We are committed to protecting your personal information, and ensuring its privacy, accuracy and security. We handle your personal information in a responsible manner in accordance with the Privacy Act 1988 and the Australian Privacy Principles (APPs).
0. PURPOSE
Transcend Australia is committed to protecting the privacy, dignity, safety and confidentiality of all individuals whose personal information it collects, uses, stores or discloses.
This policy establishes the principles and requirements for managing personal information in accordance with the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs). It supports Transcend Australia’s commitment to creating a safe and trusted environment for children, young people, families, staff, volunteers, supporters and partners.
This policy also supports the commitments outlined in Transcend Australia’s public Privacy Policy.
1. SCOPE
This policy applies to all Board Members, employees, volunteers and contractors.
It applies to all personal information handled by Transcend Australia in any format, including:
- Electronic records
- Emails and digital communications
- Paper files and documents
- Audio and video recordings
- Images and photographs
The policy applies to personal information collected or managed through:
- Employment and volunteer management
- Service delivery and community programs
- Events and community engagement activities
- Fundraising and donor relations
- Governance and administration activities
- Website and digital platforms
2. PRIVACY PRINCIPLES
Transcend Australia will:
- Collect only the personal information reasonably necessary for its functions and activities.
- Be open and transparent about how personal information is collected, used, stored and disclosed.
- Obtain consent where required, particularly when collecting sensitive information.
- Limit access to personal information on a need-to-know basis.
- Protect personal information through appropriate physical, technical and administrative safeguards.
- Respect the rights of individuals to access and correct their personal information.
- Respond promptly and appropriately to privacy complaints and data breaches.
- Continuously improve privacy practices, systems and staff awareness.
3. DEFINITIONS
Personal Information
Information or an opinion that identifies, or could reasonably identify, an individual, regardless of whether the information is true or recorded in a material form.Examples include:
- Name
- Address
- Email address
- Telephone number
- Photographs
- Date of birth
Sensitive Information
A special category of personal information that requires additional protection under the Privacy Act.Examples include:
- Gender identity
- Sexual orientation
- Health information
- Disability information
- Racial or ethnic origin
- Religious beliefs
- Political opinions
- Membership of professional associations
- Criminal history
Sensitive information, including information relating to gender identity, sexual orientation, health or disability, will generally only be collected with the individual’s consent and where reasonably necessary for Transcend Australia’s functions and activities, unless an exception under the Privacy Act applies.
Health Information
Information relating to an individual’s physical or mental health, health status, disability, or health services provided.Collect, Use, Store and Disclose
Terms describing the ways personal information is gathered, handled, protected, retained and shared.Data Breach
Unauthorised access to, disclosure of, loss of, or inability to access personal information.Examples include:
- Sending information to the wrong person
- Losing a laptop or mobile device
- Cybersecurity incidents
- Unauthorised access to records
Privacy Officer
The person appointed by Transcend Australia to oversee privacy compliance, respond to privacy enquiries and manage privacy incidents. The person appointed is the CEO.
4. COLLECTION OF PERSONAL INFORMATION
4.0 Client and Service User
Transcend Australia collects personal information only by lawful and fair means and only where reasonably necessary for its functions and activities.
Where practical, information will be collected directly from the individual concerned.
Information may be collected through:
- Application forms
- Registration forms
- Surveys
- Online submissions
- Recruitment processes
- Volunteer onboarding processes
- Emails, telephone calls and meetings
- Participation in programs and events
- Website and digital platform interactions
Information may be collected from third parties only where:
- The individual has consented;
- It is reasonably necessary for service delivery; or
- If required to satisfy legal duties
At or before the time personal information is collected, or as soon as practicable afterwards, Transcend Australia will take reasonable steps to notify individuals of:
- the purpose of collection;
- the consequences if the information is not provided;
- any organisations to which the information may be disclosed;
- how to access or correct personal information;
- how to make a privacy complaint; and
- whether information is likely to be disclosed overseas.
Unsolicited Personal Information
If Transcend Australia receives personal information that it did not solicit, it will determine whether it could have lawfully collected the information under this policy and the Privacy Act.Where the information could not have been collected lawfully and is not contained in a Commonwealth record, Transcend Australia will destroy or de-identify the information as soon as practicable.
Information About Children and Young
People Transcend Australia provides services, support, education, and community programs that may involve children and young people.
Where personal information relates to a child or young person, we will take additional care to ensure information is collected, used, stored, and disclosed in a manner that protects their privacy, dignity, safety, and wellbeing.
Depending on the circumstances and legal requirements, information may be collected from:
- the child or young person directly;
- a parent or legal guardian;
- a family member or caregiver; or
- another person authorised to act on behalf of the child or young person.
4.1 Employee and Volunteer Information
Personal information collected about employees, volunteers, contractors and Board
Members may include:
- Recruitment and onboarding records
- Qualifications and training records
- Payroll and superannuation information
- Performance and development records
- Emergency contact details
- Workplace health and safety information
- Screening and background check information where required
Certain employee records may be exempt from some requirements of the Privacy Act where the information relates directly to a current or former employment relationship. Despite this exemption, Transcend Australia is committed to managing employee information responsibly and confidentially.
Examples of employee records may include recruitment records, payroll and superannuation information, performance and development records, workplace health and safety records, leave records, disciplinary records, emergency contact details and employment-related correspondence. While certain employee records may be exempt from some requirements of the Privacy Act where they relate directly to an employment relationship, Transcend Australia will handle such information responsibly, securely and confidentially.
0. DIRECT MARKETING AND COMMUNICATIONS
Transcend Australia may use personal information to provide newsletters, fundraising appeals, event information, advocacy updates and other information related to its activities.
Individuals may opt out of receiving marketing communications at any time using the unsubscribe facility provided or by contacting Transcend Australia directly.
Transcend Australia will not use or disclose personal information for direct marketing purposes where prohibited by law.
1. USE OF PERSONAL INFORMATION
1.0 Client and Service User
Personal information may only be used for the purpose for which it was collected, for a related purpose that would reasonably be expected, or where authorised or required by law.
Transcend Australia will take reasonable steps to ensure personal information used or disclosed is accurate, up to date, complete and relevant to the purpose for which it is being used.
Personal information may be used to:
- Deliver programs and services
- Provide peer support and community engagement activities
- Communicate with clients, families, volunteers and supporters
- Manage employment and volunteer relationships
- Process donations and fundraising activities
- Organise events and campaigns
- Meet legal, governance and reporting obligations
- Undertake advocacy, evaluation and research activities in a privacy-compliant manner
1.1 Employee and Volunteer Information
Transcend Australia collects and uses personal information relating to employees, volunteers, contractors and Board Members for legitimate employment, governance and volunteer management purposes. This can include recruitment, onboarding, payroll administration, supervision, performance management, training, workplace health and safety, organisational communications and compliance with legal obligations.
2. CONFIDENTIALITY
All Board Members, employees, volunteers and contractors are required to maintain the confidentiality of personal information accessed through their role.
They must:
Access information only where required to perform their duties.
Keep personal information secure and confidential.
- Not discuss personal information in public or inappropriate settings.
- Not disclose information to unauthorised persons.
- Use only approved organisational systems and applications.
- Continue to maintain confidentiality after their employment, volunteer appointment or engagement ends.
Personal information must only be shared internally on a need-to-know basis.
3. DISCLOSURE OF PERSONAL INFORMATION
3.0 Client and Service User
Transcend Australia may disclose personal information:
- To authorised employees, volunteers, contractors or Board Members where required to perform their role.
- To external service providers engaged to support organisational operations.
- To regulatory, law enforcement or government agencies where required by law.
- To other parties with the individual’s consent.
- Where authorised or required under legislation.
All service providers with access to personal information must comply with privacy and confidentiality obligations appropriate to their role.
Transcend Australia does not routinely disclose personal information overseas unless required for operational purposes and in compliance with applicable privacy obligations.
Where personal information may be disclosed to overseas service providers, including cloud-based technology providers, Transcend Australia will take reasonable steps to ensure those providers handle personal information in accordance with privacy obligations substantially similar to the Australian Privacy Principles or otherwise as required by law.
Personal information stored in cloud-based systems may be processed or stored in Australia or other jurisdictions where service providers operate.
Sensitive information will only be disclosed where permitted by law or with appropriate consent.
3.1 Employee, Volunteer and Contractor Records
Access to employee, volunteer and contractor records is restricted to authorised personnel who require the information to perform their role. Personnel files, payroll records, health information and performance-related information will be handled confidentially and stored securely.
3.2 Children and Young People
Particular care must be taken when handling information relating to children, young people and families.
Information relating to a child, young person or family must only be shared where:
- Required for service delivery;
- Necessary to protect safety or wellbeing;
- Required by law; or
- Appropriate consent has been obtained.
4. SECURITY, STORAGE AND RETENTION
Transcend Australia takes reasonable steps to protect personal information from misuse, interference, loss, unauthorised access, modification or disclosure.
Protection measures include:
- Secure systems and networks
- Password protection and multi-factor authentication where available
- Access controls and permissions
- Confidentiality agreements
- Approved cloud-based services
- Secure storage of physical records
- Cybersecurity controls and monitoring
All Board Members, employees, volunteers and contractors must:
- Follow organisational IT, cybersecurity and privacy requirements.
- Store information only in approved systems.
- Protect passwords and access credentials.
- Immediately report suspected security incidents.
- Not store organisational information in personal accounts, devices or applications unless expressly authorised by the CEO.
Personal information will be retained only for as long as necessary to meet legal, operational or regulatory requirements. Information that is no longer required will be securely destroyed or de-identified.
5. DATA BREACH MANAGEMENT
Any actual or suspected privacy breach must be reported immediately to the CEO who is the Privacy Officer.
Examples include:
- Information sent to the wrong recipient
- Lost or stolen devices
- Unauthorised access to records
- Disclosure without authority
- Cybersecurity incidents
- Accidental publication of personal information
Transcend Australia will assess, contain and respond to privacy breaches in accordance with legislative requirements and applicable organisational procedures.
Where required by law, affected individuals and relevant authorities will be notified.
6. ACCESS, CORRECTION AND PRIVACY COMPLAINTS
Privacy complaints will be acknowledged promptly and investigated in a fair and timely manner. Transcend Australia will seek to resolve complaints within a reasonable period and will provide a written outcome where appropriate.
Individuals have the right to:
- Request access to personal information held about them.
- Request correction of inaccurate, incomplete or outdated information.
- Raise concerns regarding the handling of their personal information.
Requests will be responded to within a reasonable timeframe and in accordance with applicable privacy legislation.
Where access or correction cannot be provided, the individual will be informed of the reason unless a legal exception applies.
If Transcend Australia refuses a correction request, the individual will be provided with written reasons for the decision and information about available complaint mechanisms. Where appropriate, individuals may request that a statement associated with the disputed information be attached to the record.
Privacy enquiries, access requests, correction requests and complaints should be directed to the CEO.
If an individual is dissatisfied with Transcend Australia’s response, they may contact the Office of the Australian Information Commissioner (OAIC).
7. RESPONSIBILITIES
Board
The Board is responsible for:
- Overseeing organisational compliance with privacy obligations.
- Monitoring privacy-related risk.
- Ensuring appropriate governance arrangements are in place.
CEO / Privacy Officer
The CEO, or delegated Privacy Officer, is responsible for:
- Implementing this policy.
- Managing privacy enquiries and complaints.
- Responding to data breaches.
- Supporting training and awareness activities.
- Monitoring compliance with privacy obligations.
Employees, Volunteers and Contractors
All employees, volunteers and contractors are responsible for:
- Complying with this policy.
- Protecting personal information and confidentiality.
- Reporting suspected privacy breaches immediately.
- Completing required training.
- Using information only for authorised purposes.
8. POLICY REVIEW
This policy will be reviewed every two years, or earlier if:
- Legislative requirements change;
- Significant privacy incidents occur;
- Organisational changes require review; or
- Improvements are identified through monitoring or feedback.
Related Documents
- Child Safety and Wellbeing Policy
- Code of Conduct
- Records Management Procedures
- Data Breach Response Procedure
- Privacy Act 1988 (Cth)
- Australian Privacy Principles (APPs)