Terms and conditions

These terms and conditions (“Agreement”) set forth the general terms and conditions of your use of the xpfilmseries website (“Website” or “Service”) and any of its related products and services (collectively, “Services”). This Agreement is legally binding between you (“User”, “you” or “your”) and XP. LTD (doing business as “Xp.”, “we”, “us” or “our”). If you are entering into this agreement on behalf of a business or other legal entity, you represent that you have the authority to bind such entity to this agreement, in which case the terms “User”, “you” or “your” shall refer to such entity. If you do not have such authority, or if you do not agree with the terms of this agreement, you must not accept this agreement and may not access and use the Website and Services. By accessing and using the Website and Services, you acknowledge that you have read, understood, and agree to be bound by the terms of this Agreement. You acknowledge that this Agreement is a contract between you and Xp. LTD, even though it is electronic and is not physically signed by you, and it governs your use of the Website and Services.

Accounts and membership

If you create an account on the Website, you are responsible for maintaining the security of your account and you are fully responsible for all activities that occur under the account and any other actions taken in connection with it. We may, but have no obligation to, monitor and review new accounts before you may sign in and start using the Services. Providing false contact information of any kind may result in the termination of your account. You must immediately notify us of any unauthorised uses of your account or any other breaches of security. We will not be liable for any acts or omissions by you, including any damages of any kind incurred as a result of such acts or omissions. We may suspend, disable, or delete your account (or any part thereof) if we determine that you have violated any provision of this Agreement or that your conduct or content would tend to damage our reputation and goodwill. If we delete your account for the foregoing reasons, you may not re-register for our Services. We may block your email address and Internet protocol address to prevent further registration.

User content

We do not own any data, information or material (collectively, “Content”) that you submit on the Website in the course of using the Service. You shall have sole responsibility for the accuracy, quality, integrity, legality, reliability, appropriateness, and intellectual property ownership or right to use of all submitted Content. We may monitor and review the Content on the Website submitted or created using our Services by you. You grant us permission to access, copy, distribute, store, transmit, reformat, display and perform the Content of your user account solely as required for the purpose of providing the Services to you. Without limiting any of those representations or warranties, we have the right, though not the obligation, to, in our own sole discretion, refuse or remove any Content that, in our reasonable opinion, violates any of our policies or is in any way harmful or objectionable. You also grant us the license to use, reproduce, adapt, modify, publish or distribute the Content created by you or stored in your user account for commercial, marketing or any similar purpose.

Backups

We are not responsible for the Content residing on the Website. In no event shall we be held liable for any loss of any Content. It is your sole responsibility to maintain appropriate backup of your Content. Notwithstanding the foregoing, on some occasions and in certain circumstances, with absolutely no obligation, we may be able to restore some or all of your data that has been deleted as of a certain date and time when we may have backed up data for our own purposes. We make no guarantee that the data you need will be available.

Links to other resources

Although the Website and Services may link to other resources (such as websites, mobile applications, etc.), we are not, directly or indirectly, implying any approval, association, sponsorship, endorsement, or affiliation with any linked resource, unless specifically stated herein. We are not responsible for examining or evaluating, and we do not warrant the offerings of, any businesses or individuals or the content of their resources. We do not assume any responsibility or liability for the actions, products, services, and content of any other third parties. You should carefully review the legal statements and other conditions of use of any resource which you access through a link on the Website. Your linking to any other off-site resources is at your own risk.

Prohibited uses

In addition to other terms as set forth in the Agreement, you are prohibited from using the Website and Services or Content: (a) for any unlawful purpose; (b) to solicit others to perform or participate in any unlawful acts; (c) to violate any international, federal, provincial or state regulations, rules, laws, or local ordinances; (d) to infringe upon or violate our intellectual property rights or the intellectual property rights of others; (e) to harass, abuse, insult, harm, defame, slander, disparage, intimidate, or discriminate based on gender, sexual orientation, religion, ethnicity, race, age, national origin, or disability; (f) to submit false or misleading information; (g) to upload or transmit viruses or any other type of malicious code that will or may be used in any way that will affect the functionality or operation of the Website and Services, third party products and services, or the Internet; (h) to spam, phish, pharm, pretext, spider, crawl, or scrape; (i) for any obscene or immoral purpose; or (j) to interfere with or circumvent the security features of the Website and Services, third party products and services, or the Internet. We reserve the right to terminate your use of the Website and Services for violating any of the prohibited uses.

Intellectual property rights

“Intellectual Property Rights” means all present and future rights conferred by statute, common law or equity in or in relation to any copyright and related rights, trademarks, designs, patents, inventions, goodwill and the right to sue for passing off, rights to inventions, rights to use, and all other intellectual property rights, in each case whether registered or unregistered and including all applications and rights to apply for and be granted, rights to claim priority from, such rights and all similar or equivalent rights or forms of protection and any other results of intellectual activity which subsist or will subsist now or in the future in any part of the world. This Agreement does not transfer to you any intellectual property owned by xp. LTD or third parties, and all rights, titles, and interests in and to such property will remain (as between the parties) solely with Xp. LTD. All trademarks, service marks, graphics and logos used in connection with the Website and Services, are trademarks or registered trademarks of Xp. LTD or its licensors. Other trademarks, service marks, graphics and logos used in connection with the Website and Services may be the trademarks of other third parties. Your use of the Website and Services grants you no right or license to reproduce or otherwise use any of Xp. LTD or third party trademarks.

Changes and amendments

We reserve the right to modify this Agreement or its terms related to the Website and Services at any time at our discretion. When we do, we will post a notification on the main page of the Website. We may also provide notice to you in other ways at our discretion, such as through the contact information you have provided.

An updated version of this Agreement will be effective immediately upon the posting of the revised Agreement unless otherwise specified. Your continued use of the Website and Services after the effective date of the revised Agreement (or such other act specified at that time) will constitute your consent to those changes.

Acceptance of these terms

You acknowledge that you have read this Agreement and agree to all its terms and conditions. By accessing and using the Website and Services you agree to be bound by this Agreement. If you do not agree to abide by the terms of this Agreement, you are not authorised to access or use the Website and Services.

Contacting us

If you have any questions, concerns, or complaints regarding this Agreement, we encourage you to contact us using the details below:

Contact us admin@xpfilmseries.com

This document was last updated on Dec 11, 2023

Privacy Policy

1. Definitions specific to this policy

1.1 Personal Information

Xp. LTD ensures the protection of any personal information it receives, as required by the

Privacy Act 1998 (Cth) (Privacy Act). ‘Personal Information’ is defined in the Privacy Act as

information or an opinion (including information or an opinion forming part of a database), about an identified individual, whether true or not, and whether recorded in a material form or not, about an individual whose identity is apparent, or can reasonably be ascertained, from the information or opinion.

Personal information can include paper and electronic records as well as personally held information, knowledge or opinions. It also includes photos, videos or audio recordings where individuals are reasonably identifiable. 

On 12 March 2014, the Privacy Act was amended and the new definition of ‘personal information’ is:

information or an opinion about an identified individual, or an individual who is reasonably identifiable: a) whether the information or opinion is true or not; and b) whether the information or opinion is recorded in a material form or not.

Scope of personal information, as required by state and territory Acts and charters which include:

collection of personal information, regardless of when it came into existence, and to the storage, handling, accessing, amendment, management, transfer, use and disclosure of personal information regardless of when it was collected.

Personal information in Australia includes information or an opinion, in any form and whether true or not, about an identified (or reasonably identifiable) individual. Personal information might include an individual’s name (which may include up to 5 names legally), telephone number, postal or e-mail address.

1.2 Sensitive Information

Where applicable, special provisions apply to the collection of personal information which is sensitive. Sensitive information is a type of personal information and includes information or an opinion about an individual’s race, political opinion, religious beliefs, sexual orientation, criminal record, membership of a trade union or health information. The nature of the ministry of Xp. LTD it is unlikely that we would seek sensitive information.

Xp. LTD generally collects personal information from individuals directly unless otherwise stated in this policy.

1.3 Unsolicited personal information

Xp. LTD generally collects personal information only when Xp. LTD specifically requests the information or when Xp. LTD takes active steps to collect that information. However, from time to time, personal information may be volunteered to Xp. LTD without Xp. LTD specifically requesting the information or without Xp. LTD taking active steps to collect the information. Further, Xp. LTD may receive unsolicited personal information when Xp. LTD requests that certain information is provided, and the individual provides more information than requested. 

Where Xp. LTD receives unsolicited personal information, Xp. LTD will determine whether it could lawfully have collected the information had Xp. LTD sought the information.

If Xp. LTD determines that it could not lawfully have collected the information, unless Xp. LTD is authorised or required by law to retain the information, then Xp. LTD will take reasonable steps to destroy or to de-identify that information.

1.4 Staff/Contractor/Intern/Volunteer personal information

An individual who conducts work for Xp. LTD, whether they receive payment for work or not, and can include volunteers, interns and students on placements hosted by Xp. LTD must all abide by this policy.

There is an exemption from the Australian Privacy Principles for ‘employee records’; information that relates to the employment relationship. This exemption does not apply to information about volunteers or contractors or unsuccessful job applicants who apply for employment and whose records and application might be retained. Xp. LTD complies with the Privacy Act by: 

Treating all personal information we handle about volunteers or contractors or job applicants in alignment with the Australian Privacy Principles; 

Endeavouring to apply broad privacy concepts to how we handle employee records; and 

Handling personal information about employees that are not employee records in compliance with the Australian Privacy Principles. 

1.5 Personal Information related to minors

The Privacy Act and Australian Privacy Principles apply equally to personal information about minors. Due to the nature of Xp. LTD’s functions and activities, we collect personal information about minors to enable us to facilitate interactive sessions discussing faith and meaning with minors (such as school aged children and young people). 

Due to child safety risks associated with personal information about minors (such as addresses or contact details), Xp. LTD handles personal information about minors with extra care. For example, we ensure all volunteers and employee who work with children as representatives of Xp. LTD – and therefore have access to personal information about minors – have valid Working with Children clearance and undertake child safety training on an ongoing basis. 

Further, when collecting photos and video content of minors, we seek consent from parents or guardians – or the child or young person themselves if they are capable of providing consent. 

2. Guiding Principles

This Xp. LTD Privacy and Confidentiality Policy addresses:

How we collect personal information and data

How we use personal data

How we disclose personal data

Rights and Choices

Storage, Security, Retention and Destroying personal data

Xp. LTD regards someone’s privacy as critically important. We acknowledge the rights and choices of people including how they contact Xp. LTD about our privacy principles and practices.

Xp. LTD takes seriously the expectation that we will access, handle, store and protect personal information with exceptional diligence and care. We recognise that personal information is sensitive and are committed to accountable, robust and diligent privacy management processes, data and document security, and the utmost highest level of confidentiality of such information.

Xp. LTD may collect and use personal data when we engage in ministry with someone, or they connect with us and use our programs and services.

Xp. LTD is committed to ensuring that any 3rd party provider of services to the organisation (e.g. Stripe, Google refer Addendum to this policy), including web servers and cloud providers even if based overseas, financial transaction platforms, are fully compliant with the above stated Statutory Legislation and Regulations (Commonwealth, States and Territories). Xp. LTD will only seek personal information for the sole purpose of Xp.’s ministry, programs, resources and services.

Personal information and data provided to Xp. LTD, in whatever form, will only be used for purposes stated at the time of the information exchange whether in writing, via a digital form or format, or in person. Xp. LTD will never provide to any person or entity the personal information it holds unless Xp. LTD:

is legally required to do so,

the person has given, in writing, their permission to share their information with another individual or entity and the purpose of the sharing has been stipulated in the written permission.

2.1 Legislative Compliance

Xp. LTD respects and upholds the privacy of individuals and affirms the organisation’s commitment to comply with its organisational responsibilities, including those outlined in the Privacy Act 1998 (Cth), and any other relevant Act or Charter (state or territory). Confidentiality of personal information is of highest importance and will only be shared under specific requirements outlined in this policy.

Xp. LTD has taken steps to ensure that data is maintained under security and privacy principles that provide a level of data and documentation protection at least as secure as those protections required by the Privacy Act 1988 (Cth) or those of a state or territory if they are a higher-level requirement.

2.2 Data Protection and Rights

People generally have the following rights in relation to Personal Data Xp. LTD control about someone:

The right to request confirmation of whether Xp. LTD processes personal data related to someone, and if so, request a copy of that personal data.

The right to request that Xp. LTD rectifies or updates someone’s personal data that is inaccurate, incomplete or outdated.

The right to request that Xp. LTD erase someone’s personal data in certain circumstances provided by law.

The right to request that Xp. LTD restricts the use of someone’s personal data in certain circumstances, such as whilst Xp. LTD considers another request that someone has submitted.

The right to request that Xp. LTD export someone’s personal data that is held by another organisation where technically feasible.

Where the processing of someone’s personal data is based on previously given consent and that someone has a right to withdraw their consent at any time.

Right to object to the processing of someone’s personal data.

2.3 Awareness

To ensure that all individuals are aware of their rights and responsibilities in respect to privacy, Xp. LTD will guarantee that people involved with governance, management, and operations of Xp. LTD:

Are aware of and supported to comply with all relevant governing legislation and guidelines in relation to privacy through induction, ongoing training, guidance and review;

Are trained about their responsibility to uphold the privacy of people to whom Xp. LTD hold data both during and after their engagement with Xp. LTD.

Xp. LTD must declare to people to whom Xp. LTD hold personal information and/or sensitive information how Xp. LTD collects, uses, stores and protects all personal information; and the privacy provisions within Xp. LTD Privacy & Confidentiality Policy through a Protecting Your Privacy brochure, and how to access this policy.

2.4 Collection and use

Xp. LTD recognises that the collection of information, including personal, sensitive or complaints information and data, enhances the organisation’s ability to deliver its breadth of ministry. Xp. LTD has robust, accountable processes in place regarding the collection of information, ensuring that information sought and used is relevant to the Xp. LTD’s purposes, and is appropriately managed.

This includes:

Ensuring that people are clearly informed as to the reasons for the collection of personal information;

Ensuring that information collected is accurate, up-to-date and complete;

Advising how the information will be stored, used, in real time, as well as backup and documentation security and protection;

Informing how data is stored or shared through cloud-based applications or software, in particular third-party organisations.

Advising the criteria that will be used when requests for information access are made;

Ensuring, where appropriate, people give consent for the collection of personal and sensitive information;

Banking, credit/debit card details and similar sensitive data will be stored electronically and securely using, at least at a minimum, 256-bit SSL encrypted transmission either in place by Xp. LTD or third-party platforms transacting on behalf of Xp. LTD; and

Data encryption, where appropriate, will be used to further secure personal, sensitive or financial information.

Xp. LTD will only collect information by lawful and fair means. Xp. LTD will collect information in a number of different ways, and may hold information in either electronic and/or hard copy formats, including but not limited to:

Forms and approval documents (paper or software programs or online),

Electronically, such as through website contact forms or email,

Phone calls and text messages,

Information provided through diary notes or other notations,

Complaints and disputes processes,

Other correspondence, such as email, enquiry forms and postal mail.

Xp. LTD will always collect personal information directly from the individual unless it is unreasonable or impractical for Xp. LTD to do so. On occasion, Xp. LTD may collect information from government, other involved services and professionals where an individual has expressly given permission.

2.5 Storage and Security

Xp. LTD invests substantial resourcing into the establishment of secure information storage systems, with document control security and storage processes in place, and will ensure that individuals are aware of how their information is stored.

Xp. LTD will store data with Australian providers as a preference. Personal and sensitive information will only be transferred to, for storage only, with an international-based server outside Australia provided that it meets the General Data Protection Regulation (GDPR) and has appropriate technical and organisational measures to ensure data protection. GDPR is the highest level of data security globally.

Xp. LTD will always take reasonable steps to let someone know:

that the information has been received by Xp. LTD and how to contact us,

if Xp. LTD received an individual’s information from another source, details of the information received and why it was received,

why Xp. LTD is collecting the information,

the main consequences (if any) for someone should they not provide all or part of the information Xp. LTD have requested,

the organisations or types of organisations to which Xp. LTD normally pass on information (for example during a complaint investigation process if this were required),

that an individual can access and seek to correct their information and that Xp. LTD has procedures in place to respond to these requests,

that Xp. LTD details how someone can complain if they believe Xp. LTD may have breached Privacy Act requirements and how Xp. LTD will handle this type of complaint,

if Xp. LTD are likely to disclose information to other parties and if so, why.

Xp. LTD has taken all appropriate steps to protect personal and sensitive information it holds from:

loss,

misuse,

interference,

unauthorised access, use, modification or disclosure, and

during storage, collection, processing, transfer and destruction of information.

Xp. LTD complies with all requirements of The National Privacy Principles through taking reasonable steps to destroy or permanently de-identify personal information if it is no longer needed for any purpose for which the information was obtained.

2.6 Access

Any individual who connects with, is a user or client with, or whose work intersects with, Xp. LTD has a right to access their personal and sensitive information. Formal applications will be addressed to Xp. LTD Operations Director and responded to within a reasonable period no longer than 48 hours from receipt. Regular informal requests for information may be assessed and granted by the Operations Director.

Access to employment records is subject to different legislative conditions and, as such, the National Director or their delegate will respond to these requests.

2.7 Disclosure

Xp. LTD will use personal information for the purposes intended at the time of collection. Where the information is required for another use or disclosure, Xp. LTD will obtain consent for the revised use, unless a reasonable exception exists.

2.8 Anonymity

Xp. LTD will support an individual’s request to remain anonymous (in so far as this does not contravene any legal requirement), including removing identifiable details of a person, in the provision of personal information where it is reasonable and practicable to do so, and such request does not impact legislative/regulatory/policy compliance. Xp. LTD will advise individuals of the limitations to support and services prior to the collection of the information.

2.9 Opt-Out

Xp. LTD will provide individuals with an option to opt-out of receiving information on Xp. LTD by emailing admin@xpfilmseries.com

2.10 Website and Cookies

Xp. LTD will take steps to ensure the security of its website. However, users are advised that there is always some risk when transmitting information across the Internet, including a risk that information sent to or from a website may be intercepted, corrupted or modified by third parties.

Xp. LTD may use cookies and web logs on its website to improve its functionality.

Cookies are a small text file that websites may place on someone’s computer, and collect information such as Internet Protocol address, computer’s operating system, browser type and traffic patterns, and username or email address. An individual may adjust their Internet browser to disable cookies or inform them when one is being used. If someone chooses to disable cookies, they may be unable to access certain areas of the Xp. LTD website.

Sometimes Xp. LTD’s website contains links to other third-party websites for user convenience and information. When someone accesses a website other than Xp. LTD’s website:

Xp. LTD makes no representations or warranties in relation to the privacy practices of any third-party website,

Xp. LTD is not responsible for the privacy policies or the content of any third-party website.

Third party websites are responsible for informing individuals about their own privacy practices.

Xp. LTD do not provide any personal information to third-party sites nor does any such information automatically pass to them with the linkage.

Xp. LTD acknowledges the people may or may not be aware that the Internet is not a secure environment, and transmission of personal information over the Internet is at the individual’s own risk.

Xp. LTD website may contain links to other websites operated by third parties. We make no representations or warranties in relation to the privacy practices of any third-party website, and we are not responsible for the privacy policies or the content of any third-party website. Third party websites are responsible for informing individuals about their own privacy practices.

Xp. LTD website uses software known as ‘cookies’ to record someone’s visit to the website and collect some statistical information. Xp. LTD may use this information to help administer and improve our website. Xp. LTD does not use this information to personally identify someone.

Information Xp. LTD may collect includes:

someone’s server address

someone’s domain name

the date and time of access to the website

pages accessed and documents downloaded

the previous site visited

if you have visited the website before

the type of browser software in use.

An individual may set their web browser to disable cookies when visiting the Xp. LTD website.

2.11 Marketing Materials

From time to time, Xp. LTD may send out promotional materials for purposes within its ministry requirements. Should an individual not wish to receive these communications, they may click ‘unsubscribe’ or contact Xp. LTD to unsubscribe. Xp. LTD may also send requests to participate in research by third parties, and sometimes Xp. LTD will receive requests from researchers for data to assist them to write research papers. An individual may receive information from Xp. LTD about such opportunities to participate in research. There is no obligation on any individual to participate in a research study.

2.12 Complaints and appeals

Individuals will be made aware of their rights to report actual, suspected or perceived breaches of privacy and how they can make these complaints. These complaints can be lodged with the Xp. LTD Operations Director.

External complaints can also be lodged with the Office of the Australian Information Commissioner or other statutory bodies including both Federal and State Government Departments, regulatory authorities which have some association with the ministry of Xp. LTD.

If someone is unhappy with the outcome of a privacy complaint, they may lodge a complaint with the Office of the Australian Information Commissioner (OAIC) via: https://www.oaic.gov.au/privacy/privacy- complaints/

2.13 How to access and correct personal and sensitive information

Xp. LTD takes all reasonable steps to ensure that all personal and sensitive information collected, used or disclosed, is accurate, up-to-date, complete, relevant and not misleading.

Xp. LTD will correct any personal and sensitive information that we believe to be incorrect, out- of-date, incomplete, irrelevant or misleading. Individuals may request to access or correct their personal and sensitive information at any time by following the Xp. LTD Personal Information Requests.

2.14 Destruction and De-identification

Xp. LTD will continue to store and hold personal information indefinitely, until such time as Xp. LTD no longer needs the information for any purpose for which the information may be used or disclosed under this Privacy & Confidentiality Policy, or for any other lawful purpose under applicable privacy or data protection laws or (if earlier, and subject to the next paragraph) a reasonable time after someone asks Xp. LTD to delete it.

Xp. LTD uses secure methods to destroy or to permanently de-identify personal information within a reasonable time after the end of the period mentioned in the previous paragraph (unless we are required to retain by any applicable privacy or data protection laws) or if Xp. LTD determines that the personal information received is required to be destroyed or permanently de-identified in accordance with any applicable privacy or data protection laws.

2.15 Notifiable Data Breaches

The Privacy Amendment (Notifiable Data Breaches) Act 2017 established the Notifiable Data Breaches (NDB) scheme in Australia. The NDB scheme applies to all agencies and organisations with existing personal information security obligations under the Australian Privacy Act 1988 (Privacy Act) from 22 February 2018.

The NDB scheme introduced an obligation to notify individuals whose personal information is involved in a data breach that is likely to result in harm, particularly serious harm. This notification must include

recommendations about the steps individuals should take in response to the breach. The Office of the Australian Information Commissioner (OAIC) must also be notified of eligible data breaches.

In the event that someone’s Personal information is lost, stolen or subject to unauthorised access or disclosure, Xp. LTD will adhere to its obligations under the Privacy Act in relation to any required notifications to the Officer of the Australian Information Commissioner, and to those people whose Personal Information has been lost, stolen or subject to unauthorised access or disclosure.

Xp. LTD takes data breaches involving an individual’s personal information seriously. The Australian privacy law provides for an individual affected by a data privacy breach to seek compensation from the organisation involved in the breach. The individual may also have claims for the data privacy breach based on breach of contract, negligence and/or contravention of the Australian Consumer Law. Entities can also be fined for serious and repeated privacy breaches.

At a minimum, if Xp. LTD uncover a privacy breach, we will:

Immediately communicate in writing a full apology to the person/s whose privacy was breached.

Xp. LTD will immediately adopt and implement remedial measures in response to the privacy breach.

Xp. LTD will review its privacy/information handling policies and procedures and conduct training and make necessary changes to ensure information is accurate, complete and up-to-date.

Xp. LTD will fulfil all directions of the Office of the Australian Information Commissioner (OAIC) as a result of a notifiable data breach.

3. Procedure Responding to Personal Information Request

3.1 Assisting individuals to make a request for personal information

Where an individual (stakeholder, contractor or staff member, volunteer or student on placement) seeks to access their personal information, they should, in the first instance, be supported to understand the process. The individual will be provided with a copy of the Xp. LTD Privacy & Confidentiality brochure and if required will be assisted by an Xp. LTD person, who will explain the process using accessible language.

These requests can be made in 3 ways:

The individual asks an Xp. LTD contact to access their information;

An individual makes contact with Xp. LTD directly via the phone or in person which should be referred immediately to the Operations Director;

Through the formal process via an email or writing a letter.

3.2 Determining how to respond to a request for personal information

Requests for personal information can only be responded to formally by the Operations Director.

Regarding formal requests for personal information:

These requests can take the form of requests from individuals, requests from organisations (e.g. Xp. LTD members), from legal representatives, subpoenas, search warrants;

Where a formal request is made by an individual, an email or letter outlining the request must be sent to the Operations Director and must be complete. Xp. LTD may provide a support person who will be named in an email response if appropriate.

If the request is to be refused, the person will receive advice of the decision and the reasons for this. It is not necessary for the requests for personal information to be notified in writing. A record of a verbal notification must be made in Privacy Register which is part of the Document Control Register.

If the request is to be fulfilled:

Xp. LTD will advise the applicant of the decision and a time frame for providing the requested information;

Xp. LTD will provide the information to the applicant by hand, by registered post or by courier. This information will not be provided by email. Where the information is delivered by hand, the applicant’s identity must be confirmed by sighting a photo identification (e.g. driver licence, over 18 card, passport). A diary note must be made confirming that this has occurred and given to the Operations Director for document storage.

The Xp. LTD Privacy & Confidentiality brochure with be provided with the information (to inform of complaint avenues).

If, at any time during the process, it is determined that the request is to be referred to the Board for advice or for approval due to the sensitivity of the data, it is the responsibility of the National Director to ensure such approval has been sought.

3.3 Subpoenas and Court Orders

Formal information requests by way of an order can include the following:

Subpoenas

Search Warrants (sealed by a court);

Other orders issued usually issued by for example Crime and Misconduct Commission or any other statutory body.

All orders or requests must be received only by the National Director of Xp. LTD.

Within three working days, the National Director will acknowledge receipt of the request and provide advice regarding how the request will be managed.

In almost all cases, the National Director will directly manage the response. In doing this, the National Director will be requested to provide an electronic copy of all relevant documents within a specified timeframe. The National Director will not accept any original documents; these must remain securely where they are stored and managed.

The National Director will be fully responsible for the ongoing management of the response, including what information is to be provided and what document review or redaction needs to take place.

Requests will be responded to within the timeframe specified. If this timetable is not able to be met, the National Director will contact the issuing authority and seek an extension.

When the requested documents are ready for release, the National Director will liaise with the Governance Committee (if required) regarding how these documents will be provided:

In all cases, a cover letter will be sent with the information, containing information about the response and who to contact.

The information will be transported to the relevant courthouse or agency in person, or via courier, in paper form.

Details of the request and responses will be recorded via the Privacy Register which is part of the Document Control Register.

3.4 Other formal requests for information

Other formal information requests include formal requests from stakeholders, employees/contractors, or other Xp. LTD third-party practitioners or advocates.

All formal requests (excluding orders made by courts or other statutory bodies) must be recorded and requested through the appropriate channel to the Operations Director.

Within three working days, the Operations Director will acknowledge receipt of the request (which may include making contact with the person requesting information directly) and provide advice regarding how the request will be managed.

In almost all cases, the Operations Director will directly manage the response. In doing this, anyone within Xp. LTD will be requested to provide an electronic copy of all relevant documents within a specified timeframe. The National Director will not accept any original documents; these must remain securely where they are stored and managed.

The Operations Director will coordinate with others regarding the management of the response.

Requests will be resolved within a reasonable timeframe (generally taken to mean 14 days) and periodic contact with the person formally requesting information will be maintained by the Operations Director.

Regarding the outcome of the request:

If the request is being fulfilled, the individual or organisation will be notified of when this request is expected to be fulfilled, either via email or by telephone;

If the request is being refused, the individual or organisation will be notified of this outcome and the reasons in writing, either by email or letter. This letter will be prepared by the Operations Director and will contain the Privacy & Confidentiality Brochure information and appeal avenues.

If the request is being fulfilled, when the requested documents are ready for release, the Operations Director will direct how these documents will be provided:

In all cases, a cover letter will be sent with the information, containing information about the response and who to contact.

The information will be transported to the individual via registered post or a courier. This information may be provided on a USB or in paper form. If this information is being provided in paper form, the Operations Director will confer with the National Director who may give consideration to charging a fee.

Details of the request and response will be recorded in the Privacy Register which is part of the Document Control Register.

3.5 Reasonable grounds for refusal

Where Xp. LTD is considering refusing a request, it must be for one of the following lawful reasons:

Xp. LTD reasonably believes that giving the individual access to the requested information would pose a serious threat to the life, health or safety of any individual, or to public safety; or

Giving access would have an unreasonable impact on the privacy of other individuals; or

Giving access would be unlawful; or

The request for information is frivolous or vexatious; or

Denying access is otherwise required or authorised by law; or

The information relates to existing or anticipated legal proceedings between Xp. LTD and the individual and the information would not be accessible by the process of discovery in those proceedings; or

Giving access would reveal the intentions of Xp. LTD in relation to negotiations with the individual in such a way that may prejudice those negotiations; or

Giving access would be unlawful; or

Refusal of access is required or authorised by or under an Australian law or a court/tribunal order; or

Xp. LTD has reason to suspect that unlawful activity, or misconduct of a serious nature, that relates to Xp. LTD functions or activities, has been, is being or may be engaged in and providing access to this information would likely prejudice the taking of appropriate action in relation to the matter; or

Giving access would be likely to prejudice one or more enforcement related activities by, or on behalf of, an enforcement body; or

Giving access to the information would reveal evaluative information generated with Xp. LTD in connection with commercially sensitive decision-making processes.

A decision to refuse a personal information request must be confirmed by the National Director before the Operations Director advising the individual/organisation requesting the information. The National Director must inform immediately their decision to refuse to the Xp. LTD Board.

If Xp. LTD refuses to provide someone with access to or correct their personal information, we will provide the person with reasons for this decision in writing. In some circumstances where we correct a record, we may still require the retention of the original record.

Please note that, since Xp. LTD, does not wish to interfere with the privacy of individuals, Xp. LTD reserves the right to verify someone’s identity prior to releasing their personal information to them and/or correcting any personal information the individual asserts is incomplete, inaccurate or outdated. Further, Xp. LTD reserves the right to redact the personal information of other individuals which may be collected and held by Xp. LTD and which would be otherwise subject to access request.

3.6 Records Management

All informal and formal requests for personal information managed by the Operations Director or National Director of Xp. LTD, and any general advice given in response to personal information enquiries, must be recorded in the Privacy Register which is part of the Document Control Register.

3.7 Complaints and Concerns

Questions or comments about Xp. LTD’s Privacy & Confidentiality Policy, or supporting publicly available user documents or statements, or complaint about how Xp. LTD has handled personal information (including, where applicable, credit-related information) about someone, must contact of Xp. LTD as follows: admin@xpfilmseries.com

Xp. LTD will respond to any privacy complaint in accordance with any timeframes required by law or as detailed in this policy.