Privacy Policy

1. Introduction

YMCA South Australia considers the privacy of individuals, staff, volunteers, clients, Member Associations and associated companies to be of highest importance, and is committed to handling all personal information with honesty and transparency.

YMCA South Australia is committed to ensuring openness and transparency of governance to stakeholders while protecting the privacy of individuals. This policy outlines how the YMCA South Australia will approach the collection, storage, disclosure and use of personal information.

This policy has been prepared in accordance with current legislation.

2. Scope

YMCA South Australia reserves the right to make changes or amendments to the Privacy Policy as required by law, technologies and relevant changes in YMCA South Australia’s operational practices.

This policy applies to all people with access to YMCA South Australia Inc., its entities and YMCA South Australia Youth and Family Services Inc. For the purpose of this document we refer to these entities as YMCA South Australia. All policies and procedures that apply to YMCA activities at an Association / Entity level must conform to this Policy.

This policy applies to the whole of YMCA South Australia (staff, Board Directors, volunteers and independent contractors and consultants) with access to information systems and storage (computer based or otherwise).

3. Policy Statement

YMCA South Australia adheres to the Australian Privacy Principles under the Commonwealth Privacy Act 1988; and as amended, the Commonwealth Amendment (Private Sector) Act 2000; and the Privacy Amendment (Enhancing Privacy Protection) Act 2012.

For more information on the Act and the Australian Privacy Principles, please refer to the Office of the Australian Information Commissioner - www.oaic.gov.au.

4. Collection of Personal Information

If YMCA South Australia requires the collection of any personal information, the purpose for which the information is to be collected and the consequences of providing it will be made clear at the time of the collection.

Personal information may be collected for the following purposes:

• Programs and Service Provision
• Administration
• Training
• Employment (payroll, taxation, superannuation)
• Work Health & Safety
• Research, Development and Quality Assurance
• Donations

YMCA South Australia also collects sensitive health information such as:

• Blood Pressure
• Body-Mass Index
• Personal Medical Plans
• Public Incident Injury and Claims Records
• Medical Conditions and/or Disability

Personal information may be collected from various sources including:

• Client membership application forms
• Training application forms
• Website inquiry and website feedback sections
• Website donation form
• Email, e-card, mail and facsimile
• Responses to employment advertisements
• Employees and contractors
• Voting member registers
• Registration for events and programs

All information is collected in a fair and lawful manner and as required / permitted by law. YMCA South Australia is committed to ensuring that all individuals are aware of the purpose of collection of the information.

4.1 Collection of Personal / Health information relating to children

YMCA South Australia will not collect, use or disclose personal information about anyone under the age of sixteen (16) years of age unless the consent of a parent or legal guardian has been obtained.

4.2 Website

Accessing the YMCA South Australia website at www.sa.ymca.org.au will not require any identification or any other personal information to enable access, and therefore users retain anonymity.

YMCA South Australia does however collect personal information, suggestions and feedback provided by visitors through the following sections on the website:

• ‘Contact us’
• ‘Provide Feedback’
• eNewsletter Distribution
• Donation Form

This information, and the ideas provided, may be used to assist in making improvements to the website or to YMCA South Australia operations. On no occasion will a person’s name or personal details be published without permission.

Where emails or e-cards are forwarded to an email address or contact person listed on this website, the sender’s address will not be added to a mailing list and will be only used by YMCA South Australia to contact the sender. Once the office has responded to any feedback or complaint, the sender’s contact information will be deleted in a secure manner.

YMCA South Australia will provide advice on its website regarding the accessing of other links provided on the site, and include a disclaimer regarding perceived ownership of said sites.

4.3 Maintenance and Storage of Personal Information

YMCA South Australia will take reasonable steps and use appropriate security mechanisms to ensure that the personal information held is protected from misuse and loss, and from unauthorised access, modification or disclosure.

YMCA South Australia will maintain its record keeping system to ensure that all personal information collected is up to date and complete as is reasonably practical.

Any person who on behalf of YMCA South Australia, uses or discloses personal information held by YMCA South Australia must have appropriate authorisation to do so.

5. Use & Disclosure

YMCA South Australia will not use personal information for any purpose other than for which it is intended without first seeking the individual’s consent or unless authorised or requested by law. The organisation will take reasonable steps to protect personal information from loss, misuse, unauthorised access, disclosure or inappropriate or accidental destruction.

Disclosure of personal and health information will be in accordance with the Australian Privacy Principles.

6. Data Quality

Where YMCA South Australia requires personal information to be collected, every effort will be made to ensure the information is accurate, complete and up to date.

7. Data Security

Information collected on individuals, including staff, volunteers, clients, member associations and associated companies will be stored in a secure environment at all times. Where information is stored off site, YMCA South Australia will ensure confidentiality agreements with the archival suppliers are in place and maintained. All such suppliers are to be screened to ensure that they maintain security and confidentiality requirements.

Consumer health information is to be retained for a minimum of seven (7) years following the last occasion on which a service is provided. Where information was first collected while the individual was a child, it is to be retained until he/she is twenty five (25) years of age or for seven (7) years, whichever is the greater.

Accredited training qualifications and related records are retained for twenty seven (27) years.

Employment documents and records, including payroll records, are to be retained for periods of time as prescribed by the relevant legislation both during and post-employment. Employees may request access to their personal file. However, files are not to be removed from the office location in which they are stored and access is to be supervised. At the discretion of the Manager - People and Culture, documents may be copied or printed and provided to the employee – original copies are not to be removed from files other than for copying purposes.

All credit card and personal financial data collected by YMCA South Australia is handled in accordance with the Payment Card Industry Data Security Standard (PCI DSS).

8. Openness

YMCA South Australia will be open about the type of personal information collected and stored and the ways in which it is used. The YMCA South Australia Privacy Policy is available to the community, members and clients upon request and YMCA South Australia website.

9. Access and Correction

Where personal information is obtained and retained, the individual it relates to is entitled to access that record. YMCA South Australia may be required to deny access only in circumstances where it would be unlawful or not within the jurisdiction of relevant legislation.

YMCA South Australia must take reasonable steps to confirm the identity of any individual seeking access to their own information. Unless required by law no person or persons may have access to any personal information pertaining to any other person.

YMCA South Australia will respond to processing, access, and correction requests promptly upon request.

Any health information collected by YMCA South Australia will not be deleted during the period of time it is required to be held (refer above). Amendments or alterations to health information are to be recorded on a separate form and attached to the original file.

10. Identifiers

YMCA South Australia may be required to collect an individual’s identifiers such as a Tax File Number, Medicare Number or Social Security Number for the provision of services. Where collected, these identifiers will only be disclosed to agencies as required by law.

11. Transfer/Closure of Health Services

In the event of local YMCA Association managed health services (i.e. medical suite, massage service, physiotherapy service, sports medicine service, health and fitness club) being transferred, sold, leased, or ceasing operation, the Association is required to enact notification and transfer procedures as directed by the appropriate State/Territory legislation.

12. Sensitive Information

If or when YMCA South Australia is required to collect sensitive information about an individual, it will only be collected and transferred to other parties as outlined at the time of collection with the individual’s consent.

Collection of sensitive information such as religious affiliation, gender, disability, NDIS status, languages spoken other than English and criminal records will only occur when the individual has consented or where the law requires such collection.

13. Contact and Complaints

Formal complaints regarding the manner in which personal information is collected, used or disclosed are to be handled in accordance with the YMCA Customer Feedback Management Procedure.

If any person has concerns, complaints or thinks there has been a breach of privacy regarding information collected about you, please either submit via the website or contact the Chief Executive Officer or the person nominated by the Chief Executive Officer.

If you are not satisfied with the response to your complaint, or at any time, you may refer your complaint to the Office of the Australia Information Commissioner (www.oaic.gov.au).

14. Roles and Responsibilities

15. Supporting Documents

Privacy rights in South Australia are established in accordance with the privacy related legislation:

• The Commonwealth Privacy Act 1988
• Criminal Law Consolidation Act 1935
• Listening and Surveillance Devices Act 1972
• Summary Offences Act 1953
• Electronic Transactions Act 2000 (South Australia)
• Disability Services Act 1993 (South Australia)
• Equal Employment Opportunity Act 1987 (Commonwealth)
• Payment Card Industry (PCI) Security Standards Council
• YMCA South Australia - Complaints and Grievance Policy
• YMCA South Australia - Code of Conduct Policy
• YMCA South Australia – Membership Terms and Conditions
• YMCA South Australia – Fact Sheet in relation to YMCA Website and Privacy

www.archives.sa.gov.au/content/privacy-law-sa

16. Monitoring and Evaluation

The YMCA South Australia will monitor and evaluate the Privacy Policy every two (2) years to ensure the systems and process remains relevant and consistent with ‘best practise’ business management principles.

17. Version History

The National Council of the Young Men's Christian Associations of Australia (a company limited by guarantee, ABN 45 004 076 297) and Australian YMCA Services Pty Ltd