Sensitive information and government identifiers
Sensitive information includes personal information such as an individual’s criminal record, health information, membership of a professional or trade association, or membership of a trade union.
ASX does not collect sensitive information about an individual unless:
- it is required or authorised by law to do so, or
- the individual has consented and the information is reasonably necessary for one or more of ASX’s functions or activities.
Government identifiers such as Tax File Numbers will generally not be collected or used unless required by law or in accordance with the Operating Rules, or where necessary to complete a transaction or service.
How does ASX use personal information collected through cookies?
Our website uses cookies. Please see our Cookie Policy for further information on the cookies used on our website and how you can manage them.
Most cookies on our website are used to store information anonymously in relation to your visit, for example using a unique identifier or a value to indicate whether you have visited a webpage.
Your personal information may be collected in session information to authenticate access to certain areas of our website, in order to allow you to access and participate in those areas of the website. Once you have closed your browser, this type of cookie is deactivated.
We will not combine anonymous information collected through cookies with other information we hold about you to identify you unless:
- you have consented
- we are required by law or a regulatory obligation to do so, such as where a law enforcement agency issues a warrant to inspect the service provider’s logs
- your usage is causing technical issues for ASX’s website which need to be resolved, or
- you may have won a game.
Does ASX transfer personal information overseas?
ASX does not generally transfer personal information to overseas parties unless required by law or enforcement activity or unless working with international service providers. ASX shares or stores personal information with vendors who have been contracted to provide customer relationship systems and technological solutions. These third parties may not be subject to the same privacy and data protection laws as those located in Australia, however they may be subject to applicable data protection laws in their own jurisdiction. When ASX transfers personal information overseas to third party service providers, ASX’s normal practice is to take reasonable steps to ensure that appropriate safeguards are in place, such as standard contractual provisions requiring those parties to keep the information confidential or ensuring that the third party has an appropriate certification. Personal information is encrypted where possible when transferred overseas.
These third-party service providers change from time to time and may be located in Australia, the United States, Japan, the United Kingdom and other countries. You can contact ASX at the details below for a list of the current countries.
Data retention
ASX has a data retention policy. Where personal information is no longer required for the purpose for which it was collected ASX will take reasonable steps to destroy or permanently de-identify the information, unless:
- it is required to allow ASX to address any complaints or for legal or compliance matters, or for another purpose permitted under applicable data protection laws, or
- ASX is required by law or a regulatory obligation to retain it.
ASX will take reasonable steps to destroy unsolicited personal information received from third parties that does not serve an appropriate purpose unless it is required by law or a regulatory obligation to retain it.
To determine the appropriate retention period for personal information, ASX considers the nature and sensitivity of the personal information, the purposes for which it is held and the applicable legal requirements. When ASX deletes personal information it holds electronically that information will be removed from our active database, but it will generally remain in archival or back-up systems for a period of time where it is not practicable or possible to delete it. In some circumstances we may anonymise your personal information (so that it can no longer be associated with you) for research, statistical or data analysis purposes, in which case we may use this information indefinitely without further notice to you. If you would like further information on the retention periods we apply to your personal information, please contact us in writing at the details below.
