YMCA Bundaberg Privacy Policy

YMCA of Bundaberg Inc (YMCA Bundaberg) respects the privacy of all our people including members, employees, volunteers, our customers/beneficiaries, donors, business partners and online users, and is committed to safeguarding the personal information that is provided to us.

Purpose

The purpose of this privacy policy is to:                                                             

  • clearly communicate the personal information handling practices of YMCA Bundaberg
  • enhance the transparency of YMCA Bundaberg operations, and
  • give individuals a better and more complete understanding of the sort of personal information that YMCA Bundaberg holds, and the way we handle that information.

Scope

The procedures applicable to this policy apply to all YMCA Bundaberg employees, members, volunteers, customers, and business partners who collect or have access to personal information.

The Privacy Act and this Privacy Policy do not apply to acts or practices which directly relate to employee records of YMCA Bundaberg current and former employees.

Definitions

Online users: refers to anyone that accesses the YMCA Bundaberg website (as below)

Personal information: as defined by the Privacy Act 1988 (as amended) is information or an opinion about an identified individual, or an individual who is reasonably identifiable, whether true or not, and whether recorded in a material form or not.

Sensitive information: as defined by the Privacy Act 1988 (as amended) is information or opinion (that is also personal information) about an individual’s racial or ethnic origin, political opinions, membership of a political association, religious beliefs or affiliations, philosophical beliefs, membership of a professional or trade association, membership of a trade union, sexual preferences or practices or criminal record or health, genetic, biometric information or biometric templates, that is also personal information.

The website: means the YMCA Bundaberg website https://bundaberg.ymca.org.au

Outline of Procedures Relevant to this Policy

‘Part A — Personal Information Handling Practices’ explains the general information handling practices across YMCA Bundaberg including information about how personal information is collected, used, disclosed and stored

‘Part B — Files’ offers further detail by explaining the personal information handling practices in relation to specific YMCA Bundaberg functions or activities.

Procedures Part A – Our Personal Information Handling Practices

Our obligations under the Privacy Act

This privacy policy sets out how the YMCA Bundaberg complies with the obligations under the Privacy Act 1988 (Cth) (Privacy Act). YMCA Bundaberg is bound by the Australian Privacy Principles (APPs) in the Privacy Act which regulate how organisations may collect, use, disclose and store personal information, and how individuals may access and correct personal information held about them.

Collection of Personal and Sensitive Information

The nature and extent of personal and sensitive information collected by YMCA Bundaberg varies depending on the particular interaction with YMCA Bundaberg.

Under the Act people must be given an option to access any YMCA Bundaberg Services on an anonymous basis or using a pseudonym if possible and lawful.

YMCA Bundaberg collects personal and sensitive information for multiple purposes from customers/beneficiaries, donors, business partners, YMCA Bundaberg people and online users including but not limited to:

YMCA Bundaberg Customers and Beneficiaries

Kind of information collected:

  • contact details (name, address, email etc.)
  • personal details including: date of birth, gender
  • information on personal issues and experiences, relationships,
    family background, supports customers may have in the community
  • areas of interest
  • health information and/or medical history
  • credit card numbers or bank account details

How the information is collected:

  • membership applications
  • telephone

Purpose for which YMCA Bundaberg uses the information:

  • to provide YMCA Bundaberg services
  • to provide customers/beneficiaries with the most appropriate services for their needs
  • to meet any requirements of government funding for programs
  • to monitor and evaluate existing services and plan for future services
  • to produce annual reports and for research purposes which may involve contracted organisations
  • to comply with legal obligations

YMCA Bundaberg Members (Health, Fitness and Wellbeing participants)

Type of information collected:

  • contact details (name, address, telephone numbers, email etc.)
  • date of birth
  • health information and/or medical history
  • credit card details
  • expiration date of credit card
  • areas of interest

Purpose for which YMCA Bundaberg uses the information:

  • to provide appropriate YMCA Bundaberg services ( Including tailored Health and Fitness Programs)
  • to provide communication updates and ensure transparency
  • to process payments, donations and provide accurate receipts
  • to facilitate ongoing fundraising and marketing activities
  • to provide info about YMCA Bundaberg
  • to receive invitations to upcoming events and activities
  • to recognise your support of YMCA Bundaberg

YMCA Bundaberg Business Partners

Type of information collected:

  • contact person’s name, the name of the organisation which employs the person, telephone numbers, fax number, street and postal address, email address and position title
  • areas of interest by category and industry
  • bank details (if YMCA Bundaberg is to receive payment or make payment for services received)
  • Australian Business Number (ABN)
  • type of support (eg. workplace giving, goods in kind, program support, volunteering)

How the information is collected:

  • communications, email, flyers

Purpose for which YMCA Bundaberg uses the information:

  • to provide YMCA Bundaberg services
  • to process donations and provide accurate receipts
  • to pay for services
  • to establish and manage partnerships
  • to receive services from you or the organisation which employs you
  • to manage YMCA Bundaberg ‘s relationship with the business partner
  • to provide information about YMCA Bundaberg’s services
  • to update the company on YMCA Bundaberg appeals for public donations, programs and services

YMCA Bundaberg People (volunteers, employees, delegates) and candidates for volunteer work and prospective employees

Type of information collected:

  • contact details (name, address, telephone numbers, email etc.)
  • personal details including personal details of emergency contact person(s)
  • date of birth
  • country of birth, citizenship, residency and/or visa details
  • details of current/previous employment or volunteer involvement
  • skills and experience
  • languages spoken and written
  • qualifications, drivers license details
  • information and opinions from referees for prospective employees and candidates for volunteer work
  • a Police Check will be required for all roles in YMCA Bundaberg (particularly those involving children, young people and other vulnerable individuals). Individuals will be required to provide certain information for a Police Check. There are different arrangements for Police Checks in each state and territory of Australia. In some cases the Police Check will be received directly by YMCA Bundaberg and then stored securely or destroyed.
  • in some situations it is necessary for YMCA Bundaberg to collect or receive information about an individual’s health. In this circumstance, YMCA Bundaberg will advise why the information is being collected and whether and to whom it will be released.

Purpose for which YMCA Bundaberg uses the information:

  • to provide YMCA Bundaberg services
  • to process an application to become a member, volunteer or employee of our organisation
  • to facilitate a placement in an appropriate service or position
  • to assist with services whilst an individual is employed or engaged as a volunteer with YMCA Bundaberg
  • to provide feedback on performance as a volunteer or employee
  • to meet legislative responsibilities to all volunteers and employees
  • to obtain feedback from individuals about their experiences
  • to assist YMCA Bundaberg to review and improve its programs and services to keep individuals informed about  YMCA Bundaberg developments and opportunities
  • to provide information about YMCA Bundaberg services
  • to facilitate further involvements with YMCA Bundaberg (eg. Disability supports, membership, donor)

Additional Information

The website may from time to time contain links to other websites. YMCA Bundaberg stresses that when an online user accesses a website that is not the YMCA Bundaberg website, it may have a different privacy policy. To verify how that website collects and uses information, the user should check that particular website’s policy.

How Information is Collected

Where possible, personal and sensitive information is collected directly from the person through various means, including telephone and in-person interviews, appointments, forms and questionnaires. In some situations YMCA Bundaberg may also obtain personal information about people from a third party source.

Collection of Health Information

As part of administering YMCA Bundaberg services, health information may be collected. For example, YMCA Bundaberg collects health information (such as medical history) from some customers/beneficiaries/ gym members participating in YMCA Bundaberg programs. When collecting health information, YMCA Bundaberg will obtain consent to such collection and explain how the information will be used and disclosed.

If health information is collected from a third party (such as a doctor), YMCA Bundaberg will inform the person that this information has been collected and will explain how this information will be used and disclosed.

YMCA Bundaberg will not use health information beyond the consent provided, unless further consent is obtained or in accordance with one of the exceptions under the Privacy Act or in compliance with another law. If YMCA Bundaberg uses health information for research or statistical purposes, it will be de-identified if practicable to do so.

Use and disclosure of Personal Information

YMCA Bundaberg will only use personal information for the purposes for which it was given, or for purposes which are related to YMCA Bundaberg functions or activities.

For the purposes referred to in this Privacy Policy (discussed above under ‘Collection of Personal and Sensitive Information‘), personal information may also be disclosed to other external organisations including:

Government departments/agencies who provide funding for some YMCA Bundaberg services
Contractors who manage some of the services we offer, such as distribution centres who may send information on behalf of YMCA Bundaberg. Steps are taken to ensure they comply with the APPs when they handle personal information and are authorised only to use personal information in order to provide the services or to perform the functions required by YMCA Bundaberg;
Doctors and health care professionals, who assist with delivery of services;
Other regulatory bodies, such as WorkSafe;
Nominated referees and/or former employers of persons applying to work or volunteer at YMCA Bundaberg
YMCA Bundaberg professional advisors, including our accountants, auditors and lawyers.

Except as set out above, YMCA Bundaberg will not disclose an individual’s personal information to a third party unless one of the following applies:
the individual has consented
the individual would reasonably expect us to use or give that information for another purpose related to the purpose for which it was collected (or in the case of sensitive information – directly related to the purpose for which it was collected)
it is otherwise required or authorised by law
it will prevent or lessen a serious threat to somebody’s life, health or safety or to public health or safety
it is reasonably necessary for us to take appropriate action in relation to suspected unlawful activity, or misconduct of a serious nature that relates to our functions or activities
it is reasonably necessary to assist in locating a missing person
it is reasonably necessary to establish, exercise or defend a claim at law
it is reasonably necessary for a confidential dispute resolution process
it is necessary to provide a health service
it is necessary for the management, funding or monitoring of a health service relevant to public health or public safety
it is necessary for research or the compilation or analysis of statistics relevant to public health or public safety
it is reasonably necessary for the enforcement of a law conducted by an enforcement body.

YMCA Bundaberg does not usually send personal information out of Australia. 

Security of Personal and Sensitive Information

YMCA Bundaberg takes reasonable steps to protect the personal and sensitive information we hold against misuse, interference, loss, una​uthorised access, modification and disclosure.

These steps include password protection for accessing our electronic IT system, securing paper files in locked cabinets and physical access restrictions. Only authorized personnel are permitted to access these details.

When the personal information is no longer required, it is destroyed in a secure manner, or deleted according to our Records Disposal Policy.

Access to and correction of personal information

If an individual requests access to the personal information we hold about them, or requests that we change that personal information, we will allow access or make the changes unless we consider that there is a sound reason under the Privacy Act or other relevant law to withhold the information, or not make the changes.

Requests for access and/or correction should be made to the CEO, YMCA of Bundaberg Inc. For security reasons, request are required to be in writing and provide proof of identity. This is necessary to ensure that personal information is provided only to the correct individuals and that the privacy of others is not undermined.

In the first instance, YMCA Bundaberg will generally provide a summary of the information held about the individual. It will be assumed (unless told otherwise) that the request relates to current records. These current records will include personal information which is included in YMCA Bundaberg databases and in paper files, and which may be used on a day to day basis.

We will provide access by allowing the person to inspect, take notes or print outs of personal information that we hold about them. If personal information (for example, name and address details) is duplicated across different databases, YMCA Bundaberg will generally provide one printout of this information, rather than multiple printouts.

All reasonable steps will be taken to provide access or the information requested within 14 days of request. In situations where the request is complicated or requires access to a large volume of information, we will take all reasonable steps to provide access to the information requested within 30 days.

YMCA Bundaberg may charge reasonable fees to reimburse the cost incurred relating to the request for access to information, including photocopying and delivery cost of information stored off site. If an individual is able to establish that personal information YMCA Bundaberg holds about her/him is not accurate, complete or up to date, YMCA Bundaberg will take reasonable steps to correct our records.

Access will be denied if:

the request does not relate to the personal information of the person making the request;
providing access would pose a serious threat to the life, health or  safety of a person or to public health or public safety;
providing access would create an unreasonable impact on the privacy of others;
the request is frivolous and vexatious;
the request relates to existing or anticipated legal proceedings;
providing access would prejudice negotiations with the individual making the request;
access would be unlawful;
denial of access is authorised or required by law;
access would prejudice law enforcement activities;
access would prejudice an action in relation to suspected unlawful activity, or misconduct of a serious nature relating to the functions or activities of YMCA Bundaberg
access discloses a ‘commercially sensitive’ decision making process or information; or
any other reason that is provided for in the APP’s or in the Privacy Act.

If we deny access to information we will set our reasons for denying access. Where there is a dispute about right of access to information or forms of access, this will be dealt with in accordance with the complaints procedure set out below.

Complaints Procedure

If you have provided personal and sensitive information, or we have collected and hold personal and sensitive information, people have a right to make a complaint and have it investigated and dealt with under this complaints procedure.

If there is a complaint about YMCA Bundaberg privacy practices or our handling of personal and sensitive information, people should contact the Chief Executive Officer.

All complaints will be logged on our database.

A privacy complaint relates to any concern that regarding YMCA Bundaberg privacy practices or our handling of personal and sensitive information. This could include matters such as how information is collected or stored, how information is used or disclosed or how access is provided to personal and sensitive information.

The goal of this policy is to achieve an effective resolution of your complaint within a reasonable timeframe, usually 30 days or as soon as practicable.

However, in some cases, particularly if the matter is complex, the resolution may take longer.

Once the complaint has been made, we will try to resolve the matter in a number of ways such as:

  • Request for further information: We may request further information from the person, including details of any relevant dates and documentation. This will enable us to investigate the complaint and determine an appropriate solution. All details provided will be kept confidential.
  • Discuss options: We will discuss options for resolution with the person and listen to suggestions about how the matter might be resolved
    Investigation: Where necessary, the complaint will be investigated. We will try to do so within a reasonable time frame. It may be necessary to contact others in order to proceed with the investigation.
  • Conduct of our employees: If the complaint involves the conduct of an employee, it will be raised with the employee concerned and seek their comment and input in the resolution of the complaint.
  • The complaint is substantiated: If the complaint is found to be substantiated, the person will be informed of this finding. We will then take appropriate agreed steps to resolve the complaint, address their concerns and prevent the problem from recurring.
    If the complaint is not substantiated, or cannot be resolved to the persons satisfaction, but this Privacy Policy has been followed, YMCA Bundaberg may decide to refer the issue to an appropriate intermediary. For example, this may mean an appropriately qualified lawyer or an agreed third party, to act as a mediator.
    At the conclusion of the complaint, if the person is still not satisfied with the outcome they should be advised to take the complaint to the Office of the Australian Information Commissioner at www.oaic.gov.au.
    We will keep a record of all complaints and the outcomes.

We are unable to deal effectively with anonymous complaints as they are unable to be investigated and followed-up. In the event that an anonymous complaint is received we will note the issues raised and, where appropriate, try to investigate and resolve them appropriately.

Procedures Part B — Types of files

Purpose

We may maintain contacts lists which include contact information about individuals who may have an interest in disability support, YMCA Bundaberg or other services we provide. We use these contacts lists to distribute information about our activities and publications.

Collection

It is our usual practice to collect personal information in contacts lists directly from individuals, for example, where they have asked to be added to a contacts list.

Sometimes we collect personal information from a third party or from a publicly available source such as a website or telephone directory. We usually only collect personal information in this way if the individual would reasonably expect us to, or has given their consent. For instance, we might collect this information if we thought that the individual (or the organisation they work for) would like to receive information about services we are carrying out, or that they might be likely to consider information about health/fitness and/or disability care useful in the work they do. We would only contact this individual in their work capacity.

Use and disclosure

We only use personal information in contacts lists for the purpose of managing stakeholder relations.

We do not give personal information about an individual to other organisations or anyone else without consent unless the individual would reasonably expect, or has been told, that information of that kind is usually passed to those organisations or individuals, or the disclosure is otherwise required or authorised by law.

Data quality

We maintain and update personal information in our contacts lists when we are advised by individuals that their personal information has changed. We will regularly audit contacts lists to check the currency of the contact information. We will remove contact information of individuals who advise us that they no longer wish to be contacted.

Data security

The personal information in the contacts lists is stored in either password protected electronic media or in locked cabinets in paper form. When no longer required, personal information in contacts lists is destroyed in a secure manner or deleted in accordance with Records Disposal Policy.

Routine access to contacts lists is limited to the database operators who have responsibility for maintaining the contacts lists. Other staff members have access to the personal information in contacts lists on a need to know basis.

Access and correction

For information about how to access or correct personal information in our contacts lists see ‪’Access and correction’ in Part A of this document.

Changes to this Privacy Policy

YMCA Bundaberg reserves the right to review, amend and/or update this policy from time to time.

We aim to comply with the APPs and other privacy requirements required to be observed under State or Commonwealth Government contracts.

Relevant Legislation

Privacy Act 1988 (Cth)

Information Privacy Act 2009 (Qld)

Australian Privacy Principles