OBJECTIVE
Karndean International Pty Ltd (Karndean) respects privacy and is committed to handling personal information openly, lawfully and securely. This policy explains how Karndean collects, holds, uses, discloses, protects, accesses and corrects personal information and how privacy enquiries and complaints can be made.
SCOPE
This policy applies to Karndean ANZ and to personal information about customers and prospective customers, showroom and event visitors, website users, sample recipients, survey participants, competition and promotion entrants, suppliers, contractors, job applicants and other individuals who interact with Karndean. It applies to electronic, paper, image and other records.
REGULATORY POSITION
For Australian operations, Karndean is subject to the Privacy Act 1988 (Cth), including the Australian Privacy Principles, and other applicable laws. Karndean will maintain practices, procedures and systems proportionate to the nature, scale and risk of its personal-information handling. This policy is reviewed annually and when law, systems, providers or business practices materially change.
DEFINITIONS
Personal information is information or an opinion about an identified individual, or an individual who is reasonably identifiable, whether or not it is true or recorded in a material form. Sensitive information is a protected category that includes health, genetic and certain biometric information and information or opinions about matters such as racial or ethnic origin, political opinions or associations, religious or philosophical beliefs, professional or trade association or union membership, sexual orientation or practices and criminal record.
INFORMATION WE COLLECT
Depending on the interaction, Karndean may collect:
• identity and contact details, such as name, address, postcode, phone number, email address, age or date of birth where relevant;
• customer, account, order, delivery, sample, payment, bank, credit and transaction information;
• business relationship details, enquiries, correspondence, preferences, feedback, survey responses and competition or promotion entries;
• images, recordings and social-media interactions where relevant and notified;
• technical and online information, such as IP address, browser, device type, cookie or advertising identifiers, page views and website or campaign interactions;
• recruitment and contractor information, including work history, qualifications, references and information reasonably required to assess or manage an engagement; and
• sensitive information only where reasonably necessary, permitted by law and, where required, with consent.
If requested information is not provided, Karndean may be unable to respond to an enquiry, fulfil an order or sample request, administer an event or promotion, assess an application or provide the relevant service.
HOW WE COLLECT INFORMATION
Karndean generally collects personal information directly from the individual, including through:
• showroom visits, exhibitions, trade shows and other events;
• website forms, online or telephone enquiries, sample orders, purchases, email, telephone, meetings and social media;
• surveys, competitions, promotions and event registrations, including forms hosted by service providers such as SurveyMonkey or Jotform;
• recruitment, contractor, supplier and customer onboarding; and
• websites, digital advertising and electronic communications using cookies, pixels, tags and similar technologies.
Karndean may also collect information from referrals, public sources, related Karndean entities and service providers. At or before collection, or as soon as practicable afterwards, Karndean will take reasonable steps to provide an appropriate collection notice. Where lawful and practicable, individuals may interact anonymously or using a pseudonym.
UNSOLICITED INFORMATION
If Karndean receives personal information it did not request, Karndean will determine whether it could lawfully have collected the information. If not, and where lawful and reasonable, the information will be securely destroyed or de-identified as soon as practicable.
HOW WE USE AND DISCLOSE INFORMATION
Karndean may collect, hold, use and disclose personal information to:
• identify and communicate with individuals;
• supply flooring products, process orders, deliver samples and provide customer service;
• manage accounts, payments, warranties, complaints, showrooms, events, surveys, promotions and competitions;
• manage customers, suppliers, contractors, recruitment and other business relationships;
• improve products, services, websites, campaigns and customer experience;
• send direct marketing and conduct personalised advertising where permitted;
• prevent and respond to fraud, cyber incidents, misuse, data breaches or unlawful activity;
• meet legal, regulatory, contractual, insurance, audit, security and risk-management obligations; and
• use or disclose information for another purpose with consent or where authorised or required by law or a court or tribunal.
DIRECT MARKETING AND CUSTOMER AUDIENCE ADVERTISING
Karndean may send marketing communications where the individual has consented or where otherwise permitted. Marketing communications will provide a practical opt-out. Requests to opt out will be actioned within a reasonable period and reflected in relevant suppression records.
Where appropriate notice and permission support the use, Karndean may use customer relationship information to create advertising audiences. This may include securely providing hashed contact data to platforms such as Google, Meta or LinkedIn for audience matching, campaign measurement, exclusion or personalised advertising. Information collected solely to fulfil a sample delivery or other one-off request will not be used for unrelated marketing or customer audience advertising unless an appropriate notice and permission, or another lawful basis confirmed by Karndean, supports that use.
COOKIES AND TRACKING TECHNOLOGIES
Karndean websites and communications may use first-party and third-party cookies, pixels, tags and similar technologies for website functions, analytics, audience segmentation, campaign measurement, optimisation and advertising. These technologies may collect IP address, device, browser, identifier, page-view and interaction information. Karndean will provide clear information and appropriate preference or consent controls where required. Individuals may also manage technologies through browser, device or platform settings, although some website functions may be affected.
USE OF ARTIFICIAL INTELLIGENCE (AI)
Karndean may use Artificial Intelligence (AI) technologies and AI-enabled tools to support business operations, improve productivity, enhance customer service, analyse information and assist in decisionmaking processes.
Where AI tools are used to process personal information, Karndean remains responsible for ensuring that personal information is collected, used, stored, disclosed and protected in accordance with applicable privacy laws and this Privacy Policy.
Karndean implements reasonable safeguards to ensure that:
• personal information is only used in AI systems where there is a legitimate business purpose;
• access to personal information is restricted to authorised persons;
• appropriate security and confidentiality controls are maintained;
• individuals' privacy rights continue to be respected; and
• significant decisions affecting individuals are subject to appropriate human oversight where required.
As AI technologies continue to evolve, Karndean may update its practices and governance arrangements to ensure the responsible, secure and lawful use of AI.
Employees and contractors must not input personal, confidential or commercially sensitive information into unapproved AI tools or platforms.
SERVICE PROVIDERS
Karndean may use related entities and service providers for CRM, hosting, technology, security, analytics, forms, surveys, event registration, email marketing, media buying, programmatic advertising, audience matching, campaign optimisation, payments, fulfilment and professional services. Providers may include Microsoft, Mailchimp, Google, Meta, LinkedIn, SurveyMonkey, Jotform and appointed agencies. Providers may change over time. Karndean will take reasonable steps to select and manage providers with privacy, security, use, retention, deletion and incident-notification controls appropriate to the service and risk.
OVERSEAS DISCLOSURE
Personal information may be disclosed to related Karndean entities and service providers located outside Australia, including in the United Kingdom and the United States of America, and potentially other countries depending on the provider and service configuration. Karndean will take reasonable steps required by law before an overseas disclosure, including appropriate due diligence and contractual safeguards where applicable. Further information about current arrangements may be requested from the Privacy Officer.
DATA QUALITY, SECURITY, RETENTION AND DISPOSAL
Karndean takes reasonable steps to keep personal information accurate, complete and up to date and to protect it from misuse, interference, loss and unauthorised access, modification or disclosure. Controls may include approved systems, restricted access, authentication, encryption, endpoint protection, secure storage, backups, logging, training and provider controls. Personal information is retained only as long as reasonably required for its purpose and legal, contractual, audit or legitimate business requirements, then securely destroyed or de-identified in accordance with the Data Retention and Records Management Policy and schedule, subject to any legal hold.
ACCESS AND CORRECTION
Individuals may request access to or correction of personal information by contacting privacy@karndean.com.au. Karndean may verify identity before responding. Karndean will respond within a reasonable period. No charge is made for requesting access or correction, although a reasonable charge for giving access may apply where permitted and advised in advance. Access may be refused or limited where permitted by law. If a request is refused, Karndean will generally provide written reasons and available complaint mechanisms.
PRIVACY INCIDENTS AND DATA BREACHES
Karndean will contain, assess, investigate and document suspected loss, unauthorised access, disclosure or misuse of personal information. Where the Notifiable Data Breaches scheme or another law applies, Karndean will notify affected individuals and the relevant regulator as required.
COMPLAINTS AND ENQUIRIES
Privacy enquiries, access or correction requests, marketing opt-outs and complaints may be directed to:
• Email: privacy@karndean.com.au
• Online contact form: karndean.com/en-au/floors/contact-us
• Telephone: 1800 331 170
• Post: Privacy Officer, Karndean International Pty Ltd, 835 Stud Road, Knoxfield VIC 3180
Karndean will investigate a complaint and notify the complainant of the outcome as soon as practicable. If the complainant is not satisfied, they may contact the Office of the Australian Information Commissioner.