LEEP PRIVACY POLICY

1. PURPOSE AND APPLICATION

1.1 Purpose

This Privacy Policy establishes the principles, practices and procedures by which Iconic Productions Pty Limited, in connection with its LEEP program, services, productions, booking systems and associated activities (“LEEP,” “we,” “us” or “our”), collects, holds, uses, manages, protects and discloses personal information.

We recognize that the responsible stewardship of personal information is integral to the confidence placed in LEEP by clients, prospective clients, participants, representatives, suppliers, contractors, production personnel and other persons with whom we interact.

1.2 Scope

This Privacy Policy applies to personal information handled by LEEP in connection with:

1. the website at leep-projects.com, its associated pages, systems and services, together with information collected through those systems and stored or processed using server infrastructure controlled or utilized by Iconic Productions Pty Limited, including server infrastructure physically located in the United States of America;
2. inquiries, quotations, applications, bookings and production engagements;
3. LEEP programs, packages, productions, events and related services;
4. contractual documentation, acknowledgments, consents and electronic signatures;
5. payment, transaction and accounting administration;
6. communications between LEEP and its clients, prospective clients, participants, representatives, suppliers and contractors;
7. photographs, video recordings, audio recordings and other production related materials where those materials constitute personal information;
8. administrative, security, evidentiary and compliance records; and
9. any other activity undertaken by Iconic Productions Pty Limited in connection with LEEP.

1.3 Legal framework

Where applicable, we manage personal information in accordance with the Privacy Act 1988 (Cth), the Australian Privacy Principles (“APPs”), the Notifiable Data Breaches scheme, and other applicable Australian laws and regulatory requirements.

Nothing in this Privacy Policy is intended to exclude, restrict or modify any right, protection, obligation or remedy that cannot lawfully be excluded, restricted or modified.

2. DEFINITIONS

For the purposes of this Privacy Policy:

“APPs” means the Australian Privacy Principles contained in Schedule 1 to the Privacy Act 1988 (Cth), as amended from time to time.

“Client” includes a prospective, current or former client, customer, purchaser, booking party or person engaging or seeking to engage LEEP.

“Personal information” has the meaning prescribed by applicable privacy legislation and generally includes information or an opinion about an identified individual, or an individual who is reasonably identifiable, whether the information or opinion is true or not and whether recorded in material form or not.

“Physical Electronic Signature” means, for the purposes of LEEP systems, a handwritten signature or representation of a handwritten signature drawn or otherwise physically created by an individual and captured electronically through a Website or digital signature interface. The expression describes the manner in which the signature representation is captured and does not, of itself, determine or guarantee the legal validity, authenticity, attribution or evidentiary weight of any particular signature.

“Sensitive information” has the meaning prescribed by applicable privacy legislation.

“Services” includes LEEP productions, programs, events, bookings, packages, production services, associated products and any ancillary service supplied or administered by us.

“Website” means leep-projects.com and any associated LEEP web page, portal, booking interface or digital service operated by or on behalf of Iconic Productions Pty Limited.

3. PERSONAL INFORMATION WE MAY COLLECT

3.1 General information

Depending upon the nature of your dealings with LEEP, we may collect and hold information including:

1. your name, title and contact details;
2. residential, postal, business, production or event addresses;
3. email addresses and telephone numbers;
4. business, organization and representative information;
5. Australian Business Numbers and other business identification information;
6. booking, production, event and scheduling information;
7. correspondence, inquiries, instructions and communications;
8. preferences, requirements and production objectives;
9. quotations, orders, booking selections and transaction information;
10. contractual acknowledgments, declarations, consents and signatures;
11. payment related and transaction information;
12. photographs, video, audio or other media in which an individual may be identifiable;
13. complaint, dispute, refund and customer service information;
14. information reasonably necessary for fraud prevention, security, legal compliance or the protection of our lawful interests;
15. technical and device information associated with use of our Website or systems; and
16. other information you elect to provide to us or that is reasonably necessary for the provision or administration of our Services.

3.2 We do not necessarily collect every category

The foregoing categories describe information that we may collect. They do not represent that LEEP collects every category of information from every individual.

We endeavor to limit collection to information reasonably necessary for our functions and activities or otherwise permitted or required by law.

4. SENSITIVE INFORMATION

LEEP does not seek to collect sensitive information unnecessarily.

Where sensitive information is reasonably necessary for our functions or activities, we will collect and handle that information in accordance with applicable law, including obtaining consent where consent is required.

In particular circumstances, information concerning accessibility requirements, disability accommodations, health related production requirements or other special arrangements may constitute or reveal sensitive information.

Where such information is provided to enable us to accommodate an individual or safely and effectively provide Services, we will endeavor to limit its collection, use and disclosure to what is reasonably necessary for the relevant purpose, subject to applicable law.

5. HOW WE COLLECT PERSONAL INFORMATION

5.1 Direct collection

Where reasonable and practicable, we collect personal information directly from the individual concerned.

This may occur when you:

1. use our Website;
2. submit an inquiry;
3. request information or a quotation;
4. commence or complete a booking;
5. purchase or engage Services;
6. communicate with LEEP or Iconic Productions;
7. enter into a production agreement or other contractual arrangement;
8. provide an electronic signature, consent or acknowledgment;
9. participate in a LEEP production or event;
10. make a payment;
11. submit feedback, a complaint or other correspondence; or
12. otherwise provide information to us.

5.2 Collection from third parties

We may also receive personal information from third parties where lawful and reasonably necessary, including:

1. a person authorized to act on your behalf;
2. an organization, business or representative making arrangements involving you;
3. contractors and service providers;
4. payment and transaction service providers;
5. venues and production partners;
6. publicly available sources; or
7. other persons or organizations where collection is authorized or required by law.

5.3 Unsolicited personal information

If we receive personal information that we did not solicit, we will deal with that information in accordance with applicable privacy law, including determining whether the information could lawfully have been collected by us and, where required, destroying or deidentifying information that we are not permitted or required to retain.

6. PURPOSES FOR WHICH INFORMATION MAY BE USED

Subject to applicable law, we may collect, hold, use or disclose personal information for purposes including:

1. responding to inquiries;
2. administering quotations and bookings;
3. providing LEEP Services;
4. establishing, administering and performing contractual relationships;
5. verifying booking selections, instructions, acknowledgments and consents;
6. processing and reconciling transactions;
7. communicating with clients and participants;
8. coordinating personnel, venues, suppliers and production resources;
9. providing customer support;
10. administering amendments, cancellations, disputes, refunds and complaints;
11. maintaining appropriate business, accounting and taxation records;
12. protecting the security and integrity of our Website, systems, personnel and operations;
13. preventing, detecting and investigating suspected fraud, misuse or unlawful activity;
14. establishing, exercising or defending legal rights and claims;
15. complying with legal, regulatory, insurance, taxation and accounting obligations;
16. maintaining records reasonably required for contractual, evidentiary, audit or compliance purposes;
17. improving our Services and business processes;
18. undertaking direct marketing where permitted by law; and
19. purposes otherwise notified to you, authorized by you or permitted or required by law.

7. LEEP BOOKINGS AND CONTRACTUAL RECORDS

LEEP bookings may involve the creation and retention of contractual and evidentiary records.

These records may include:

1. booking details;
2. selected Services and options;
3. pricing and payment selections;
4. contractual terms applicable at the relevant time;
5. acknowledgments and consents;
6. dates and times associated with relevant actions;
7. electronic signatures or other signature records;
8. transaction and booking identifiers;
9. communications associated with the booking; and
10. technical or system generated records reasonably necessary to establish the integrity, chronology or authenticity of the transaction.

We may retain such information where reasonably necessary for contractual administration, evidentiary integrity, dispute resolution, fraud prevention, regulatory compliance, enforcement of legal rights or other lawful business purposes.

8. ELECTRONIC AND PHYSICAL ELECTRONIC SIGNATURES

Where LEEP requests or permits an electronic signature or Physical Electronic Signature, that signature and associated information may be collected and retained as part of the relevant contractual or evidentiary record.

Signature information will not knowingly be used for a materially unrelated purpose except where authorized by the individual or permitted or required by law.

LEEP may maintain information reasonably necessary to demonstrate the integrity of a signature or associated transaction, including relevant booking identifiers, dates, times, document versions and technical integrity records.

Nothing in this section represents that any particular technological or evidentiary mechanism is infallible, nor does it limit any right or obligation arising under applicable law.

9. PAYMENT AND TRANSACTION INFORMATION

9.1 Payment service providers

LEEP may use independent payment service providers to facilitate payments.

At the date of this Privacy Policy, payment providers used or intended to be available through LEEP include Stripe and Pin Payments.

LEEP may change, replace, add or discontinue payment providers as its Services and payment infrastructure evolve.

9.2 Information processed by payment providers

Payment information supplied through a third party payment interface may be transmitted directly to, collected by, or processed by the applicable payment provider rather than being stored in full by LEEP.

LEEP may nevertheless retain transaction related information reasonably necessary for accounting, reconciliation, booking administration, refunds, chargebacks, fraud prevention, contractual evidence and legal compliance.

9.3 Independent privacy practices

Information directly collected or independently handled by a payment provider may also be governed by that provider's privacy policy and applicable terms.

LEEP does not represent that it controls the independent information handling practices of a third party payment provider beyond the control that LEEP actually possesses.

10. TECHNICAL INFORMATION AND SYSTEM RECORDS

When you access or interact with our Website or digital systems, technical information may be generated or collected.

Depending upon our systems and service providers, this may include:

1. Internet Protocol addresses;
2. browser and device information;
3. dates and times of access or transactions;
4. page requests and navigation information;
5. system, security and error logs;
6. session or transaction identifiers; and
7. information reasonably required for security, troubleshooting, fraud prevention, service delivery or evidentiary integrity.

We may use this information for legitimate operational, security, analytical, contractual and compliance purposes in accordance with applicable law.

11. COOKIES AND SIMILAR TECHNOLOGIES

Our Website may use cookies or similar technologies where required for functionality, security, session management, preferences, analytics or other legitimate website purposes.

The nature and use of these technologies may change as our Website and service providers evolve.

Where applicable law requires notification, consent or another particular mechanism for specific technologies, we will endeavor to implement the required mechanism.

You may be able to configure your browser to restrict certain cookies, although doing so may affect Website functionality.

12. DISCLOSURE OF PERSONAL INFORMATION

We do not disclose personal information indiscriminately.

Subject to applicable law, personal information may be disclosed where reasonably necessary to:

1. Iconic Productions personnel who require access for legitimate business purposes;
2. production personnel and contractors;
3. venues, suppliers and service providers;
4. payment processors and financial service providers;
5. hosting, information technology, communications, security and data service providers;
6. accountants, auditors, insurers, solicitors and professional advisers;
7. government authorities, regulators, courts, tribunals or law enforcement bodies where permitted or required by law;
8. persons involved in an actual or prospective corporate transaction where lawful and subject to appropriate confidentiality arrangements; or
9. another person or organization where you have authorized the disclosure or the disclosure is otherwise permitted or required by law.

We endeavor to limit disclosure to information reasonably necessary for the relevant purpose.

13. CONTRACTORS AND SERVICE PROVIDERS

LEEP necessarily relies upon third party providers and contractors in conducting aspects of its operations.

Where a third party processes personal information on our behalf, we will take such steps as are reasonable in the circumstances to address privacy and security considerations applicable to that arrangement.

Some third parties operate independently and may have their own legal obligations and privacy practices.

Nothing in this Privacy Policy should be construed as a representation that LEEP exercises control over an independent third party beyond the control that LEEP actually possesses.

14. OVERSEAS STORAGE, DISCLOSURE AND PROCESSING

14.1 United States server infrastructure

LEEP and Iconic Productions Pty Limited utilize server infrastructure physically located in the United States of America for the hosting, storage, administration or processing of information associated with LEEP and the Website.

Accordingly, personal information collected through LEEP may be stored or processed using infrastructure located outside Australia, including in the United States of America.

14.2 Distinction between overseas storage and disclosure

The physical location of server infrastructure outside Australia does not, of itself, necessarily determine whether personal information has been “disclosed” to an overseas recipient for the purposes of the Australian Privacy Principles.

Whether a particular arrangement constitutes an overseas disclosure may depend upon the circumstances of the arrangement, including the access available to an overseas service provider and the degree of effective control retained by Iconic Productions Pty Limited.

14.3 Overseas recipients and service providers

In addition to overseas storage, some technology, communications, cloud, payment, production or professional service providers used by LEEP may operate infrastructure, personnel or systems outside Australia.

Personal information may therefore, in some circumstances, be disclosed to, accessed from, or processed by overseas recipients.

Where personal information is likely to be disclosed to overseas recipients and it is practicable to identify their countries, those countries will be identified as required by applicable law.

At present, the United States of America is a country in which LEEP information is known to be stored or processed.

14.4 APP 8

Where APP 8 applies to an overseas disclosure, Iconic Productions Pty Limited will take such steps as are required by applicable law before or in connection with that disclosure.

Nothing in this Privacy Policy represents that information will at all times be stored or processed exclusively in Australia or exclusively in any other particular jurisdiction.

15. PHOTOGRAPHY, VIDEO, AUDIO AND PRODUCTION MATERIAL

LEEP operates in a production environment in which photography, cinematography, video, audio and related content may be created.

The collection, ownership, licensing, promotional use and other exploitation of production content may additionally be governed by:

1. the applicable LEEP Booking Terms and Conditions;
2. a production agreement;
3. a release or consent;
4. a separate contractual instrument; or
5. applicable law.

This Privacy Policy concerns the handling of personal information. It does not of itself confer or extinguish copyright, performer rights, contractual rights, licenses, releases or other intellectual property rights.

Where production material constitutes personal information, we will handle that personal information in accordance with applicable privacy obligations.

16. DIRECT MARKETING

16.1 Applicable laws

LEEP may use or disclose personal information for direct marketing only where permitted by applicable law.

Depending upon the nature and method of the communication, relevant requirements may arise under the Privacy Act 1988 (Cth) and APP 7, the Spam Act 2003 (Cth), the Do Not Call Register Act 2006 (Cth) and other applicable laws.

16.2 Electronic commercial communications

Where the Spam Act 2003 (Cth) applies, LEEP will endeavor to ensure that commercial electronic communications are sent with the consent required by law, appropriately identify the sender, provide applicable sender contact information and contain a functional means of unsubscribing.

Where required by that legislation, an unsubscribe request will be honored within the applicable statutory period.

16.3 Opt out requests

An individual may request that we cease using or disclosing their personal information for direct marketing.

Where applicable law requires us to comply with such a request, we will do so within the applicable period and will not charge the individual for making or giving effect to the request.

An opt out from direct marketing does not prevent us from sending communications reasonably necessary to administer an existing booking, contract, payment, production, transaction, legal obligation or service relationship.

16.4 Source of information

Where applicable law provides an individual with the right to request the source from which we obtained personal information used or disclosed for direct marketing, we will respond to such a request within the period required by applicable law unless an applicable exception permits otherwise.

17. ANONYMITY AND PSEUDONYMITY

Where required by the Australian Privacy Principles, individuals may have the option of dealing with us anonymously or by pseudonym.

This option may not be practicable where LEEP is required or authorized by law to deal with an identified individual or where it is impracticable for us to deal with an individual who has not identified themselves or has used a pseudonym.

This may include contractual engagements, bookings, payments, production participation, legal documentation, fraud prevention, refunds and other circumstances in which identity is reasonably necessary.

18. DATA QUALITY

We take reasonable steps in the circumstances to ensure that personal information we use or disclose is accurate, up to date, complete and relevant, having regard to the purpose for which it is used or disclosed.

Individuals are encouraged to notify us where material personal information provided to us changes or is believed to be inaccurate.

19. SECURITY OF PERSONAL INFORMATION

We take reasonable steps in the circumstances to protect personal information that we hold from misuse, interference and loss and from unauthorized access, modification or disclosure.

The measures appropriate to particular information may vary according to factors including the nature and sensitivity of the information, the manner in which it is held, technological developments, operational requirements and reasonably foreseeable risks.

No Internet transmission, information system, storage mechanism or security measure can properly be represented as eliminating every conceivable risk.

Accordingly, while we take privacy and information security seriously, this Privacy Policy does not constitute a warranty or representation that unauthorized access, cyber incidents, technical failures or other security events can never occur.

We do not publicly disclose detailed security configurations where doing so could itself prejudice the effectiveness of those safeguards.

Nothing in this section limits, excludes or qualifies the obligations of Iconic Productions Pty Limited under APP 11 or any other applicable law concerning the security, protection, destruction or deidentification of personal information.

20. RETENTION, DESTRUCTION AND DEIDENTIFICATION

We do not intend to retain personal information indefinitely merely because it has been collected.

Retention periods may vary according to:

1. the purpose for which information was collected;
2. contractual requirements;
3. applicable limitation periods;
4. taxation, accounting and corporate recordkeeping obligations;
5. actual or reasonably anticipated disputes;
6. insurance requirements;
7. fraud prevention and security requirements;
8. evidentiary requirements; and
9. other lawful purposes for which the information remains reasonably necessary or for which retention is permitted or required by applicable law.

Personal information will not be retained for longer than reasonably necessary merely because continued retention may be operationally convenient.

Where we hold personal information that is no longer required for a purpose for which it may lawfully be used or disclosed, we will take such reasonable steps as applicable law requires to destroy the information or ensure that it is deidentified, subject to applicable lawful exceptions.

Where personal information is held using third party infrastructure, reasonable steps may include appropriate directions to the relevant provider and, where appropriate and reasonably practicable, steps to obtain confirmation that required destruction or deidentification has occurred.

21. DATA BREACHES

21.1 Data breach preparedness

LEEP maintains procedures intended to facilitate the prompt identification, containment, investigation, assessment, remediation and management of actual or suspected data breaches involving personal information.

Our data breach response arrangements are designed to support compliance with the Privacy Act 1988 (Cth), the Notifiable Data Breaches scheme and other applicable legal obligations.

21.2 Immediate response and containment

Where an actual or suspected data breach is identified, we will take such steps as are reasonable in the circumstances to contain the incident, protect affected information, preserve relevant evidence, investigate the circumstances and reduce the risk of harm to affected individuals.

Where appropriate, remedial action may be undertaken during the investigation or assessment of an incident in an effort to prevent or reduce the likelihood of serious harm.

21.3 Assessment of suspected eligible data breaches

Where we become aware of reasonable grounds to suspect that circumstances may amount to an eligible data breach under the Privacy Act 1988 (Cth), we will undertake the assessment required by applicable law.

We will take all reasonable steps to complete that assessment expeditiously and, where the statutory assessment period applies, within the period prescribed by law.

The statutory assessment period is not treated by LEEP as a period during which action may unnecessarily be deferred. Where practicable, suspected breaches will be assessed substantially sooner having regard to the circumstances and potential risk to affected individuals.

21.4 Eligible data breach criteria

An incident may constitute an eligible data breach where, among other applicable statutory requirements:

1. personal information has been subject to unauthorized access or unauthorized disclosure, or has been lost in circumstances in which unauthorized access or disclosure is likely;
2. the circumstances are likely to result in serious harm to one or more individuals to whom the information relates; and
3. remedial action has not prevented the likelihood of that serious harm.

The statutory criteria applicable at the time of the incident will govern any determination.

21.5 Notification

Where LEEP or Iconic Productions Pty Limited has reasonable grounds to believe that an eligible data breach has occurred and notification is required by applicable law, we will take the steps required under the Notifiable Data Breaches scheme, including notification to the Office of the Australian Information Commissioner (“OAIC”) and affected or at risk individuals as applicable.

Required notification will be undertaken as soon as practicable in accordance with applicable law.

Where notification is required, information provided to affected individuals may include the nature of the incident, the kinds of information involved and practical steps individuals may take to reduce or respond to the risk of harm.

21.6 Multiple entity incidents

Where an incident involves a third party service provider, contractor, payment provider, hosting provider or another organization, LEEP may coordinate investigation, assessment, remediation and notification activities with that entity.

Nothing in such an arrangement limits any obligation imposed upon Iconic Productions Pty Limited by applicable law.

21.7 Post incident review

Following a material privacy incident, LEEP may review the circumstances of the incident, the effectiveness of its response and any technical, organizational or procedural improvements reasonably appropriate to reduce the likelihood or consequences of recurrence.

22. ACCESS TO PERSONAL INFORMATION

22.1 Right to request access

Subject to applicable law, an individual may request access to personal information about that individual held by us.

A request may be directed to the LEEP Privacy Channel Captain, being LEEP's designated Privacy Officer, using the contact details set out in Section 34 of this Privacy Policy.

Nothing in this Privacy Policy requires a person to use particular terminology or a particular form before a valid access request can be considered.

22.2 Identity verification

We may require reasonable verification of identity before providing access to personal information.

22.3 Response

We will respond to access requests within the period required by applicable law.

For requests governed by the Australian Privacy Principles, we will ordinarily endeavor to respond within a reasonable period, generally not exceeding 30 calendar days, having regard to the nature and complexity of the request and surrounding circumstances.

If additional time is reasonably required, we will endeavor to communicate with the individual concerning the delay and anticipated response timeframe.

22.4 Access charges

No fee will be charged merely for making an access request.

Where LEEP incurs reasonable administrative costs in actually providing access to requested personal information, LEEP may impose a reasonable access charge reflecting those costs, ordinarily not exceeding AUD $50 plus any applicable tax.

Any proposed charge will be communicated and explained to the individual before access is provided.

The amount of any charge will have regard to the actual reasonable costs associated with providing access and applicable law. LEEP may reduce or waive a proposed charge where appropriate having regard to the circumstances.

An access charge will not be imposed or calculated for the purpose of discouraging, obstructing or penalizing an individual for exercising a right of access.

Where practicable, if a charge may arise, LEEP may discuss reasonable alternatives with the individual for narrowing the request or providing access in another suitable manner that may reduce or eliminate the charge.

22.5 Refusal or alternative access

Access may be refused or limited where an exception under applicable law applies.

Where required by law, we will provide written reasons for refusing access and information concerning applicable complaint mechanisms.

Where direct access cannot appropriately be provided, we will consider whether access can reasonably be provided by another means consistent with applicable law.

23. CORRECTION OF PERSONAL INFORMATION

23.1 Right to request correction

An individual may request correction of personal information held by us where the individual believes that information is inaccurate, out of date, incomplete, irrelevant or misleading.

Correction requests may be directed to the LEEP Privacy Channel Captain, being LEEP's designated Privacy Officer, using the contact details set out in Section 34 of this Privacy Policy.

A correction request does not need to employ particular legal terminology or a prescribed form unless applicable law provides otherwise.

23.2 Consideration of requests

We will consider correction requests and take reasonable steps to correct personal information where required by applicable law.

We will respond within the period required by applicable law and, where the Australian Privacy Principles apply, ordinarily within a reasonable period.

23.3 Previous recipients

Where required by applicable law, if personal information is corrected and the individual requests that we notify another APP entity to which the information was previously disclosed, we will take reasonable steps to give that notification unless it would be unlawful or impracticable to do so.

23.4 Refusal and statement

Where we refuse to correct personal information and applicable law requires it, we will provide written reasons for the refusal and information concerning available complaint mechanisms.

Where applicable law provides the individual with the right to request that a statement be associated with the relevant personal information asserting that the information is inaccurate, out of date, incomplete, irrelevant or misleading, we will take reasonable steps to associate that statement with the information in a manner that makes the statement apparent to users of the information.

24. IDENTITY VERIFICATION

For the protection of personal information, we may require reasonable evidence of identity before acting upon an access, correction, complaint or other privacy related request where verification is reasonably necessary.

The level of verification required may vary according to the sensitivity of the information and the nature of the request.

We will endeavor not to collect more identity information than is reasonably necessary for verification.

A request for identity verification does not permit us to impose unnecessary or disproportionately burdensome identification requirements.

25. CHILDREN AND PERSONS REQUIRING REPRESENTATION

LEEP Services are not designed to circumvent the legal rights or protections applicable to children or persons who require lawful representation or assistance in making relevant decisions.

Where information concerning a child or another person requiring lawful representation is involved, we may require the involvement, authority or consent of a parent, guardian, attorney, representative or other legally authorized person where appropriate or required by law.

The precise requirements will depend upon the circumstances and applicable law.

26. THIRD PARTY WEBSITES AND EXTERNAL SERVICES

Our Website may contain links to websites, platforms or services operated independently by third parties.

A link does not, without more, constitute control of or responsibility for the privacy practices of the external provider.

Individuals should review the privacy information supplied by relevant third parties before providing personal information directly to them.

27. AUTOMATED PROCESSING AND DECISION MAKING

LEEP may use computer systems, software and automated processes to administer aspects of its operations, including bookings, calculations, workflow, communications, security and transaction processing.

We do not intend this clause to imply that LEEP presently undertakes any particular form of automated decision making that significantly affects an individual's rights or interests.

From December 10, 2026, additional Australian Privacy Principle transparency requirements concerning certain uses of personal information in automated decision making commence.

Where those provisions apply to LEEP, we will provide the information required by applicable law concerning the kinds of personal information used and the kinds of decisions made or substantially made using qualifying computer programs.

This section will be reviewed as those provisions commence and as authoritative regulatory guidance develops.

28. PRIVACY COMPLAINTS

28.1 Making a complaint

If you believe that LEEP has mishandled your personal information or failed to comply with an applicable privacy obligation, you may submit a complaint to the LEEP Privacy Channel Captain, being LEEP's designated Privacy Officer, using the contact details set out in Section 34 of this Privacy Policy.

A complaint should, where reasonably possible, contain sufficient information to enable us to identify the matter complained of and investigate it appropriately.

We may request further information where reasonably necessary, but we will not reject an otherwise intelligible privacy complaint merely because particular legal terminology or a particular form has not been used.

28.2 How complaints are handled

We will endeavor to:

1. acknowledge the complaint within a reasonable period;
2. investigate its substance fairly and proportionately;
3. obtain relevant information where reasonably necessary;
4. provide the complainant with a reasonable opportunity to explain relevant circumstances where appropriate; and
5. provide a substantive response ordinarily within 30 calendar days after receiving the complaint.

Where the nature or complexity of a complaint means that a substantive response cannot reasonably be provided within that period, we will endeavor to notify the complainant, explain the reason additional time is required and provide an anticipated timeframe for our substantive response.

28.3 External complaint mechanisms

Where you remain dissatisfied and applicable privacy legislation provides an external complaint mechanism, you may have the right to contact the Office of the Australian Information Commissioner (“OAIC”).

Nothing in this Privacy Policy restricts any right to approach a regulator, court, tribunal or other competent authority where that right exists under applicable law.

29. LEGAL REQUESTS, PROCEEDINGS AND ENFORCEMENT

We may preserve, use or disclose personal information where reasonably necessary and permitted or required by law in connection with:

1. a subpoena, warrant, court or tribunal order;
2. regulatory or governmental requirements;
3. law enforcement inquiries;
4. actual or anticipated legal proceedings;
5. the establishment, exercise or defense of legal or equitable claims;
6. the investigation of suspected fraud or unlawful conduct; or
7. enforcement or protection of contractual or legal rights.

Nothing in this Privacy Policy requires us to destroy information that we are lawfully required or entitled to preserve.

30. CHANGES TO THIS PRIVACY POLICY

We may amend this Privacy Policy from time to time to reflect changes in:

1. applicable law or regulatory guidance;
2. our Services or business operations;
3. technology and information handling practices;
4. service providers;
5. security practices; or
6. other legitimate operational requirements.

The current version will be published on our Website with an appropriate version identifier or effective date.

Publication of an amended Privacy Policy does not retrospectively create consent where applicable law requires specific consent, nor does it extinguish accrued legal rights.

Where a material change requires additional notice or consent under applicable law, we will take such steps as are reasonably required in the circumstances.

31. RELATIONSHIP WITH OTHER LEEP DOCUMENTS

This Privacy Policy should be read together with applicable LEEP contractual documentation, including the LEEP Booking Terms and Conditions, Purchase, Sale and Contract of Engagement and any specific privacy collection notice, production agreement, consent, release or other document applicable to a particular transaction.

A privacy collection notice provided at or in connection with a particular collection may contain information specific to that collection and should be read together with this Privacy Policy.

If another document regulates a matter beyond personal information, this Privacy Policy does not displace that document merely because the same factual circumstances involve personal information.

Where an inconsistency concerns a mandatory privacy obligation, applicable law prevails to the extent of the inconsistency.

32. NO EXCLUSION OF MANDATORY RIGHTS

Nothing in this Privacy Policy excludes, restricts or modifies any guarantee, right, remedy, protection or obligation that cannot lawfully be excluded, restricted or modified.

Any provision that would otherwise operate contrary to a mandatory requirement of applicable law is to be construed, to the extent legally permissible, so as to preserve its lawful operation.

33. SEVERABILITY AND READING DOWN

If any provision or part of a provision of this Privacy Policy is determined by a court or other competent authority to be unlawful, invalid or unenforceable, that provision or part is, to the extent legally permissible, to be read down so as to preserve its lawful operation.

Where lawful operation cannot be preserved by reading down, the affected provision or part is to be severed to the minimum extent necessary without affecting the continuing operation of the remaining provisions.

34. CONTACTING LEEP ABOUT PRIVACY

Questions, access requests, correction requests, complaints or other inquiries concerning this Privacy Policy or the handling of personal information may be directed to LEEP's designated Privacy Officer:

Telephone: +61 2 8355-3848
Email: privacy-captain_leep@leep-projects.com

Individuals are encouraged, but are not required, to identify correspondence as “Privacy Inquiry,” “Privacy Access Request,” “Privacy Correction Request,” or “Privacy Complaint”, as appropriate, to assist us in directing the matter efficiently.

This Privacy Policy is made available free of charge through the LEEP Website.

A person or body may also request a copy of this Privacy Policy in another particular form. Where the Australian Privacy Principles require us to do so, we will take reasonable steps to provide the policy in that form.

35. PRIVACY COLLECTION NOTICES

This Privacy Policy describes LEEP's general management of personal information.

Where appropriate, LEEP may provide a separate privacy collection notice at or before a particular collection of personal information, or as soon as practicable afterward where prior or contemporaneous notification is not practicable.

A collection notice may address matters specific to the particular collection, including:

1. the identity and contact details of the collecting entity;
2. the circumstances and purposes of collection;
3. any consequences that may arise if requested information is not provided;
4. usual categories of recipients;
5. access, correction and complaint information;
6. the availability of this Privacy Policy; and
7. likely overseas disclosures and relevant countries where applicable and practicable.

A collection notice supplements this Privacy Policy and does not replace it.

36. VERSION CONTROL