The University of Melbourne is governed by the Privacy and Data Protection Act 2014 (Vic) and the Health Records Act 2001 (Vic) when collecting and managing the personal and health information of individuals (referred to collectively in this statement as ‘personal information’). To the extent that they apply to our activities, the University is also subject to the requirements of the Privacy Act 1988(Cth) and the European Union General Data Protection Regulation 2016/679 (which relates to the personal data of individuals located in the European Economic Area). (Together, ‘Privacy Laws’)

“Personal information” is defined broadly in the Privacy Laws as recorded information or opinion that relates to an identified or identifiable individual.

The “processing" of personal information refers to all activities relating to the management of personal information by the University, from its collection and use, through to its storage and disposal, and everything in between.

We are committed to protecting your privacy and processing your personal information fairly and lawfully in compliance with the Privacy Laws as applicable.

The University collects and processes the personal information of alumni, friends and supporters through lawful and fair means and in a non-intrusive way throughout their engagement with the University. We will collect this information directly from you wherever possible.

If you studied at the University, information that you provided upon enrolment and during your time as a student, or which is otherwise collected by the University during your studies, is then provided to the Alumni Office. The collection and processing of students’ personal information is explained in the University’s Student Privacy Statement. If you do not wish to be contacted as an alum of the University, please contact Stop1 by phoning 13 MELB (13 6532) as a student of the University, or the Alumni Office at advancement-operations@unimelb.edu.au in your interaction as an alum.

If you register for events, campus tours, newsletters or are a supporter of, or a volunteer at, the University, we will hold the personal information provided by you during your interactions with us. This is explained in the relevant privacy collection notices specific to those activities. You may also provide us with your personal information when you agree to participate in user experience research or provide feedback.

The University also collects and holds personal information derived from publicly available sources, either directly or through targeted internet searches, to maintain our records. These public sources may include, social media, business-related resources including company websites, honours lists, and reliable news sources.

Examples of categories of personal information which we may hold are:

• Biographical/contact details – such as your name, postal/email address and telephone number, date of birth, gender, nationality, marital status, and your unique personal identifier (student number and our Advancement database ID);
• Education details – for example, the courses you completed and dates of study;
• Professional details – such as your employer, occupation and work address;
• Any preferences provided by you for a specific purpose such as access requirements or other adjustments and dietary preferences for event management purposes, and your communication preferences;
• Philanthropic details – for example, your history of donations made to the University, both of time (for example, volunteering or participation in mentoring programs) and money, and your areas of philanthropic interest and publicly known philanthropy;
• Engagement details – such as your membership of clubs, societies and groups, as an alum or when you were a student, your attendance at University events or participation in programs, your relationships with other alumni or supporters of the University, your access to alumni benefits and services, and your publicly-known relationships with non-University stakeholders; and
• Photographs – including those we have taken (for example, at events or to accompany a published interview) and those which are in the public domain.

Most of the personal information we hold is information that you have provided to the University or information which is in the public domain. We only process personal information for specified purposes and in accordance with the Privacy Laws as relevant.

In general terms, we process your personal information to improve your experience and engagement with the University as a supporter and/or member of our alumni community.

The personal information processed by us, or on our behalf, is necessary to foster alumni relationships, maintain and facilitate alumni networks and benefits, and to help us engage with you and improve your experience with the University. Your personal information may also be used for the purposes of benchmarking, analysis, quality assurance and planning, and to ensure that we can provide you with the services and information requested by you.

We also process personal information for the following purposes:

• To inform you of opportunities to engage with and support the University;
• To generate philanthropic support (for example, fundraising and/or volunteering) for University charitable projects. More specifically, these activities may include:
  • sending you publications, such as the alumni magazine, email newsletters about the University and its fundraising projects, and updates on University hosted, sponsored or affiliated events, in a way which is tailored and relevant to you;
  • helping you keep in touch with other alumni and/or University supporters and donors by inviting you to alumni and University events;
  • informing you of and providing benefits available to alumni (where you are interacting with us as an alum);
  • through a variety of channels, such as phone, email or social media, asking you if you would like to support the University by, for example, making a donation, contributing to surveys, volunteering, or acting as a mentor;
  • thanking you for any gifts of time and money that help the University’s charitable causes;
  • undertaking any necessary due diligence to align with the University’s Gift Policy and the Donations Framework; and
  • internal record-keeping and administration (for example, to process a donation or administer an event which you are attending).
• To validate your address and to prepare reports using maps by ‘geocoding’ your address against publicly available web mapping services;
• To inform you about University courses or events;
• To seek feedback of your experience as an alum or supporter of the University;
• To publish photographs and videos relating to our activities and events. We will inform you about such processing at the time that the information is obtained or as soon as reasonably possible thereafter;
• To compile anonymised statistics for benchmarking in which the University participates;
• To attend to routine administrative matters, and to provide associated services such as security, parking and information technology; and
• To use the information as required or otherwise permitted by law.

We may occasionally carry out wealth screening. This involves using trusted third parties who review information which is in the public domain (for example, FTSE100 directorships, company directorships, property holdings, Forbes rich lists, etc.) on our behalf to give an indication of the financial giving capacity of individuals. We never use the data produced by this exercise as the sole basis for sending out communications; it is a starting point for further research we carry out about a person to identify if they may be interested in supporting the University, which includes considering any previous engagement with the University, their philanthropic interests and previous donations. This enables us to identify and contact only those individuals whose interests we believe align with our charitable fundraising mission.

We consider that the lawful basis for the processing of your personal information as an alum, friend and supporter of the University is that it is necessary:

• To maintain strong relationships with our alumni and supporters, enable our alumni community to remain connected to the University and each other, for the pursuit of the University’s legitimate interests in support of its charitable mission, and for fundraising purposes;
• To fulfil and monitor our responsibilities to comply with legislative reporting requirements;
• To support the performance of tasks carried out in the public interest (such as teaching, learning and research), or in the exercise of our official authority, for example the completion of the Graduate Outcomes Survey; and
• Very occasionally, when it is needed to protect your or another person’s vital interests and you are not capable of giving your consent (for example, in an emergency).

In some circumstances we will need to obtain your consent for specific use of your personal information (for example, if you are not an alum of the University, or if, because of a disability, we need to make reasonable adjustments for you at an event we are organising), or where that personal information includes sensitive information or special category data. You can withdraw your consent to our specific use of such information at any time.

If you choose not to allow the University to process your personal information, it may not be possible for us to process your particular request or benefit, or to inform you of courses or engagement opportunities in which you have expressed interest.

Within the University, your information is shared with only those University staff who need access for the purpose of delivering our alumni and supporter activities. Your personal information is held securely on the University’s Advancement database, which is restricted to nominated and authorised university employees.

Your personal information is shared as necessary, on a considered and confidential basis, with several external organisations which assist with our alumni and supporter activities. These organisations act on our behalf in accordance with our instructions for the legitimate purposes outlined in this statement, and do not process your information for any purpose over and above what we have requested. We make sure we have appropriate agreements with them in place.

Sometimes your personal information is processed by these organisations outside of Victoria or Australia (for example, where they are located internationally or use a cloud-based system with servers based in international jurisdictions). If so, appropriate safeguards are in place to ensure the confidentiality and security of your personal information. We take all reasonable steps to ensure that the interstate or overseas transfer of personal information is in accordance with this Privacy Statement, the University’s Privacy Policy and other relevant policies, and the Privacy Laws as applicable.

It is also sometimes necessary for us to share personal information with third parties as follows:

• Third parties engaged by the University to provide alumni, supporter and fundraising related services, such as banks, mailing houses, logistics, IT service providers, social media platforms and caterers for University events – we share biographical, contact and education details, professional details, volunteering and philanthropic details;
• Event venue providers – names and accessibility and assistance requirements and related information;
• Your nominated financial institution and government departments such as the Australian Taxation Office (ATO) (where you make a donation);
• Occasionally, and when necessary, internal and external auditors or regulators; and
• In the event of an emergency or law enforcement matter, police, medical or hospital personnel, civil emergency services, your legal representative, or other person assessed as necessary to respond to the emergency.

Where personal information is disclosed to third parties, it will be done so only to the extent necessary to fulfil the purpose of such disclosure. We ensure we have appropriate information sharing and/or processing agreements in place before sharing your personal information with any third parties.

Where appropriate, examples of third parties the University provides personal information to and for what purposes are captured in privacy collection notices specific to particular activities, which are provided to you at the time your personal information is collected (or as soon as reasonably possible thereafter).

We do not sell your personal information to third parties under any circumstances or permit third parties to sell on the information we have shared with them.

The University handles a substantial amount of information about people. It is important that individuals have trust and confidence that the University will protect their privacy. The University takes great care to ensure that personal information is handled, stored and disposed of confidentially and securely.

Our staff receive regular privacy and data protection training, and the University has implemented organisational and technical measures so that personal information is processed in accordance with the Privacy Laws as applicable.

Your personal information is created, stored and transmitted securely in a variety of paper and electronic formats. This includes databases that are shared across the University. Accordingly, your personal information is not segregated or treated differently from any other personal information based on your geographic location or jurisdiction.

Access to your personal information is limited to University staff and representatives of University affiliates who have a legitimate interest in it for the purpose of carrying out their duties. We take all reasonable steps to ensure that any personal information we and our contracted service providers or affiliates, transmit, store or otherwise process, is accurate and complete, and that appropriate technical and organisational measures are implemented and maintained to protect your personal information from accidental or unlawful destruction, misuse, loss, alteration, or unauthorised access or disclosure.

Typically, we retain most of your personal information indefinitely in support of your lifelong relationship with the University, or until there is no longer a legal basis for processing it, or unless you withdraw your consent for the use of your personal information for direct marketing purposes. If you change your mind about receiving information about the University’s alumni and supporter services and activities, you can contact us advancement-operations@unimelb.edu.au.

Once your personal information is no longer required for the purpose it was collected, and in accordance with our other legislative obligations, it is securely destroyed in compliance with the University’s retention and disposal authority.

You may request access to, or correction of, your personal information we hold, or exercise rights of access, rectification, erasure and other rights under the GDPR if applicable, unless providing you with access would have an unreasonable impact on the privacy of others or would contravene the University’s other legislative obligations.

Personal information obtained via the alumni portal can be viewed by you through the portal. If this information is incorrect, or needs to be updated, you will be able change it. Depending on the type of change, this can be done online or by contacting the Alumni Office at advancement-operations@unimelb.edu.au. If there is information that you believe the University holds relating to you, which is not held on the Advancement database, you can contact the Alumni Office and we will redirect your query as appropriate or will endeavour to assist you.

In some instances, the University may require requests for personal information to be made in accordance with the Freedom of Information Act 1982 (Vic). See our Freedom of Information web page for more information regarding this process.

The University Secretary is the designated Privacy and Data Protection Officer (PDPO) for the University of Melbourne. The privacy team in Legal and Risk provide guidance on privacy obligations and responsibilities.

Please refer to our Privacy webpage for details on how to contact us with a privacy enquiry or lodge a complaint, or if you would like further information.

If you are dissatisfied with our response to a complaint, you may lodge a complaint with the applicable supervisory authority:

• Office of the Victorian Information Commissioner (in relation to personal information and/or sensitive information)
• Health Complaints Commissioner (in relation to health information)
• Office of the Australian Information Commissioner (to the extent that the Privacy Act 1988 (Cth) applies)
• Data Protection Authority (to the extent that GDPR applies)

The University website collects site visit data to better understand general user trends at an aggregate level and improve web performance, web services, and to inform website maintenance. Please refer to the University’s Website Privacy Statement for details of how your personal information may be processed in this instance.

The University periodically refines its privacy statements to reflect appropriate information flows. The overall level of privacy protection is maintained when changes or inclusions are made. We will endeavour to inform you of any substantive changes to this Privacy Statement, however, we may occasionally make changes without notice, particularly where there are changes in the relevant laws or we adopt new working practices. We therefore encourage you to regularly review this statement for any updates. This statement was first published on 19 December 2019.