Privacy Policy

Novulex Pty Ltd ACN 672332302 ABN 416 7233 2302, its subsidiaries and affiliates (collectively referred to as Novulex) are committed to managing personal information in accordance with the Australian Privacy Principles (APPs) under the Privacy Act 1988 (Cth) (Privacy Act) and in accordance with other applicable privacy laws.

These terms set out our policies for managing your personal information and is referred to as our Privacy Policy.  This Privacy Policy should be read in conjunction with our Website Terms of Use and our AI Policy. Together, these documents govern your use of our services and outline how we collect, use, disclose, and protect your personal information, including any processing involving artificial intelligence technologies. 

In this Privacy Policy, "we," "us," and "our" refer to Novulex, and "you" refers to any individual about whom we collect personal information. For the purposes of applicable data protection laws, including the Privacy Act where we are an APP Entity, and the European Union's General Data Protection Regulation (GDPR) where we act as a Data Controller, Novulex is responsible for determining the purposes and means of processing your personal information. We have appointed a Data Protection Officer (DPO) who oversees our data protection strategy and compliance with applicable laws.

About Novulex 

Novulex is a service company and not an incorporated legal practice. All solicitors associated with Novulex are consulting solicitors who perform all legal work under GTC Legal Pty Ltd ACN 655 561 514 trading as Taylor Rose Australia (Taylor Rose). Any legal services provided through Novulex are delivered by Taylor Rose, an incorporated legal practice regulated under applicable laws and professional regulations. 

What is Personal Information?

In this Privacy Policy, "personal information" has the meaning given under the Privacy Act and includes any information or opinion about an identified individual or an individual who is reasonably identifiable, whether the information is true or not, and whether recorded in a material form or not. This includes, but is not limited to, names, contact details, financial information, and sensitive information such as health data.

Your Consent

By providing us with your personal information, you consent to the collection, use, and disclosure of that information as described in this Privacy Policy. Where practicable, we will obtain your express consent for the collection of sensitive information or for the use of your personal information for purposes not disclosed in this Privacy Policy. Records of consent are maintained in compliance with legal requirements and in accordance with our organisation's policies.

Use in Legal Matters

As a consulting partner of Taylor Rose, we may use your personal information to provide legal services, which may include:

• Communicating with you and other parties involved in legal matters.
• Complying with legal obligations, court orders, and lawful requests from government or law enforcement agencies.
• Protecting our rights, privacy, safety, or property, and/or that of our clients or other third parties.

All personal information used in legal matters is handled in accordance with legal professional privilege, confidentiality obligations, and applicable laws. 

Joint Controllers

We may act as a joint controller with our affiliated companies when processing your personal data for shared purposes. We have arrangements in place to determine our respective responsibilities for compliance with our obligations. You can exercise your rights in respect of and against each of the joint controllers.

Cookies and Tracking Technologies

Our websites use cookies and similar tracking technologies to enhance your experience, analyse site traffic, and assist in our marketing efforts. Cookies are small data files stored on your device. The types of cookies we use include:

• Essential Cookies: Necessary for the website to function properly.
• Performance and Analytics Cookies: Help us understand how visitors interact with our website by collecting and reporting information anonymously.
• Functionality Cookies: Enable the website to provide enhanced functionality and personalisation.

You can control the use of cookies through your browser settings. However, disabling cookies may affect the functionality and features of our website.

Third-Party Analytics

We may use third-party service providers, such as Google Analytics, Microsoft Clarity or Azure Monitor to collect and analyse usage information. These providers may collect information about your use of the website over time and across different websites. For more information on how these providers collect and process data, please refer to Google's Privacy Policy and Microsoft's Privacy Policy.

Interactions on Social Media

If you interact with us through social media platforms (e.g., Facebook, LinkedIn, X (formerly Twitter)), we may collect personal information that you make available to us on those platforms, including your social media handle and any content you post publicly.

Third-Party Links

Our website may contain links to external websites or social media platforms. We are not responsible for the privacy practices or content of these third-party sites. We encourage you to review their privacy policies before providing any personal information.

Automated Processes

We may use automated processes, including profiling, to analyse information about you to improve our services and marketing strategies. These processes may influence the communications and offers you receive from us.

Privacy Rights 

Your Privacy Rights

We are committed to protecting your personal information and respecting your privacy rights under applicable data protection laws in the jurisdictions where we operate. Depending on your location and subject to local laws, you may have the following rights regarding your personal information:

• Right to Access: You have the right to request access to the personal information we hold about you and to obtain information about how we process it.
• Right to Rectification: You can request correction of any inaccurate or incomplete personal information we hold about you.
• Right to Erasure ("Right to be Forgotten"): You may request that we delete your personal information under certain circumstances, such as when it is no longer necessary for the purposes for which it was collected.
• Right to Restrict Processing: You have the right to request that we restrict the processing of your personal information in certain situations, for example, if you contest its accuracy.
• Right to Data Portability: You can request a copy of your personal information in a structured, commonly used, and machine-readable format, and have the right to transmit that data to another controller.
• Right to Object: You may object to the processing of your personal information for reasons related to your particular situation, including processing for direct marketing purposes.
• Right to Withdraw Consent: Where we rely on your consent to process your personal information, you have the right to withdraw your consent at any time without affecting the lawfulness of processing based on consent before its withdrawal.
• Rights Related to Automated Decision-Making: You have the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning you or similarly significantly affects you.
• Right to Lodge a Complaint: If you believe that we have infringed your privacy rights, you have the right to lodge a complaint with a supervisory authority or regulatory body responsible for data protection in your jurisdiction.

Exercising Your Rights

To exercise any of these rights, please contact our DPO using the contact details provided in this Privacy Policy. We may need to verify your identity before fulfilling your request to ensure the security of your personal information. We will respond to your request within the timeframes required by applicable laws.

Cross-Border Data Transfers

We operate globally and may transfer your personal information to countries outside of your country of residence, including countries that may not provide the same level of data protection as your home country. In such cases, we take appropriate steps to ensure that your personal information is protected in a manner that is consistent with this Privacy Policy and applicable laws, including:

• Implementing appropriate safeguards such as standard contractual clauses or binding corporate rules approved by relevant authorities.
• Transferring personal information based on your explicit consent, contractual necessity, or other legal bases permitted under applicable laws.
• Entering into data protection agreements with recipients of your personal information to ensure they protect your data adequately.

By providing us with your personal information, you consent to the transfer, processing, and storage of your information in countries outside of your country of residence as described in this Privacy Policy.

Protection of Children's Personal Information

Our services are not intended for individuals under the age of 16. We do not knowingly collect or solicit personal information from children without the consent of a parent or guardian where required by applicable laws. If we become aware that we have collected personal information from a child without such consent, we will take steps to delete that information promptly. If you believe that we might have any information from or about a child, please contact us.

What information do we collect? 

Clients and prospective clients 

When you enquire about our services or when you become a client of Novulex, a record is made which includes your personal information.

The type of personal information that we collect will vary depending on the circumstances of collection and the kind of service that you request from us, but will typically include:

• your name, e-mail, postal address and other contact details;
• information about your employer or an organisation who you represent;
• your professional details; and
• any additional personal information you provide to us, or authorise us to collect, as part of your interaction with Novulex.

Sensitive Information

We may collect sensitive information about you, such as information about your health, racial or ethnic origin, criminal record, or membership of a professional or trade association, only with your consent or as required by law. 

Explicit consent is obtained for processing sensitive personal data.

Sensitive information will be used and disclosed only for the purpose for which it was provided or a directly related secondary purpose, unless you agree otherwise or the use or disclosure of the sensitive information is required or authorised by law.

Other individuals 

Novulex may collect personal information about other individuals who are not clients of Novulex. This includes customers and members of the public who participate in events we are involved with; individual service providers and contractors to Novulex; and other individuals who interact with Novulex on a commercial basis. The kinds of personal information we collect will depend on the capacity in which you are dealing with Novulex. Generally, it would include your name, contact details, and information regarding our interactions and transactions with you.

If you are participating in an event we are managing or delivering, we may take images or audio-visual recordings which identify you.

Visitors to our websites 

The way in which we handle the personal information of visitors to our websites is discussed below.

Unsolicited Personal Information

If we receive personal information about you that we did not solicit, we will determine, within a reasonable period, whether we could have collected the information under the APPs. If we determine that we could not have collected the information and the information is not contained in a Commonwealth record, we will, as soon as practicable and if lawful and reasonable to do so, destroy the information or ensure it is de-identified.

How and why do we collect and use your personal information? 

Novulex collects personal information reasonably necessary to carry out our business, to assess and manage our clients' needs, and provide legal services. We may also collect information to fulfil administrative functions associated with these services, for example billing, entering into contracts with you and/or third parties and managing client relationships.

The purposes for which Novulex usually collects and uses personal information depends on the nature of your interaction with us, but may include: 

• responding to requests for information and other general inquiries;
• managing, planning, advertising and administering programs, events, competitions and performances;
• researching, developing and expanding our facilities and services;
• informing you of our activities, events, facilities and services;
• recruitment processes (including for volunteers, internships and work experience); and
• responding to enquires and complaints.

Novulex generally collects personal information directly from you. We may collect and update your personal information over the phone, by email, over the internet or social media, or in person. We may also collect personal information about you from other sources, for example:

• Australian Government organisations and regsiters, such as Land Registers, the Australian Securities and Investments Commission, the Personal Property Security Regsiter etc;
• our affiliated and related companies; and
• third-party suppliers and contractors who assist us to operate our business.

Novulex also collects and uses personal information for market research purposes and to innovate our delivery of products and services. 

Can you deal with us anonymously? 

Where practicable and lawful, you have the option to interact with us anonymously or using a pseudonym. For example, you may wish to make a general inquiry without providing your name. However, please be aware that in many cases, it may not be possible for us to deal with you anonymously or pseudonymously, especially where we are required to identify you to provide services or comply with legal obligations.

How do we hold information? 

Novulex stores personal information in secure environments, both physically and electronically. We are committed to protecting your personal information from misuse, interference, loss, unauthorised access, modification, or disclosure. Our practices for holding information include:

Physical Storage

Personal information collected in paper form is stored securely in locked facilities with controlled access. When appropriate, physical documents are converted to electronic format, and the original paper documents are securely archived or destroyed using certified shredding services.

Electronic Storage

Electronic records are stored in secure databases and systems, including trusted third-party cloud service providers located in Australia and overseas. We ensure that our service providers comply with applicable data protection laws and maintain robust security measures.

Security Measures

We implement a range of security measures to safeguard your personal information:

• Physical Security Controls: Our premises are protected by security systems, including locks, surveillance and access controls to prevent unauthorised entry.
• Technical Security Controls:
  • We use encryption protocols such as Secure Sockets Layer (SSL)/Transport Layer Security (TLS) to protect data transmitted over the internet.
  • Firewalls and intrusion detection systems are in place to protect our networks and systems from unauthorised access.
  • Access to personal information is restricted to authorized personnel on a need-to-know basis. We utilise strong authentication mechanisms, including user IDs, passwords, and multi-factor authentication.
  • Our systems and software are regularly updated and patched to protect against known vulnerabilities.
• Organisational Measures:
  • We receive regular training on data privacy and security practices.
  • We have established policies and procedures to guide our staff in handling personal information responsibly.
• Monitoring and Auditing:
  • We conduct periodic risk assessments and security audits to evaluate and improve our security practices.
  • An incident response plan is in place to manage and mitigate the effects of any security breaches promptly.

Website Security

Our websites utilise encryption technologies, such as SSL/TLS, to ensure the secure transmission of information over the internet. While we strive to protect your personal information, no method of transmission or electronic storage is completely secure. We encourage you to:

• Be cautious when submitting personal information online and ensure that you are using secure networks.
• Keep your login credentials confidential and notify us immediately if you suspect any unauthorised access to your account.

Data Retention and Destruction

We retain your personal information only for as long as necessary to fulfill the purposes for which it was collected, 

which may include:

• To comply with legal obligations, resolve disputes, and enforce our agreements. We may retain certain data to satisfy legal and regulatory requirements.
• Data related to contracts is retained for the duration of the contract and for a period thereafter as required by law.
• For operational needs, accounting purposes, auditing, and reporting obligations.
• We may retain your contact details for marketing purposes until you opt out or unsubscribe from such communications.

The retention periods vary depending on the type of data and the context of its collection. When personal information is no longer required, we take reasonable steps to securely destroy or de-identify it in accordance with applicable laws and regulations. Methods of destruction include:

• Shredding or incinerating physical documents containing personal information.
• Permanently deleting or anonymizing electronic records so that the information cannot be retrieved or re-identified.

Data Breach Notification

We have implemented procedures to detect, report, and investigate personal data breaches. In the event of a data breach, we will notify the relevant supervisory authority without undue delay and, where required, inform you if the breach is likely to result in a high risk to your rights and freedoms.

Do we use or disclose your personal information for direct marketing? 

We may use your personal information to send you marketing communications about our services, events, and promotions that may be of interest to you. These communications may be sent in various forms, including mail, email, SMS, and social media, in accordance with applicable laws.

Opting Out

You may opt out of receiving marketing communications from us at any time by:

• Using the unsubscribe link or opt-out mechanism provided in the communication.
• Contacting us directly using the contact details provided in this Privacy Policy.

Please note that even if you opt out of receiving marketing communications, we may still send you transactional or administrative messages related to our ongoing services.

How does Novulex use and disclose personal information? 

For clients 

The purposes for which we may use and disclose your personal information will depend on the services we are providing you. For example, if you have engaged us to deliver a service, we may disclose information about you to service providers where this is relevant to our services.

Processing of Special Categories of Data

Where we process sensitive personal data (e.g., health information), we do so based on your explicit consent or where necessary for the establishment, exercise, or defense of legal claims.

For potential clients and participants 

If you are a potential client or participant in an event, we may disclose your personal information to our clients and venues where this is reasonably necessary for, and relevant to, the delivery of the event. We may use images or audio-visual recordings which identify you for promotional purposes where you would reasonably expect this to occur.

Disclosure to contractors and other service providers 

Novulex may disclose information to third parties we engage in order to provide our services, including contractors and service providers used for data processing, data analysis, customer satisfaction surveys, information technology services and support, website maintenance/development, printing, archiving, mail-outs, and market research.

Personal information may also be shared between related and affiliated companies of Novulex, located in Australia and overseas.

Third parties to whom we have disclosed your personal information may contact you directly to let you know they have collected your personal information and to give you information about their privacy policies.

Use and disclosure for administration and management 

Novulex will also use and disclose personal information for a range of administrative, management and operational purposes. This includes:

• administering billing and payments and debt recovery;
• planning, managing, monitoring and evaluating our services;
• quality improvement activities;
• statistical analysis and reporting;
• training staff, contractors and other workers;
• risk management and management of legal liabilities and claims (for example, liaising with insurers and legal representatives);
• responding to enquiries and complaints regarding our services;
• obtaining advice from consultants and other professional advisers; and
• responding to subpoenas and other legal orders and obligations.

Other uses and disclosures 

We may use and disclose your personal information for other purposes explained at the time of collection or otherwise as set out in this Privacy Policy. 

Do we disclose your personal information overseas? 

Novulex and its affiliated organisations are global organisations and works with clients, service providers, sponsors and commercial interests across the globe. It is likely that your personal information will be disclosed to overseas recipients. 

We may disclose your personal information to overseas recipients for purposes necessary to provide our services, including data storage and processing. The countries in which these recipients may be located include, but are not limited to:

• New Zealand
• Canada
• United Arab Emirates
• United States of America
• United Kingdom

We will take reasonable steps to ensure that any overseas recipient complies with the APPs or is bound by laws or contractual obligations that offer similar protection of personal information.

Consent to Overseas Disclosure

By providing us with your personal information, you consent to the transfer of your personal information to recipients outside Australia as set out in this Privacy Policy. If you do not wish for your personal information to be disclosed overseas, please contact us.

How can you access or seek correction of your personal information? 

You have the right to request access to the personal information we hold about you and to request corrections if you believe it is inaccurate, out-of-date, incomplete, irrelevant, or misleading. To do so:

• Contact our DPO using the contact details provided. Please provide sufficient information to verify your identity and specify the information you require.
• Notify us of any changes or errors in your personal information, and we will take reasonable steps to correct it.

We will respond to your request within a reasonable time, usually within 30 days. In certain circumstances, we may decline your request in accordance with the APPs, and if so, we will provide you with written reasons for the refusal and information on how to complain if you are not satisfied.

What should you do if you have a complaint about the handling of your personal information? 

If you have concerns or complaints about how we have handled your personal information, please contact our DPO.  To assist us in resolving your complaint, please provide full details of the issue and any relevant documentation.

Our Complaints Process

• Acknowledgment: We will acknowledge receipt of your complaint within 7 days.
• Investigation: We will investigate your complaint thoroughly, which may involve reviewing relevant documents and speaking with staff members.
• Response: We aim to respond to your complaint within 30 days of receipt. If more time is needed, we will inform you of the reasons for the delay.
• Resolution: We will inform you of the outcome of our investigation and any steps we have taken or will take to address your concerns.

If you are not satisfied with our response to your complaint, or you consider that Novulex may have breached the APPs or the Privacy Act, a complaint may be made to the Office of the Australian Information Commissioner (OAIC). The OAIC can be contacted by telephone on 1300 363 992 or by using the contact details on the OAIC website.

How changes are made to this privacy policy? 

We may update this Privacy Policy from time to time to reflect changes in our practices or legal obligations. Any changes will be effective when published on our website at http://novulex.com.au.

For significant changes, we will provide a more prominent notice, such as a website banner or email notification. We encourage you to review this Privacy Policy periodically to stay informed about how we are protecting your personal information.

How can you contact Novulex? 

If you have any questions, concerns, or requests regarding this Privacy Policy or our handling of your personal information, please contact our Data Protection Officer:

Mail:

Novulex Data Protection Officer

PO Box 108

Salisbury QLD 4107

Australia

Email: info@novulex.com.au

Telephone: +61 3 398 090 513

 

This Privacy Policy was last updated in September 2024