Privacy Policy and Information Notice

Villa Maria Catholic Homes Limited

Privacy Policy and Information Notice

for

Website Users

https://vmch.com.au

Introduction

Villa Maria Catholic Homes Limited (VMCH) respects that individuals have a right to privacy, and understands the value and sensitivity of personal information (“personal data”) and confidential information.

VMCH attaches a great deal of importance to and will pay particular attention to protecting your personal data and to respecting your privacy and confidential information.

Purpose

The purpose of this privacy policy and information notice for website users (“notice”) is to inform you of how your personal data is collected, used, distributed, and handled (“processed”) when you visit VMCH’s website (https://vmch.com.au “website”). In this regard, please note that VMCH (“we”, “us” and “our”) acts as the Australian Privacy Principle entity (“APP entity”) as the service provider responsible for your personal data.

What Personal Data do we collect?

When you browse our website, the VMCH web servers, controlled directly or indirectly by VMCH, make a record of your visit and log the following information:

your Internet Protocol (IP) address (e.g. 123.246.123.246) and/or fully qualified domain name (e.g. https://vmch.com.au);

the date and time of your visit to the website;

the web pages you accessed, the files you downloaded and the sizes of those pages/files;

if you followed a link to the website (e.g. from a search engine), the name of the previous web page and the name of the web site you visited;

the type and version of your web browser (e.g. MS Internet Explorer, Firefox or Chrome);

the name of your operating system (e.g. Windows 7 or 8, Apple or Linux); and

the protocols used (e.g. http, https, ftp).

Depending upon your search, activity and preferences, we collect the following categories of personal data about you:

identification data (e.g., surname, first name, email address, username, password, region, type of device);

professional data (e.g., position held, field of activity, employer); and

personal data contained in correspondence you send to us, including through our contact us, email and chat services.

When you complete the VMCH “Contact Us” Form (https://vmch.com.au/contact-us), in addition to the above personal data, we also collect the following personal data about you:

your interests;

how you heard about us;

whether the enquiry is for you or on behalf of someone else e.g., your employer);

your relationship with that someone else; and

anything you choose to provide in the free form message section.

Provision of your personal data is voluntary, but we will be unable to provide you with the services and information you request without it. For example, if you contact us through the website, you will need to provide us with your email address so that we can respond to you.

Additionally, if you provide us with personal data belonging to third parties, you undertake to ensure that such persons have been duly informed of the processing of their personal data in accordance with this policy and, if required, have consented to the processing of their personal data.

In any case, we will inform you when it is mandatory to provide your personal data, and we acknowledge your rights under Australian privacy and data protection laws, specifically the Privacy Act 1988 (Cth) (Privacy Act), APP2 to remain anonymous and to use a pseudonym.

VMCH Service Agreement

When you enter into a service agreement with VMCH (e.g. to participate in our residential aged care, community care services, respite care, retirement living and low-cost housing options for the elderly), we will collect additional personal data, and you will be provided with a specific information notice on how we process your personal data. We do not need all your personal data when you simply visit the website because the website is to tell visitors to our website about us and the services and products we provide, and not to provide the services themselves.

Why do we use your Personal Data?

The table below outlines the purposes that we process your personal data for and, for each purpose, the legal basis for the processing operation in question:

Purposes	Legal Basis
Search terms that you provide when you search the website.	Collected for statistical analysis, to understand what users are looking for on the website and to improve the products and services which VMCH offers.
Responding to requests and questions you may submit through the website, and more broadly, managing our relationship with visitors to the website.	The processing is carried out to provide you with the service you requested from us.
Improving our services and our website.	The processing is carried out to optimise our tools and solutions to best accommodate our website visitors, clients, and prospects.
Complying with legal and regulatory obligations applicable to us.	The processing is necessary to comply with the legal obligations that we are subject to.
Managing any potential or actual disputes with you or third parties.	The processing is carried out to defend our interests, including through legal action, if necessary.
Sending, using both automated (e.g., email, SMS, MMS, etc.) and non-automated (e.g., phone, ordinary mail, etc.) means, marketing messages and promotional content messages relating to our activities, products and services (including market research, customer satisfaction surveys, information about webinars and events) (marketing).	The processing is carried out only if you provide specific consent.

Please note that we will not process your personal data for any other purpose that is incompatible with the above-mentioned purposes.

Who do we share your Personal Data with?

In the context of our processing operations, we may communicate your personal data to the following recipients:

to our service providers, suppliers, agents, and contractors, to the extent that they assist us in carrying out the purposes set out in this policy (e.g., we use IT service providers to host your personal data on our behalf); and

to competent courts, public authorities, government agencies, and law enforcement agencies (including where we are required to comply with legal or regulatory requests).

Regardless of the recipient, we will only disclose your personal data to them on a strictly need-to-know basis and only to the extent required by law and to fulfill the purposes identified in this policy.

Transfer Personal Data outside Australia

Your personal data is likely be transferred to the USA for processing, storage or support services. Where your personal data is transferred outside Australia, we ensure that the level of protection your personal data is given is not adversely affected by such transfers.

This specifically means that we ensure that:

the overseas recipient does not breach the Privacy Act or the Privacy Principles (APPs);

the recipient of the information is subject to a law, or binding scheme, that protects your personal data in a substantially similar manner to Australian privacy law;

there are technical and organisational mechanisms in place to ensure the protection of your personal data; and

there are mechanisms that you can access to take action to enforce your rights.

No transfer of your personal data overseas will be made unless at least one of the below apply:

VMCH has entered into a data processing agreement (DPA) with the third-party which contains standard contractual clauses and contractual safeguards;

the existence of an exemption related to one of the specific situations exhaustively provided for by the Privacy Act (e.g. where you have given your consent to such transfer having been informed of the absence of safeguards, where the transfer is necessary for the performance of a contract concluded between you and us, where the transfer is necessary for the conclusion or performance of a contract concluded in your interest between us and a third-party, or where the transfer is necessary for the establishment, exercise or defense of our legal claims, etc.);

in compliance with the permitted general situations in relation to the collection, use or disclosure of personal data (s 16A Privacy Act); and

the disclosure of the information is required or authorised under an Australian law. Or international agreement.

Further, that we will take such steps as are reasonable in the circumstances to protect your personal data from misuse, interference and loss, and from unauthorised access, modification or disclosure.

How long do we store your Personal Data for?

We store your personal data for no longer than is necessary for the purpose of the processing concerned, or, a legitimate related purpose pursuant to APP 6.2(a).

This means that the storage periods we apply vary depending on the purpose for which we process the data in question. The table below indicates, for each purpose, the storage period that will be applied to your personal data:

Purposes	Retention Term
Website searches and logging for statistical analysis and related matters.	Stored for 6 months
Responding to requests and questions you may submit through the website, and more broadly, managing our relationship with visitors to the website.	We will store your personal data for a maximum of 3 years from our last contact with you.
Improving our services and our website.	We will store your data for a maximum of one year, although in most cases your data will be aggregated shortly after collection into non-identifiable statistics.
Complying with legal and regulatory obligations applicable to us.	We store your personal data for as long as we are subject to the relevant legal or regulatory obligations.
Managing any potential or actual disputes with you or third parties.	Your personal data will be stored until all potential remedies have been exhausted, and /or the statutes of limitation no longer apply.
Sending, using both automated (e.g., email, SMS, MMS, etc.) and non-automated (e.g., phone, ordinary mail, etc.) means, marketing messages and promotional content messages relating to our activities, products and services (including market research, customer satisfaction surveys, information about webinars and events) (marketing).	We will process your personal data until your consent is withdrawn.

Our archiving policy ensures that your personal data is not stored in the active database unnecessarily.

In any case, once the applicable storage period has elapsed, we will irrevocably erase or anonymise your personal data irreversibly, so that you can no longer be identified.

Do we use Cookies?

We use cookies on our website.

To find out more about the cookies we use and the purposes that we use them for, please refer to our cookie policy. A link to the policy can be found on our website.

What rights do you have?

As an individual, the Privacy Act gives you significant control over the way that your personal data is handled. The Privacy Act allows you to:

know why your personal data is being collected, how it will be used and who it will be disclosed to;

have the option of not identifying yourself, or of using a pseudonym in certain circumstances;

ask for access to your personal data;

stop receiving unwanted direct marketing;

ask for your personal information that is incorrect, to be corrected;

make a complaint about us, if you think we have mishandled your personal data; and

where processing of your personal data is based on your consent, withdraw your consent at any time, without affecting the lawfulness of processing based on your consent carried out prior to your withdrawal of consent.

However, please note that some of the above rights are subject to specific conditions stipulated in law. Therefore, if your specific situation does not meet these conditions, we will unfortunately be unable to comply with your request.

To exercise your rights, please contact our Data Privacy Officer (DPO) using the contact details provided in clause 11 below (Company information and how to contact us). To process your request as efficiently as possible, we may ask you for certain additional information to confirm your identity and/or assist in locating the personal data that forms the subject matter of your request.

You may lodge a complaint to the following Regulators:

Privacy - Office of the Australian Information Commissioner (OAIC) here;

Consumer affairs - Australian Competition and Consumer Commission (ACCC) here; and

Unsolicited marketing (spam) - Australian Communications and Media Authority (ACMA) here.

Please note also that Australian telecommunication and data surveillance laws limit your right to privacy to some extent. These laws establish a legitimate means for us to monitor and secure our systems and networks, which is an obligation upon us under corporations, cyber security and other laws.

Company information and how can you contact us

If you have any questions or requests regarding our processing operations with your personal data under this policy, including exercising your rights as outlined above, you may contact us using the contact details provided below.

Name	Villa Maria Catholic Homes Limited (VMCH)
Responsible VMCH Officer	Tania Fisher
Physical address and the address for receipt of legal service of documents	Level 27 / 2 Lonsdale Street, Melbourne VIC 3002
Postal address	PO Box 134, East Melbourne VIC 3002
Phone numbers and contacts	03 9926 2009 1300 698 624 hello@vmch.com.au
Website address	https://vmch.com.au
Email address	hello@vmch.com.au
ABN	2 004 364 103
Directors	Julien O’Connell – Non Exec, Chairperson Vincent Arthur – Non Exec. Director Tom Barry – Non Exec. Director Brendon Donohoe – Non Exec. Director Michael Fisher – Non Exec. Director Sally Howe – Non Exec. Director Liesl Malcolm – Non Exec. Director Dr. Natasha Michael – Non Exec. Director Mary Power– Non Exec. Director Bob Santamaria – Non Exec. Director Garry Thompson – Non Exec. Director

Current version: VMCH - Privacy policy for website visitors – v2-0

Last updated: 01/08/2025