How we handle
your information.

This Privacy Policy describes how Rivercity Garden & Lawn Pty Ltd (trading as Rivercity Environmental) ("Rivercity", "we", "us", "our") collects, uses, holds, discloses and protects personal information.

We handle personal information in accordance with the Privacy Act 1988 (Cth) (the Privacy Act), the Australian Privacy Principles (APPs), the Notifiable Data Breaches scheme and any other applicable Australian privacy laws.

This policy applies to information collected through this website, by phone, by email, in person, on site, on application, in connection with our services and through any other interaction you have with Rivercity.

The personal information we collect depends on how you interact with us. Typically it includes:

• Contact information — your name, organisation, role, postal address, email address and phone number.
• Project & site information — the project location, scope, photographs, plans, site contact details and any information you choose to share when requesting a quote, scheduling works or reporting an issue.
• Employment, contractor & supplier information — resumes, qualifications, licences and tickets, references, right-to-work documentation, banking information for payroll/payment, insurance information, ABN and tax details.
• Correspondence — the content of emails, voicemails, messages, support tickets and meeting notes you exchange with us.
• Website & technical information — IP address, browser type and version, device type, operating system, referring URL, pages viewed, time on page and similar log data, plus cookie identifiers.

We do not generally collect sensitive information (as defined in the Privacy Act). Where it is reasonably necessary — for example, work-related health information, criminal record checks for employment, or membership of an industry body — we will only do so with consent or where authorised or required by law.

We collect personal information in a number of ways:

• Directly from you — when you submit a form on this website, request a quote, send us an email, call us, meet us on site, attend a tender briefing, apply for a role through our careers portal or otherwise interact with our team.
• From third parties — including referees, recruitment agencies, government agencies, professional associations, our clients (e.g. when a council or principal contractor provides project contacts), insurers and our service providers.
• Automatically — through cookies, server logs and analytics tools when you visit this website.

If you provide personal information about another person to us, you must have that person’s consent and tell them about this Privacy Policy.

We collect, hold and use personal information to operate our business, deliver our services and meet our legal obligations. Specifically:

• Responding to enquiries — reviewing and replying to messages submitted via the website, by phone or by email.
• Quoting, scoping & delivering services — preparing proposals, agreements and schedules; arborist or horticultural site assessments; coordinating crews and plant; capturing safety, traffic management and works records; and invoicing.
• Managing our team & subcontractors — recruitment, onboarding, payroll, qualifications/licence tracking, insurance, training, performance and work health and safety.
• Operating, securing & improving the website — understanding how the site is used, fixing problems and protecting against fraud or misuse.
• Communicating with you — including service updates, scheduling notices, asset records and, where you have consented, marketing communications about our services.
• Meeting our legal obligations — including tax, work health and safety, environmental compliance, accreditation requirements (ISO 9001/14001, AS/NZS 4801, QBCC, QAA) and responding to lawful requests from regulators or courts.

We will only use personal information for the primary purpose for which it was collected, for a related secondary purpose you would reasonably expect, or where you consent or another exception under the APPs applies.

We may share personal information with:

• Our team — authorised employees, contractors and supervisors who need access to perform their duties.
• Service providers — including IT, cloud hosting, email, customer relationship management, analytics, payroll and accounting providers, all of whom are required to protect personal information consistent with this policy.
• Professional advisors — legal, accounting, audit, insurance and risk advisors.
• Clients & principals — where it is necessary to deliver the services you have engaged us for (for example, providing site contact details on a council or tier-one project).
• Government & regulators — where we are required or authorised by law (for example, work health and safety regulators, the ATO, or in response to a subpoena, warrant or other lawful request).
• A potential or actual purchaser — in the context of a sale, merger, restructure or financing of our business, subject to confidentiality.

We do not sell, rent or trade personal information.

This website uses cookies and similar technologies to operate the site, remember your preferences and understand how the site is used. Cookies fall into the following categories:

• Essential cookies — required for the website to function (for example, security, form submission and load balancing).
• Performance & analytics cookies — that help us understand which pages are useful, how visitors move through the site and where we can improve it. We may use Google Analytics or a similar service for this purpose. Information collected by these tools is generally aggregated and de-identified.
• Functional cookies — that remember choices you make (such as accepting a notice).

You can disable cookies in your browser settings or by using browser-level controls. Disabling cookies may affect how the website works.

From time to time we may use the contact details you have provided to send you information about our services, programs or industry updates that we believe may be of interest. We will only do this where you have consented (expressly or as reasonably implied from the nature of your enquiry) or where the law otherwise allows.

Every marketing communication will include a clear way to opt out (for example, an unsubscribe link in emails). You can also opt out at any time by contacting us using the details below.

We hold personal information in a combination of secure hard-copy and electronic systems, including reputable cloud-based services. We take reasonable steps to protect personal information from misuse, interference, loss, unauthorised access, modification and disclosure, including:

• Access controls, authentication and role-based permissions for our systems.
• Encryption in transit (TLS) for traffic to and from this website.
• Confidentiality obligations for staff and contractors.
• Vendor due diligence on our key service providers.
• Secure disposal of records when they are no longer required.

We retain personal information only for as long as it is needed for the purposes for which it was collected, or as required by law (for example, work health and safety, tax and contractual record-keeping obligations).

Some of our service providers (for example, cloud hosting, email and analytics) may store or process personal information on servers located outside Australia. Where this happens, we take reasonable steps to ensure that the overseas recipient handles personal information in a way consistent with the APPs, including through contractual safeguards.

By submitting personal information through this website you acknowledge and consent to such cross-border disclosure for the purposes described in this policy.

You have the right under the APPs to request access to the personal information we hold about you and to ask us to correct it if it is inaccurate, out of date, incomplete or misleading. To make a request, please contact us using the details below.

We will respond to your request within a reasonable time and free of charge in most cases. We may need to verify your identity before providing access, and there are limited circumstances in which we may decline a request (for example, where giving access would unreasonably affect the privacy of others).

If you believe we have breached this policy or the APPs, please contact us first so we can investigate and respond. We will acknowledge your complaint promptly and aim to resolve it within 30 days.

If you are not satisfied with our response you can refer the matter to the Office of the Australian Information Commissioner (OAIC) at oaic.gov.au.

We comply with the Notifiable Data Breaches scheme under Part IIIC of the Privacy Act. If we suffer an eligible data breach that is likely to result in serious harm to any individual whose personal information is involved, and we cannot prevent that harm with remedial action, we will notify the affected individuals and the OAIC as soon as practicable.

This website and our services are not directed at children under 16. We do not knowingly collect personal information from children. If you believe we hold information about a child without appropriate consent, please contact us so we can investigate and remove it.

We may update this policy from time to time to reflect changes in our business, technology, or applicable law. The current version will always be available on our website with an updated "Effective date". Material changes will be highlighted on the page or notified to you where reasonably practicable.

If you have a privacy question, request, or complaint, please get in touch with our Privacy Officer:

• Privacy Officer — Rivercity Garden & Lawn Pty Ltd
• Post: 44 Export Drive, Molendinar QLD 4214
• Email: rivercity@rcgl.com.au
• Phone: 1300 600 400