Privacy Policy

• About this document
  This Privacy Policy has been adopted by the following IFC entities:
  • IFC Global Logistics Pty Ltd (ACN 051 694 074);
  • IFC Warehousing & Distribution Pty Ltd (ACN 119 121 461); and
  • Cloud Logistics Solutions Pty Ltd (ACN 132 468 458)

Our employees, contractors, consultants, partners and any other third party entities that at our direction have access to your personal information are bound by and must adhere to this Privacy Policy

By providing personal information to us you consent to our collection, use and disclosure of your personal information in accordance with this Privacy Policy.

We reserve the right to make amendments to this Privacy Policy at any time and will make available to you details of the changes we make.  If you have objections to our Privacy Policy, you should notify us immediately and not submit personal information to us.

1. Commitment

As responsible data custodians we are committed to protecting your personal information. This Privacy Policy outlines how we collect, use, store and disclose your personal information to carry out IFC’s functions or activities in accordance with the Australian Privacy Principles (APPs) established under the Australian Privacy Act 1988 (Cth) (Privacy Act) and any other legislation that requires us to collect, use, store and/or disclose your personal information.

You can obtain further information regarding the APPs and your privacy rights at the Office of the Australian Information Commissioner (OAIC) at www.oaic.gov.au.

2. Personal or sensitive information we collect

We may collect personal information that you have supplied to us such as your name, age, date of birth, address, and other contact details.  We may also collect sensitive information from you with your consent (in specific circumstances) or without your consent where a “permitted general situation” (as defined in the Privacy Act) applies.

The type of information we may collect depends on your dealings with us and may include:

• Name, contact details, residential address, date of birth, employment position, residency status;
• Identification information – e.g. your driver’s licence, ASIC/MSIC card, proof of age card, passport, your device’s IP address, licence plate number;
• From our website: search terms, pages visited, date and time pages accessed, downloads, time spent on page, bounce rate, referring domain and out link (if applicable), device type, operating system and browser information, device screen size, geographic location (city).
• Employment information in relation to employees or prospective employees, contractors and consultants – e.g. current and historical, employee, reference and emergency contact details, employment contracts, proof of Australian citizenship, copies of academic qualifications and police record checks, taxation details, medical certificates;
• Biometric information including your faceprint where facial recognition technology is used;
• Identity and location information through CCTV footage;
• Information provided to us via client surveys.

3. Collection & Use

We try to only collect the information we need for the particular function or activity we are carrying out. The main way we collect personal information about you is when you give it to us. We may collect personal information from you or from third parties by:

• You contacting us to ask for information (but only if we need it);
• You engaging our services;
• Asking you to complete client questionnaires;
• You using our website and interacting with our social media sites;
• You communicating with us through correspondence;
• You participating in a meeting or in consultation with us;
• You asking for access to information IFC holds about you or other information about our operation;
• You applying for a job vacancy at IFC;
• You attending our premises;
• Conferring with third parties such as (but not limited to) Australian Border Force, and vendors of goods;
• Using “cookies” or other similar tracking technologies and web analytics on our website that track website usage, preferences and personal account information; and
• Requesting information from a publicly available source.

We collect personal information from you to be able to provide our functions and activities, specifically our warehousing and distribution services including for our corporate clients, and Australian Border Force and Customs including:

• Handling and storing goods in a safe and secure manner;
• Complying with and maintaining our obligations to provide secure facilities for goods including Customs controlled goods;
• Communicating with Australian Border Force and other government authorities regarding Customs matters;
• Controlling access to goods to secure against unlawful or unauthorised movement, alteration or interference during movement of the goods into or out of the IFC premises, and while goods are stored in those premises, and while goods are being transported;
• Communicating with customers of our clients regarding despatch of goods;
• Communicating with our clients regarding handling and storage of their goods;
  • Liaising with third parties on your behalf such as, government organisations, insurance;
  • Conducting publicity campaigns;
  • Handling complaints;
  • Managing employee records;
  • Running our website and social media accounts;
  • Conducting training to improve efficiencies and provision of our services;
  • Assessing suitable candidates for career opportunities within IFC
  • Assessing personnel, both current and prospective employees and contractors, to ensure compliance with IFC’s obligations under agreements and licenses.

Sometimes we may need to collect sensitive information about you, for example, to enable us to make sure our warehousing facility remains secure from unauthorised persons entering.

In the course of performing our warehousing and distribution functions and activities, we may collect personal information (including sensitive information) about you indirectly from publicly available sources or from third parties. We collect personal information from publicly available sources to enable us to contact stakeholders who may be interested in our services.

We use Analytics Services to collect data about your interaction with our website. If your web browser has Do Not Track enabled, the Analytics Services will not track your visit. These web analytics providers are hosted in multiple different countries and are available on request.

We use Google’s YouTube site to host videos which are embedded on our website. YouTube collects information about user activity including videos watched and interactions with content and ads. These analytics are made available to IFC, and we use this information to understand how our videos perform. You can access the privacy policy for YouTube on the Google website.

We will collect information that you provide to us when signing up to mailing lists and registering for our events, or when submitting feedback on your experience with our website. We use Mailing List services that are available on request. When subscribing to our mailing list, you will be asked to give your express consent that the Mailing List Services may use your data for analytics purposes. Analytics are performed when you click on links in the email, or when you download the images in the email. They may include which emails you open, which links you click, your mail client (eg. Outlook or iPhone), if your action occurred on ‘mobile’ or ‘desktop, and the country geolocation of your IP address.

 We use social networking services such as Facebook, LinkedIn, and YouTube to communicate with the public about our services. When you communicate with us using these services we may collect your personal information, but we only use it to help us to communicate with you and the public. The social networking service will also handle your personal information for its own purposes. These services have their own privacy policies. You can access the privacy policies for Facebook, LinkedIn, and Youtube (a Google company) on their websites.

We store your personal information in one or more of the following places: on cloud servers located in Australia hosted by Microsoft Azure, MYOB Online, and/or WiseTech Global.

4. Biometric Information Collection and Use

We collect biometric information through our employee/user time and attendance system using facial recognition technology provided by Noah Facial Recognition Pty Ltd (NoahFace) hosted by Attendance Management Systems Pty Ltd. This includes:

• Facial images captured during employee/user registration and timekeeping;
• Biometric templates generated from facial characteristics obtained when on site from devices including CCTV footage;
• Time and attendance records linked to biometric verification.

Collection occurs with employee consent or where reasonably necessary for employment functions under APP 3.3 of the Privacy Act 1988.

Biometric information is used solely for:

• Employee/user time and attendance recording;
• Payroll calculation;
• Workplace security and access control.

Before collecting biometric information, we will:

• Provide written notice of collection;
• Obtain express consent from employees/users;
• Offer alternative identification methods for non-consenting employees/users;
• Allow withdrawal of consent at any time.

Employees and those who come in contact with our biometric collection systems have the right to:

• Refuse biometric data collection and use alternative identification;
• Access their biometric information records;
• Request correction of inaccurate biometric data;
• Request deletion of biometric data (subject to employment record requirements);
• Withdraw consent (where technically feasible);
• Lodge complaints regarding biometric information handling.

Our biometric data retention and destruction timelines are as follows:

• Active employee/user biometric data: Retained during employment/while using our facilities;
• Former employee/user biometric data: Destroyed within 30 days of employment termination or as soon as practically possible;
• Failed biometric verification attempts: Destroyed within 3 months
• Time and attendance records: Retained per employment law requirements;
• Biometric templates: Automatically destroyed when no longer required.

5. Disclosure

We may disclose your personal information for the following purposes:

• To enable you to access and use our services and in turn provide our services to you;
  • To provide you with direct marketing materials that may be of interest to you such as articles or product brochures or correspondence from our business partners;
  • In order to comply with any Australian Border Force and Customs obligations and requirements;
  • For purposes where you consent to such disclosure or for a related purpose where you would reasonably expect such disclosure; and
• Any circumstance otherwise authorised by the APPs and/or the Privacy Act.

We will only use sensitive information for the primary purpose it was obtained for or for a secondary purpose that is directly related to the primary purpose that you would reasonably expect or if you agree (or where otherwise required by law).

We may disclose your personal and sensitive information to third parties, including the following entities:

• Our representatives, advisers, employees, agents and related bodies corporate;
• third party suppliers and service providers such as the providers for the operation of our website or business services, including our website servers, data cloud servers, those that manage our databases and IT;
• Specific third parties authorised by you to receive information held by us;
• Australian Border Force;
• As required by law, including Customs-related law (as defined in section 4B of the Customs Act 1901 (Cth)) or directed by legal decision/process; and
• Any industry body, tribunal, court or otherwise connected with any complaint regarding our services.

To protect the personal information we disclose we:

• Enter into a contract or MOU which requires the service provider to only use or disclose the information for the purposes of the contract or MOU;
• Include special privacy requirements in the contract or MOU, where necessary.

As stated above, web traffic information is disclosed to Analytics Services when you visit our website. The Analytics Services store information across multiple countries. When you communicate with us through a social network service such as Facebook, or LinkedIn, the social network provider and its partners may collect and hold your personal information overseas.

6. Overseas Disclosure

We usually will not disclose personal information outside of Australia.

However, where it is necessary for the collection purposes, we may disclose personal information to overseas recipients, including:

• Cloud service providers whose data centres or systems are located overseas;
• Related bodies corporate, business partners, suppliers or service providers located overseas;
• Professional advisers or consultants based overseas;
• Any other person where you have consented to the overseas disclosure.

If, however, we need to disclose information overseas for the collection purposes, or if for any reason it becomes necessary for us to disclose personal information to an overseas recipient, we will take reasonable steps to ensure that the recipient uses that information in a manner that complies with, and does not breach, this Privacy Policy and the APPs in relation to that information, unless an exception exists in the APPs. Such an exception may include where the overseas recipient is bound by the laws of another country that is on the ministerial “white list” or a participant in a binding scheme that is listed in the Privacy Regulations, or the laws have the effect of protecting the personal information in a way that is substantially similar to the privacy protections and mechanisms for individuals to enforce these protections as those contained in the APPs.

If personal information is to be disclosed to an overseas recipient, the likely country in which such recipients will be located is:

• United States (cloud service providers – AWS, Microsoft Azure)
• Countries where related entities or business partners operate.

Details of countries will be updated on our website and reviewed annually.

We remain accountable for the acts or practices of overseas recipients in relation to your personal information.

Where personal information is disclosed overseas, we will ensure that:

• Appropriate contractual protections are in place;
• The overseas recipient has adequate systems and processes to protect the personal information; and
• We maintain oversight of how your personal information is handled by the overseas recipient.

We will only rely on exceptions to our accountability obligations where legally permitted to do so, including where you have provided express consent after being made aware of the risks of overseas disclosure.

Where we seek your express consent for overseas disclosures, we will inform you that:

• You will not be able to seek redress under the Privacy Act if the overseas recipient breaches the APPs;
• We will not be accountable under the Privacy Act for the overseas recipient’s handling of your information; and

The overseas recipient may not be subject to privacy obligations similar to Australian privacy laws.

7. Third-Party Biometric Service Providers

We engage NoahFace to provide facial recognition technology services. NoahFace:

• Processes biometric information on our behalf;
• Maintains data security and privacy protections;
• Does not use personal data for commercial purposes;
• Complies with Australian privacy laws;
• Stores data securely within Amazon Web Services Australia.

NoahFace’s privacy policy is available at: https://www.noahface.com/privacy. NoahFace’s privacy and security information is available at: https://www.noahface.com/privacy-and-security

8. Automated decision-making:

Automated Decision-Making means the use of computer programs to make decisions or provide substantial assistance to human decision-makers, where such decisions could reasonably be expected to significantly affect an individual’s rights or interests.

We may use computer programs to make decisions or assist our staff in making decisions that could reasonably be expected to significantly affect your rights or interests.

The types of personal information we may use in automated decision-making may include:

• Credit and financial information for credit assessment purposes;
• Transaction history and payment patterns for credit limit and payment terms decisions;
• Contact and identification information for account management decisions.

We may use computer programs to make the following types of decisions without human involvement:

• Automated credit limit adjustments based on payment history;
• System-generated alerts for overdue accounts;
• Automated application of standard terms and conditions.

We may use computer programs to substantially and directly assist human decision-makers in making the following types of decisions:

• Credit applications and trade account approvals;
• Customer risk assessments and credit limit determinations;
• Pricing decisions and discount eligibility;
• Debt recovery and collection actions.

You have the right to:

• Request information about how our automated decision-making processes work;
• Seek human review of decisions made by automated processes where this significantly affects you;
• Lodge a complaint if you are concerned about automated decision-making affecting you.

To exercise these rights or for more information about our automated decision-making processes, please contact our Privacy Officer using the details in Section 11.

9. Security and storage

We take our security obligations seriously and your personal information is regarded as confidential and may be held in both hard copy and/or electronic versions. We will take all reasonable steps to safeguard your information so that it is not misused, lost, modified, accessed by unauthorised persons or disclosed without authorisation.

All personal information collected that is held in electronic versions is held on our cloud storage, on servers with external third party providers located in Australia. We retain effective control over any personal information held on our cloud, and the information is handled in accordance with the Australian Privacy Principles.

We take steps to protect the security of the personal information we hold from both internal and external threats by:

• Regularly assessing the risk of misuse, interference, loss, and unauthorised access, modification or disclosure of that information;
• Taking measures to address those risks, including, for example, keeping records of when someone has added, changed or deleted personal information held in our electronic databases and regularly check that staff only access those records when they need to;
• Conducting regular internal and external audits to assess whether we have adequately complied with or implemented these measures;
• Privacy and security policies, procedures and standards;
• Staff training on privacy and security obligations;
• Incident response and data breach management procedures;
• Privacy governance framework with designated privacy officers;
• Vendor management and due diligence processes;
• Regular review and testing of security controls;
• Privacy by design and privacy by default approaches.

As part of our commitment to protecting your personal information under the APPs, we implement technical and organisational measures to protect personal information, including:

• Encryption of biometric data in transit and at rest;
• Secure cloud storage with certified providers;
• Access controls and authentication systems;
• Regular security assessments and updates;
• Anti-virus and anti-malware software;
• Back-up and recovery systems with secure storage;
• Data loss prevention controls;

Automatic data destruction upon employment termination unless required by law to keep or information is exempt employee records within the meaning of the Privacy Act and retention is necessary, in which case the data will be destroyed when it is no longer required.

We regularly review and update our technical and organisational measures to ensure they remain appropriate to the risks and threats to your Personal Information, taking into account:

• The nature and sensitivity of the Personal Information we hold;
• The current state of technology;
• The cost of implementation;
• The possible adverse consequences for individuals if a security incident occurs.

Our technical and organisational measures are designed to ensure the ongoing confidentiality, integrity, availability, and resilience of our information systems and services.

We destroy personal information in a secure manner when we no longer need it.

As responsible data custodians we are familiar with the requirements of the Notifiable Data Breaches scheme and are committed to responding to data breaches in accordance with our obligations under the Privacy Act. We will notify the Office of the Australian Information Commissioner and you if there is unauthorised access to, unauthorised disclosure of, or loss of, personal information held by us and the access, disclosure or loss is likely to result in serious harm to any of the individuals to whom the information relates in accordance with the Privacy Act.

Our website may contain links to external websites operated by third parties. The privacy polices of these other websites may not accord with this Privacy Policy and we cannot be held responsible and do not have control of the use of your personal information by these third parties.

As responsible data custodians, any breach of this Privacy Policy by our employees, contractors, consultants, partners and any other entity that at our direction have access to your personal information will invoke disciplinary and possible legal action against the offending party.

10. Accessing, Updating and Correcting Your Personal and Sensitive Information

You have a right to ask for access to your personal information, subject to exceptions allowed by law. If you would like to do so, please provide us with a request in writing to the contact details listed below.  Depending upon the complexity of the request, we will endeavour to respond to you within 30 days of receiving your request.

We reserve the right to charge a fee for searching for, and providing access to, your information on a per request basis. This fee will not be excessive, and may include the cost of:

• staff searching for, locating and retrieving the requested information, and deciding which personal information is relevant to the request;
• staff reproducing and sending the personal information;
• the postage or materials involved in giving access; and/or
• using an intermediary, if necessary.

We will let you know the likely amount of this charge when you make the request and discuss options with you for changing your request to minimise the charge. For example, changing the way you receive the information – by email rather than post.

Where we cannot provide you with access to all of your personal information, we will provide you with reasons why. We may also require your identity to be verified when you send in your request and prior to sending any substantive response. The steps appropriate to verify an individual’s identity will depend on the circumstances. We will seek the minimum amount of personal information needed to establish an individual’s identity.

To ensure that the personal information we collect is accurate, up-to-date and complete we:

• Record information in a consistent format;
• Where necessary, confirm the accuracy of information we collect from a third party or a public source;
• Promptly add updated or new personal information to existing records; and
• Regularly audit our contact lists to check their accuracy.

We also review the quality of personal information before we use or disclose it.

If at any time you believe that information we hold about you is incomplete, inaccurate, irrelevant, misleading or not up-to-date, please contact us and we will take reasonable steps to correct the information if we consider it is incorrect, in accordance with the Privacy Act, unless there is a law that allows or requires us not to.

If we make a correction and we have disclosed the incorrect information to others, you can ask us to tell them about the correction. We must do so unless there is a valid reason not to.

If we refuse to correct your personal information, you can ask us to associate with it (for example, attach or link) a statement that you believe the information is incorrect and why.

11. Complaints and Inquiries

Individuals now have rights under Australian law to seek compensation for serious invasions of privacy. We are committed to handling personal information in accordance with privacy laws to prevent such invasions.

This Privacy Policy is reviewed annually and updated as required to reflect changes in privacy law, technology, and business practices.

If you have a complaint regarding the way we have handled your information, or have any questions about this Privacy Policy, or your personal information we hold, please contact us by any of the following means:

• Att: Penny Oliver
  privacy@ifc.com.au
  35 Jordan Close, Altona, Victoria, 3018, Australia
  +61 3 8398 0600

Please make sure to include your name and return contact details with any inquiry.

If you have a complaint, you should first complain to us in writing.

If we receive a complaint from you about how we have handled your personal information, we will determine what (if any) action we should take to resolve the complaint.

We will endeavour to respond to your complaint or inquiry within 30 days from when it is received.

If you are not satisfied with our response to your complaint or inquiry or the way in which your complaint was handled, you can contact the Office of the Australian Information Commissioner (OAIC) at www.oaic.gov.au.

Policy Effective: 28 October 2025