Privacy Policy
& Data Handling Notice

Bowen Basin Index is an Australian industry directory and information platform based in Mackay, Queensland. References in this Policy to “BBI”, “we”, “us” or “our” mean the operator of the Bowen Basin Index website and associated services.

Our primary website is bowenbasinindex.com.au. Privacy enquiries may be sent to info@bbindex.com.au.

This Policy is intended to reflect the requirements and principles of the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs) where they apply to BBI, together with other applicable Australian laws relating to privacy, electronic communications and data handling.

Whether the Privacy Act applies to a particular Australian business can depend on factors including annual turnover and the activities it carries on. Some small businesses with annual turnover of $3 million or less may be exempt, while others remain covered because of the nature of their activities or another statutory rule.

BBI intends to handle personal information consistently with the standards described in this Policy where legally required and, where appropriate, as a matter of good privacy practice. Nothing in this Policy should be interpreted as an admission that a particular statutory obligation applies where it does not apply as a matter of law.

The information BBI collects depends on how you interact with the platform. We seek to collect information that is reasonably relevant to operating the directory, providing services, responding to enquiries, maintaining security and improving the platform.

BBI may collect information:

• directly from you when you create an account, submit or manage a listing, contact BBI, subscribe to communications, submit project information or make an advertising enquiry;
• from a business or authorised representative that provides information about its staff, contacts or operations;
• from publicly available sources such as company websites, public business directories, company announcements, public social-media pages, government publications, project documents and industry sources;
• automatically through the website using server logs, cookies, analytics, security and performance technologies;
• from service providers where reasonably necessary to operate the platform, prevent abuse, process communications or provide requested services.

Where practicable and appropriate, BBI collects personal information directly from the individual concerned. Where information is collected indirectly, BBI will consider the circumstances, the public nature of the information, the individual's reasonable expectations, the purpose of collection and applicable legal obligations.

BBI is a public business directory. Information submitted for a directory profile is generally intended to be published and made discoverable by website users, search engines and other visitors.

Public listing information may include:

• business name and trading name;
• business contact details;
• website and social-media links;
• business locations and service regions;
• categories, capabilities and service descriptions;
• logos, images and promotional information;
• named business contacts where supplied or where publication is otherwise appropriate and lawful.

Some BBI profiles may be created using publicly available business information or industry research before being claimed by the business. Businesses may contact BBI to request correction, updating, claiming or, where appropriate, removal of a profile.

BBI may use or disclose information for purposes including:

Where the APPs apply, BBI will generally use or disclose personal information for the primary purpose for which it was collected, for a related secondary purpose permitted by law, with consent where required, or where another lawful exception applies.

BBI is a business and industry platform and does not ordinarily need sensitive information such as health information, biometric information, racial or ethnic origin, political opinions, religious beliefs, sexual orientation, criminal-record information or similar sensitive information.

Please do not submit sensitive information, tax file numbers, identity documents, payment-card details or other high-risk personal information unless BBI has specifically requested it for a legitimate purpose.

If sensitive or unsolicited personal information is received, BBI may assess whether it is reasonably necessary and lawful to retain. Where appropriate, it may be deleted, de-identified, restricted or handled in another manner permitted by law.

BBI may use cookies, local storage, server logs, analytics tools, security tools and similar technologies to operate and understand the website.

Analytics or interaction tools may process information such as IP address, browser/device information, referral source, pages viewed, clicks, scrolling and session activity. BBI does not intentionally use analytics tools to collect sensitive information.

You can usually control cookies through your browser settings and, where provided, website consent controls. Disabling essential cookies may affect account, form or website functionality.

Where consent is legally required for a particular tracking technology, BBI will seek consent before using that technology for the relevant purpose.

BBI may send administrative or service communications where necessary to operate accounts, listings, enquiries, subscriptions or requested services.

Commercial electronic messages will be sent only where permitted by applicable law. Where the Spam Act 2003 (Cth) applies, BBI will take reasonable steps to ensure commercial messages:

• are sent with the required consent or another permitted basis;
• identify BBI or the relevant sender;
• include valid contact information; and
• contain a functional unsubscribe mechanism where required.

Unsubscribe requests for commercial electronic messages will be actioned as required by law. Opting out of marketing does not prevent BBI from sending necessary transactional, security, account or service communications.

BBI may disclose relevant information to:

• website and hosting providers that provide infrastructure, storage, backups, security and technical support;
• email and communications providers used to send or receive platform communications;
• analytics, performance and security providers used to understand or protect the website;
• payment providers where paid services are offered;
• professional advisers such as legal, accounting, insurance or technical advisers where reasonably necessary;
• regulators, courts, law-enforcement bodies or government authorities where disclosure is required or authorised by law;
• another party to a business transaction where the disclosure is reasonably necessary for a proposed or completed sale, restructure or transfer and appropriate protections are used;
• other persons with consent or where another lawful basis or exception permits the disclosure.

BBI operates in Australia, but some third-party technology, cloud, analytics, security, communications or software providers may store or process information outside Australia or use global infrastructure.

The countries involved can vary depending on the provider, service configuration, data-routing arrangements and subcontractors. Where it is practicable to identify likely overseas recipient locations and Australian privacy law requires this information, BBI will provide additional details in this Policy, in a collection notice or on request.

Where APP 8 applies to an overseas disclosure, BBI will take such reasonable steps as are required in the circumstances to address the privacy handling of the overseas recipient, subject to the exceptions available under law.

If you require information about the likely location of a particular service provider processing your information, contact info@bbindex.com.au.

BBI takes reasonable technical and organisational measures appropriate to the nature of the platform and the information held. Depending on the circumstances, measures may include:

• HTTPS/TLS encryption for website traffic;
• access controls and restricted administrative privileges;
• password protection and account security measures;
• software updates, patching and vulnerability management;
• website security, firewall, anti-spam or malware controls;
• backups and recovery arrangements;
• logging, monitoring and incident investigation;
• limiting access to information according to operational need;
• reviewing retention and deleting or de-identifying information when it is no longer reasonably required.

No website, network, electronic transmission or storage system can be guaranteed to be completely secure. BBI does not promise absolute security, but will take reasonable steps required by applicable law and will review security practices as risks and technology change.

If BBI becomes aware of a suspected loss, unauthorised access, unauthorised disclosure or other security incident involving personal information, BBI may take steps to contain the incident, investigate what occurred, assess risk, remediate the issue and preserve appropriate records.

Where BBI is subject to the Notifiable Data Breaches (NDB) scheme under the Privacy Act and has reasonable grounds to believe an eligible data breach has occurred, BBI will notify affected individuals and the Office of the Australian Information Commissioner (OAIC) as required by law.

Not every security incident is an eligible notifiable data breach. Notification requirements depend on the nature of the incident, the information involved, the likelihood of serious harm, remedial action and the applicable law.

BBI retains information for as long as reasonably necessary for the purpose for which it is held, for related permitted purposes, to maintain appropriate records, resolve disputes, protect the platform, enforce agreements or satisfy legal, tax, accounting, insurance or regulatory requirements.

Retention periods may vary according to:

• the type and sensitivity of the information;
• whether an account, listing, enquiry or commercial relationship remains active;
• the need to maintain historical, security or audit records;
• legal limitation periods and statutory record-keeping requirements;
• backup, archival and technical deletion cycles.

Where APP 11 applies and BBI no longer needs personal information for a permitted purpose, BBI will take reasonable steps in the circumstances to destroy it or ensure it is de-identified, unless retention is required by law or an applicable exception applies.

A request to remove a public business listing is not necessarily the same as a request to erase every internal record. BBI may need to retain limited records of requests, correspondence, disputes, fraud prevention or compliance activity.

Where the Privacy Act applies, individuals may request access to personal information BBI holds about them and may request correction where information is inaccurate, out of date, incomplete, irrelevant or misleading.

BBI may ask for sufficient information to verify identity and understand the scope of a request before releasing or changing personal information. This helps protect information from being disclosed to the wrong person.

BBI will respond within the timeframe required by applicable law. Where the APPs apply to BBI as an organisation, a reasonable response period will generally not exceed 30 calendar days, subject to the nature and complexity of the request.

Access may be refused or limited where a lawful exception applies—for example, where disclosure would unreasonably affect another person's privacy, would be unlawful, relates to certain legal proceedings, or another statutory ground applies. Where required, BBI will explain the refusal and available complaint options.

You can generally browse publicly available BBI pages without creating an account or identifying yourself directly.

In some circumstances BBI needs accurate identity or business information—for example to create or claim a business listing, authenticate an account, process a correction request, respond to a privacy request, deliver a paid service, prevent misuse or comply with law. In those circumstances, anonymous or pseudonymous dealing may be impracticable or unavailable.

BBI may use software-assisted or automated tools for functions such as spam detection, security, analytics, content classification, search, moderation support, formatting or administration.

BBI does not intend to use automated tools as a substitute for appropriate human judgement where a decision could materially affect a person's rights or interests. If BBI introduces automated decision-making that is subject to specific transparency obligations under Australian privacy law, BBI will update this Policy and provide the information required by law.

BBI contains links to business websites, project sources, government pages, social-media platforms and other external services. Clicking an external link may allow that third party to collect information under its own privacy policy and terms.

BBI is not responsible for the privacy, security or content practices of independent third-party websites. Users should review the relevant third party's privacy information before providing personal information.

Where BBI embeds content or integrates third-party functionality, that service may receive technical information such as IP address, browser information or interaction data as necessary to provide the integration.

BBI is a business-to-business industrial platform and is not directed to children. We do not intentionally solicit sensitive or unnecessary personal information from children through directory or commercial services.

If BBI becomes aware that personal information about a child has been provided in circumstances where it should not have been collected or retained, BBI may take reasonable steps to delete, de-identify or otherwise appropriately handle it.

If BBI or substantially all of the platform's business or assets is sold, merged, reorganised, financed or transferred, information held by BBI may form part of the transaction or due-diligence process where lawful and reasonably necessary.

BBI will seek to use appropriate confidentiality, data-minimisation and security measures in connection with such a transaction and will comply with applicable privacy obligations.

If you believe BBI has mishandled personal information, please contact us first so we have an opportunity to investigate and resolve the issue.

A privacy complaint should ideally include:

• your name and preferred contact details;
• a clear description of the privacy concern;
• the relevant BBI page, listing, account, communication or interaction;
• dates and supporting information where available;
• the outcome you are seeking.

Send privacy complaints to info@bbindex.com.au with the subject “Privacy Complaint”.

BBI will seek to acknowledge and investigate complaints promptly and, where the Privacy Act applies, aims to provide a substantive response within 30 calendar days where reasonably practicable. If more time is reasonably required, BBI may contact you with an explanation and expected timeframe.

BBI may update this Policy to reflect changes in law, technology, suppliers, website functions, services, business practices or privacy guidance.

The current version will be published on this page with the “Last updated” date. Where a change is material and additional notice or consent is required by law, BBI will take appropriate steps in the circumstances.

Previous conduct will be assessed under the law and privacy information applicable at the relevant time. BBI will not rely on a policy update to retrospectively create consent where consent is legally required.