Privacy Policy

1.          Purpose

1.1          As part of Brindabella Investment Group Pty Ltd’s (“Brindabella Investment Group”) process to ensure that it continues to maintain the highest levels of professional integrity and ethical conduct, Brindabella Investment Group has adopted this Privacy Policy (“Policy”) to manage personal information in an open and transparent manner. 

1.2          This Privacy Policy explains how we collect, hold, use, disclose and protect personal information in accordance with:

• the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs); and

• our obligations as an Australian financial services licensee, including under section 912A of the Corporations Act 2001 (Cth) to maintain adequate risk management, compliance and operational resilience.

  
  

1.3          The policy applies to:

• our directors, officers, employees and representatives;

• Corporate Authorised Representatives, Authorised Representatives and Sub-Authorised Representatives of Brindabella Investment Group; and

• individuals who engage with us as investors, clients, prospective clients or service providers.

2.          Privacy Statement

2.1           Brindabella Investment Group’s Compliance Officer ensures that at all times the provisions of this Policy are implemented in the day to day running of Brindabella Investment Group.

2.2          The Compliance Officer ensures that at all times this Policy:

a.           is current and reflects the latest applicable Australian laws; and

b.           contains the following information:

(i)        the kinds of personal information that Brindabella Investment Group collects and holds;

(ii)         how Brindabella Investment Group collects and holds personal information;

(iii)        the purposes for which Brindabella Investment Group collects, holds, uses and discloses personal information;

(iv)        how an individual may complain about a breach of the Australian Privacy Principles, or other relevant legislation that binds Brindabella Investment Group, and how Brindabella Investment Group deals with such a complaint;

(v)         whether Brindabella Investment Group is likely to disclose personal information to overseas recipients; and

2.3        Brindabella Investment Group ensures that the Brindabella Investment Group’s Privacy Statement is available free of charge and in such form as appropriate.

2.4        If the Privacy Statement is requested in a particular form, Brindabella Investment Group will take such steps as are reasonable to provide the Privacy Statement in the form requested.

3.      Personal Information 

3.1        Personal information is any information or an opinion, whether true or not, about a person, that identifies the person, or by which that person’s identity can be reasonably ascertained.

3.2        Brindabella Investment Group does not collect personal information unless the information is reasonably necessary for one or more of Brindabella Investment Group’s functions or activities.

3.3        Brindabella Investment Group’s functions or activities include:

a.      managing wholesale unregistered managed investment schemes and providing related financial services, for this purpose; and

b.     raising capital through investment vehicles.  

4.     Collection of Personal Information

4.1        Brindabella Investment Group only collects personal information by lawful and fair means.

4.2        Brindabella Investment Group only collects personal information about an individual from the individual (rather than someone else), unless it is unreasonable or impracticable to do so or the individual has instructed Brindabella Investment Group to liaise with someone else.

4.3        Brindabella Investment Group collects personal information when:

a.           the individual consents to the collection;

b.           the information is reasonably necessary for one or more of Brindabella Investment Group’s functions or activities;

c.           the collection of the information is required or authorised by or under an Australian law or a Court/Tribunal order; or

d.           a permitted general situation exists in relation to the collection of the information by Brindabella Investment Group; or

e.           a permitted health situation exists in relation to the collection of the information by Brindabella Investment Group

5.      Purpose Of Collection

5.1        If an individual is acquiring or has acquired a product or service from Brindabella Investment Group, the individual’s personal information will be collected and held for the purposes of:

a.           checking whether an individual is eligible for Brindabella Investment Group’s product or service;

b.           providing the individual with Brindabella Investment Group’s product or service;

c.           managing and administering Brindabella Investment Group’s product or service;

d.           protecting against fraud, crime or other activity which may cause harm in relation to Brindabella Investment Group’s products or services;

e.           complying with legislative and regulatory requirements in any jurisdiction;

f.            confirming an individual’s identity for the purposes of the AML/CTF Act and Rules; and

g.           any other reason relating Brindabella Investment Group providing the product or service.

5.2        Brindabella Investment Group may also collect personal information for the purposes of letting an individual know about products, services or other opportunities in which they may be interested. Please refer to Section 10 for further information.

6.      Unsolicited Information

6.1        If Brindabella Investment Group:

a.           receives personal information about an individual; and

b.           the information is not solicited by Brindabella Investment Group

Brindabella Investment Group must, within a reasonable period after receiving the information, determine whether or not it was permitted to collect the information under Section 5 above.

6.2        Brindabella Investment Group may use or disclose the personal information for the purposes of making the determination under paragraph 6.1.

6.3        If Brindabella Investment Group:

a.           determines that it could not have collected the personal information; and

b.           the information is not contained in a Commonwealth record,

Brindabella Investment Group must take reasonable steps to notify the individual concerned and as soon as practicable, destroy the information or ensure that the information is de-identified, only if it is lawful and reasonable to do so.

7.      Notification Of Collection

7.1        Brindabella Investment Group must notify the individual of the following matters in the Privacy Statement:

a.           Brindabella Investment Group’s identity and contact details;

b.           if Brindabella Investment Group collects the personal information from a third party or the individual is not aware that Brindabella Investment Group has collected the personal information, the fact that Brindabella Investment Group so collects, or has collected the information and the circumstances of that collection;

c.           if the collection of the personal information is required or authorised by or under an Australian law or a Court/Tribunal order, the fact that the collection is so required or authorised (including the details of the law or court);

d.           the purposes for which Brindabella Investment Group collects the personal information;

e.           the main consequences (if any) for the individual if the information is not collected by Brindabella Investment Group;

f.            any other entities to which Brindabella Investment Group usually discloses personal information of the kind collected by Brindabella Investment Group;

g.           that Brindabella Investment Group’s Privacy Statement and this Privacy Policy contains information about how the individual may access the personal information about the individual that is held by Brindabella Investment Group and seek correction of such information;

h.           that Brindabella Investment Group’s Privacy Statement contains information about how the individual may complain about a breach of the Australian Privacy Principles and how Brindabella Investment Group will deal with such a complaint; and

i.            whether Brindabella Investment Group discloses the personal information to overseas recipients;

8.     Use Or Disclosure

8.1        Where Brindabella Investment Group holds personal information about an individual that was collected for a particular purpose (“the primary purpose”), Brindabella Investment Group must not use or disclose the information for another purpose (“the secondary purpose”) unless: 

a.           the individual has consented to the use or disclosure of the information; or

b.           the individual would reasonably expect Brindabella Investment Group to use or disclose the information for the secondary purpose and the secondary purpose is directly related to the primary purpose; or

c.           the use or disclosure of the information is required or authorised by or under an Australian law or a Court/Tribunal order; or

d.           a permitted general situation exists in relation to the use or disclosure of the information by Brindabella Investment Group; or

e.           Brindabella Investment Group reasonably believes that the use or disclosure of the information is reasonably necessary for one or more enforcement related activities conducted by, or on behalf of, an enforcement body.

f.            for the purposes of the AML/CTF Act

8.2        This section 8 does not apply to:

a.           personal information for the purposes of direct marketing; or

b.           government related identifiers.

8.3        If Brindabella Investment Group collects personal information from a related body corporate, this section 8 applies as if Brindabella Investment Group’s primary purpose for the collection was the primary purpose for which the related body corporate collected the information.

9.      Sharing Personal Information

9.1        Brindabella Investment Group may disclose personal information collected from clients and prospective clients to the following:

a.           organisations involved in providing, managing or administering Brindabella Investment Group’s product or service such as third-party suppliers, e.g. printers, posting services, and our advisers;

b.           organisations involved in maintaining, reviewing and developing Brindabella Investment Group’s business systems, procedures and infrastructure, including testing or upgrading Brindabella Investment Group’s computer systems;

c.           organisations involved in a corporate re-organisation;

d.           organisations involved in the payments system, including financial institutions, merchants and payment organisations;

e.           organisations involved in product planning and development;

f.            other organisations, who jointly with Brindabella Investment Group’s, provide its products or services;

g.           authorised representatives who provide Brindabella Investment Group’s products or services on its behalf;

h.           the individual’s representatives, including legal advisers;

i.            debt collectors;

j.            Brindabella Investment Group’s financial advisers, legal advisers or auditors;

k.           fraud bureaus or other organisations to identify, investigate or prevent fraud or other misconduct;

l.            external dispute resolution schemes; or

m.         regulatory bodies, government agencies and law enforcement bodies in any jurisdiction.

10.      Direct Marketing

10.1     Brindabella Investment Group may use or disclose personal information about an individual for the purposes of direct marketing if:

a.           Brindabella Investment Group collected the information from the individual; and the individual would reasonably expect Brindabella Investment Group to use or disclose the information for that purpose; or

b.           Brindabella Investment Group has collected the information from a third party; and either:

(i)          Brindabella Investment Group has obtained the individual’s consent to the use or disclose the information for the purpose of direct marketing; or

(ii)         it is impracticable for Brindabella Investment Group to obtain the individual’s consent; and

c.           Brindabella Investment Group provides a simple way for the individual to opt out of receiving direct marketing communications from Brindabella Investment Group;

d.           in each direct marketing communication with the individual Brindabella Investment Group:

(i)          includes a prominent statement that the individual may opt out of receiving direct marketing; or

(ii)         directs the individual’s attention to the fact that the individual may opt out of receiving direct marketing; and

e.           the individual has not made a request to opt out of receiving direct marketing.

11.       Requests To Stop Direct Marketing

11.1     Where Brindabella Investment Group uses or discloses personal information about an individual for the purposes of direct marketing by Brindabella Investment Group or facilitating direct marketing by another organisation, the individual may request:

a.           that Brindabella Investment Group no longer provide them with direct marketing communications;

b.           that Brindabella Investment Group does not use or disclose the individual’s personal information for the purpose of facilitating direct marketing by another organisation;

c.           that Brindabella Investment Group provides the source of the personal information.

11.2     Where Brindabella Investment Group receives a request from an individual under section 11.1, Brindabella Investment Group must:

a.           give effect to the request under section 11.1a or 11.1b within a reasonable period after the request is made and free of charge; and

b.           notify the individual of the source of the information, if the individual requests it, unless it is impracticable or unreasonable to do so.

11.3     This Section 11 does not apply to the extent that the following laws apply:

a.           the Do Not Call Register Act 2006;

b.           the Spam Act 2003; or

c.           any other Act of the Commonwealth of Australia.

12.      Cross Border Disclosures

12.1     Where Brindabella Investment Group discloses personal information about an individual to a recipient who is not in Australia and who is not Brindabella Investment Group or the individual, Brindabella Investment Group must ensure that the overseas recipient does not breach the Australian Privacy.

12.2     Section 12.1 does not apply where:

a.           Brindabella Investment Group reasonably believes that:

(i)          information is subject to a law or binding scheme that has the effect of protecting the information in a way that is at least substantially similar to the way in which the Australian Privacy Principles protect the information; and

(ii)         there are mechanisms that the individual can access to take action to enforce that protection of the law or binding scheme; or  

b.           both of the following apply:

(i)          Brindabella Investment Group has informed the individual that if they consent to the disclosure of information Brindabella Investment Group will take reasonable steps to ensure the overseas recipient does not breach the Australian Privacy Principles; and

(ii)         after being so informed, the individual consents to disclosure;

c.           the disclosure of the information is required or authorised by or under an Australian law or a Court/Tribunal order; or

d.           a permitted general situation (other than the situation referred to in subsection 16A(1) of the Privacy Act) exists in relation to the disclosure of the information by Brindabella Investment Group.

13.      Government Related Identifiers

13.1     Brindabella Investment Group must not adopt a government related identifier of an individual as its own identifier unless:

a.           Brindabella Investment Group is required or authorised by or under an Australian law or a Court/Tribunal order to do so; or

b.           the identifier, Brindabella Investment Group and the circumstances of the adoption are prescribed by regulations.

13.2     Before using or disclosing a government related identifier of an individual, Brindabella Investment Group must ensure that such use or disclosure is:

a.           reasonably necessary for Brindabella Investment Group to verify the identity of the individual for the purposes of the organisation’s activities or functions; or

b.           reasonably necessary for the organisation to fulfil its obligations to an agency or a State or Territory authority; or

c.           required or authorised by or under an Australian law or a Court/Tribunal order; or

d.           reasonably necessary for one or more enforcement related activities conducted by, or on behalf of, an enforcement body; or

e.           the identifier, Brindabella Investment Group and the circumstances of the adoption are prescribed by regulations.

14.      Security Of Personal Information

14.1      Brindabella Investment Group ensures that it protects any personal information it holds from misuse, interference, loss, unauthorised access, modification and disclosure.

14.2     Brindabella Investment Group takes reasonable steps to destroy or de-identify any personal information it holds where:

a.           Brindabella Investment Group no longer needs the personal information for any purpose for which the information may be used or disclosed by Brindabella Investment Group;

b.           the information is not contained in a Commonwealth record;

c.           Brindabella Investment Group is not required to retain that information under an Australian law, or a Court/Tribunal order.

14.3     Brindabella Investment Group stores personal information in different ways, including:

a.           hard copy on site at Brindabella Investment Group’s head office; and

b.           electronically secure data centres which are located in Australia and owned by either Brindabella Investment Group or external service providers.

14.4     In order to ensure Brindabella Investment Group protects any personal information it holds from misuse, interference, loss, unauthorised access, modification and disclosure, Brindabella Investment Group implements the following procedure/system:

a.           access to information systems is controlled through identity and access management;

b.           employees are bound by internal information securities policies and are required to keep information secure;

c.           all employees are required to complete training about information security;

d.           Brindabella Investment Group regularly monitors and reviews its compliance with internal policies and industry best practice; and

e.           appropriate data backup and recovery processes to maintain the availability and integrity of its information assets.

15.      Access to Personal Information 

15.1     Brindabella Investment Group must give an individual access to the personal information it holds about the individual if so requested by the individual.

15.2     Brindabella Investment Group must respond to any request for access to personal information within a reasonable period after the request is made.

15.3     Brindabella Investment Group must give access to the information in the manner requested by the individual, if it is reasonable and practicable to do so and must take such steps as are reasonable in the circumstances to give access in a way that meets the needs of Brindabella Investment Group and the individual.

15.4     Brindabella Investment Group must not charge an individual for making a request and does not impose excessive charges for the individual to access their personal information.

15.5     Brindabella Investment Group is not required to give an individual access to their personal information if:

a.           Brindabella Investment Group reasonably believes that giving access would pose a serious threat to the life, health or safety of any individual, or to public health or public safety; or

b.           giving access would have an unreasonable impact on the privacy of other individuals; or

c.           the request for access if frivolous or vexatious; or

d.           the information relates to existing or anticipated legal proceedings between Brindabella Investment Group and the individual, and would not be accessible by the process of discovery in those proceedings; or

e.           giving access would reveal intentions of Brindabella Investment Group in relation to negotiations with the individual in such a way as to prejudice those negotiations; or

f.            giving access would be unlawful; or

g.           denying access is required or authorised by or under an Australian law or a Court/Tribunal order; or

h.           Brindabella Investment Group has reason to believe that unlawful activity, or misconduct of a serious nature, that relates to our functions or activities has been, or may be engaged in and giving access would be likely to prejudice the taking of appropriate action in relation to the matter; or

i.            giving access would be likely to prejudice one or more enforcement related activities conducted by, or on behalf of, an enforcement body; or

j.            giving access would reveal evaluative information generated within Brindabella Investment Group in connection with a commercially sensitive decision-making process.

15.6     If Brindabella Investment Group refuses to give access in accordance with paragraph 15.5 or to give access in the manner requested by the individual, Brindabella Investment Group will give the individual a written notice that sets out:

a.           the reasons for the refusal except to the extent that, having regard to the grounds for the refusal, it would be unreasonable to do so; and

b.           the mechanisms available to complain about the refusal; and

c.           any other matter prescribed by the regulations.

15.7     Where Brindabella Investment Group refuses to give access under section 15.5j Brindabella Investment Group may include an explanation of the commercially sensitive decision in its written notice of the reasons for denial.

16.      Correction Of Information

16.1     Brindabella Investment Group must take reasonable steps to correct all personal information, having regard to the purpose for which the information is held where:

a.           Brindabella Investment Group is satisfied the information is inaccurate, out of date, incomplete, irrelevant or misleading; or

b.           the individual requests Brindabella Investment Group corrects the information.  

16.2     Where Brindabella Investment Group corrects personal information about an individual that Brindabella Investment Group previously disclosed to another APP entity and the individual requests Brindabella Investment Group to notify the other APP entity of the correction, Brindabella Investment Group must take reasonable steps to give that notification, unless it is impracticable or unlawful to do so.

16.3     If Brindabella Investment Group refuses to correct personal information as requested by the individual, Brindabella Investment Group will give the individual a written notice that sets out:

a.           the reasons for the refusal except to the extent that it would be unreasonable to do so; and

b.           the mechanisms available to complain about the refusal; and

c.           any other matter prescribed by the regulations.

17.      Complaints

17.1     Brindabella Investment Group offers a free internal complaint resolution scheme to all customers. Should a client have a privacy complaint, they are to contact Brindabella Investment Group to discuss their concerns using the following contact details:

a.           Email: admin@brindabellasecurities.com.au

b.           Phone: +61 2 8090 2079

c.           Post: Level 10, 131 York Street, Sydney NSW 2000

17.2     Brindabella Investment Group will rectify any breach if the complaint is justified and takes necessary steps to resolve the issue.

17.3     In certain situations, to deal with a complaint it may be necessary to consult with third parties. However, any disclosure of Personal Information to third parties will be provided with the customer’s authority and consent.

17.4     After a complaint has been received, Brindabella Investment Group sends the customer a written notice of acknowledgement setting out the process. The complaint is investigated, and the decision sent to the customer within thirty (30) days unless the customer has agreed to a longer time. If a complaint cannot be resolved within the agreed time frame or a decision could not be made within thirty (30) days of receipt, a notification will be sent to the customer setting out the reasons and specifying a new date when the customer can expect a decision or resolution.

17.5     If the customer is not satisfied with Brindabella Investment Group’s internal privacy practices or the outcome in respect to complaint, the customer may approach the Office of the Australian Information Commissioner (OAIC) with their complaint:

Office of the Australian Information Commissioner

Address: GPO Box 5218, Sydney NSW 2001

Phone: 1300 363 992

Email: enquiries@oaic.gov.au

Website: oaic.gov.au

18.   Notifiable Data Breaches Scheme

18.1     Under the Privacy Amendment (Notifiable Data Breaches) Act 2017 (“Privacy Amendment Act”) Brindabella Investment Group is required to notify the OAIC” in relation to all eligible data breaches.

18.2     Brindabella Investment Group notifies the OAIC by lodging a Notifiable Data Breach Form soon as practicable. The Notifiable Data Breach Form is available at the following link: https://forms.business.gov.au/smartforms/landing.htm?formCode=OAIC-NDB.

18.3     Under the Privacy Amendment Act, Brindabella Investment Group also promptly informs clients whose personal information has been compromised by the eligible data breach that a breach of their personal information has occurred.

18.4     Brindabella Investment Group has also developed a Data Breach Response Plan in accordance with the OAIC’s guidelines to ensure the timely notification of all clients affected by any eligible data breach.

19.    Policy Breaches

19.1     Breaches of this Policy may lead to disciplinary action being taken against the relevant party, including dismissal in serious cases and may also result in prosecution under the law where that act is illegal. This may include re-assessment of bonus qualification, termination of employment and/or fines (in accordance with the Privacy Act).

19.2     Staff are trained internally on compliance and their regulatory obligation to Brindabella Investment Group. They are encouraged to respond appropriately to and report all breaches of the law and other incidents of non-compliance, including Brindabella Investment Group’s policies, and seek guidance if they are unsure. 

19.3     Staff must report breaches of this Policy directly to the Compliance Officer.

19.4     The Compliance Officer retains the completed Notifiable Data Breach Forms for seven (7) years in accordance with Brindabella Investment Group’s Document Retention Policy. The completed forms are retained for future reference and review.

19.5     As part of their training, all staff are made aware of the need to practice thorough and up to date record keeping, not only as a way of meeting Brindabella Investment Group’s compliance obligations, but as a way of minimising risk.

20.   Policy Review

20.1     Brindabella Investment Group’s Privacy Policy is reviewed on at least an annual basis by the Compliance Officer of Brindabella Investment Group, having regard to the changing circumstances of Brindabella Investment Group. The Compliance Officer then reports to the Director on compliance with this Policy.

21.   Glossary

Issued by Brindabella Investment Group Pty Ltd

28 July 2025