Privacy Policy

Automated decision-making

From time to time, we may use computer programs to make, or to assist in making, some decisions about you that may significantly affect your rights or interests. We are required to tell you about this under Australian Privacy Principles 1.7 to 1.9.

The kinds of decisions we make using these systems are:

• whether to accept your application for storage
• whether to refuse or terminate storage where a risk listing is returned
• whether to suspend your access to your unit where your account is in arrears

The kinds of personal information used in these systems are:

• your name, date of birth and identification details
• your current residential and previous addresses
• your storage and payment history with us
• information returned about you from the StorerCheck database

You can ask for a decision made this way to be reviewed by a member of our staff. Contact our Privacy Officer using the details at the end of this Policy and we will respond within 30 days.

Collection of information

We need to collect, retain and use information about you, including your personal information, to provide you with storage and do business with you.

Generally, this information is collected directly from you, but we may collect information about you that is publicly available, including from public registers or social media, or made available by third parties.

Information we collect may include:

• first and last name
• driver's licence details
• date of birth
• passport details
• telephone number(s)
• email address
• residential address
• CCTV images and video footage of you, and electronic records of your access to our facility. Our CCTV system does not record audio
• video recorded by the dashcams fitted to our delivery vehicles, which may capture you, your vehicle or your property when we deliver or collect a gobox. Our dashcams do not record audio; and
• any other information reasonably necessary to manage our relationship with you.

We may also be required to collect payment information from you, including credit card or direct debit information, and we collect and retain information about your ongoing storage and payment history.

Card payments

Card payments made through our website are processed by NAB Transact, a payment service operated by National Australia Bank. Your card details are sent directly from your browser to NAB over an encrypted connection. They do not pass through, and are not stored on, our website or its servers.

NAB sends us confirmation of the payment, the amount, a reference number and a masked version of your card number showing only the first six and last three digits. We keep that masked number with your payment record so that we can identify the payment. We never receive or store your full card number or your card security code (CVV).

We will never ask you to send card details by email or live chat, and you should not do so.

If you choose not to provide us with the information that we have requested, we will be unable to offer you storage at our facility or communicate further with you.

Our website, cookies and analytics

When you visit our website we collect technical information including your IP address, device and browser type, the pages you view, how long you spend on them, and the site that referred you to us. We use cookies and similar technologies to do this.

We use the following third-party services on our website and in our business:

You can disable cookies through your browser settings, though some parts of our website may not work properly if you do. You can also limit how this information is used for advertising through Google's Ad Settings (adssettings.google.com), the Google Analytics opt-out browser add-on (tools.google.com/dlpage/gaoptout) and your Facebook or Instagram ad preferences.

Our website may link to other websites. We are not responsible for the privacy practices of those sites.

Why we collect this information

We need to collect information from you for a variety of purposes including to provide you with storage and do business with you.

We also need to collect information from you to:

• ensure security of the facility and the goods and people within the facility
• establish your identity and assess your application for storage
• be able to contact you during the storage relationship
• provide you with information about your account, including billing and provision of notices
• provide you with information about our business and related entities, including promotions
• be able to answer questions from you about your account and our services
• manage our risk, including enabling us to undertake a search of the StorerCheck database, or any relevant credit history entity
• assist other storage facilities manage their credit risk, by uploading your information to the StorerCheck database
• undertake appropriate searches, including a Personal Property Securities Register (PPSR) search, if your account goes into default
• cooperate with enquiries from government and law enforcement bodies and comply with our legal obligations, and
• enforce our rights under the Storage Agreement.

CCTV, dashcams and site surveillance

Why we use CCTV

Our CCTV operates at our warehouse facilities in Dandenong South, Victoria and Marleston, South Australia. We do not install or operate CCTV at your home, your business or any other place where a gobox is delivered.

Our facilities operate CCTV continuously. We use it to:

• protect the goods stored with us, and our premises, vehicles and equipment
• deter, detect and investigate theft, break-ins, trespass, vandalism and fraud
• verify who accessed the facility, and when
• meet our work health and safety obligations, and investigate incidents, injuries and near misses
• support insurance claims, and respond to lawful requests from police and to court orders

Where cameras are, and are not

• Cameras cover entrances and exits, perimeter fencing, driveways and vehicle access points, loading areas, unit storage bays, and the car park.
• We do not install cameras in toilets, bathrooms, change rooms, showers or lactation rooms. We do not direct cameras into neighbouring properties or private residences. We do not use covert or hidden cameras.
• We do not open or film inside your storage unit, except where we are entitled to do so under your Storage Agreement, where there is a suspected safety hazard, or where we are required by law.

Notice

• Signs advising that CCTV is in operation are displayed at every entrance to our facilities and throughout monitored areas.

Who can view footage

Access to live and recorded footage is restricted to the Operations Manager and the directors. Access is logged. Footage is not shown, copied or circulated to other customers, to staff who do not need it, or to the public.

We release footage outside that group only:

• to police or another enforcement body, where we are required or authorised by law or where it relates to a suspected unlawful activity
• to our insurer or loss adjuster in connection with a claim
• to a court or tribunal under a subpoena or court order
• where there is a serious and imminent threat to a person’s life, health or safety, or
• to an individual who has made a valid access request under this Policy.

How long we keep footage

• CCTV footage is retained for 30 days and is then automatically overwritten. Where footage relates to a security incident, an insurance claim, a work health and safety incident, a police investigation or a legal proceeding, we retain the relevant footage for as long as it is needed for that purpose and then destroy it securely.
• Footage is stored on recording equipment held in a locked room at the relevant facility.

Vehicle dashcams and GPS tracking

Our delivery vehicles are fitted with dashcams and GPS tracking.

Dashcams record video of the road and the area around the vehicle. This may include you, your vehicle or your property when we deliver or collect a gobox. GPS records the location, route and movements of our vehicles. GPS tracking applies to our vehicles only. Our dashcams and our vehicle tracking and monitoring system are provided by Webfleet. Our dashcams do not record audio.

We use dashcam footage and GPS records to:

• keep our drivers, our customers and the public safe
• investigate accidents, incidents, complaints and damage claims
• confirm when and where a delivery or collection took place
• plan routes and manage our fleet
• support insurance claims, and respond to lawful requests from police and to court orders

Dashcam footage is stored on the camera in the vehicle and is overwritten on a rolling basis. Footage of an incident, and footage we request for review, is uploaded to Webfleet. Where footage relates to an accident, an incident, a complaint, an insurance claim, a police investigation or a legal proceeding, we retain the relevant footage for as long as it is needed for that purpose and then destroy it securely.

Detailed GPS location records are kept for up to 90 days. Trip logs and reports are kept for the current year and the previous two years.

The rules in this section about who can view footage, when we release it, and how you can ask for footage of yourself apply to dashcam footage in the same way as they apply to CCTV.

Asking for footage of yourself

• You can ask us for a copy of CCTV footage showing you. Make the request in writing to our Privacy Officer within the retention period above, and tell us the approximate date, time and location so that we can locate it.
• We will respond within 30 days. We may refuse or limit access where giving it would unreasonably affect the privacy of other people, where it would prejudice an investigation or legal proceedings, or where another exception under Australian Privacy Principle 12 applies. Where other people appear in the footage we may blur or redact them, and we may charge a reasonable fee for the cost of doing so. If we refuse, we will tell you why in writing and explain how to complain.

Retention of your information

We keep personal information only for as long as we need it, or for as long as the law requires — whichever is longer — and then destroy it securely or de-identify it. Paper records are shredded and digital records are securely deleted.

Where we are required to retain information for a legal proceeding, an investigation or an insurance claim, we keep it until that matter is concluded.

Access and correction of the information we hold about you

Access

You can ask us for a copy of the personal information we hold about you. Write to our Privacy Officer using the contact details at the end of this Policy and tell us what information you are after. We will need to verify your identity before we can respond.

We will respond within 30 days. We will give you access in the way you ask for it — by email, by post, or in person at our facility — where that is reasonable and practicable.

There is no charge for making a request. We may charge a reasonable fee for the cost of locating, compiling, copying or redacting the information, and we will tell you what that fee is before we do the work. The fee will not be excessive and will not apply to the request itself.

We may refuse access in the limited circumstances set out in Australian Privacy Principle 12 — for example, where giving access would unreasonably affect another person’s privacy, or would prejudice an investigation, legal proceedings, or negotiations with you. If we refuse, or if we can only give partial access, we will tell you in writing why and explain how you can complain.

Correction

If you believe information we hold about you is inaccurate, out of date, incomplete, irrelevant or misleading, tell us in writing and let us know what the correct information is. We will correct it as soon as reasonably possible, and in any event within 30 days.

There is no charge for requesting or making a correction.

If we have previously disclosed the incorrect information to another organisation — including the StorerCheck database — you can ask us to notify that organisation of the correction, and we will take reasonable steps to do so unless it is impracticable or unlawful.

If we do not agree that a correction is needed, we will tell you in writing why, explain how to complain, and — if you ask us to — associate a statement with the information recording that you consider it inaccurate.

Anonymity and pseudonymity

Dealing with us anonymously

You can make a general enquiry, ask a question about our services or request a quote without identifying yourself, or using a pseudonym.

We cannot provide storage services anonymously. We need to verify identity before we enter into a Storage Agreement and before we release anyone’s goods, and we are required to keep records of who is storing with us.

Sensitive information

Sensitive information includes health information, biometric information, and information about a person’s race, religion, political opinions, sexual orientation or criminal record. It has additional protection under the Privacy Act.

We do not seek sensitive information as a matter of course. We may end up holding it where:

• you tell us about a health condition, mobility issue or disability so that we can arrange suitable access or unit placement
• you describe goods in a way that reveals sensitive information.

We collect sensitive information only with your consent and only where it is reasonably necessary for our functions or activities, unless we are required or authorised by law to collect it. We use it only for the purpose you gave it to us for.

Children's privacy

Our services are for adults and our website is not directed at children. We do not knowingly collect personal information from anyone under 18. If you believe a child has given us personal information, please contact us and we will delete it.

Job applicants, staff and contractors

If you apply to work with us, we collect the information in your application — your résumé, work history, contact details, referee details, and the results of any licence, qualification or background check we are entitled to run. We use it to assess your application and, if you are successful, to employ or engage you.

We keep unsuccessful applications for 12 months and then destroy them, unless you ask us to keep them on file for future roles.

Personal information about our contractors is handled in the same way as information about our customers under this Policy.

Disclosure of your information

We may disclose any information we have about you including your personal information as is reasonably necessary or as is permitted by law, including but not limited to the following:

• our employees, including temporary workers or externally contracted staff
• our related entities
• service providers engaged by us including for data storage, IT and software management
• insurers and financial services providers
• third parties engaged to perform specific functions within our business, such as auctioneers, second-hand dealers, building contractors, and maintenance services
• government departments and agencies
• law enforcement agencies, including the police
• investigators
• any person who can demonstrate to our satisfaction a legal or equitable interest in the goods stored
• liquidators, administrators or other persons appointed to administer your financial affairs
• debt collection services
• your Alternative Contact Person ("ACP")
• the StorerCheck database (which means that other storage facilities / members of the Self Storage Association of Australasia ("SSAA") may search the StorerCheck database to determine whether you are a credit risk)
• storers or third parties who reasonably believe you have caused damage or injury to that storer or third party
• agents for any of the above, and
• our professional advisers (for example, our lawyers).

We never sell, rent or trade your personal information. We do not provide your contact details to any other organisation for that organisation’s own marketing. The disclosures listed above are the only circumstances in which we share your information, and each of them is either necessary to provide our services and enforce our Storage Agreement, or required, or authorised by law.

Facial recognition technology

We do not use facial recognition technology, and we do not collect or hold faceprints, fingerprints or other biometric information.

If this changes, we will update this Policy before deploying any such system, tell affected customers, and seek express consent. We will not make consent to biometric collection a condition of storing goods with us.

Disclosure of your information overseas

We may send your information outside Australia.  Some SSAA members and some of our service providers (including data storage providers) or other third parties may be located, operate or hold data outside of Australia.

When information is sent or disclosed outside of Australia, we take reasonable efforts to ensure that appropriate data handling and security arrangements are in place.

We utilise service providers which are located in several countries outside Australia, including New Zealand, the United Kingdom, the United States of America, Singapore and member states of the European Union (including Lithuania, Ireland, France, Spain and Germany). CCTV footage is stored on equipment held at the relevant Australian facility and is not sent overseas. Vehicle GPS and monitoring records, and dashcam footage that is uploaded from a vehicle, are held by our fleet management provider, Webfleet, in Germany.

The third-party services we use, listed in the section on cookies and analytics above, may also hold data outside Australia.

Please note that Australian laws may not apply to some of these entities in those countries.

Alternative Contact Person (ACP)

If you have provided us with personal information identifying your nominated ACP, you must ensure that you have the right and/or their permission to do so.

You must take reasonable steps to ensure your ACP is aware that:

• you have made this disclosure
• we may use this information as we would personal information collected about you, and
• they may access and correct the information held by us in the same manner you may correct your personal information.

Direct marketing

We may use your contact details to send you information about our services, promotions and offers, by email, SMS, post or telephone.

Every marketing email and SMS we send includes an unsubscribe option. You can also opt out at any time by contacting our Privacy Officer, or by replying to any marketing message. We will action your request within 5 business days and there is no cost to you.

Opting out of marketing will not stop operational messages about your booking, your account or your stored goods, which we need to send you.

If you ask us to, we will tell you where we got your contact details from.

We never provide your details to another organisation for that organisation’s marketing.

StorerCheck

For credit and risk management purposes, we use the StorerCheck database, operated for members of the Self Storage Association of Australasia.

When you apply to store goods with us, we will ask you to separately acknowledge and agree that we may:

• search the StorerCheck database for information that has been reported by other users of the StorerCheck database about you
• communicate with other users of the StorerCheck database and discuss your information with them
• choose to refuse you storage, or terminate your Storage Agreement, if you are listed on the StorerCheck database
• release or update any details and personal information listed on the StorerCheck database about you, including but not limited to your name, address, previous addresses, email addresses, driver's licence details, passport details, date of birth, storage history and account payment history, and
• use the information you provide during this application, including web or telephone enquiries, or information provided at any other time to update any listing currently about you on the StorerCheck database.
• upload your details and personal information on the StorerCheck database if you breach your Storage Agreement or engage in illegal or threatening behaviour including but not limited to:
  • not paying for storage
  • dumping or abandoning goods
  • being chronically late with payments
  • being abusive or threatening to staff or other storers
  • eliciting the involvement of law enforcement agencies, such as law enforcement enquiries regarding your storage activities and the execution of search warrants against you, this facility or your storage space, or
  • any other breach of the Storage Agreement.

We may use the information you provide during your storage application, including web or telephone enquiries, or information provided at any other time to update any listing currently about you on the StorerCheck database.

If you do not consent to these terms, please let us know immediately.

By applying to store goods with us you consent to the terms and conditions set out in this document and online at www.storercheck.com, including our right to search StorerCheck for your details, and to upload your information and details to the StorerCheck database in certain circumstances.

For more information about the StorerCheck database please visit www.storercheck.com.

If you would prefer to discuss it first, contact our Privacy Officer.

Security of your information

We keep your information provided to us in electronic form.  We take steps to secure this from misuse, loss, unauthorised modification, unauthorised disclosure and access.

We employ physical security such as locks on filing cabinets and restricted access to hard copy files, and other security measures including password-protected computers and internet firewalls.

We also provide our staff with compliance training on our Privacy Act obligations.

We take reasonable care when engaging third parties to provide services to us where those services may necessitate the third party handling your information, including data storage, file destruction, enforcement of the Storage Agreement and debt collection.

Eligible data breaches

If we suspect that a data breach has occurred, we will immediately take steps to contain it, and we will carry out a reasonable and expeditious assessment of whether it is likely to result in serious harm to any individual. That assessment will be completed within 30 days of us becoming aware of the suspected breach, and sooner where we can.

If we take remedial action that means the breach is not likely to result in serious harm, no notification is required, but we will still record and investigate the incident.

Where we have reasonable grounds to believe an eligible data breach has occurred, we will notify the Office of the Australian Information Commissioner and the affected individuals as soon as practicable. Our notification will describe the breach, the kinds of information involved, and the steps we recommend you take in response.

We maintain a data breach response plan and review it annually.

Complaints

If you believe we have breached the Privacy Act or the Australian Privacy Principles and wish to complain, please contact us at infovic@gobox.com.au

We will promptly investigate your complaint and notify you of the outcome within three weeks.

If you do not believe your complaint has been satisfactorily handled or resolved, you can lodge a complaint with the OAIC.

You can contact the OAIC on the details below:

GPO Box 5288, Sydney. NSW 2001

1300 363 992

enquiries@oaic.gov.au

www.oaic.gov.au

Contact us

Please email our Privacy Officer at infovic@gobox.com.au if you:

• would like to know what personal information we hold about you
• wish to access or correct the personal information that we hold about you, or
• have a question or feedback for us about this Policy.

You can also contact us on the details below:

PO Box 271, Brighton. VIC 3186

1300 668 688

infovic@gobox.com.au

www.gobox.com.au