BVN takes data privacy seriously. We recognise and value the trust that individuals place in us when providing us with personal information. We are committed to safeguarding the privacy and security of personal information we may collect from visitors to our websites and/or the clients to whom we provide architectural services.

This privacy notice explains how BVN Architecture Pty Ltd (ABN 46 010 724 339) and its group companies (“BVN”) use personal information. We may occasionally change this Privacy Notice by updating this page.

Please note: This Privacy Notice does not apply to, and BVN is not responsible for, any third-party websites that may be accessible through links from this website. If you follow a link to any of these third-party websites, they will have their privacy policies, and you will need to check these policies before you submit any personal information to such third-party websites.

This Privacy Notice aims to help you understand our personal information collection, usage, and disclosure practices in relation to your personal information by explaining:

• Who are we, and what do we do
• What information we collect, use, and why
• Lawful bases and data protection rights
• Where do we get personal information from
• How long do we keep information?
• How do we store information?
• Who do we share information with?
• Which countries do we share your information with
• How to access and correct information
• How to submit a request
• Contact details

Who are we, and what do we do

BVN is a global architectural services practice with studios in Australia, the UK, and the USA. We deliver design excellence across many industries, including healthcare, education, defence, corporate, and residential.

What information we collect, use, and why

We collect or use the following information to provide and improve products and services for clients:

• Names and contact details
• Addresses
• Occupation
• Transaction data (including details about payments to and from you and details of products and services you have purchased)
• Usage data (including information about how you interact with and use our website, products and services)
• Video recordings
• Audio recordings (eg calls)
• Records of meetings and decisions
• Website user information

We collect or use the following personal information for the operation of client or customer accounts:

• Names and contact details
• Addresses
• Purchase or service history
• Account information, including registration details
• Information used for security purposes
• Marketing preferences
• Technical data, including information about browsers and operating systems

We collect or use the following personal information for information updates or marketing purposes:

• Names and contact details
• Addresses
• Profile information
• Marketing preferences
• Website and app user journey information
• IP addresses

We collect or use the following personal information for research or archiving purposes:

• Names and contact details
• Addresses
• Purchase or client account history
• Website and app user journey information
• IP addresses

We collect or use the following personal information to comply with legal requirements:

• Name
• Contact information
• Identification documents
• Client account information
• Any other personal information required to comply with legal obligations

We collect or use the following personal information for dealing with queries, complaints or claims:

• Names and contact details
• Address
• Relevant information from previous investigations
• Customer or client accounts and records
• Financial transaction information
• Correspondence

We collect or use the following personal information for recruitment purposes:

• Contact details (e.g. name, address, telephone number or personal email address)
• Date of birth
• National Insurance number
• Copies of passports or other photo ID
• Employment history (e.g. job application, employment references or secondary employment)
• Education history (e.g. qualifications)
• Right-to-work information
• Details of any criminal convictions (e.g. Disclosure Barring Service (DBS), Access NI or Disclosure Scotland checks )
• Security clearance details (e.g. basic checks and higher security clearance)

Under certain circumstances, BVN may need to collect sensitive information about you. This might include any information or opinion about your racial or ethnic origin, political opinions, political association, religious or philosophical beliefs, professional body membership, sexual preferences, criminal record, or health information.

If we collect your sensitive information, we will do so only with your consent or as otherwise required or authorised by law, and we take appropriate measures to protect the security of this information.

Lawful bases and data protection rights

Under UK data protection law, we must have a “lawful basis” for collecting and using your personal information. There is a list of possible lawful bases in the UK GDPR. You can find out more about lawful bases on the ICO’s website.

The lawful basis on which we rely may affect your data protection rights, as shown below. You can find out more about your data protection rights and the exemptions that may apply on the ICO’s website:

• Your right of access—You have the right to ask us for copies of your personal information and to request other information, such as details about where we get personal information from and who we share personal information with. There are some exemptions, which means you may not receive all the information you ask for. You can read more about this right here.
• Your right to rectification - You can ask us to correct or delete personal information you think is inaccurate or incomplete. You can read more about this right here.
• Your right to erasure - You have the right to ask us to delete your personal information. You can read more about this right here.
• Your right to restriction of processing - You can ask us to limit how we can use your personal information. You can read more about this right here.
• Your right to object to processing - You have the right to object to the processing of your personal data. You can read more about this right here.
• Your right to data portability—You have the right to ask that we transfer the personal information you gave us to another organisation or to you. You can read more about this here.
• Your right to withdraw consent—When we use consent as our lawful basis, you have the right to withdraw your consent at any time. You can read more about this here.

If you make a request, we must respond to you without undue delay and, in any event, within one month.

To make a data protection rights request, please contact us using the contact details at the bottom of this Privacy Notice.

Our lawful bases for the collection and use of your data

Our lawful bases for collecting or using personal information to provide and improve products and services for clients are:

• Contract – we must collect or use the information to enter or carry out a contract with you. All of your data protection rights may apply except the right to object.
• Legitimate interests – we’re collecting or using your information because it benefits you, our organisation or someone else without causing an undue risk of harm to anyone. All of your data protection rights may apply, except the right to portability. Our legitimate interests are:
• This will enable us to fulfil our obligations and provide our services to you.

Our lawful bases for collecting or using personal information for the operation of client or customer accounts are:

• Contract—We need to collect or use the information to enter into or carry out a contract with you. All of your data protection rights may apply, except the right to object.
• Legal obligation—We must collect or use your information to comply with the law. All your data protection rights may apply, except the right to erasure, the right to object and data portability.

Our lawful bases for collecting or using personal information for information updates or marketing purposes are:

• Consent—We have permission from you after we give you all the relevant information. Your data protection rights may apply, except the right to object. To be clear, you have the right to withdraw your consent at any time.
• Legitimate interests – we’re collecting or using your information because it benefits you, our organisation or someone else without causing an undue risk of harm to anyone. All of your data protection rights may apply, except the right to portability. Our legitimate interests are:
• To provide details of new services, updates and invites to seminars and events where you have chosen to receive these. We will provide an option to unsubscribe or opt out of further communication on any electronic marketing communication sent to you, or you may opt out

Our lawful bases for collecting or using personal information for research or archiving purposes:

• Legal obligation—We must collect or use your information to comply with the law. All your data protection rights may apply, except the right to erasure, the right to object and data portability.

Our lawful bases for collecting or using personal information to comply with legal requirements:

• Legal obligation—We must collect or use your information to comply with the law. All your data protection rights may apply, except the right to erasure, the right to object and data portability.
• Our lawful bases for collecting or using personal information for recruitment purposes are:
• Consent—We have your permission after we give you all the relevant information. Your data protection rights may apply, except the right to object. To be clear, you can withdraw your consent at any time.
• Legal obligation—We must collect or use your information to comply with the law. All your data protection rights may apply, except the right to erasure, the right to object and data portability.
• Legitimate interests – we’re collecting or using your information because it benefits you, our organisation or someone else without causing an undue risk of harm to anyone. All of your data protection rights may apply, except the right to portability. Our legitimate interests are:
• To ensure that we can make the most appropriate recruitment decisions.

Our lawful bases for collecting or using personal information for dealing with queries, complaints or claims are:

• Legal obligation—We must collect or use your information to comply with the law. All your data protection rights may apply, except the right to erasure, the right to object and data portability.
• Legitimate interests – we’re collecting or using your information because it benefits you, our organisation or someone else without causing an undue risk of harm to anyone. All of your data protection rights may apply, except the right to portability. Our legitimate interests are:
• Cooperate with law enforcement and regulatory authorities to ensure that you fall within our acceptable risk profile and assist with preventing crime and fraud.

Where do we get personal information from

• Directly from you
• Publicly available sources

How long do we keep information?

We will retain your personal information for as long as necessary to fulfil the purpose for which it was collected, and any other permitted linked purpose (for example, specific transaction details and correspondence related to any services we provide may be retained until the time limit for claims in respect of the transaction has expired or to comply with regulatory requirements regarding the retention of such data).

Our data retention periods are determined by our legal obligations, internal policies, and business needs and reflect good practice and proportionality principles. Once personal information is no longer required for these purposes, we will take reasonable steps to securely destroy or de-identify it in line with the Australian Privacy Principles.

Personal information is stored securely in Australia or jurisdictions with appropriate data protection safeguards.

How do we store information?

We will take reasonable steps to ensure that all information we collect is held in a secure format and protected from loss and misuse, as well as unauthorised access, modification, disclosure, alteration, or destruction. The information may be held either in hard copy or electronically.

We will hold the information we collect on systems managed and maintained by us and/or our third-party cloud storage service provider who may create a backup of our data and store that backup overseas. See below clause for more information on sharing information overseas.

Who do we share information with?

Others we share personal information with:

• Insurance companies, brokers or other intermediaries
• Professional service advisors including legal advisors
• Organisations we are legally obliged to share personal information with
• Third parties:
• Technology service providers such as Autodesk.

Which countries do we share your information with

As a global architectural practice, we cannot limit the processing of that data to the country in which that individual is located. Where necessary, we may transfer personal information to locations outside your jurisdiction, principally to Australia and (for United Kingdom based clients), the United Kingdom. Where we disclose your information to third parties overseas, we will take reasonable steps to ensure appropriate safeguards are in place.

Please use the contact information provided below to contact us for further information or to obtain a copy of the appropriate safeguards for any of the transfers above.

Australian individuals should be aware that if the information is shared with a person in the UK or a European Union country, the "data controller" in that country may engage "data processors" in other countries recognised as having General Data Protection Regulation-compliant systems laws, in accordance with applicable law.

How to access and correct information

BVN will endeavour to keep your personal information accurate, complete, and up to date. If you wish to make a request to access and/or correct the personal information we hold about you, you should make a request by contacting us and we will provide a written response within 30 days.

How to submit a request

If you have any concerns about our use of your personal information, you can contact us using the contact details at the bottom of this privacy notice.

Contact details

Via post (UK)

Privacy Officer
74 Rivington Street,
London,
EC2A 3AY,
Great Britain

Via post (Australia)

Privacy Officer
Level 11, 255 Pitt Street
Sydney
2000,
Australia

Via email

privacy@bvn.com.au