Privacy Policy

Purpose

This policy establishes Westlink Logistics’ commitment to protecting the privacy of personal information. It sets out how the organisation collects, holds, uses, and discloses personal information in compliance with the Privacy Act 1988 (Cth), the thirteen Australian Privacy Principles (APPs), and the Notifiable Data Breaches (NDB) scheme.

Scope

This policy applies to all personal information collected, held, used, or disclosed by Westlink Logistics. It applies to all directors, workers, contractors, and third-party service providers who handle personal information on behalf of the organisation. Personal information includes any information or opinion about an identified or reasonably identifiable individual, whether true or not and whether recorded in material form or not.

Organisational Context

Westlink Logistics operates heavy haulage, project logistics, and maritime services across Australia, primarily supporting defence, government, resources, and infrastructure sectors. The organisation collects personal information of workers, contractors, clients, and suppliers for employment administration, security vetting, WHS obligations, payroll, and client service delivery. Sensitive information including health records, criminal history, and security clearance data is held for DISP and fitness-for-work purposes.

The organisation holds DISP membership and is subject to JOSCAR pre-qualification, both of which require demonstrated data privacy controls. The Privacy and Other Legislation Amendment Act 2024 introduced a statutory tort for serious invasion of privacy (commenced June 2025), increasing the consequence of privacy breaches.

Policy Commitments

Westlink Logistics is committed to:

• Collecting only personal information that is reasonably necessary for business functions, directly from the individual where practicable, and providing notice of collection purposes at or before the time of collection (APP 3, APP 5).

• Using and disclosing personal information only for the primary purpose of collection or a directly related secondary purpose the individual would reasonably expect. Westlink does not sell personal information or use it for unsolicited direct marketing (APP 6, APP 7).

• Protecting personal information from misuse, interference, loss, unauthorised access, modification, and disclosure through physical, technical, and administrative security measures aligned with TEC-POL-001. Information no longer needed is destroyed or de-identified per APP 11.2 and GOV-SCH-001 (APP 10, APP 11).

• Providing individuals with access to their personal information and correcting inaccurate, out-of-date, or incomplete information within 30 days of request, unless an exception under the Privacy Act applies (APP 12, APP 13).

• Maintaining a data breach response capability per Part IIIC (NDB scheme). Where a breach is likely to result in serious harm, Westlink will notify the OAIC and affected individuals as soon as practicable. All suspected breaches must be reported immediately to the QHSE Manager.

Responsibilities

Review

This policy is reviewed annually as part of the management review cycle, or following any notifiable data breach, significant legislative change, or update to OAIC guidance. This policy is communicated to all workers at induction and is available to interested parties on request.

Applicable Standards and Legislation

• Privacy Act 1988 (Cth)

• OAIC Guide to Securing Personal Information (2024)

• OAIC Data Breach Preparation and Response guidance

• ISO 9001:2015 Quality Management Systems — Requirements

Related Documents

• TEC-POL-001 Information Security Policy

• GOV-POL-011 Grievance Resolution Policy

• QHSE-PRO-001 Hazard and Incident Reporting and Investigation Procedure