If an individual requests access to the personal information we hold about them or requests that we change that personal information, we will allow access or make the changes unless we consider that there is a sound reason under the Privacy Act or other relevant law to withhold the information, or not make the changes.

Requests for access and/or correction should be made to the relevant service (details of which are set out below). For security reasons, you will be required to put your request in writing and provide proof of your identity. This is necessary to ensure that personal information is provided only to the correct individuals and that the privacy of others is not undermined.

In the first instance, Magic Map will generally provide a summary of the information held about the individual. It will be assumed (unless told otherwise) that the request relates to current records. These current records will include personal information which is included in Magic Map databases and which may be used on a day to day basis.

We will provide access by allowing you to inspect, take notes or print outs of personal information that we hold about you. If personal information (for example, your name and address details) is duplicated across different databases, Magic Map will generally provide one printout of this information, rather than multiple printouts.

We will take all reasonable steps to provide access or the information requested within 30 days of your request. In situations where the request is complicated or requires access to a large volume of information, we will take all reasonable steps to provide access to the information requested within 90 days.

Magic Map may charge you reasonable fees to reimburse us for the cost we incur relating to your request for access to information, including in relation to photocopying and delivery cost of information stored off site.

If an individual is able to establish that personal information Magic Map holds about her/him is not accurate, complete or up to date, Magic Map will take reasonable steps to correct our records.

Access will be denied if:

• the request does not relate to the personal information of the person making the request;
• providing access would pose a serious threat to the life, health or safety of a person or to public health or public safety;
• providing access would create an unreasonable impact on the privacy of others;
• the request is frivolous and vexatious;
• the request relates to existing or anticipated legal proceedings;
• providing access would prejudice negotiations with the individual making the request;
• access would be unlawful;
• denial of access is authorised or required by law;
• access would prejudice law enforcement activities;
• access would prejudice an action in relation to suspected unlawful activity, or misconduct of a serious nature relating to the functions or activities of Magic Map
• access discloses a ‘commercially sensitive’ decision making process or information; or
• any other reason that is provided for in the APP’s or in the Privacy Act.

If we deny access to information we will set our reasons for denying access. Where there is a dispute about your right of access to information or forms of access, this will be dealt with in accordance with the complaints procedure set out below.

If you have provided us with personal and sensitive information, or we have collected and hold your personal and sensitive information, you have a right to make a complaint and have it investigated and dealt with under this complaints procedure.

If you have a complaint about Magic Map privacy practices or our handling of your personal and sensitive information please contact Magic Map (details of which are set out at the end of this document).

All complaints will be logged on our database.

A privacy complaint relates to any concern that you may have regarding Magic Map privacy practices or our handling of your personal and sensitive information. This could include matters such as how your information is collected or stored, how your information is used or disclosed or how access is provided to your personal and sensitive information.

The goal of this policy is to achieve an effective resolution of your complaint within a reasonable timeframe, usually 30 days or as soon as practicable.

However, in some cases, particularly if the matter is complex, the resolution may take longer.

Once the complaint has been made, we will try to resolve the matter in a number of ways such as:

• Request for further information: We may request further information from you. You should be prepared to provide us with as much information as possible, including details of any relevant dates and documentation. This will enable us to investigate the complaint and determine an appropriate solution. All details provided will be kept confidential.
• Discuss options: We will discuss options for resolution with you and if you have suggestions about how the matter might be resolved you should raise these with your service provider.
• Investigation: Where necessary, the complaint will be investigated. We will try to do so within a reasonable time frame. It may be necessary to contact others in order to proceed with the investigation. This may be necessary in order to progress your complaint.
• Conduct of our employees: If your complaint involves the conduct of our employees we will raise the matter with the employee concerned and seek their comment and input in the resolution of the complaint.
• The complaint is substantiated: If your complaint is found to be substantiated, you will be informed of this finding. We will then take appropriate agreed steps to resolve the complaint, address your concerns and prevent the problem from recurring.
• If the complaint is not substantiated, or cannot be resolved to your satisfaction, but this Privacy Policy has been followed, Magic Map may decide to refer the issue to an appropriate intermediary. For example, this may mean an appropriately qualified lawyer or an agreed third party, to act as a mediator.
• At the conclusion of the complaint, if you are still not satisfied with the outcome you are free to take your complaint to the Office of the Australian Information Commissioner at www.oaic.gov.au.

We will keep a record of your complaint and the outcome.

We are unable to deal with anonymous complaints. This is because we are unable to investigate and follow-up such complaints. However, in the event that an anonymous complaint is received we will note the issues raised and, where appropriate, try and investigate and resolve them appropriately.

We adhere to the APA legislation regarding eligible data breaches, which we determine to be under the following circumstances:

(i) there is unauthorised access to, or unauthorised disclosure of, the information;

AND

(ii) a reasonable person would conclude that the access or disclosure would be likely to result in serious harm to any of the individuals to whom the information relates;

OR

(i) unauthorised access to, or unauthorised disclosure of, the information is likely to occur;

AND

(ii) assuming that unauthorised access to, or unauthorised disclosure of, the information were to occur, a reasonable person would conclude that the access or disclosure would be likely to result in serious harm to any of the individuals to whom the information relates

In the event of an eligible data breach, we will comply fully with the notification requirements set out in the APA legislation.

Magic Map reserves the right to review, amend and/or update this policy from time to time.

We aim to comply with the APPs and other privacy requirements required to be observed under State or Commonwealth Government contracts.

If further privacy legislation and/or self-regulatory codes are introduced or our Privacy Policy is updated, we will summarise any substantial modifications or enhancements in this section of our Privacy Policy.

If you wish to contact Magic Map in relation to the above or for any other matter please visit our Contact page.