Privacy Policy
AIS International Group
Privacy and Protection of Personally Identifiable Information (PII) Policy
Approved By: Executive Management
Version: 1, Effective Date: 29 June 2023
Version: 2, Effective Date: 19 June 2026
- Purpose
AIS International Group (AIS) is committed to protecting the privacy, confidentiality, integrity and security of Personal Information and Personally Identifiable Information (PII) collected, used, disclosed, stored and processed as part of its business activities.
This Policy establishes the principles and requirements for managing Personal Information in accordance with:
- Privacy Act 1988 (Cth)
- Australian Privacy Principles (APPs)
- ISO/IEC 27001:2022 Control A.5.34 – Privacy and Protection of PII
- Contractual and regulatory obligations applicable to AIS International Group
- Scope
This Policy applies to:
- Employees
- Contractors
- Job applicants
- Clients and customers
- Suppliers and business partners
- Website users
- Any other individual whose Personal Information is collected, held or processed by AIS International Group
This Policy applies to information in all formats, including:
- Electronic records
- Paper records
- Emails
- Databases
- Cloud services
- Audio and visual records
- Policy Statement
AIS shall collect, use, disclose, retain and dispose of Personal Information lawfully, fairly and transparently.
Personal Information shall only be collected where necessary for legitimate business, contractual, regulatory or legal purposes and shall be protected throughout its lifecycle.
AIS is committed to implementing appropriate administrative, physical and technical controls to safeguard Personal Information from unauthorised access, disclosure, alteration, loss, misuse or destruction.
- Collection of Personal Information
AIS may collect Personal Information including:
- Name
- Contact details
- Date of birth
- Employment information
- Identification documents
- Financial information
- Qualifications and employment history
- System access and usage records
- Information required to provide services
Personal Information will generally be collected directly from the individual unless otherwise authorised or permitted by law.
Only the minimum amount of Personal Information necessary for the relevant business purpose shall be collected.
- Use of Personal Information
AIS may use Personal Information for purposes including:
- Delivering products and services
- Recruitment and employment administration
- Client relationship management
- Identity verification
- Regulatory compliance
- Contract administration
- Security monitoring
- Fraud prevention
- Business operations and reporting
Personal Information shall not be used for unrelated purposes without lawful authority, consent or other applicable legal basis.
- Disclosure of Personal Information
Personal Information may be disclosed to:
- Employees with a legitimate business need
- Technology service providers
- Professional advisers
- Regulatory authorities
- Government agencies where legally required
- Business partners involved in service delivery
AIS does not sell Personal Information. Where Personal Information is disclosed to third parties, reasonable steps shall be taken to ensure appropriate privacy and security protections are maintained.
- Cross-Border Disclosure
Where Personal Information is transferred, stored or processed outside Australia, AIS shall take reasonable steps to ensure that appropriate privacy and security safeguards are in place and that applicable legal obligations are met.
- Protection of Personal Information
AIS shall implement appropriate controls to protect Personal Information, including:
- Access controls based on business need
- Multi-factor authentication where appropriate
- Encryption of Personal Information in transit and at rest where practicable
- Secure authentication controls
- Security monitoring and logging
- Backup and recovery controls
- Physical security measures
- Secure disposal processes
Access to Personal Information shall be restricted to authorised personnel performing legitimate business functions.
- Privacy by Design
Privacy and data protection requirements shall be considered when:
- Designing new systems
- Acquiring software or services
- Implementing business processes
- Undertaking significant organisational changes
Privacy risks shall be identified and addressed through risk assessment processes where appropriate.
- Data Quality
AIS shall take reasonable steps to ensure Personal Information is:
- Accurate
- Complete
- Relevant
- Up to date
Individuals may request correction of inaccurate information.
- Access and Correction Requests
Individuals may request access to Personal Information held by AIS International Group and may request correction of inaccurate or incomplete information.
Requests should be submitted in writing to the contact details listed in this Policy.
Requests will be managed in accordance with applicable legal requirements.
- Retention and Disposal
Personal Information shall only be retained for as long as required for:
- Business purposes
- Contractual obligations
- Regulatory requirements
- Legal obligations
When no longer required, Personal Information shall be securely destroyed, deleted, anonymised or de-identified in accordance with AIS record retention requirements.
- Data Breaches and Privacy Incidents
Actual or suspected privacy breaches involving Personal Information shall be reported immediately through AIS Incident Management process.
Privacy incidents shall be investigated and managed in accordance with applicable legal obligations, including the Notifiable Data Breaches Scheme where required.
- Third-Party Service Providers
Third-party providers processing Personal Information on behalf of AIS International Group shall:
- Be subject to appropriate contractual obligations.
- Maintain suitable security controls.
- Protect Personal Information from unauthorised access or disclosure.
- Notify AIS International Group of relevant privacy or security incidents affecting Personal Information.
- Transferring Personal Data from the European Union
- Personal Data (PD) collected by AIS may be stored, processed and transferred between countries in which AIS and its service providers operate, including Australia and the United States of America.
- The European Union has not determined that the United States of America provides an adequate level of protection for Personal Data under Article 45 of the General Data Protection Regulation (GDPR).
- AIS may rely on derogations for specific situations as defined in Article 49 of the GDPR where applicable.
- For customers, applicants, users and other individuals located within the European Union, Personal Data may be transferred outside the European Union to the United States of America with the individual’s consent or where otherwise permitted by law.
- AIS may use Personal Data to provide goods, services and information requested by the individual, to perform contractual obligations, or to satisfy legitimate business interests in a manner that does not override the individual’s rights and freedoms.
- Where Personal Data is transferred, processed or stored outside the European Union, AIS shall take reasonable steps to protect such information and handle it in accordance with this Policy.
- By using AIS websites, services or products, individuals acknowledge that transfers of Personal Data may occur as described in this section.
- Payments
- AIS may provide paid products and/or services. In such circumstances, AIS may use third-party payment processing services.
- AIS does not store or collect payment card details. Such information is provided directly to third-party payment processors whose handling of Personal Information is governed by their own privacy policies.
- Payment processors may adhere to the Payment Card Industry Data Security Standard (PCI-DSS) or equivalent industry standards for the secure handling of payment information.
- Payment processors used by AIS may include PayPal, Braintree or other equivalent providers. Privacy information for those providers is available from their respective websites.
- Policy Review and Updates
- AIS reserves the right to amend this Policy from time to time.
- Where this Policy is amended, the updated version shall be published through appropriate AIS communication channels.
- Where required by law or where material changes occur, AIS may notify affected individuals of such changes.
- Personal Information shall continue to be used and disclosed in accordance with the version of this Policy applicable at the time the information was collected, unless otherwise permitted by law.
- Continued use of AIS websites, services or products following publication of an updated Policy may constitute acceptance of the revised Policy.
- Questions About Our Privacy notice
- Questions regarding this Policy may be directed to AIS using the contact details published by the organisation.
- Individuals located in the European Economic Area (EEA) or Switzerland who have questions or concerns regarding the processing of Personal Data may contact the AIS European Representative at: ais@sallbergco.se
- Correspondence may also be directed to:
Sällberg & Co AB
Attention: AIS
Bankgatan 1A
223 52 Lund
Sweden
- Individual Complaints
Individuals who believe their privacy has been affected may submit a complaint to AIS.
Complaints will be investigated and responded to within a reasonable timeframe.
If an individual is dissatisfied with the outcome, they may contact the Office of the Australian Information Commissioner (OAIC).
- Roles and Responsibilities
Executive Management
Responsible for supporting compliance with privacy obligations.
Information Security Manager
Responsible for:
- Maintaining this Policy.
- Monitoring privacy-related controls.
- Managing privacy incidents.
- Supporting compliance activities.
Employees and Contractors
Responsible for:
- Protecting Personal Information.
- Complying with this Policy.
- Reporting privacy incidents or suspected breaches.
- Related Documents
- Information Security Policy
- Access Control Policy
- Incident Management Process
- Data Disposal Policy
- Acceptable Use of Assets Policy
- Supplier Management Policy
- Security Risk Management Policy
- ISO 27001:2022 Reference
This Policy supports compliance with:
- 5.34 Privacy and Protection of Personally Identifiable Information
- 5.31 Legal, Statutory, Regulatory and Contractual Requirements
- 5.33 Protection of Records
- 5.15 Access Control
- 8.12 Data Leakage Prevention
