1. Purpose

Crownland Security is committed to safeguarding personal information and protecting the confidentiality, integrity, and availability of all information assets in our care.

This policy outlines how we collect, use, disclose, store, and protect personal information, in compliance with applicable privacy, workplace, and information security laws.

We comply with:

• The Privacy Act 1988 (Cth), including the Australian Privacy Principles (APPs);
• Privacy Amendment (Enhancing Privacy Protection) Act 2012 (Cth);
• Relevant Work Health and Safety legislation (WHS Act 2011, VIC OHS Act 2004, and associated regulations);
• ISO/IEC 27001: Information Security Management Standard for ongoing best-practice information security management.

2. Scope

This policy applies to:

• All Crownland Security employees, contractors, and authorised third parties;
• All personal information collected, stored, processed, or transmitted by Crownland Security;
• All information assets, including electronic systems, physical records, CCTV and body-worn camera footage, and communication systems.

3. Collection of Personal Information

We collect personal information by lawful, fair, and transparent means only. Information may include:

• Identification details: name, date of birth, gender, photo ID.
• Contact details: phone number, email, residential address.
• Employment details: qualifications, licences, security clearances, employment history.
• Operational data: incident reports, visitor logs, CCTV recordings, body-worn camera footage.
• Sensitive information: health or criminal history data (only where strictly necessary, lawful, and proportionate).

Sources: Directly from individuals, via surveillance systems, clients, or authorised third parties.

Refusal to Provide Information: If you do not provide certain personal information, Crownland may be unable to:

• Provide contracted services;
• Allow site or building access; or
• Meet regulatory and compliance obligations.

4. Purpose of Collection & Use

Personal information is collected and used for:

• Delivering contracted security services;
• Monitoring and protecting people, assets, and property;
• Investigating incidents and cooperating with law enforcement;
• Staff recruitment, compliance, rostering, and training;
• Meeting legal and regulatory obligations;
• Internal management and continuous improvement of our services.

We do not sell personal information under any circumstances.

5. Information Security Management (ISO/IEC 27001 Alignment)

Crownland maintains a certified Information Security Management System (ISMS), with commitments including:

• Governance & Oversight: Senior management oversees privacy and information security risks.
• Risk Management: Regular assessment of risks, with layered controls to protect against threats.
• Access Control: Strict authentication and authorisation processes.
• Supplier & Third-Party Management: Contracts require all third parties to comply with APPs, ISO/IEC 27001, and confidentiality obligations.
• Incident Response: Security incidents and breaches are managed under formal response plans, with notification to OAIC and affected individuals where required.
• Business Continuity & Disaster Recovery: Security systems and services are designed for resilience and recovery.
• Continuous Improvement: Regular audits, penetration testing, and staff training.

6. Storage, Data Residency & Retention

• Personal information is stored on secure servers located in Australia, unless otherwise required for contracted services.
• If information is transferred overseas, we ensure that the recipient provides privacy protections consistent with APPs and ISO/IEC 27001.
• Personal information is retained only for as long as necessary for operational, legal, or regulatory purposes.
• Once no longer required, data is securely destroyed (e.g., shredding, digital wiping) or permanently de-identified.

7. Use & Disclosure

Personal information may be disclosed to:

• Clients, to fulfil contracted security obligations;
• Law enforcement, regulators, and courts;
• Insurers, auditors, and legal advisors;
• Approved third-party providers (IT, payroll, secure storage) under binding confidentiality agreements.

We may restrict disclosure where it would:

• Prejudice anticipated legal proceedings;
• Reveal commercially sensitive information; or
• Breach confidentiality obligations.

8. CCTV, Surveillance & Monitoring

Crownland operates CCTV systems, access control systems, and body-worn cameras to support security operations.

• These systems are used for:
• Crime prevention and detection;
• Incident investigation;
• Workplace health and safety obligations;

Compliance with Owners Corporation rules, client requirements, and law enforcement requests.

9. Accuracy & Correction

We take reasonable steps to keep personal information accurate, complete, and up-to-date.

• Individuals may request access to or correction of their information.
• Requests will be verified for identity and processed within 30 days.
• Where correction is not possible, a statement may be attached to the record at the individual’s request.

10. Rights of Access & Limitations

Access to personal information may be denied where:

• It relates to legal proceedings;
• It would unreasonably impact the privacy of others;
• It reveals Crownland’s commercially sensitive information.

11. Complaints & Escalation

Step 1: Internal Resolution – Complaints should be lodged with our Privacy Officer (details below). We will investigate and provide a written response.

Step 2: External Resolution – If unsatisfied, individuals may escalate complaints to the Office of the Australian Information Commissioner (OAIC):

GPO Box 5218, Sydney NSW 2001

www.oaic.gov.au

12. Transparency & Policy Updates

This policy is published on our website and may be updated from time to time. Updates take effect once published.

We encourage staff, clients, and the public to review this policy regularly to stay informed of how Crownland protects personal information.

13. Contact – Privacy Officer

For access requests, corrections, or complaints, contact:

Privacy Officer – Crownland Security

Email: privacy@crownlandsecurity.com.au

Phone: 1300 276 965

Postal: Suite 35, 135 Cardigan Street, Carlton, Vic 3053 Australia

14. Review

This policy will be reviewed annually, or sooner if required by law, industry standards, or significant operational changes.

Charlie Kobak

Managing Director

Crownland Security