Purpose
Sparkview Pty Ltd is committed to protecting the privacy, confidentiality, security and integrity of information handled by the Company.
This Policy explains how Sparkview Pty Ltd manages Consumer Data Right (CDR) data and personal information and how the Company complies with applicable requirements under the Privacy Act 1988 (Cth), the Competition and Consumer Act 2010 (Cth), the Consumer Data Right Rules 2020, and applicable CDR Privacy Safeguards.
This Policy is intended to support transparent, secure and responsible management of CDR data.
Scope
This Policy applies to:
• all directors, officers, employees and contractors of Sparkview Pty Ltd.
• third-party service providers who handle information on behalf of Sparkview Pty Ltd.
• all systems, applications and processes used to collect, receive, store, use, disclose or otherwise handle CDR data
• all CDR data handled by Sparkview Pty Ltd.
Where applicable, this Policy should be read together with the Company’s general Privacy Policy, Information Security Policy, Data Retention Policy, Incident Response Policy and other relevant internal policies.
Privacy and Compliance Framework
Sparkview Pty Ltd will take reasonable steps to implement practices, procedures and systems designed to ensure compliance with applicable privacy and CDR requirements.
The Company will maintain appropriate governance arrangements, including:
• assigning responsibility for privacy and CDR compliance;
• maintaining appropriate policies and procedures;
• providing relevant staff with privacy and security training;
• monitoring compliance;
• reviewing this Policy periodically;
• responding to privacy inquiries and complaints; and
• taking appropriate corrective action where non-compliance is identified.
Collection of CDR Data
Sparkview Pty Ltd will only seek to collect CDR data where permitted under the CDR framework and where the required consumer consent or authorisation has been obtained.
The Company will seek to ensure that:
• consumers understand what data is being requested;
• the purpose for collecting the data is explained;
• only data reasonably required for the relevant purpose is collected;
• data is not collected for an unrelated purpose; and
• consent and authorisation records are maintained where required.
Use and Disclosure of CDR Data
CDR data will only be used or disclosed for purposes permitted under applicable CDR requirements and the consumer’s consent, unless another lawful basis or exception applies.
The Company will not use or disclose CDR data for unrelated purposes.
Where direct marketing is proposed, the Company will ensure that the relevant CDR requirements and consumer consent requirements are satisfied before using CDR data for that purpose.
Consumer Consent
Consent is an important component of the CDR framework.
Where consent is required, Sparkview Pty Ltd will ensure that the consent process is appropriately designed and documented.
Consumers will be provided with appropriate information about:
• the data being requested;
• the purpose for which the data will be used;
• the duration or relevant period of the consent;
• the parties involved in the data sharing arrangement; and
• how consent can be withdrawn.
Consumers will be able to withdraw consent through the applicable consumer dashboard or other mechanism provided by the Company.
Consumer Access and Correction
Consumers may request access to CDR data held by Sparkview Pty Ltd, subject to applicable legal requirements.
Consumers may also request correction of information that is inaccurate, incomplete or misleading.
The Company will assess and respond to requests within the timeframes required by applicable law and the CDR Rules.
Where appropriate, the Company will take reasonable steps to correct information and notify relevant parties where required.
Anonymity and Pseudonymity
Where required by the CDR framework, Sparkview Pty Ltd will provide consumers with appropriate options to deal with the Company without identifying themselves or by using a pseudonym.
Exceptions may apply where identification is required or permitted by law or where dealing with an unidentified or pseudonymous consumer is not reasonably practicable.
Data Security
Sparkview Pty Ltd will take reasonable steps to protect CDR data against:
• unauthorised access;
• unauthorised disclosure;
• misuse;
• loss;
• interference;
• unauthorised modification;
• destruction; and
• other security threats.
Security controls may include, as appropriate:
• access controls and authentication;
• encryption;
• secure system configuration;
• logging and monitoring;
• vulnerability management;
• security testing;
• employee security training;
• secure backups;
• incident response procedures; and
• regular review of security controls.
Access to CDR data will be limited to authorised individuals who require access for legitimate business purposes.
Data Retention and Deletion
Sparkview Pty Ltd will not retain CDR data for longer than is reasonably required for an authorised purpose, subject to applicable legal, regulatory and contractual retention requirements.
Where CDR data is no longer required and no lawful retention requirement applies, the Company will take appropriate steps to delete or de-identify the information in accordance with applicable CDR requirements.
Overseas Disclosure
Sparkview Pty Ltd will comply with applicable CDR restrictions relating to overseas disclosure of CDR data.
Before transferring or disclosing CDR data outside Australia, the Company will assess whether the proposed disclosure is permitted under the applicable CDR framework.
Data Quality
Sparkview Pty Ltd will take reasonable steps to ensure that CDR data held and disclosed by the Company is accurate, complete and up to date where required.
If the Company becomes aware that incorrect CDR data has been disclosed, it will take appropriate steps to address the issue in accordance with applicable CDR requirements.
Data Breaches and Security Incidents
Sparkview Pty Ltd will maintain procedures for identifying, assessing, responding to and reporting privacy and security incidents.
Where a suspected or actual data breach occurs, the Company will:
1. identify and contain the incident;
2. assess the information affected;
3. determine the potential impact on consumers;
4. take reasonable steps to remediate the incident;
5. notify affected individuals and regulators where required; and
6. document the incident and any corrective actions.
Where applicable, the Company will comply with the Privacy Act’s Notifiable Data Breaches requirements and relevant CDR requirements.
Complaints and Privacy Enquiries
Consumers may contact Sparkview Pty Ltd regarding:
• privacy concerns;
• CDR data;
• consent or authorisation;
• access or correction requests;
• withdrawal of consent;
• deletion of redundant data; or
• complaints concerning the Company’s handling of CDR data.
Contact Details:
Privacy Officer:
Email: info@Sparkview Pty Ltd.com.au
Phone: +61 412 165 316
Postal Address: Unit 1, Ground Floor, Building 3, 540 Springvale Road, Glen Waverley – 3150
The Company will investigate complaints fairly and within a reasonable timeframe.
Where a consumer is dissatisfied with the Company’s response, they may have the right to contact the Office of the Australian Information Commissioner (OAIC) or another relevant external dispute resolution body.
Consumer Dashboard
Where Sparkview Pty Ltd is required to provide a consumer dashboard, the Company will ensure the dashboard provides the functionality required by applicable CDR Rules and standards.
This may include allowing consumers to:
• view their consents;
• manage their consents;
• withdraw consent;
• manage data-sharing arrangements; and
• make relevant deletion requests.
Third-Party Service Providers
Where third parties are engaged to provide services involving CDR data, Sparkview Pty Ltd will assess the relevant privacy and security risks before engagement.
Contracts with relevant service providers should include appropriate requirements concerning:
• confidentiality;
• information security;
• permitted use of information;
• data handling;
• incident notification;
• access controls;
• deletion or return of data; and
• compliance with applicable laws.
Staff Responsibilities
All employees and contractors who have access to CDR data must:
• comply with this Policy;
• only access information required for their role;
• protect passwords and authentication credentials;
• not disclose CDR data without authorisation;
• report suspected privacy or security incidents promptly; and
• complete required privacy and security training.
Breaches of this Policy may result in disciplinary or contractual action.
Training and Awareness
Sparkview Pty Ltd will provide appropriate privacy and information security training to personnel who handle CDR data.
Training will be provided:
• during onboarding where appropriate;
• periodically;
• when significant regulatory or operational changes occur; and
• where additional training is identified as necessary.
Monitoring and Review
This Policy will be reviewed at least annually and whenever there are significant changes to:
• CDR legislation or rules;
• privacy requirements;
• Company’s CDR arrangements;
• information systems;
• data handling practices; or
• identified privacy or security risks.
The Privacy Officer or nominated responsible person will oversee the review.
Record Keeping
Sparkview Pty Ltd will maintain appropriate records relating to CDR compliance, including where applicable:
• consumer consents;
• data requests;
• disclosures;
• access and correction requests;
• complaints;
• privacy incidents;
• security incidents;
• training;
• compliance reviews; and
• policy reviews.
Records will be retained in accordance with applicable legal and business requirements.
Policy Approval
This Policy has been approved by:
Name: ______________________________
Position: ___________________________
Signature: __________________________
Date: ______________________________
Document Control
| Version | Date | Description | Approved By |
| 1.0 | [DATE] | Initial Policy | [NAME] |
Important: This Policy is a template and should be customised to reflect the Company’s actual CDR role, systems, data flows, consent processes, security controls and business operations. It should be reviewed by an appropriately qualified Australian privacy/CDR professional before being represented as legally compliant.