Privacy Policy

• Our approach to privacy
• Meaning of 'personal information'
• Use of your personal information
• How we collect personal information
• Collection of personal information and what we do with it
• Website privacy
• Web Based Data Collection
• Cookies
• Web beacons
• Clickstream data
• Links to external websites
• Disclosure of personal information
• Data quality and data security
• Information Security risks
• Online payments
• Access to your information
• Staying anonymous
• Privacy complaints
• Further information

Our approach to privacy

The Residential Tenancies Bond Authority (RTBA) is committed to responsible and fair handling of your personal information, consistent with the Information Privacy Principles set out in the Privacy and Data Protection Act 2014 (Vic) and the confidentiality requirements of section 499 of the Residential Tenancies Act 1997 (Vic).

This Privacy Statement tells you how we manage your personal information. It applies to all your contact with us, whether in person, over the telephone or online.

Meaning of 'personal information'

Personal information means information or an opinion, that is recorded in any form, and whether true or not, about an individual whose identity is apparent or can reasonably be ascertained from the information or opinion.

The sort of personal information we collect includes name, address, telephone and email contact details, complaint details and the information we need to process the various residential tenancy bond transactions.

Use of your personal information

The RTBA uses the personal information it collects to undertake bond lodgment, transfer and repayment functions, and to pursue compliance with the Residential Tenancies Act 1997 (Vic).

Under section 499 of the Residential Tenancies Act 1997 (Vic) the RTBA is required to keep confidential any information concerning the affairs of a person. Information may be provided to third parties only where:

• it is required by a court;
• the person to whom the information relates has provided their written consent;
• the Minister for Consumer Affairs has approved the supply; or
• it is required to be provided under another Victorian or Australian law.

Under section 431 of the Residential Tenancies Act 1997 (Vic) the RTBA is also required to provide the information contained in bond lodgment forms to the Director of Housing for use in research, statistics, and public education. The information supplied by the RTBA excludes names, dates of birth, email addresses and telephone numbers.

The RTBA does not collect health information or any other sensitive personal information.

How we collect personal information

We collect personal information:

• when you submit a paper form
• when you submit an online form
• when you write to us
• when you email
• when you telephone

We may get personal information about you from other people or organisations. For example:

• when we investigate a complaint
• when we obtain your contact details from another person or a public database such as a telephone directory.

Whenever we collect personal information, we will take reasonable steps to ensure you are aware of:

• the fact that we have collected your personal information;
• how to contact us;
• how you can gain access to the information;
• the purposes for which we are collecting the information;
• to whom (or the types of individuals or organisations to which) we usually disclose information of that kind;
• any law that requires the particular information to be collected; and
• the main consequences (if any) if you do not provide the information.

Collection of personal information and what we do with it

We mainly collect personal information to undertake bond transactions. Most of the information we collect will come directly from you or from another party to the bond in which you have an interest.

We may collect personal information for other reasons. Some of our work involves the 'indirect' collection of personal information - that is, where personal information is collected or received about you, but from someone else or from some other source.

For example, if:

• a complaint is made about you, we use the details provided to investigate the complaint
• an enquiry is received, we may record the name of the respondent and related details
• we are carrying out an investigation or enforcement, we may collect personal information about you from the Business Licensing Authority, Consumer Affairs Victoria, or other State or Federal agencies
• we need to publicise a new law or seek feedback on a new initiative, we may get your details from a publicly available database

We may need to use your personal information for a purpose that is different from the reason we originally collected it. For example, where:

• we undertake an investigation or enforcement action
• we carry out research or collect statistics

Website privacy

The websites operated by or on behalf of the RTBA are "RTBA Online" and Residential Tenancies Bond Authority information page hosted by Consumer Affairs Victoria.

You can access the RTBA websites without disclosing your personal information. We do not collect personal information when you visit or browse. Where you submit an email automatically generated from the website, or complete and submit a form online, your personal information will be managed in accordance with the policy set out in this Privacy Statement. Email addresses are not added to mailing lists without your consent.

The RTBA does not collect any credit card details.

We may preserve the content of any electronic message that we receive. Any personal information contained in that message will only be used or disclosed in ways set out in this Privacy Statement. We will not use that information to add you to a mailing list without your consent.

Web Based Data Collection

Pages on the RTBA websites may be coded with Google Analytics software. This software stores a cookie in your browser, which contains a unique identifier, and sends information to Google. This enables Google to track the number of unique visitors to the site. In no way does this unique identifier identify a user personally. We do not and will not marry any data collected by Google with any personal information.

While you can browse the RTBA websites anonymously, without disclosing your personal information, we may not be able to provide the full range of services through this website if we are not provided with the information previously outlined.

When you provide us with personal information about other individuals, reasonable steps must be taken to ensure this fact is brought to the other individuals' attention. We rely on you to make them aware:

• that such information will or may be provided to the RTBA
• why such information will be made available to the RTBA
• the consequences of not making the information available
• that the Residential Tenancies Act 1997 (Vic) requires the collection of the information
• of the types of third parties we may provide the information to
• of the relevant purposes that we and such third parties will use the information for, and
• how they can access the information.

The RTBA will also, in appropriate circumstances, take reasonable steps to ensure that an individual is or individuals are made aware that it holds information in respect to them.

Cookies

Like many sites, the RTBA websites may use cookies from time to time.

Cookies are small data files that a website is able to place on a user's hard drive to record aspects of that user's experience of the website. For example, we may use cookies to record that a user visited a particular section of the website, that their browsing software was a particular version or to ensure that online applications and transactions do not require you to re-input information when moving between web pages. In this way, cookies can improve the operation of the website, and make the experience more efficient, more enjoyable or more personalised. Importantly, in depositing information on a user's computer and referring to it later in the same session (sessional) or on a subsequent visit (persistent), cookies do not need to identify the user or record any personal information.

The default settings of browsers like Internet Explorer and Chrome may allow some or all cookies, but users can easily take steps to erase cookies from their hard-drive, block all cookies, or receive a warning before a cookie is stored. However, some parts of the RTBA websites may not function fully for users that disallow cookies.

Web beacons

The RTBA websites uses web beacons, also known as web bugs, pixel tags or clear GIFs, as some pages on the site are coded with Google Analytics (see further information under Web Based Data Collection).

Used in combination with cookies, a web beacon is an often-transparent graphic image, usually no larger than 1 pixel x 1 pixel, which is placed on a site or in an email that is used to monitor the behaviour of the user visiting the site or receiving the email.

When the HTML code for the web beacon points to a site to retrieve the image, at the same time it can pass along information such as:

• the IP address of the computer that retrieved the image
• the time the web beacon was viewed and for how long
• the type of browser that retrieved the image and
• previously set cookie values.

Web beacons are typically used by a third party to monitor the activity of a site. If you have concerns about web beacons, turning off the browser's cookies will prevent web beacons from tracking your activity. The web beacon will still account for an anonymous visit, but your unique information will not be recorded.

Clickstream data

The web servers used by the RTBA websites automatically record non-personal clickstream data. To the extent that any clickstream data could make you identifiable, we will not attempt to identify you from clickstream data unless required by law or to investigate suspected improper activity in relation to the websites or to assist in law enforcement.

The following clickstream data are automatically recorded by our web servers for statistical and system administration purposes only:

• your server address;
• your top level domain name (e.g. .com, .au, .gov);
• the date and the time of your visit to the site;
• the pages you accessed and downloaded;
• the address of the last site you visited;
• your operating system;
• the type of browser you are using.

Links to external websites

The RTBA Privacy Statement does not extend beyond the RTBA Websites. When following links to other sites from our websites, we recommend that you read the privacy statement of that site to familiarise yourself with its privacy practices.

Disclosure of personal information

We may share personal information with our service providers who assist us in providing our websites; our bond lodgment, repayment and registry services; and other products and services such as organisations who provide archival, auditing, professional advisory, banking, mailhouse, delivery, call centre, technology, research, utility and security services. Such service providers may be outside of Victoria and in other countries.

We may also disclose your personal information to third parties acting on your behalf, for example your solicitor or interpreter.

Data quality and data security

We make every effort to ensure that personal information we collect, use or disclose is accurate, complete and up-to-date. Most of our information is collected or received directly from the person concerned, and is used for its intended purpose without delay.

We have secure office premises and a security pass entry system. Our files are protected from outside or unauthorised access, while older files are securely archived at separate premises. Our information technology arrangements also incorporate data security measures. We require staff to use passwords to enter the computer system and our databases require an additional password, with different levels of access depending on the role of the officer concerned. Only staff who need to use your information have access to it. We have 'firewalls' to protect the integrity of the information we store electronically and we also screen routinely for viruses. These and other measures help protect your personal information from misuse, loss or unauthorised access, unauthorised modification or disclosure.

Where personal information is disclosed or made available to contractors (for example to provide bond lodgment, repayment and registry service, or do a large mail-out), we ensure that the contract requires confidentiality, restricts the use of the information to the purposes of the contract and clarifies what happens to personal information when the contract finishes. Wherever possible, arrangements are also made to enable us to monitor the contractor's compliance. Where contractors are involved in handling private information, we require them to comply with the information privacy principles.

Information Security Risks

We have implemented technology and security policies, rules and measures to protect the personal information that we have under our control. However, you should be aware that there are risks in transmitting information across the Internet. So while we strive to protect such information, we cannot ensure or warrant the security of any information transmitted to us online and individuals do so at their own risk. Once any personal information comes into our possession, we will take reasonable steps to protect that information from misuse and loss and from unauthorised access, modification and disclosure.

If you are concerned about conveying sensitive material to us over the Internet, you might prefer to contact us by telephone or mail. We will remove personal information from our system where it is no longer required (except where archiving is required).

Online payments

If you make a payment using this website, we may process your payment with the assistance of a reputable third party electronic payments service provider and present you with an online receipt for your records.

If you make an online application or another payment transaction using the RTBA Websites we take additional steps to protect the security of your personal information, such as strong 128-bit SSL encryption. Before using these facilities, you should ensure that you are using a web browser that supports 128-bit encryption. In many web browsers, you can confirm that your session is encrypted by the appearance of a locked padlock symbol at the foot of the browser.

Access to your information

You can request access to the personal information we hold about you at any time. We will try to give you access to your personal information with as little formality as possible. We will only refuse you access to your personal information if we are permitted by law to do so. However, where your request is difficult or time consuming to answer, we may charge a fee.

If you become aware that personal information we hold about you is not accurate, complete or up to date, you can ask us to correct it.

Staying anonymous

Most of the things we do require you to provide us with personal information. However, where it does not affect the proper performance of our functions, we will not require you to provide it. For instance, if you make an enquiry about a RTBA process or a consumer protection law, we can help you over the telephone or by email without the need for you to give us any of your personal details.

Privacy complaints

If you are unhappy about the way we have handled the privacy of your personal information, you may complain in person, by telephone or in writing. Oral complaints that are judged to need more than 5 days to respond must be put into writing. Written privacy complaints about the RTBA are handled by Consumer Affairs Victoria.

To make a privacy complaint, view the Provide feedback about Consumer Affairs Victoria page.

Our Privacy Coordinator will handle the investigation of a privacy complaint. Consumer Affairs Victoria will acknowledge oral and written complaints within 5 working days, and will provide a full response within 20 working days.

If you are not satisfied with the outcome, you are entitled to complain directly to the Office of the Victorian Information Commissioner (OVIC). OVIC is an independent body that investigates complaints about possible privacy breaches by public sector organisations and local government. For more information, visit the Office of the Victorian Information Commissioner website or call 1300 666 444.

Further information

Further information is available:

Telephone: 1300 137 164 Email:rtba@justice.vic.gov.au Web:Residential Tenancies Bond Authority information page hosted by Consumer Affairs Victoria