Privacy Policy

Effective date: 12 November 2026

This Privacy Policy explains how Anista Pty Ltd (ACN 116 524 406, ABN 23 116 524 406), trading as Anista Employee Benefits (“Anista”, “we”, “us”, “our”), handles personal information collected through the DXC employee benefits portal at dxc.anista.com.au (the “Portal”).

We handle personal information in accordance with the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs). For users in New Zealand, we also comply with the Privacy Act 2020 (NZ) and its Information Privacy Principles (IPPs). See the section “New Zealand users” below.

When you log in, Anista Pty Ltd collects your work email address so that we can send you a one-time login code and give you access to your employer’s DXC benefits portal. If you don’t provide it, you can’t log in. Your employer may also have given us your name and work email so that we could set up your access.

If you use the portal, we share your details with benefit providers you choose to contact or book with, and with service providers that host and run the site, some of them overseas (Singapore, the United States and the European Union). Your employer receives only aggregated, de-identified usage statistics. The rest of this policy explains how to access or correct your information or make a complaint, including to the OAIC (Australia) or the Office of the Privacy Commissioner (New Zealand).

1. Who this policy applies to

The Portal is provided to employees of organisations that have engaged Anista to deliver employee benefits (“your employer”). This policy applies to anyone who uses the Portal, including employees in Australia and New Zealand.

2. What personal information we collect

Identity and contact details: your name, work email address, employer, job title or department (if provided), and location (state or region).
Login information: one-time passcodes, single sign-on (SSO) identifiers from your employer’s identity provider, and Google sign-in details if you choose that option.
Portal activity: the benefits, offers and pages you view, bookings and event registrations, orders, rewards points, feedback and survey responses, and messages you send to us or to our chatbot.
Bookings for health and wellbeing services: when you book a service such as an onsite health check or skin check, we collect your booking details (name, contact details, time slot and the service booked). We do not ask for medical history or results through the Portal; those are handled directly by the provider who delivers the service.
Payment information: if you buy something through the Portal, payments are processed by our payment providers (Stripe and WooPayments). We do not store your full card details.
Technical information: IP address, browser and device type, and cookie and analytics data (see section 8).

Sensitive information

The fact that you have booked a health service can reveal information about your health, which is “sensitive information” under Australian law. We collect it only with your consent (given when you make the booking), use it only to arrange the service, and share it only with the provider delivering that service. We do not share it with your employer in a way that identifies you.

3. How we collect personal information

Directly from you, when you log in, register, book, order, complete a form, give feedback or contact us.
From your employer, who may give us your name, work email and employment details so that we can set up your access to the Portal.
From your employer’s identity provider or Google, if you log in using single sign-on or Google sign-in.
Automatically, through cookies and similar technologies when you use the Portal.

If you do not provide your work email address, we cannot give you access to the Portal. If you do not provide booking or order details, we cannot complete that booking or order.

4. Why we collect, use and disclose personal information

to verify your identity and give you access to the Portal;
to provide the benefits, offers, bookings, events, rewards and services available to you;
to connect you with a benefit provider when you request a callback or make a booking;
to process orders and payments;
to send you service messages (login codes, booking confirmations, reminders and feedback requests);
to answer your enquiries, including through our chatbot;
to report to your employer on overall use of the Portal, using aggregated statistics only;
to maintain, secure and improve the Portal;
to send you news and offers from Anista, but only if you have opted in (see section 7); and
to comply with our legal obligations.

5. Who we disclose personal information to

Your employer: aggregated, de-identified statistics only (for example, total numbers of staff who booked a service). We do not give your employer information that identifies you or shows which benefits you individually used.
Benefit and service providers you choose: when you request a callback, make a booking or buy a benefit, we give the relevant provider the details they need to contact you and deliver the service.
Our service providers, who help us run the Portal and who may only use the information for that purpose. These include our website host (Hostinger), email and communications providers (Brevo and our SMTP provider), payment processors (Stripe and WooPayments), Google (sign-in, analytics, tag management and document storage), LinkedIn (advertising measurement) and Anthropic (the AI service behind our chatbot).
Our professional advisers, and anyone we are required or authorised by law to disclose information to.

We do not sell your personal information.

6. Overseas disclosure

Some of our service providers store or process personal information outside Australia and New Zealand. The Portal is hosted in Singapore. Our other providers are located in, or may process information in, the United States (Google, LinkedIn, Stripe, WooPayments and Anthropic) and the European Union (Brevo). We take reasonable steps, including through our contracts and by choosing reputable providers, to ensure that overseas recipients handle your information in a way that is consistent with the Australian Privacy Principles and, for New Zealand users, provides comparable safeguards to the NZ Privacy Act (IPP 12).

7. Marketing

We send news and offers about Anista’s own benefits and services only if you have opted in. Every marketing email identifies Anista and includes a working unsubscribe link, and you can also opt out at any time by emailing privacy@anista.com.au. Opting out does not affect service messages such as login codes or booking confirmations. We comply with the Spam Act 2003 (Cth) and the Unsolicited Electronic Messages Act 2007 (NZ).

8. Cookies and analytics

The Portal uses cookies that are needed to keep you logged in and to run the shopping cart. It also uses Google Tag Manager/Google Analytics and the LinkedIn Insight Tag to measure how the Portal is used. These tools collect information such as your IP address, browser type and the pages you visit, and send it to Google and LinkedIn. You can block or delete cookies in your browser settings, or install the Google Analytics opt-out add-on. Some parts of the Portal may not work properly without essential cookies.

9. Automated processing

Rewards points are calculated automatically under the published rules of the rewards program. Our chatbot answers general questions using an AI service; it does not make decisions about your eligibility for benefits. We do not use automated decision-making that significantly affects your rights or interests. If this changes, we will update this policy before it starts.

10. Security and retention

We take reasonable steps to protect personal information from misuse, interference, loss and unauthorised access, modification or disclosure. These steps include encrypted connections (HTTPS), one-time passcode login and access controls. We keep personal information only for as long as we need it for the purposes in this policy or as required by law, and then destroy or de-identify it.

If a data breach is likely to result in serious harm, we will notify affected individuals and the Office of the Australian Information Commissioner (OAIC) and, for New Zealand users, the Office of the Privacy Commissioner (OPC), as required by law.

11. Accessing and correcting your information

You may ask for access to the personal information we hold about you and ask us to correct it. Email privacy@anista.com.au. We will respond within 30 days (Australia) or within 20 working days (New Zealand). We do not charge for making a request. If we refuse a request, we will tell you why in writing and how to complain.

12. Complaints

If you have a concern about how we have handled your personal information, contact our Privacy Officer first (details below). We will acknowledge your complaint promptly and aim to resolve it within 30 days.

If you are not satisfied with our response, you can complain to:

Australia: the Office of the Australian Information Commissioner, www.oaic.gov.au, phone 1300 363 992.
New Zealand: the Office of the Privacy Commissioner, www.privacy.org.nz, phone 0800 803 909.

13. New Zealand users

Anista is an Australian company. When we deal with personal information of people in New Zealand in the course of carrying on business in New Zealand, the Privacy Act 2020 (NZ) applies to us. In particular:

you have the right to access and request correction of your personal information (IPPs 6 and 7). If we do not correct it, you can ask us to attach a statement of the correction you sought;
where we collect your information from your employer rather than from you, we will tell you about that collection as required by IPP 3A, including through this policy and when you first log in;
we disclose personal information overseas only in line with IPP 12 (see section 6); and
you can complain to the NZ Office of the Privacy Commissioner (see section 12).

14. Contact us

Privacy Officer, Anista Pty Ltd
PO Box 3737, Wamberal NSW 2260, Australia
Email: privacy@anista.com.au

15. Changes to this policy

We may update this policy from time to time. The current version is always available at dxc.anista.com.au/privacy-policy/, and the effective date at the top shows when it was last changed.

Collection notice: logging in to DXC