We respect your privacy. This policy explains what personal information we collect, why we collect it, how we look after it, and the choices you have. It applies to everything we do: our website, client engagements, events, marketing, and our dealings with staff and contractors.
1. Who we are
GCA Group Aus Pty Ltd (ACN 699 867 055, ABN 98 699 867 055) trades as GCA Group, a Melbourne advisory firm serving purpose-led organisations. In this policy, "we", "our" and "us" mean GCA Group. Our registered address is 16 Tanya Pl, Wheelers Hill VIC 3150.
We handle personal information in line with the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs), and we apply those standards across our business.
2. The information we collect
The personal information we collect depends on how you deal with us. It may include:
- Contact details: your name, email address, phone number, organisation and position.
- Engagement information: details you give us when you enquire about, or engage us for, advisory, project, event or coaching services, including your business needs and objectives.
- Booking information: your selected meeting time, length, location and attendee details when you use the Book a Meeting feature on our website.
- Event information: registration details, dietary or accessibility requirements you choose to tell us, and attendance records for events we run or support.
- Communications: emails, messages, meeting notes, and recordings or transcripts of meetings where all participants have been told.
- Website and technical data: IP address, browser and device type, pages visited and referring site, collected through cookies and similar technologies.
- Recruitment, staff and contractor information: CVs, referee details, work history, tax file numbers, superannuation and bank details, where needed for engagement or payroll.
- Payment and billing information: billing contacts and invoice details. We do not store full payment card numbers.
We do not ask for sensitive information (such as health, racial or ethnic origin, or political opinions) unless it is needed for a specific purpose, for example an accessibility need at an event. We only collect it with your consent.
3. How we collect it
We collect information directly from you, in person, by phone, by email, through our website and through our events. We may also collect it from your organisation, from referees and referrers, from public sources such as LinkedIn and company websites, and from partners we work with on joint programs. Where we collect information about you from someone else, we take reasonable steps to let you know.
4. Why we collect, use and disclose it
- Delivering services
- Scoping, quoting, delivering and invoicing our advisory, project recovery, event, coaching and workshop services.
- Communicating
- Responding to enquiries, scheduling meetings and sending confirmations and reminders.
- Marketing
- Sending newsletters, invitations and updates about our services and events. You can opt out at any time.
- Running the business
- Managing accounts, payroll, insurance, compliance, audits and security.
- Improving what we do
- Understanding how our website and services are used so we can improve them.
- Legal obligations
- Meeting our obligations under tax, corporate, employment, work health and safety and other laws.
We use your information for the purpose we collected it, for related purposes you would reasonably expect, or where you have consented or the law allows or requires it.
5. Who we share it with
We do not sell your personal information. We share it only with people and organisations that help us run our business, and only as far as needed. These include:
- Our team members, contractors and partners working on your engagement.
- Service providers for cloud storage, email, calendar and meeting tools (such as Microsoft 365 and Microsoft Teams, and video conferencing providers), website hosting and databases, email delivery, accounting, payroll and payments.
- Professional advisers, including accountants, lawyers, auditors and insurers.
- Event partners, venues and sponsors, where you have registered for an event and the sharing is part of running it.
- Government agencies and regulators where the law requires or authorises disclosure.
If we ever need to share your information with a client or partner in a way you would not expect, we will ask you first.
6. Overseas disclosure
Some of our service providers store or process information outside Australia, including in the United States, Europe and Singapore, depending on the service. Before we use these providers we take reasonable steps to make sure they handle information consistently with the APPs. By dealing with us you understand your information may be handled in these locations.
7. Website, cookies and analytics
Our website at gcagroup.com.au uses cookies and similar technologies to make the site work, remember your settings and measure traffic. Most browsers let you refuse or delete cookies in their settings, though some features of the site may not work as well if you do. Our site may link to other websites, such as LinkedIn. We are not responsible for the privacy practices of those sites and encourage you to read their policies.
8. Direct marketing
We may send you marketing messages by email or other channels where you have consented, or where you would reasonably expect to hear from us. Every marketing message includes a simple way to unsubscribe, and you can also ask us at any time by emailing privacy@gcagroup.com.au. We comply with the Spam Act 2003 (Cth).
9. How we protect your information
We take reasonable steps to protect personal information from misuse, interference, loss, and unauthorised access, modification or disclosure. These include access controls and multi-factor authentication on our systems, encrypted storage and transmission, confidentiality obligations for our team and contractors, and limiting access to those who need it.
We keep personal information only as long as we need it for the purposes above or as the law requires. When it is no longer needed, we destroy or de-identify it.
If a data breach is likely to result in serious harm to you, we will notify you and the Office of the Australian Information Commissioner (OAIC) as required by the Notifiable Data Breaches scheme.
10. Accessing and correcting your information
You can ask us for access to the personal information we hold about you, and ask us to correct it if it is inaccurate, out of date, incomplete or misleading. Email privacy@gcagroup.com.au. We may need to verify your identity first. We will respond within 30 days, and if we cannot give you access or make a correction, we will explain why in writing.
11. Complaints
If you think we have breached the APPs or this policy, please contact us using the details below with the details of your concern. We will acknowledge your complaint promptly, investigate it and respond within 30 days.
If you are not satisfied with our response, you can contact the Office of the Australian Information Commissioner: oaic.gov.au, 1300 363 992, or GPO Box 5288, Sydney NSW 2001.
12. Changes to this policy
We may update this policy from time to time. The current version is always available on our website and on request. The effective date at the top of this page shows when it was last changed.
13. Contact us
- Privacy contact
- GCA Group Aus Pty Ltd
- Post
- 16 Tanya Pl, Wheelers Hill VIC 3150
- Website
- gcagroup.com.au