1. About this privacy policy

Canteen (Canteen, we, our, us) is committed to protecting the privacy and confidentiality of our young people, their caregivers, parents, friends, donors, staff, volunteers, corporate supporters and customers, and complying with our obligations including those in the Australian Privacy Act 1988 (Cth).

We have prepared this privacy policy, in line with Canteen’s commitment to best practice, to inform you of the personal information we may collect and hold about you via shop.bandannaday.org.au, www.canteen.org.au, canteenconnect.org.au and parents.canteen.org.au (collectively, our Website), and how we use that information. This privacy policy also provides information about your privacy rights as an individual and how to contact us if you have any privacy concerns.

This privacy policy may change from time to time and it is therefore important that you review it regularly.

2. What personal information do we collect and handle?

Personal information

Canteen may collect personal information, which is any information or opinion (whether true or not, and whether recorded in a material form or not) about you as an identified or reasonably identifiable individual.

The types of personal information that we may collect and handle vary depending on your use of the Website

Sensitive information

We may also collect sensitive information. Sensitive information is a special subset of personal information which is generally afforded greater protections under the Australian Privacy Act. The types of sensitive information we may collect include:

• health information (such as current and past medical history) and assessments;
• cultural background;
• details of relationships; and
• personal circumstances and other information that you choose to provide.

Photographs

We may feature photographs of various individuals on our Website.  These photographs are taken and displayed on our Website with the permission of the individuals involved.  If you are in one or more of these photos and would like those photos removed, please get in touch via the contact details below.

2.1 For young people

The types of personal information we may collect about you and handle may include, but are not limited to:

• your name, contact details, date of birth and gender;
• your emergency contact details;
• information in forms that you submit and survey responses;
• information that you share in forums or blogs on our Website;
• photographs, if you attend one of our events or submit photographs to us;
• enquiry/complaint details, posts and other submissions to our Online Services (as described at section 7 below);
• information about your use of our services; and
• information about your other dealings with Canteen, including records of any telephone, email or online interactions.

In addition to the personal and sensitive information listed above, we may also collect additional personal and sensitive information that you provide directly to us during, or in connection with the provision of support services and related services.

We may collect personal information directly from you as well as from third parties including public sources, your carers, family, friends and other representatives, social media and other sources with whom we exchange information as described in this Privacy Policy.

If you are under the age of 15 years old, you will need to ask for your parent’s or guardian’s permission to share your personal information with us.

2.2 For parents, caregivers, friends and other Canteen members

The types of personal information we may collect about you and handle may include, but are not limited to:

• your name, contact details, date of birth and gender;
• photographs, if you attend one of our events or submit photographs to us;
• information in forms that you submit and survey responses;
• payment details; and
• enquiry/complaint details, posts and other submissions to our Online Services (as described at section 7 below).

2.3 For donors, corporate supporters and customers

The types of personal information we may collect about you and handle may include, but are not limited to:

• your name and contact details;
• your organisation, employment, positions held;
• photographs, if you attend one of our events or submit photographs to us;
• information in forms that you submit and survey responses; and
• payment details.

2.4 For volunteers, employees and contractors

The types of personal information we may collect about you and handle may include, but are not limited to:

• your name and contact details; and
• information about your qualifications, skills, experience, character, screening checks (including health, reference, background, directorship, financial probity, identity, eligibility to work, vocational suitability and criminal record checks) and employment history.

3. How do we collect your personal information?

We collect personal information through various avenues, including:

• information you provide to us directly, for example:
• when you communicate or interact with us by telephone, email, online (including through our website and our social media channels) or in person;
• when you complete a form or a survey;
• when you provide us with a case study;
• when you complete a patient form prior to receiving medical services from us;
• information you provide to us during attendance at our events;
• information from third parties, including:
• your organisation;
• our sponsors;
• our suppliers and other third parties who provide services to us; and
• hospitals and medical practitioners (if they have your consent to provide your information to us).

You must only provide us with the personal information of someone else if you have that person’s consent to do so.

4. Why do we collect your personal information?

We collect, hold, use and disclose personal information for a variety of reasons, including:

• to provide, administer, promote and develop and evaluate our programs, services and fundraising activities;
• to process payments and refunds;
• to verify your identity and personal information;
• to maintain and update our records;
• to manage our relationship with you;
• where your health or well-being is at risk;
• to conduct health and social research;
• to train and manage our people;
• to protect our lawful interests;
• to deal with enquiries and disputes;
• for people who work or volunteer with us, or apply to work or volunteer with us, to assess your application, conduct screening checks and consider and contact you about other positions;
• to provide marketing communications and targeted advertising to you on an ongoing basis by telephone, electronic messages (eg. email), online (including websites and mobile apps) and other means, unless you opt out or we are subject to legal restrictions; and
• to meet reporting obligations to government agencies or as required by law.

5.  What if we can’t collect your personal information?

If you do not provide us with the personal information we need, some or all of the following may occur:

• we may not be able to provide you with our services, including any psychological and emotional support you may request;
• we may not be able to consider your application to join us as an employee, contractor or volunteer; and
• we may not be able to respond to your requests for information

6. Who might we disclose your personal information to?

We may disclose your personal information to various third parties for any of the purposes identified above. Some of the third parties described below may be located in the United States and other countries.

The types of third parties with whom we may exchange your personal information include:

• a parent, guardian, representative or carer;
• our service providers that assist us with archival, auditing, accounting, legal, business consulting, banking, payment, delivery, data processing, data analysis, document management, research, website and technology services;
• various third party suppliers and partners that provide services and support for our programs and operations;
• for people who work or volunteer with us, or apply to work or volunteer with us, your current and previous employers, academic institutions, recruiters, professional and trade associations, referees and screening check providers (eg. for background, identity, eligibility to work, vocational suitability, health and criminal record checks);
• where your health and well-being is at risk, in which case we may notify relevant health services and other parties that can help us to protect you;
• health service providers involved in your ongoing care or to provide treatment, including your general practitioner, home service provider or mental health practitioner;
• government health bodies and departments; and
• to law enforcement agencies and other organisations where required or permitted by law

7. Visitors to our Website

We seek to engage with you through a range of online services, including websites, social media profiles, mobile apps, blogs, forums, advertising on partner websites and email communications (Online Services).

We sometimes collect clickstream data that logs which parts of those Online Services you have visited. We may also use cookies in some of our Online Services so that we have a way of remembering a user’s activity.  We uses clickstream data and cookies to help users have a better experience of the Online Services.

Where we engage third party partners for online advertising, the techniques our partners employ do not collect personal information such as your name, email address, postal address or telephone number. You can visit http://www.networkadvertising.org/ to opt out of our partners’ targeted advertising.

8. How do we protect your personal information?

We take all reasonable steps to keep personal information protected from loss, interference, misuse or unauthorised access, modification or disclosure. These steps may include access controls, encryption, and secure premises. We store personal information in both physical and electronic form, sometimes with the assistance of third parties such as data hosting providers. We also have systems in place to record and monitor the secure destruction or de‑identification (where necessary) of personal information it no longer requires or is no longer permitted by law to store.

9. How can you access and correct your personal information?

The accuracy of the personal information we hold and use is important to us. We take reasonable steps to ensure that the personal information we handle is accurate, complete and up-to-date. To help us keep your personal information accurate, please let us know if there are any errors or changes in your personal information.

You can request access to the personal information we hold about you at any time by contacting us via the contact details at the bottom of this policy. You may also request the correction of any of the personal information we hold about you. In most cases, we can help you promptly and informally with these requests. In other cases, we may need to verify your identity and ask you to make your request in writing.

In some cases, such as where it would be unlawful to do so, or where providing access would have an unreasonable impact upon the privacy of other individuals, we may restrict access to all or part of the information requested. From time to time, we may need to reject your request to access or correct the personal information we hold about you, if we believe it to be necessary and to the extent allowed by law. We will provide a written explanation if we deny your request for access to, or correction of, your personal information. If we disagree with a requested change, we will on request keep a record of the requested changes with the relevant personal information.

10. How can you make a privacy complaint?

You can contact us via the contact details at the bottom of this Privacy Policy if you have any concerns about how we have handled your personal information.  We will respond to let you know who will be handling your matter and when you can expect a further response.  We may request additional details from you regarding your concern, and we may need to engage or consult with other parties to investigate and deal with your issue. We will keep records of your request and any resolution. If you are not satisfied with the manner in which we have dealt with your complaint, you may contact the Office of the Australian Information Commissioner at www.oaic.gov.au or you can call them on 1300 363 992.

11. How to contact us

If you have any questions or comments about this privacy policy, please don’t hesitate to contact us.

Last updated: [28 November, 2019]