Our privacy commitment to you 

Vitaco Health Australia Pty Limited and Vitaco Health (NZ) Limited (Vitaco, we or us) are committed to protecting your privacy and personal information.

As we operate in, and have offices in both Australia and New Zealand, this Privacy Policy outlines how we collect, store, use and disclose personal information and the steps we take to comply with Australian and New Zealand privacy laws (Privacy Laws).

This Privacy Policy describes the personal data collected or generated (processed) when you use our site.  It also covers the following topics:

• Who is responsible for the processing of your personal information?
• What kind of personal information do we collect?
• How do we collect your personal information?
• How do we use cookies?
• What do we use your personal information for?
• Who do we disclose your personal information to?
• How do we protect your personal information?
• How can you access and update your personal information?
• How do we handle enquiries and complaints?
• Changes to this Privacy Policy.

You agree that by:

• using any of our websites
• purchasing Products from any of our websites
• taking part in any of our promotional or marketing campaigns
• applying for employment with us; or
• or visiting our premises,

you consent to the collection and use of your personal information as set out below.

If you find any links to other websites on any of our websites, this Privacy Policy does not apply to them.  Always check the privacy policy of any website you access.

We may also provide you with separate privacy notices when we collect your personal information which may outline additional uses and disclosures not detailed in this Privacy Policy. If there is any inconsistency between these separate privacy notices and this Privacy Policy, you should rely on the information in those notices.

The site is not intended for children under the age of 13. We do not knowingly collect personal information online from visitors in this age group.

Who is responsible for the processing of your personal information? 

Vitaco Health Australia Pty Limited or its affiliate Vitaco Health (NZ) Limited are responsible for the processing of your personal information.

What kind of personal information do we collect?

The kinds of personal information we collect vary depending on our interaction with you and may include:

• Your name, address, telephone number, email address, residential address, shipping address, and where we are dealing with you on a business-to-business basis, your ABN, NZBN, trading name, delivery address and vehicle registration details if you visit one of our premises
• Details about your orders from us and product preferences
• Digital information, such as cookies, pixels, software versions used, device identifiers (like IP address), location data (where available and not disabled by you), dates, times, file metadata, referring website, data entered, and your user activity such as links clicked, adding items to a shopping cart, and making purchases
• Financial information including credit card details
• Where you apply for employment with us, your CV and pre-employment history, contact and emergency details, and other similar information
• Information that you voluntarily provide to us through your responses to competitions, promotions, surveys, feedback and enquiries.
•  

Sensitive Information 

Some personal information we may collect from you is ‘sensitive information’. The collection of such sensitive information will depend on the nature of our interaction with you, but may include information which we require for the purpose of providing advice to you. This might include information about your weight, height, age, health, diet, lifestyle and if needed, your medical background.

You may decide not to provide us with your personal information we ask for. However if you do so, or if you provide us with personal information that is inaccurate or incomplete, we may not be able to respond adequately to your enquiries or provide you with the products or services you require.

If you contact our Naturopath & Nutritionist hotline or our Customer Services Representatives we may need to collect sensitive information from you. In such circumstances, we will advise you of this in a separate privacy notice at the time of collection.

How do we collect your personal information?

We collect most personal information directly from you. We may collect personal information when:

• you purchase any products from us online
• you use Naturopathic & Nutrition Team hotline
• you contact our Customer Service representative
• you communicate and interact with us, including in person, by email, by letter, telephone, online or via social media, when you apply for employment, or participate in any of our marketing or promotional campaigns
• you visit one of our premises.

Other ways we may collect personal information from you:

• We may also collect personal information from third parties, such as from nominated referees during job applications, or through competitions or promotions operated in conjunction with Vitaco by one of our partners

• If you contact us by the hotline or our Customer Service phone number your personal information may be collected by us as a recorded voice message if our Naturopaths, Nutritionists or Customer Service team are temporarily unavailable to answer a call and you choose to leave a voice message

• If you visit one of our premises, we may also collect personal information about you on CCTV as part of our security and crime prevention measures.  We may also collect your name and contact details and, where applicable, your vehicle registration through our visitor registration system VisitorRego, for security and health and safety purposes, and your visiting history to our premises, and to provide facilities such as Wi-Fi.  This information, including CCTV footage may constitute ‘personal information’ as defined in the Privacy Laws.

How do We Use Cookies?

We may use “cookies” which enable us to monitor traffic patterns on our websites and to serve you more efficiently if you revisit our websites. A cookie does not identify you personally but it does identify your computer or device. You can set your browser to notify you when you receive a cookie and this will provide you with an opportunity to either accept or reject it in each instance.

• Third party vendors, including Google, show our ads on sites on the internet and use cookies to serve ads based on a user’s prior visits to a website
• You may opt out of Google’s use of cookies by visiting the Google advertising opt-out page
• We use cookies for the purposes of conducting re-marketing campaigns. Google’s Display Network use the DoubleClick Cookie
• Our cookies typically expire after 30 days. After the expiry date, your browser will delete the cookie (depending on browser used and your browser settings). You can manually delete cookies in your browser anytime.

What do we use your personal information for?

The main purpose for collecting your personal information is to enable us to operate our business, assess your employment application, provide our products and services to you, and to comply with the law.

We may use and share your personal information for these purposes, including in order to:

• Charge you for products we provide to you
• Communicate with you
• Let you know about promotions, competitions, products and services which we think you may be interested in
• Deal with enquiries, feedback, complaints and requests about our products or services
• Manage and improve our products and services and other relationships and arrangements
• Provide advice to you regarding our products from naturopaths and nutritionists
• Undertake product recalls
• Monitor our sales of products and for quality control purposes, including undertaking customer surveys and analysis, or seeking feedback from you
• Develop new products
• Undertake contact tracing in relation to the Covid-19 outbreak (if you attend our premises)
• Undertake recruitment and staffing functions
• Meet our legal obligations
• Undertake any other purpose disclosed to you at the time the relevant personal information is collected and for purposes directly related to any of the above.

We may use CCTV footage specifically for the following purposes:

• Detecting and deterring criminal behaviour on our premises
• Monitoring the safety and security of our staff and our premises, and completing incident investigations.

If you do not wish to receive information about promotions or activities we think you may be interested in, you can opt-out by contacting us on the details below, or by using the unsubscribe function in emails.

Who do we disclose your personal information to?

We may disclose your personal information for the purposes listed above to third parties that include the following:

• Our related entities, such as Vitaco offices located in New Zealand or Australia
• Other companies or individuals who assist us in supplying our products and services or who perform functions on our behalf, such as delivery contractors, couriers, credit card processors, mailing houses, advertising and media agencies and technology hosting providers
• Other persons that we need to deal with in connection with employment and engagement of staff (such as insurers, next-of-kin, referees) where required or authorised by law to do so and to anyone else whom you authorise us to disclose it.

Otherwise, we will only disclose your personal information without your consent if doing so is:

• To assist with any request from WorkSafe, the Ministry of Health or a District Health Board in New Zealand or any Commonwealth, State or Territory health authority in Australia in relation to contact tracing for Covid-19
• Necessary to protect or enforce our legal rights or interests, or to defend any claims made against us by any person (including you)
• Necessary in order to report a data breach, cyber incident or for cyber security purposes (including to prevent unauthorised access to, or attacks on, our systems)
• Necessary to lessen a serious threat to a person’s health or safety.

Unless otherwise disclosed to you in a separate privacy notice, the only overseas disclosures of personal information Vitaco makes is between our offices in New Zealand and Australia which assist us with the following functions:

• Storage of personal information of past, current and prospective employees
• Staffing of the Naturopathic & Nutrition Team and Customer Service hotlines and customer complaints and enquiries handling

How do we protect your personal information?

We securely store your personal information in different ways, including in hard copy and electronic form.  Generally, personal information is maintained on a secure database and in hard copy files located in New Zealand and Australia. We take such steps as are reasonable in the circumstances to protect your personal information from risks such as misuse, interference and loss, and from unauthorised access, modification or disclosure including:

• Training and reminding our staff of their obligations with regards to your personal information
• Using software on a number of our websites which encrypts information (where a lock symbol appears on the browser window)
• Utilising passwords, firewalls and virus scanning tools, and protection in buildings where personal information is stored, to prevent against unauthorised access to our systems
• Restricting staff and authorised contractors that have access to the databases that store personal information to those on a “need to know” basis
• If we no longer require your personal information, taking reasonable steps to destroy or de-identify it.

CCTV footage will usually be retained for a period of 60 days, after which time it will be overwritten.

Site visitor logs and personal information collected for the purposes of COVID-19 contact tracing using the VisitorRego system will be retained for a period of 60 days, after which time they will be deleted.

The security of your personal information is important to us and we are committed to handling such information carefully. However, no method of transmission over the Internet, or method of electronic storage, is 100% secure. Therefore, while we strive to use commercially acceptable means to protect your personal information, we cannot guarantee its absolute security.

How can you access and update your personal information?

• We seek to ensure that all personal information collected and stored in our files and database systems is correct and accurate
• If you wish to request that we delete your personal information, request that we no longer use your information to provide you with marketing communications, or withdraw your consent to use your personal information please contact us as set out below. We may require you to verify your identity so that we can ensure your personal information is disclosed only to you and specify what personal information you want access to
• We will respond to your request within 30 days.

How we handle enquiries and complaints

For any privacy enquiries, issues or concerns, or if you believe that we have not complied with the Privacy Laws contact us in writing:

By mail:
Privacy Officer
Vitaco Health Australia Pty
Level 3, 68 Waterloo Road
North Ryde NSW 2113

Email: privacy@vitaco.com.au

We will investigate any complaint and will respond to you as soon as is practicable after we receive your complaint.

If you do not agree with the way we have handled your complaint you can refer your complaint:

In Australia to: 

Office of the Australian Information Commissioner

Website: www.oaic.gov.au

Phone:  1300 363 992

In New Zealand to: 

New Zealand Privacy Commissioner

www.privacy.org.nz

Phone:  0800 803 909

Changes to this Privacy Policy

We may update this policy from time to time. We will let you know of significant changes to this policy by posting a notification on our websites.

Empowering Healthier Lives

1. Where we stand

The Vitaco Lead Team and People Leaders are committed to providing a safe place to work and promoting a culture of living our values and ethical behaviour within our business and when dealing with suppliers and customers, as outlined in our Code of Conduct and other policies. 

Vitaco is committed to providing an environment where people can report any wrongdoing, free from retaliation or detrimental treatment. 

Purpose 

The purpose of this Whistleblower Protection Policy is to:

• provide you with an understanding of what can be reported under the Whistleblower laws; 
• outline how you can make a report and who you can make a report to; 
• explain what happens when you make a report; 
• explain how you will be protected if you do make a report; 

What is Whistleblowing? 

• Anyone working at Vitaco or with Vitaco should use good judgment to enhance trust, respect and the reputation of Vitaco.  This may involve raising concerns about potential, suspected or actual misconduct or dishonest or illegal activity within Vitaco. This kind of reporting concerns is called whistleblowing.
  
• A whistleblower is a director, employee or contractor of Vitaco, who is apprehensive about raising his/her concern in relation to a wrongdoing within Vitaco’s business because of the fear of possible adverse action against him/her , and who makes a report under this Policy

We Care:

• Protecting people where they feel they need to report conduct under this Policy by making sure that they are treated fairly 
• Protecting people’s confidentiality to ensure that they feel safe in reporting conduct, without fear of retaliation or victimisation as a result
• Supporting a culture of honest and ethical behaviour and good corporate compliance and governance

We Act: 

• Encouraging early internal or external reporting of inappropriate business conduct or behaviours that breach the Vitaco Code of Conduct or other company policies, which also includes any suspected fraud or corrupt conduct 
• Treating every report relating to reportable conduct without judgement and acting promptly to investigate and provide an appropriate response

We Succeed:

• Through education – ensuring Vitaco leaders, employees and suppliers understand how to make a report under this Policy and ensuring persons who may receive a report under this Policy understand their obligations 
• By providing effective internal and external protection, support and assistance to people who may make a repot under this policy. 

2. Scope of this Policy 

This Policy applies to all Vitaco Health Group companies in Australia and New Zealand and will be applied in accordance with the laws of the relevant jurisdiction where the Vitaco Group operates. Where local jurisdictional requirements are more stringent than those contained in this Policy, those requirements will apply in addition to this Policy.

Whistleblowing is covered under the following legislation in Australia and New Zealand: 

• Corporations Act 2001(Cth)
• Treasury Laws Amendment (Enhancing Whistleblower Protections) Act 2019 (Cth)
• Taxation Administration Act 1953 (Cth)
• Protected Disclosures Act 2000 (NZ) 

This Policy should be read alongside the following Vitaco policies and procedures: 

• Vitaco Code of Conduct
• Conflict of Interest Policy
• Fair Treatment Policy 
• Harassment and Bullying Policy and Complaints Process
• EEO Policy and Complaints Process

3. The Policy

Who can make a report? 

The following people can make a report: 

• all current and former Vitaco directors, officers and employees
• all current and former contractors and employees of such contractors to Vitaco
• an individual supplier, broker, auditor who supplies goods and services (whether paid or unpaid) to Vitaco or relatives, dependents of such individuals or their spouse, at all locations within the Vitaco Group, in Australia and New Zealand
• a lawyer on behalf of a discloser in one of the above categories

(all of the above are referred to as whistleblowers or “You” in this Policy).

Reportable Conduct

What sort of conduct or wrongdoing can I report?

Examples of wrongdoing or reportable conduct include, but are not limited to:

• any suspected or actual misconduct or an improper state of affairs or circumstances in relation to Vitaco and which involve:
• a Vitaco director, executive, manager, team member, contractor, supplier, tenderer or other person who has business dealings with Vitaco who has engaged, or attempted to engage in conduct which:
• • • is dishonest, fraudulent or corrupt, including bribery
    • breaches any law or is illegal;
    • is unethical and is in breach of the Code of Conduct or other policies;
    • includes sexual harassment;
    • represents a danger to the public or to the financial system;
    • is potentially damaging to Vitaco, a member of staff or a third party, such as unsafe work practices, environmental damage, health risks or abuse of Vitaco’s property or resources;
    • may cause financial loss to Vitaco or damage its reputation or be otherwise detrimental to Vitaco’s interests; or
    • concerns any other kind of serious misconduct or an improper state of affairs or circumstances.

Examples might include:

• insolvent trading;
• fraud;
• pollution;
• tax evasion;
• misleading consumers;
• corruption;
• accepting bribes.

You must have reasonable grounds that the information you are disclosing about Vitaco is true, even if in the end your report does not turn out to be right.

You will not face any consequences if your beliefs were genuine at the time of making the report. However, if you make a false or misleading report, you could face disciplinary action.

What conduct can I not report?

Personal work-related grievances 

Personal work-related grievances are not reportable conduct. Personal work-related grievances relate to an employee’s current or former employment or engagement (or that of their relative or dependent who is an employee) that have implications for that person personally, and do not have broader implications for Vitaco. 

These sort of issues are related to employment with Vitaco and should be raised with your manager and/or People & Culture. 

Examples of personal work-related grievances might include: 

• a conflict between you and another employee
• issues relating to your performance
• general payroll issues
• issues relating to remuneration
• complaints relating to working hours and leave
• issues or a decision relating to your promotion or transfer
• issues or a decision relating to the termination of your employment

Other out of scope complaints 

Other out of scope complaints which are not reportable conduct include:

• service level complaints
• policy decisions

If you have a complaint about a service issue or policy decision please raise the matter with your Lead Team member.  If you wish to raise a work-related personal grievance issue, refer to Fair Treatment Policy or speak to your Vitaco contact, line manager, supervisor, or the relevant People and Culture contact person.

Who can I make a report to? 

Reports may be communicated by any of the following means:

Protected Disclosure Officers

You can make a report in an informal or a formal way, either by email or by phone, depending on the seriousness of the report. A report can be made to the following:

• In the first instance, to a senior manager of Vitaco; or 
• If you do not feel comfortable making an informal report to your line manager, or another director or employee of you can make a formal report to a Protected Disclosure Officer as listed below: 

Reports may also be made by post to c/- Legal Counsel Vitaco Health Group, PO Box 259 109, Botany, Manukau 2163, New Zealand (or marked to the attention of one of the Protected Disclosure Officers referred to above).

Other ways of making a report

Depending on the nature of the issue you are reporting, you may be able to make a report to a relevant regulator or governmental authority such as ASIC or APRA in Australia or the Ombudsman or the Serious Fraud Office in New Zealand, or to the police. In limited circumstances, a report can be made to parliamentarians and journalists, where it is in the public interest.

Anonymous Reports

You have the right to make a report anonymously. 

You are encouraged however to provide your details as it will help investigate your report, seek further information, and provide you  with the best level of support we can.

Rest assured, once a whistleblower has made a report, the person who received the report must not reveal their identity or any information that is likely to lead to their identification, unless it is an authorised disclosure to a relevant regulator or a government authority, or the police, or to a lawyer who is advising you or Vitaco on the whistleblower laws, by a court order, or with your consent. To do so may be a civil and criminal offence.

What happens when I make a report? 

Information you need to provide 

When you make a report, it is helpful if you can provide as much information as possible as this will assist in any investigation.  Useful information includes: 

• the nature of the suspected wrongdoing;
• dates, times, location, individuals involved;
• other witnesses;
• physical evidence (e.g. documents, images); and 
• any other general information may be helpful to assist Vitaco to determine how to take appropriate action.

The sooner you make a report, the easier it may be for action to be taken. 

Vitaco treat all reports raised under this policy seriously, fairly and with the highest level of sensitivity to the whistleblower and the issues raised in the report. We will ensure that any investigation is run promptly, ethically and in accordance with our internal rules and policies. 

Not all reports will necessarily lead to an investigation, but each report will be assessed and a decision made as to whether it should be investigated.  

How are reports investigated? How long will it take?

All whistleblowing reports: 

• will be investigated in accordance with the relevant laws, Vitaco’s Code of Conduct, and this Policy and any other relevant policies; 
• will be reviewed to assess whether the report is of a serious nature, if it involves conduct involving senior management and or significant financial matters.

The type and length of the investigation will vary depending on the nature of the conduct reported. For all investigations: 

• all whistleblowers, employees and suppliers and persons under investigation are expected to cooperate fully;
• within 20 working days, the Protected Disclosure Officer or other person to whom the report was made must examine seriously the allegations made in the report, and decide whether a full investigation is warranted;
• the Protected Disclosure Officer or other person to whom the report was made may investigate the matter directly or may appoint an Investigation Officer to investigate the matter, (other than in matters involving breaches of the Corporations Act where particular processes apply);
• the Legal Counsel or another Protected Disclosure Officer may be consulted to determine how Vitaco will respond investigate and/or report the matter, depending on the nature of the report. However if the matter relates to the Legal Counsel or any of the Protected Disclosure Officers, Vitaco will engage external legal advisers, accountants or other advisors as necessary to oversee the investigation;
• unless there are confidentiality or other reasons not to do so, individuals to whom the disclosure relates will be informed of the allegation at an appropriate time and will be given a chance to respond to the allegations made against them.

Can I get feedback about the investigation? 

• At the end of the 20 working days, the person to whom the report was made, will report back to you to advise the outcome of their examination and their decision whether or not to fully investigate the matter.
• If you made the allegation other than anonymously, you will also have the right to be heard during the investigation and to be kept informed of progress as appropriate.
• At the end of an investigation, Vitaco will, depending on privacy and confidentiality restrictions which may apply, inform you of the outcome of the investigation.

Outcome of Investigation 

What will I find out about the outcome of the investigation? 

• The investigation will conclude with a report from the Protected Disclosure Officer or other investigator.  All reports shall remain confidential unless we are required to release details of the report under applicable law where Vitaco is required to share details of the report as part of its legal obligations (such as to a relevant Regulator or to the Police).
• The Protected Disclosure will use all reasonable endeavours to advise whether the investigation into the report has been concluded or escalated. 

What happens if my concerns raised in the report are substantiated? 

• Where an investigation identifies a breach of this Policy and/or the Code of Conduct or other internal policies or procedures, appropriate action may be taken. 
• Where an investigation reveals that wrongdoing has taken place then Vitaco will review whether changes to our processes and systems are required to reduce the chances of such wrongdoing happening again. 
• If a person is found to have engaged in misconduct the issues will be dealt with in accordance with our disciplinary procedures. If the conduct relates to any criminal offence, the police may be involved and if the conduct breaches certain laws, the appropriate regulatory authorities may be involved. 

What happens if I am not happy with how the investigation has been conducted? 

• If you think that your report has not been appropriately investigated in accordance with this Policy, or you have a reasonable basis on which you are not satisfied with the outcome of the investigation you may raise your concerns with our external auditors. 

Protection of Whistleblowers 

Vitaco understands that you may be concerned about reprisals, discrimination, harassment or retribution in making a report.  Vitaco is committed to minimising those possibilities by:

Protecting your identity and confidentiality

If you make a report under this Policy, you will have your name, details, and the information you provide, treated in strictest confidence.  Vitaco will only share your details on a need to know basis with those within Vitaco, or our external advisors, who have a role to play in looking into your matter.  In addition, there may be certain times under applicable law where Vitaco is required to share your details as part of its legal obligations (such as to a relevant Regulator or to the Police). 

Vitaco also expects that if you make a report, you keep the information disclosed strictly confidential between yourself and the person to whom you make the report. 

Protecting your files and records 

All files and records created related to a whistleblower report or an investigation will be stored and retained securely and confidentially.

Unauthorised release of information to anyone who is not involved in the investigation (other than senior managers or directors who need to know to take appropriate action, or for corporate governance purposes) without your consent as a whistleblower will be a breach of this Policy.

Rest assured that a release of information in breach of this Policy will be regarded as a serious matter and will be dealt with under Vitaco’s disciplinary procedures.

Protecting you against detrimental conduct

Vitaco is committed to ensuring that if you make a report under this Policy you are provided support and protection from reprisal or personal or financial disadvantage because of making that report. 

If you think that you are being treated unfairly or in a detrimental way because you made a report on reasonable grounds under this Policy, you should inform any Protected Disclosure Officer or a senior Vitaco representative in accordance with Vitaco’s Harassment & Bullying Complaints Policy and Process & Guide (section 7.4 Formal intervention).

Detrimental conduct includes: 

• termination of employment;
• demotion;
• harassment, bullying or intimidation; 
• discrimination; 
• harm or injury, including psychological harm;
• disciplinary action;
• bias, threats;
• damage to reputation; 
•  or other unfavourable treatment connected with making a report.

Please also read the Harassment & Bullying Complaints Policy and Process & Guide for full information on what to do if you want to make a complaint about being treated in a detrimental way as a result of making a report.

Support 

Protected Disclosure Officer

Vitaco will provide you with assistance from a Protected Disclosure Officer who will: 

• Take all reasonable steps to protect you from detrimental treatment;
• Provide assistance with your wellbeing during the investigation;
• Maintain your confidentiality;
• Review and consider complaints of detrimental treatment or any concerns you may have that your report has not be properly investigated under this policy. 
• Take action considered appropriate where such treatment is identified. 

Employee Assistance Programme

Vitaco offers Employee Assistance support (EAP) to any whistleblowers (whether current or former employees to help them deal with being a whistleblower.  

If you think you need confidential EAP support, please speak to People and Culture or your Manager to request a referral.  You do not need to disclose the reason for the referral.  

Additional Special Legal Protection 

In respect of reports relating to specific breaches of Australian Corporations or tax law, whistleblowers may also, provided certain conditions are met, have special legal protection in addition to those protections offered by Vitaco or external parties. 

What happens if this Policy is breached? 

Breach of this policy may be regarded as serious misconduct, which may lead to disciplinary action (including termination of employment or engagement).  An individual may also be exposed to criminal or civil liability for a breach of relevant legislation.  Breach of this policy also occurs if a report has been submitted with false information and malicious or vexatious intent.

Where is this Policy published? 

The Policy is published internally on Vitaco’s intranet vitaHub to inform current employees and directors and shall be reviewed from time to time by Vitaco to ensure that it remains effective and meets Vitaco’s standards of best practice. It is also published on our corporate website to inform former employees as well as others who are able to make a report under this Policy.  

If you have any questions or concerns about this Policy please contact:

Lucinda Warren

Chief People & Culture Officer

+61 2 9490 0327