Privacy Policy

1. Definitions specific to this policy

1.1 Personal Information

Alpha Australia ensures the protection of any personal information it receives, as required by the

Privacy Act 1998 (Cth) (Privacy Act). ‘Personal Information’ is defined in the Privacy Act as

information or an opinion (including information or an opinion forming part of a database), about an identified individual, whether true or not, and whether recorded in a material form or not, about an individual whose identity is apparent, or can reasonably be ascertained, from the information or opinion.

Personal information can include paper and electronic records as well as personally held information, knowledge or opinions. It also includes photos, videos or audio recordings where individuals are reasonably identifiable.

On 12 March 2014, the Privacy Act was amended and the new definition of ‘personal information’ is:

information or an opinion about an identified individual, or an individual who is reasonably identifiable: a) whether the information or opinion is true or not; and b) whether the information or opinion is recorded in a material form or not.

Scope of personal information, as required by state and territory Acts and charters which include:

collection of personal information, regardless of when it came into existence, and to the storage, handling, accessing, amendment, management, transfer, use and disclosure of personal information regardless of when it was collected.

Personal information in Australia includes information or an opinion, in any form and whether true or not, about an identified (or reasonably identifiable) individual. Personal information might include an individual’s name (which may include up to 5 names legally), telephone number, postal or e-mail address.

1.2 Sensitive Information

Where applicable, special provisions apply to the collection of personal information which is sensitive. Sensitive information is a type of personal information and includes information or an opinion about an individual’s race, political opinion, religious beliefs, sexual orientation, criminal record, membership of a trade union or health information. The nature of the ministry of Alpha Australia it is unlikely that we would seek sensitive information.

Alpha Australia generally collects personal information from individuals directly unless otherwise stated in this policy.

1.3 Unsolicited personal information

Alpha Australia generally collects personal information only when Alpha Australia specifically requests the information or when Alpha Australia takes active steps to collect that information. However, from time to time, personal information may be volunteered to Alpha Australia without Alpha Australia specifically requesting the information or without Alpha Australia taking active steps to collect the information. Further, Alpha Australia may receive unsolicited personal information when Alpha Australia requests that certain information is provided, and the individual provides more information than requested.

Where Alpha Australia receives unsolicited personal information, Alpha Australia will determine whether it could lawfully have collected the information had Alpha Australia sought the information.

If Alpha Australia determines that it could not lawfully have collected the information, unless Alpha Australia is authorised or required by law to retain the information, then Alpha Australia will take reasonable steps to destroy or to de-identify that information.

1.4 Staff/Contractor/Intern/Volunteer personal information

An individual who conducts work for Alpha Australia, whether they receive payment for work or not, and can include volunteers, interns and students on placements hosted by Alpha Australia must all abide by this policy.

There is an exemption from the Australian Privacy Principles for ‘employee records’; information that relates to the employment relationship. This exemption does not apply to information about volunteers or contractors or unsuccessful job applicants who apply for employment and whose records and application might be retained. Alpha Australia complies with the Privacy Act by:

Treating all personal information we handle about volunteers or contractors or job applicants in alignment with the Australian Privacy Principles;
Endeavouring to apply broad privacy concepts to how we handle employee records; and
Handling personal information about employees that are not employee records in compliance with the Australian Privacy Principles.

1.5 Personal Information related to minors

The Privacy Act and Australian Privacy Principles apply equally to personal information about minors. Due to the nature of Alpha Australia’s functions and activities, we collect personal information about minors to enable us to facilitate interactive sessions discussing faith and meaning with minors (such as school aged children and young people).

Due to child safety risks associated with personal information about minors (such as addresses or contact details), Alpha Australia handles personal information about minors with extra care. For example, we ensure all volunteers and employee who work with children as representatives of Alpha Australia – and therefore have access to personal information about minors – have valid Working with Children clearance and undertake child safety training on an ongoing basis.

Further, when collecting photos and video content of minors, we seek consent from parents or guardians – or the child or young person themselves if they are capable of providing consent.

2. Guiding Principles

This Alpha Australia Privacy and Confidentiality Policy addresses:

How we collect personal information and data
How we use personal data
How we disclose personal data
Rights and Choices
Storage, Security, Retention and Destroying personal data

Alpha Australia regards someone’s privacy as critically important. We acknowledge the rights and choices of people including how they contact Alpha Australia about our privacy principles and practices.

Alpha Australia takes seriously the expectation that we will access, handle, store and protect personal information with exceptional diligence and care. We recognise that personal information is sensitive and are committed to accountable, robust and diligent privacy management processes, data and document security, and the utmost highest level of confidentiality of such information.

Alpha Australia may collect and use personal data when we engage in ministry with someone, or they connect with us and use our programs and services.

Alpha Australia is committed to ensuring that any 3rd party provider of services to the organisation (e.g. Stripe, Google refer Addendum to this policy), including web servers and cloud providers even if based overseas, financial transaction platforms, are fully compliant with the above stated Statutory Legislation and Regulations (Commonwealth, States and Territories). Alpha Australia will only seek personal information for the sole purpose of Alpha ministry, programs, resources and services.

Personal information and data provided to Alpha Australia, in whatever form, will only be used for purposes stated at the time of the information exchange whether in writing, via a digital form or format, or in person. Alpha Australia will never provide to any person or entity the personal information it holds unless Alpha Australia:

is legally required to do so,
the person has given, in writing, their permission to share their information with another individual or entity and the purpose of the sharing has been stipulated in the written permission.

2.1 Legislative Compliance

Alpha Australia respects and upholds the privacy of individuals and affirms the organisation’s commitment to comply with its organisational responsibilities, including those outlined in the Privacy Act 1998 (Cth), and any other relevant Act or Charter (state or territory). Confidentiality of personal information is of highest importance and will only be shared under specific requirements outlined in this policy.

Alpha Australia has taken steps to ensure that data is maintained under security and privacy principles that provide a level of data and documentation protection at least as secure as those protections required by the Privacy Act 1988 (Cth) or those of a state or territory if they are a higher-level requirement.

2.2 Data Protection and Rights

People generally have the following rights in relation to Personal Data Alpha Australia control about someone:

The right to request confirmation of whether Alpha Australia processes personal data related to someone, and if so, request a copy of that personal data.
The right to request that Alpha Australia rectifies or updates someone’s personal data that is inaccurate, incomplete or outdated.
The right to request that Alpha Australia erase someone’s personal data in certain circumstances provided by law.
The right to request that Alpha Australia restricts the use of someone’s personal data in certain circumstances, such as whilst Alpha Australia considers another request that someone has submitted.
The right to request that Alpha Australia export someone’s personal data that is held by another organisation where technically feasible.
Where the processing of someone’s personal data is based on previously given consent and that someone has a right to withdraw their consent at any time.
Right to object to the processing of someone’s personal data.

2.3 Awareness

To ensure that all individuals are aware of their rights and responsibilities in respect to privacy, Alpha Australia will guarantee that people involved with governance, management, and operations of Alpha Australia:

Are aware of and supported to comply with all relevant governing legislation and guidelines in relation to privacy through induction, ongoing training, guidance and review;
Are trained about their responsibility to uphold the privacy of people to whom Alpha Australia hold data both during and after their engagement with Alpha Australia.

Alpha Australia must declare to people to whom Alpha Australia hold personal information and/or sensitive information how Alpha Australia collects, uses, stores and protects all personal information; and the privacy provisions within Alpha Australia Privacy & Confidentiality Policy through a Protecting Your Privacy brochure, and how to access this policy.

2.4 Collection and use

Alpha Australia recognises that the collection of information, including personal, sensitive or complaints information and data, enhances the organisation’s ability to deliver its breadth of ministry. Alpha Australia has robust, accountable processes in place regarding the collection of information, ensuring that information sought and used is relevant to the Alpha Australia’s purposes, and is appropriately managed.

This includes:

Ensuring that people are clearly informed as to the reasons for the collection of personal information;
Ensuring that information collected is accurate, up-to-date and complete;
Advising how the information will be stored, used, in real time, as well as backup and documentation security and protection;
Informing how data is stored or shared through cloud-based applications or software, in particular third-party organisations.
Advising the criteria that will be used when requests for information access are made;
Ensuring, where appropriate, people give consent for the collection of personal and sensitive information;
Banking, credit/debit card details and similar sensitive data will be stored electronically and securely using, at least at a minimum, 256-bit SSL encrypted transmission either in place by Alpha Australia or third-party platforms transacting on behalf of Alpha Australia; and
Data encryption, where appropriate, will be used to further secure personal, sensitive or financial information.

Alpha Australia will only collect information by lawful and fair means. Alpha Australia will collect information in a number of different ways, and may hold information in either electronic and/or hard copy formats, including but not limited to:

Forms and approval documents (paper or software programs or online),
Electronically, such as through website contact forms or email,
Phone calls and text messages,
Information provided through diary notes or other notations,
Complaints and disputes processes,
Other correspondence, such as email, enquiry forms and postal mail.

Alpha Australia will always collect personal information directly from the individual unless it is unreasonable or impractical for Alpha Australia to do so. On occasion, Alpha Australia may collect information from government, other involved services and professionals where an individual has expressly given permission.

2.5 Storage and Security

Alpha Australia invests substantial resourcing into the establishment of secure information storage systems, with document control security and storage processes in place, and will ensure that individuals are aware of how their information is stored.

Alpha Australia will store data with Australian providers as a preference. Personal and sensitive information will only be transferred to, for storage only, with an international-based server outside Australia provided that it meets the General Data Protection Regulation (GDPR) and has appropriate technical and organisational measures to ensure data protection. GDPR is the highest level of data security globally.

Alpha Australia will always take reasonable steps to let someone know:

that the information has been received by Alpha Australia and how to contact us,
if Alpha Australia received an individual’s information from another source, details of the information received and why it was received,
why Alpha Australia is collecting the information,
the main consequences (if any) for someone should they not provide all or part of the information Alpha Australia have requested,
the organisations or types of organisations to which Alpha Australia normally pass on information (for example during a complaint investigation process if this were required),
that an individual can access and seek to correct their information and that Alpha Australia has procedures in place to respond to these requests,
that Alpha Australia details how someone can complain if they believe Alpha Australia may have breached Privacy Act requirements and how Alpha Australia will handle this type of complaint,
if Alpha Australia are likely to disclose information to other parties and if so, why.

Alpha Australia has taken all appropriate steps to protect personal and sensitive information it holds from:

loss,
misuse,
interference,
unauthorised access, use, modification or disclosure, and
during storage, collection, processing, transfer and destruction of information.

Alpha Australia complies with all requirements of The National Privacy Principles through taking reasonable steps to destroy or permanently de-identify personal information if it is no longer needed for any purpose for which the information was obtained.

2.6 Access

Any individual who connects with, is a user or client with, or whose work intersects with, Alpha Australia has a right to access their personal and sensitive information. Formal applications will be addressed to Alpha Australia Operations Director and responded to within a reasonable period no longer than 48 hours from receipt. Regular informal requests for information may be assessed and granted by the Operations Director.

Access to employment records is subject to different legislative conditions and, as such, the National Director or their delegate will respond to these requests.

2.7 Disclosure

Alpha Australia will use personal information for the purposes intended at the time of collection. Where the information is required for another use or disclosure, Alpha Australia will obtain consent for the revised use, unless a reasonable exception exists.

2.8 Anonymity

Alpha Australia will support an individual’s request to remain anonymous (in so far as this does not contravene any legal requirement), including removing identifiable details of a person, in the provision of personal information where it is reasonable and practicable to do so, and such request does not impact legislative/regulatory/policy compliance. Alpha Australia will advise individuals of the limitations to support and services prior to the collection of the information.

2.9 Opt-Out

Alpha Australia will provide individuals with an option to opt-out of receiving information on Alpha Australia by emailing communications@alpha.org.au

2.10 Website and Cookies

Alpha Australia will take steps to ensure the security of its website. However, users are advised that there is always some risk when transmitting information across the Internet, including a risk that information sent to or from a website may be intercepted, corrupted or modified by third parties.

Alpha Australia may use cookies and web logs on its website to improve its functionality.

Cookies are a small text file that websites may place on someone’s computer, and collect information such as Internet Protocol address, computer’s operating system, browser type and traffic patterns, and username or email address. An individual may adjust their Internet browser to disable cookies or inform them when one is being used. If someone chooses to disable cookies, they may be unable to access certain areas of the Alpha Australia website.

Sometimes Alpha Australia’s website contains links to other third-party websites for user convenience and information. When someone accesses a website other than Alpha Australia’s website:

Alpha Australia makes no representations or warranties in relation to the privacy practices of any third-party website,
Alpha Australia is not responsible for the privacy policies or the content of any third-party website.
Third party websites are responsible for informing individuals about their own privacy practices.

Alpha Australia do not provide any personal information to third-party sites nor does any such information automatically pass to them with the linkage.

Alpha Australia acknowledges the people may or may not be aware that the Internet is not a secure environment, and transmission of personal information over the Internet is at the individual’s own risk.

Alpha Australia website may contain links to other websites operated by third parties. We make no representations or warranties in relation to the privacy practices of any third-party website, and we are not responsible for the privacy policies or the content of any third-party website. Third party websites are responsible for informing individuals about their own privacy practices.

Alpha Australia website uses software known as ‘cookies’ to record someone’s visit to the website and collect some statistical information. Alpha Australia may use this information to help administer and improve our website. Alpha Australia does not use this information to personally identify someone.

Information Alpha Australia may collect includes:

someone’s server address
someone’s domain name
the date and time of access to the website
pages accessed and documents downloaded
the previous site visited
if you have visited the website before
the type of browser software in use.

An individual may set their web browser to disable cookies when visiting the Alpha Australia website.

2.11 Marketing Materials

From time to time, Alpha Australia may send out promotional materials for purposes within its ministry requirements. Should an individual not wish to receive these communications, they may click ‘unsubscribe’ or contact Alpha Australia to unsubscribe. Alpha Australia may also send requests to participate in research by third parties, and sometimes Alpha Australia will receive requests from researchers for data to assist them to write research papers. An individual may receive information from Alpha Australia about such opportunities to participate in research. There is no obligation on any individual to participate in a research study.

2.12 Complaints and appeals

Individuals will be made aware of their rights to report actual, suspected or perceived breaches of privacy and how they can make these complaints. These complaints can be lodged with the Alpha Australia Operations Director.

External complaints can also be lodged with the Office of the Australian Information Commissioner or other statutory bodies including both Federal and State Government Departments, regulatory authorities which have some association with the ministry of Alpha Australia.

If someone is unhappy with the outcome of a privacy complaint, they may lodge a complaint with the Office of the Australian Information Commissioner (OAIC) via: https://www.oaic.gov.au/privacy/privacy- complaints/

2.13 How to access and correct personal and sensitive information

Alpha Australia takes all reasonable steps to ensure that all personal and sensitive information collected, used or disclosed, is accurate, up-to-date, complete, relevant and not misleading.

Alpha Australia will correct any personal and sensitive information that we believe to be incorrect, out- of-date, incomplete, irrelevant or misleading. Individuals may request to access or correct their personal and sensitive information at any time by following the Alpha Australia Personal Information Requests.

2.14 Destruction and De-identification

Alpha Australia will continue to store and hold personal information indefinitely, until such time as Alpha Australia no longer needs the information for any purpose for which the information may be used or disclosed under this Privacy & Confidentiality Policy, or for any other lawful purpose under applicable privacy or data protection laws or (if earlier, and subject to the next paragraph) a reasonable time after someone asks Alpha Australia to delete it.

Alpha Australia uses secure methods to destroy or to permanently de-identify personal information within a reasonable time after the end of the period mentioned in the previous paragraph (unless we are required to retain by any applicable privacy or data protection laws) or if Alpha Australia determines that the personal information received is required to be destroyed or permanently de-identified in accordance with any applicable privacy or data protection laws.

2.15 Notifiable Data Breaches

The Privacy Amendment (Notifiable Data Breaches) Act 2017 established the Notifiable Data Breaches (NDB) scheme in Australia. The NDB scheme applies to all agencies and organisations with existing personal information security obligations under the Australian Privacy Act 1988 (Privacy Act) from 22 February 2018.

The NDB scheme introduced an obligation to notify individuals whose personal information is involved in a data breach that is likely to result in harm, particularly serious harm. This notification must include

recommendations about the steps individuals should take in response to the breach. The Office of the Australian Information Commissioner (OAIC) must also be notified of eligible data breaches.

In the event that someone’s Personal information is lost, stolen or subject to unauthorised access or disclosure, Alpha Australia will adhere to its obligations under the Privacy Act in relation to any required notifications to the Officer of the Australian Information Commissioner, and to those people whose Personal Information has been lost, stolen or subject to unauthorised access or disclosure.

Alpha Australia takes data breaches involving an individual’s personal information seriously. The Australian privacy law provides for an individual affected by a data privacy breach to seek compensation from the organisation involved in the breach. The individual may also have claims for the data privacy breach based on breach of contract, negligence and/or contravention of the Australian Consumer Law. Entities can also be fined for serious and repeated privacy breaches.

At a minimum, if Alpha Australia uncover a privacy breach, we will:

Immediately communicate in writing a full apology to the person/s whose privacy was breached.
Alpha Australia will immediately adopt and implement remedial measures in response to the privacy breach.
Alpha Australia will review its privacy/information handling policies and procedures and conduct training and make necessary changes to ensure information is accurate, complete and up-to-date.

Alpha Australia will fulfil all directions of the Office of the Australian Information Commissioner (OAIC) as a result of a notifiable data breach.

3. Procedure Responding to Personal Information Request

3.1 Assisting individuals to make a request for personal information

Where an individual (stakeholder, contractor or staff member, volunteer or student on placement) seeks to access their personal information, they should, in the first instance, be supported to understand the process. The individual will be provided with a copy of the Alpha Australia Privacy & Confidentiality brochure and if required will be assisted by an Alpha Australia person, who will explain the process using accessible language.

These requests can be made in 3 ways:

The individual asks an Alpha Australia contact to access their information;
An individual makes contact with Alpha Australia directly via the phone or in person which should be referred immediately to the Operations Director;

Through the formal process via an email or writing a letter.

3.2 Determining how to respond to a request for personal information

Requests for personal information can only be responded to formally by the Operations Director.

Regarding formal requests for personal information:

These requests can take the form of requests from individuals, requests from organisations (e.g. Alpha Australia members), from legal representatives, subpoenas, search warrants;
Where a formal request is made by an individual, an email or letter outlining the request must be sent to the Operations Director and must be complete. Alpha Australia may provide a support person who will be named in an email response if appropriate.

If the request is to be refused, the person will receive advice of the decision and the reasons for this. It is not necessary for the requests for personal information to be notified in writing. A record of a verbal notification must be made in Privacy Register which is part of the Document Control Register.

If the request is to be fulfilled:

Alpha Australia will advise the applicant of the decision and a time frame for providing the requested information;
Alpha Australia will provide the information to the applicant by hand, by registered post or by courier. This information will not be provided by email. Where the information is delivered by hand, the applicant’s identity must be confirmed by sighting a photo identification (e.g. driver licence, over 18 card, passport). A diary note must be made confirming that this has occurred and given to the Operations Director for document storage.
The Alpha Australia Privacy & Confidentiality brochure with be provided with the information (to inform of complaint avenues).

If, at any time during the process, it is determined that the request is to be referred to the Board for advice or for approval due to the sensitivity of the data, it is the responsibility of the National Director to ensure such approval has been sought.

3.3 Subpoenas and Court Orders

Formal information requests by way of an order can include the following:

Subpoenas
Search Warrants (sealed by a court);
Other orders issued usually issued by for example Crime and Misconduct Commission or any other statutory body.

All orders or requests must be received only by the National Director of Alpha Australia.

Within three working days, the National Director will acknowledge receipt of the request and provide advice regarding how the request will be managed.
In almost all cases, the National Director will directly manage the response. In doing this, the National Director will be requested to provide an electronic copy of all relevant documents within a specified timeframe. The National Director will not accept any original documents; these must remain securely where they are stored and managed.
The National Director will be fully responsible for the ongoing management of the response, including what information is to be provided and what document review or redaction needs to take place.
Requests will be responded to within the timeframe specified. If this timetable is not able to be met, the National Director will contact the issuing authority and seek an extension.
When the requested documents are ready for release, the National Director will liaise with the Governance Committee (if required) regarding how these documents will be provided:
- In all cases, a cover letter will be sent with the information, containing information about the response and who to contact.
- The information will be transported to the relevant courthouse or agency in person, or via courier, in paper form.
Details of the request and responses will be recorded via the Privacy Register which is part of the Document Control Register.

3.4 Other formal requests for information

Other formal information requests include formal requests from stakeholders, employees/contractors, or other Alpha third-party practitioners or advocates.

All formal requests (excluding orders made by courts or other statutory bodies) must be recorded and requested through the appropriate channel to the Operations Director.
Within three working days, the Operations Director will acknowledge receipt of the request (which may include making contact with the person requesting information directly) and provide advice regarding how the request will be managed.
In almost all cases, the Operations Director will directly manage the response. In doing this, anyone within Alpha Australia will be requested to provide an electronic copy of all relevant documents within a specified timeframe. The National Director will not accept any original documents; these must remain securely where they are stored and managed.
The Operations Director will coordinate with others regarding the management of the response.
Requests will be resolved within a reasonable timeframe (generally taken to mean 14 days) and periodic contact with the person formally requesting information will be maintained by the Operations Director.
Regarding the outcome of the request:
- If the request is being fulfilled, the individual or organisation will be notified of when this request is expected to be fulfilled, either via email or by telephone;
- If the request is being refused, the individual or organisation will be notified of this outcome and the reasons in writing, either by email or letter. This letter will be prepared by the Operations Director and will contain the Privacy & Confidentiality Brochure information and appeal avenues.

If the request is being fulfilled, when the requested documents are ready for release, the Operations Director will direct how these documents will be provided:
- In all cases, a cover letter will be sent with the information, containing information about the response and who to contact.
- The information will be transported to the individual via registered post or a courier. This information may be provided on a USB or in paper form. If this information is being provided in paper form, the Operations Director will confer with the National Director who may give consideration to charging a fee.

Details of the request and response will be recorded in the Privacy Register which is part of the Document Control Register.

3.5 Reasonable grounds for refusal

Where Alpha Australia is considering refusing a request, it must be for one of the following lawful reasons:

Alpha Australia reasonably believes that giving the individual access to the requested information would pose a serious threat to the life, health or safety of any individual, or to public safety; or
Giving access would have an unreasonable impact on the privacy of other individuals; or
Giving access would be unlawful; or
The request for information is frivolous or vexatious; or
Denying access is otherwise required or authorised by law; or
The information relates to existing or anticipated legal proceedings between Alpha Australia and the individual and the information would not be accessible by the process of discovery in those proceedings; or
Giving access would reveal the intentions of Alpha Australia in relation to negotiations with the individual in such a way that may prejudice those negotiations; or
Giving access would be unlawful; or
Refusal of access is required or authorised by or under an Australian law or a court/tribunal order; or
Alpha Australia has reason to suspect that unlawful activity, or misconduct of a serious nature, that relates to Alpha Australia functions or activities, has been, is being or may be engaged in and providing access to this information would likely prejudice the taking of appropriate action in relation to the matter; or
Giving access would be likely to prejudice one or more enforcement related activities by, or on behalf of, an enforcement body; or
Giving access to the information would reveal evaluative information generated with Alpha Australia in connection with commercially sensitive decision-making processes.

A decision to refuse a personal information request must be confirmed by the National Director before the Operations Director advising the individual/organisation requesting the information. The National Director must inform immediately their decision to refuse to the Alpha Australia Board.

If Alpha Australia refuses to provide someone with access to or correct their personal information, we will provide the person with reasons for this decision in writing. In some circumstances where we correct a record, we may still require the retention of the original record.

Please note that, since Alpha Australia, does not wish to interfere with the privacy of individuals, Alpha Australia reserves the right to verify someone’s identity prior to releasing their personal information to them and/or correcting any personal information the individual asserts is incomplete, inaccurate or outdated. Further, Alpha Australia reserves the right to redact the personal information of other individuals which may be collected and held by Alpha Australia and which would be otherwise subject to access request.

3.6 Records Management

All informal and formal requests for personal information managed by the Operations Director or National Director of Alpha Australia, and any general advice given in response to personal information enquiries, must be recorded in the Privacy Register which is part of the Document Control Register.

3.7 Complaints and Concerns

Questions or comments about Alpha Australia’s Privacy & Confidentiality Policy, or supporting publicly available user documents or statements, or complaint about how Alpha Australia has handled personal information (including, where applicable, credit-related information) about someone, must contact of Alpha Australia as follows:

Operations Director

Alpha Australia National Office

Unit 5/621 Whitehorse Rd, Mitcham VIC 3132

feedback@alpha.org.au

1800 811 903

Alpha Australia will respond to any privacy complaint in accordance with any timeframes required by law or as detailed in this policy.