Privacy policy

YMCA Whittlesea is committed to the responsible collection, handling, storage, protection and destruction of personal information, as specified in the Privacy Act 1988. We respect the privacy of our participants, parents, staff, volunteers and other visitors to our facilities.

This document clearly outlines what is required to fulfil our commitment to privacy and confidentiality. YMCA Whittlesea adheres to the Australian Privacy Principles under the Commonwealth Privacy Act 1988; and as amended, the Commonwealth Amendment (Private Sector) Act 2000; the Privacy Amendment (Enhancing Privacy Protection) Act 2012; the Freedom of Information Act 1982; and the Privacy Amendment (Notifiable Data Breaches) Act 2017.

All data collected will be collected and stored in accordance with the YMCA Whittlesea Data Collection, Storage & Destruction Protocol. YMCA Whittlesea reserves the right to make changes or amendments to the YMCA Whittlesea Privacy Policy as required by law.

This policy applies to all operations and services of YMCA Whittlesea including staff, volunteers, contractors and visitors. This policy may be accessed by any person who has dealings with YMCA Whittlesea, including members, participants, staff, volunteers, contractors and the wider community. This policy is accessible publicly via our YMCA Whittlesea website or for staff  internally through Y-MAC.

YMCA Whittlesea collects and uses personal information to provide the appropriate services, functions and activities suitable to a person’s needs, and the purpose for the YMCA obtaining this information will be made clear at the time of collection. Collection of personal information will be lawful, fair, reasonable and unobtrusive, and can be collected through electronic, verbal and written correspondence, in accordance with relevant legislation.

Personal information held by YMCA Whittlesea may include:

• Name, current address and previous addresses
• Telephone / mobile phone number and email address
• Date of birth
• Bank account and credit card details (if fees are required)
• Bank account, tax and superannuation information (for staff payments)
• Occupation, Annual salary, Driver’s License number
• Details of any YMCA services used
• Medical Information
• Parent / Carer reference
• Participant Centrelink reference
• Support documentation, for example information regarding meals, medication or communication.
• Custody Orders information
• Other documents as required

YMCA Whittlesea may be required to collect an individual’s identifiers such as a Tax File Number, Medicare Number or Social Security Number for the provision of services. Where collected, these identifiers will only be disclosed to agencies as required by law.

Collection of sensitive information such as religious affiliation, gender, disability, languages spoken other than English and criminal records will only occur when the individual has consented or where the law requires such collection.

If a person chooses not to provide the YMCA with their personal information, YMCA Whittlesea may not be able to meet the particular service request.

Personal information will be collected for the purposes of:

• Establishing a person’s eligibility for services, and prioritizing the person for that service.
• Administering and managing those services, including billing and collecting fees.
• Employment (recruitment, payroll, taxation, superannuation,criminal record) and Staff Training
• Work health & safety
• Researching, developing and improving YMCA services
• Providing data to funding bodies
• Donations
• Assessing a person’s needs and developing a care plan
• Service planning and evaluation (in which any identifying information will be removed from the data)
• Marketing and promotion of services which the YMCA considers may be of interest to the person. If the person does not wish to be contacted regarding other services, they can opt out of this option.

In accordance with the Victorian and Federal Government requirements for the return to active sport and recreation, DHHS requirements, DET requirements in Children’s services personal data collection is required for the purposes of contact tracing for the COVID -19 infection.

“ If the activity is run by an operator of an indoor physical recreation facility (such as a gym, health club or fitness centre), a personal training facility (indoors or outdoors) or an arena or stadium, then the operator must keep a record of attendees including first name, phone number, date and time of attendance” Return to Play Guidance for Community Sport and  Recreation Organisationshttps://sport.vic.gov.au/our-work/return-to-play/return-to-play-forcommunity-sport-and-active-recreation.

These provisions also apply to YMCA Whittlesea operations inclusive of recreation and camping program and children’s services.

The data collected will be first name, phone number, date and time of attendance. Data will be collected electronically or manually and stored on security software systems and will be provided on written request to the Department of Health and Human Services (Victoria) or Department of Health (Federal).

The YMCA collects personal information in a number of ways, including:

• Directly from the person, when they provide information, such as an enrolment form.
• From third parties such as council, health services, agencies or authorized representatives, or legal advisers
• From publicly available sources of information
• When legally required to do so

The YMCA collects personal information from various sources, including but not limited to:

• Membership application, amendment forms and/or enrolment forms
• Training application forms
• Tour, enquiry and waitlist forms
• Website/online inquiry and feedback sections
• Feedback forms and surveys
• Website donation forms
• Email, mail and facsimile
• Responses to employment advertisements
• Employees, volunteers and contractors
• Voting Member registers
• Engagement via social media

As far as practical, the YMCA will collect information about the person directly from them and will inform the person of the purpose for which the information is being collected and how they can gain access to this information. Information will be obtained in a private setting, and wherever possible, in the person’s preferred language if requested and as such an external interpreter service provider may be engaged.

We will collect this information only if we have consent from the person or their parent / carer, or consent from an authorized person. YMCA Whittlesea does not collect, use or disclose personal information about anyone under the age of 18 (or those who are unable to make an informed choice, for example a person with an intellectual disability) unless we have the consent of a parent or legal guardian.

Participants of Children’s Services and Disability Services will be reminded of their privacy rights on a regular basis (including annually at each reassessment if applicable). If YMCA Whittlesea receives personal information that it does not need or was received by inappropriate means, YMCA Whittlesea commits to destroy the information.

You are free to browse any of YMCA Whittlesea’s websites without entering any personal information and, therefore, you can remain anonymous. YMCA Whittlesea collects personal information, suggestions and feedback provided by visitors through the following sections on the website:

• Contact Us’
• Provide Feedback’
• eNewsletter distribution
• Donation Form

This information, and the ideas provided, may be used to assist in making improvements to the website or to YMCA operations. On no occasion, however, will a person’s name or personal details be published without permission. A cookie is a small amount of data, which often includes an anonymous unique identifier, which is sent to your browser from a website’s computers and stored on your computer’s hard drive. Cookies are required to use our service. We use cookies to record current session information, but do not use permanent cookies.
Where emails or e-cards are forwarded to an email address or contact person listed on this website, the sender’s address will not be added to a mailing list and will be only used by YMCA Whittlesea to contact the sender. Once the office has responded to any suggestion or query, the sender’s contact information will be deleted in a secure manner.

YMCA Whittlesea’s website contains links to other sites operated by other parties. Links are provided to other Internet sites as a convenience to users, and access to internet sites linked to our website is at the user’s own risk. YMCA Whittlesea is not responsible for the content or the privacy practices of linked websites and therefore strongly encourages users to examine each linked site’s privacy policy.

YMCA Whittlesea uses social media and networking platforms such as Twitter, Facebook, Instagram and YouTube to communicate with the public about our work. When you communicate with us, these services may collect your personal information, but we only use it to help us communicate with you and the public. Social networking services will also handle your personal information for its own purposes and have their own privacy policies, which are accessible through their relevant websites.

By acquiring or using YMCA Whittlesea services, products or facilities, individuals consent to the reasonable collection, use and disclosure of personal information. Consent may be directly implied in the completion of an application, membership or registration form. Alternatively, consent may be indirectly implied (for example, personal information is given in order to send information regarding programs and services).

Before seeking a person’s consent to collect information, YMCA Whittlesea will inform the person about:

• What kinds of information we wish to collect and our purpose for collecting such information
• Their rights to privacy and confidentiality
• Their right to refuse to give personal information and the consequences of such a refusal
• Their right to access their personal information
• Their right to complain if they think their information has been collected,
  used or stored inappropriately

YMCA Whittlesea may disclose personal and health information to organisations/individuals outside the YMCA in order to provide the range and quality of services and programs. The consent of the individual will be sort prior to any disclosure of personal or health information.

For the purpose set out above, the YMCA may disclose personal information to an organization outside the YMCA. Personal information may be disclosed to:

• Professional advisers, including YMCA auditors and lawyers
• Where appropriate under another Act, including the Freedom of Information Act 1982
• There is a serious and imminent threat to a person’s life, health or safety
• Emergency Services Personnel in the event of an emergency. This is specific to Children’s Services and Disability Services participants, and permission is sought from the participant prior to service arrangements being finalised
• In public registers that need to be maintained in accordance with the Acts
• Organizations assisting the YMCA to perform statistical analysis for improving the services being delivered to the Community
• Government, Regulatory and other organizations, as required or authorized
  by law
• For reporting purposes to contract managers and funding sources
• YMCA Whittlesea will not use personal information for any purpose that is not reasonably needed for the proper or effective operation of that service. Given the environment of care we provide throughout our programs and services, personal information may be accessed by and exchanged with our staff working within these programs and services or by authorised administrative staff.

Disclosure of personal and health information will be in accordance with the Australian Privacy Principles.

YMCA Whittlesea takes all reasonable steps to correct any information as required, and ensure that the personal information collected, used and disclosed is accurate, complete, up to date and relevant whenever it is collected, used or disclosed. However, the accuracy of that information depends to a large extent on the information the person provides. It is recommended that the person:

• Informs the YMCA if there are any errors in their personal information
• Keep the YMCA up to date with changes to personal information such as
  contact details or medical information

Children’s Services and Disability Services participants are required to update their enrolment details annually, or whenever they experience a change in circumstances. In some cases, updates may be required on a program-by-program basis.

Information collected on individuals, staff, volunteers, clients and associated companies is stored securely. Where information is stored off site, YMCA Whittlesea has confidentiality agreements with the archival suppliers in place. All such suppliers are screened to ensure that they maintain security and confidentiality requirements.

YMCA Whittlesea takes all practicable steps to protect personal information from
misuse, interference, loss, unauthorized access, modification, disclosure or
destruction.

Only authorized YMCA Whittlesea staff, volunteers or sub-contractors have access to information for approved purposes. All staff and volunteers are required to sign off on a confidentiality agreement upon commencement of their employment or placement acknowledging their understanding of this Privacy Policy along with the relevant associated procedures which also includes the Data Collection, Storage & Destruction Protocol.

Where it is lawful and reasonable to do so, the YMCA provides an opportunity to
remain anonymous.

Measures to ensure the privacy and security of documents and records are specified in the Data Collection, Storage & Destruction Protocol. Secure disposal methods and specific retention periods are detailed in the Data Collection, Storage & Destruction Protocol and the included Archiving Instructions.

In the unlikely event of a security breach, or an eligible data breach, it will be dealt with according to current procedures maintained in the YMCA Whittlesea Business Continuity Plan and the Data Breach Response Plan.

YMCA Whittlesea will implement the Data Breach Response Plan and notify individuals and the Office of the Australian Information Commissioner (OAIC) if personal information is lost (hard copies or electronic), accessed or intentionally/unintentionally disclosed without authorization, and this is likely to cause one or more persons serious harm being: physical, psychological, emotional, financial or of a reputational nature.

The participant has the right to access their personal information. Participants can access their information by contacting YMCA Whittlesea. An authorized representative of the person can also access information. It is recommended that the request from the authorized representative be in writing for security reasons.In some circumstances a request for access to information may be denied.

These circumstances include when:

• Granting access would pose a serious threat to the life or health of the individual
• The information was given in confidence by another person, unless that other person consents.
• It would have an unreasonable impact on the privacy of others
• It is unlawful or is required or authorized by law to withhold. Also where legal professional privilege applies and granting access would prejudice law enforcement.

Access will only be denied to those parts of the individual’s records that concern the above circumstances. If access is denied, YMCA Whittlesea will give written notice that sets out the reasons for the refusal and how someone may make a complaint about the refusal.

For personal information to be released to the person, or transferred to another service, a Personal Information Request Form must be completed and submitted to the relevant Area Director. All requests are to be processed within 30 days of receipt of application, at no charge. Adequate proof of identification is required.

In the event that a service (for example, Leisure City) is being transferred, sold, leased or ceasing operation, YMCA Whittlesea will enact appropriate notification and transfer procedures as directed by the Health Records Act.

This policy will be made available at any time, upon request, or is available on
YMCA Whittlesea’s website.

Individuals accessing YMCA Whittlesea programs and services must be advised of the privacy policy, as well as:

• The name and contact details of the service
• The fact that they are able to gain access to their information
• Why the information is collected
• The organisations to which the information may be disclosed
• Any law that requires the particular information to be collected
• The main consequences for not providing the required information
• The need to update of changed in their personal information to ensure the accuracy of  personal information

If you have any concerns or queries about this privacy statement, or if you have reason to believe there is a breach of privacy regarding information YMCA Whittlesea collects and holds about you, please contact YMCA Whittlesea and direct these to the office of the YMCA Whittlesea CEO who will handle your complaint in accordance with the Concerns and Complaints Policy and Procedures:

Email: contact@ywhittlesea.org.au
Phone: (03) 9407 6200
Address: PO Box 375, South Morang 3752

We may be able to assist with an inquiry over the telephone but, if not, you will be asked to put your question or complaint in writing, and send to the above address. All written correspondence will be responded to within five (5) business days of being received. If you are not satisfied with our response to your complaint, or at any time, you may refer your complaint to the Office of the Australian Information Commissioner (www.oaic.gov.au).

Staff or Volunteer – any person employed by YMCA Whittlesea by either paid employment or contract are responsible for the daily implementation of this Policy during all operations of YMCA Whittlesea.

Board Member – any person engaged by YMCA Australia in a volunteer director capacity. Responsible for the overall authority and compliance to this policy and its procedures.

Directors/Managers – Responsible for ensuring suitable resources and support systems are available to ensure compliance with this policy. Provide leadership and advice on the continuous improvement of this policy.

Contractors – any person engaged to carry out routine maintenance at the site/service

Visitors – any person who engages with YMCA Whittlesea programs and services