless opted out), and

(g) enable us to assess, manage and respond to applications (residents and employees) and third party relationships.

4.3 In accordance with our obligations under the National Higher Education Code to Prevent and Respond to Gender-based Violence (2025) and UWA affiliation we collect information relating to experiences or allegations of gender-based violence.

4.4 The Personal Information you provide to us is provided on a voluntary basis. If you choose not to supply some or all Personal Information requested, particularly information relevant to employment, a residency application, use of our facilities or a contractual relationship, we may not be able to properly consider your application or enter a contract with you.

5.1 We collect Personal Information when you contact us, use our facilities, stay with us, enter a contract with us, donate to us or apply for employment or residency.

5.2 Personal Information is collected in digital form, on paper and in photographs, film and video recordings.

5.3 We will collect Personal Information from you directly unless it is unreasonable or impracticable for us to do so. The sources from which we collect Personal Information include, but are not limited to:

(a) forms or correspondence that are submitted to us (including online portals), including applications, enrolments, registrations, subscriptions, expressions of interest, consent forms, disclosures or reports of Gender-based violence, surveys, accident and incident forms, complaints, requests for further information,

(b) direct contact in the course of providing services or administration,

(c) payments or donations made to us,

(d) CCTV cameras or other security surveillance systems installed to monitor and protect the safety of individuals and the security of premises,

(e) when photographing or recording student or alumni events held within the College or in which students or alumni participate outside of College,

(f) an individual’s usage of the College’s IT assets and internet services,

(g) the day-to-day activities and administration of the College, and

(h) third parties with whom the College collaborates.

6.1 We will only use Personal Information for specific, legitimate business purposes and in a manner consistent with the purposes for which it was collected. The Personal Information may be collected and used for the following purposes:

(a) governance, administration and management of the College,

(b) compliance with legislative, regulatory and/or funding arrangements,

(c) employment and management of staff (or applicants),

(d) admission and readmission of residents (or applicants),

(e) providing network resources, including internet and Wi-Fi access for residents and staff,

(f) invoicing and collecting fees and charges,

(g) pastoral care of residents,

(h) health and wellbeing of residents and staff,

(i) providing academic programs and support to residents and monitoring academic progress,

(j) awarding scholarships, bursaries and prizes,

(k) supporting resident activities,

(l) managing student conduct and student disciplinary processes (including but not limited to the requirements under the National Code for Preventing and Responding to Gender-based Violence),

(m) assessing, investigating, processing and/or determining matters (including accidents, incidents, events) giving rise to or related to insurance claims, employment disputes, staff disciplinary processes, legal disputes,

(n) undertaking probity and risk checks in respect of third parties dealing with the College,

(o) soliciting and receiving donations,

(p) organising resident, alumni and other College events,

(q) managing relationships with alumni and other third parties,

(r) communications, marketing and promotions,

(s) publishing magazines, newsletters, websites and social media posts and

(t) general or health situations permitted under the Act.

6.2 Subject to paragraphs 6.3 and 6.4, the College will not share your Personal Information with any third parties unless we have your specific consent to do so and we do not sell or share mailing lists.

6.3 To the extent permitted by the Act, we may disclose your Personal Information on a confidential basis:

(a) if disclosure is required by law,

(b) to law enforcement authorities for the purposes of investigating or prosecuting criminal or other unlawful acts,

(c) to government departments and agencies to satisfy reporting requirements,

(d) to your parent, guardian or person nominated by you in the case of an emergency or where your welfare is deemed at risk,

(e) as authorised under your Residency Contract or other College Rules or policies, including but not limited to the Code of Conduct and Gender-based Violence Prevention and Response Policy,

(f) to third parties providing services to us, to the extent that the information is required for them to provide the services or activities to us,

(g) to third parties for the purposes of verifying your identity,

(h) for the purpose of collecting outstanding debts.

6.4 For the purposes of protecting the safety and wellbeing of you, other residents and staff, if you are a Resident of the College, you provide explicit and informed consent as part of your Residency Contract and College Membership Agreement that the College may, where appropriate, share proportional, reasonable and relevant Personal Information relating to you to UWA and/or the University at which you are enrolled, in accordance with the requirements under the Gender-Based Violence Prevention and Response Policy and Processes and in circumstances where you have been

(a) issued a formal written warning for breaching the College Membership Agreement or Code of Conduct, or

(b) involved in or a party to a Serious Student Incident as defined under the UWA Serious Student Incident Policy.

7.1 The College stores personal information under the control of the Head of College and authorised staff:

(a) electronically in onsite data storage media;

(b) electronically in cloud-based offsite storage;

(c) in paper-based files kept onsite or archived offsite.

7.2 Third-party data storage organisations that may be engaged from time to time by the College are required to comply with the Australian Privacy Principles and this Policy.

7.3 The College has implemented measures to ensure protection of personal information from misuse, loss, unauthorised access and modification, or improper disclosure.

7.4 The College takes reasonable steps to destroy or de-identify information that is no longer required for use, after any period of time for which the College is legally required to retain the information.

8.1 The College’s website may use Cookies and analytics services to monitor usage trends and enhance user experience.

(a) Cookies are small data files that are downloaded to your computer’s hard drive when you visit a website. The cookie sends information back to the originating website on each subsequent visit, enabling the website to recognise your device and allow you to navigate more efficiently and improve your experience.

(b) The information the Cookie sends back to the originating website may include but are not limited to tracking the duration of your use of the website, time of access, page errors, numbers of unique visitors, page visits, links selected, exit points, the type of computer and operating system you are using.

(c) Cookies cannot be used to reveal Personal or Sensitive Information about you.

(d) The College’s web host and analytics providers are bound by privacy obligations consistent with the Australian Privacy Principles.

(e) If you do not want information collected by Cookies, you can disable the Cookie function in your browser, however the functionality of the College’s website may be limited as a result.

8.2 The College website may contain links to other sites. The College is not responsible for the privacy practices or the content of other sites.

8.3 Information about yourself that you disclose by posting on bulletin boards, chat rooms or social media and similar digital media platforms may become public information. If you disclose your Personal Information, or that of other residents and staff, while resident in College, the College cannot protect that personal information.

9.1 We may use your Personal Information (other than Sensitive Information) to supply you with information about our activities, campaigns and events or to seek your response to surveys.

9.2 Where we use your Personal Information to send you promotional or marketing information by post, email or telephone, we will provide you with the opportunity to opt-out of receiving such information. Alternatively, you can provide a written opt-out notice to us at email office@stmc.uwa.edu.au or mail: St Thomas More College, 48 Mounts Bay Rd, Crawley WA 6009. We will endeavour to process your request within ten (10) business days.

9.3 Even where you have opted out, the College may continue to provide you with information about changes to terms and conditions relating to our research and donation programs and other factual information as permitted under the Act and the Spam Act 2003 (Cth).

10.1 We will take all legally required and commercially reasonable steps to ensure that the Personal Information which we collect remains accurate, up to date and complete.

10.2 If your personal details change, such as your mailing or email addresses, or telephone number, please contact the College to update your details: through the website: https://www.stmc.uwa.edu.au/ email: office@stmc.uwa.edu.au or mail: St Thomas More College, 48 Mounts Bay Rd, Crawley WA 6009. When we become aware that your details have changed we will update them.

10.3 You may apply for access to the personal information about you held by the College, at no charge, by

(a) making a request in writing identifying as clearly as possible the type of information requested to Email: office@stmc.uwa.edu.au or mail: St Thomas More College, 48 Mounts Bay Rd, Crawley WA 6009 and

(b) provide proof of identity (e.g. Driver’s licence or passport).

10.4 We will deal with your request to access your Personal Information within 30 days, and subject to applicable Privacy laws, we may either grant or deny access. If we deny access to your Personal Information, we will provide you with reasons for that decision within 30 days and the avenues available for you to complain about the refusal.

10.5 If you believe that any information that we hold about you is inaccurate or out of date, please advise us at Email: office@stmc.uwa.edu.au or mail: St Thomas More College, 48 Mounts Bay Rd, Crawley WA 6009

and

We will review and update the relevant information.

11.1 If you have a question about the application of our Privacy Policy, please contact the Head of College at reception@stmc.uwa.edu.au.

11.2 If you have a complaint about this Policy or its implementation or practice, your complaint should be directed in the first instance to the Head of College at exec@stmc.uwa.edu.au. The Head of College will meet with the complainant and try to resolve the matter to the satisfaction of both parties.

11.3 If you are not satisfied with the outcome of this procedure, you may contact the College Council Chair at exec@stmc.uwa.edu.au for a further investigation of your complaint.

11.4 If your complaint remains unresolved following the steps outlined above, you may lodge your complaint with the Office of the Australian Information Commissioner at http://www.oaic.gov.au/.

12.1 The College will investigate all suspected breaches of this Policy.

12.2 If an investigation indicates that there has been unauthorised access. Disclosure of or loss of personal data which requires mandatory data breach notification at law (an Eligible Data Breach), the College will notify the relevant statutory authority and the affected individual.

12.3 Failure to comply with this Policy may result in disciplinary action.

13.1 The College may change or update parts of this Policy at any time and without notice to maintain compliance with the law or following an update to our internal practices.

13.2 Any alterations to our Policy will take effect at the time they are published to the College website.