Privacy Policy

Introduction

The Young Men’s Christian Association of South Australia Incorporated, YMCA South Australia Youth and Family Services Incorporated, and their respective affiliates (collectively, YMCA South Australia) consider the privacy of individuals to be of paramount importance.

Defined terms used in this policy are set out in Section 16.

This policy outlines how YMCA South Australia approaches the collection, storage, disclosure and use of Personal Information.

This policy has been prepared in accordance with the requirements of the Privacy Act.

In this policy, "we", “our” and "us" refers to YMCA South Australia and "you" refers to any individual about whom we collect Personal Information.

Scope

From time to time, we may amend this policy. Please ensure you review our policy each time you visit our website or interact with us, to keep up to date with any changes.

This policy applies to all Workplace Participants who may access your Personal Information, including:

our board members and any person serving YMCA South Australia on a committee or in an advisory capacity; and

our employees, contractors, sub-contractors, consultants, labour hire employees, apprentices and volunteers.

Policy Statement

YMCA South Australia is committed to managing Personal Information in accordance with the Australian Privacy Principles (APPs) under the Privacy Act, and in accordance with other applicable privacy laws.

For more information on the Privacy Act and the APPs, please refer to the Office of the Australian Information Commissioner – www.oaic.gov.au

Type of Personal Information Collected

The type of Personal Information that we collect about you depends on how you interact with us and the kind of service that you enquire about or that we provide to you. For example:

Patrons

When you enquire about our services or when you become a Patron of YMCA South Australia, a record is produced that includes your Personal Information.

The type of Personal Information that we collect will vary depending on the circumstances of collection and the kind of service that you request from us, but will typically include:

• your name and contact details, including phone number and email, postal or street address;
• your age, gender and date of birth;
• the contact details of a third party, in case of an emergency;
• your bank account, credit card details and payment history (e.g. for invoicing and payments for services, products and membership or personal credit information when you make payments to us);
• your employment details and work or volunteer history;
• your health information, if you intend to use one of our venues or services where your health status may be a consideration;
• details regarding your participation in our membership programs;
• details / history of your preferences, interests and behaviour relating to transactions, products, services and interactions with our digital services;
• records of your donations and transactions;
• your image or voice (including CCTV), if you are photographed or recorded at one of our venues or at an event that we have organised;
• records of your communications and interactions with us, such as details of your previous dealings with us or any of the facilities managed by YMCA South Australia; and
• your child’s details, including their health information, if you use any of our child care services.

Prospective employees and volunteers

YMCA South Australia collects Personal Information when recruiting personnel, such as your name, contact details (for you and your emergency contact person), education, training, qualifications, medical information, membership of professional associations, and work history. Generally, we will collect this information directly from you.

We may also collect Personal Information from third parties in ways that you would expect (e.g. from recruitment agencies or referees you have nominated). If we offer you a position, we may collect additional details such as your tax file number, bank account details, superannuation information, identification documents, next of kin, working with children checks, police record checks and other information necessary to conduct background checks. Please note that if you become our employee, records relating to our employment relationship are exempt from the Privacy Act in certain circumstances.

Other individuals

YMCA South Australia may collect Personal Information about other individuals who are not Patrons or prospective employees or volunteers of YMCA South Australia. This includes members of the public who participate in events we are involved with; individual service providers and contractors to YMCA South Australia; and other individuals who interact with YMCA South Australia on a commercial basis.

The kinds of Personal Information we collect will depend on the capacity in which you are dealing with YMCA South Australia. Generally, it would include:

• your name and contact details, including phone number and email, postal or street address;
• your bank account, credit card details and payment history (e.g. for invoicing and payments of services, products and membership or personal credit information when you make payments to us);
• your health information, if you intend to use one of our venues or services where your health status may be a consideration;
• your religious, cultural or other preferences, if you intend to use one of our venues or services that is tailored to particular interest groups;
• details regarding your participation in our membership programs;
• your image or voice (including CCTV), if you are photographed or recorded at one of our venues or at an event that we have organised; and
• records of your communications and interactions with us, such as details of your previous dealings with us or any of the facilities managed by YMCA South Australia.

Children

YMCA South Australia will not intentionally collect, use or disclose Personal Information about anyone under the age of 16 years unless the consent of a parent or legal guardian has been obtained.

Visitors to our websites

Merely accessing the various websites of YMCA South Australia will not require any identification or other Personal Information to be submitted and therefore users retain their anonymity.

However, YMCA South Australia requests information, suggestions and feedback which contain Personal Information from visitors to its websites (for example, via online forms and newsletters).

This information and the ideas that are provided may be used to assist us in making improvements to our website or operations. Unless permitted by law, on no occasion will a person’s name or personal details be published without permission.

Where emails or e-cards are forwarded to an email address or contact person listed on our website, the sender’s contact information will not be added to a direct marketing list (unless the sender has requested this) and will only be used by YMCA South Australia to contact the sender and respond to, or deal with their feedback, complaint, claim or request and will be retained for so long as we require it.

YMCA South Australia’s websites use cookies. A “cookie” is a small file stored on your computer's browser, which assists in managing customised settings of the website and delivering content. We collect certain information such as your device type, browser type, IP address, pages you have accessed on our websites and on third-party websites. You are not identifiable from such information.

You can adjust the settings in your browser to control how your browser deals with cookies. However, in doing so, you may be unable to access certain pages or content on our website.

We also use Google Analytics to understand how visitors engage with our website and to give us a sense of where in the world those website visitors are located. For further information on the types of information collected and processed by Google Analytics, please refer to “How Google uses information from sites or apps that use our services” which is available at www.google.com/policies/privacy/partners/ or any other URL that Google may provide from time to time. If you do not want Google Analytics to be used in your browser, you can install the Google Analytics Opt-Out Browser Add-on.

YMCA South Australia's websites may contain links to third-party websites. YMCA South Australia is not responsible for the content or privacy practices of third-party websites that are linked to our website. We strongly recommend that you familiarise and satisfy yourself of those parties’ practices and policies in relation to your privacy, before disclosing your Personal Information to them.

Visitors to our pools

• While attending recreation facilities with pools, your movement in our pools will be tracked using AI-assisted system if installed. That system does not collect any of your Personal Information or images of your face. Rather, it detects objects that appear above and below the water and whether they are stationery or moving.

• Where installed, we use this system to assist our existing lifeguards to detect behaviours that may indicate a need for assistance. It is used to enhance safety in our pools and does not replace the role of our lifeguards. For more information how the system works, please refer to https://lynxight.com.

Sensitive Information

In limited circumstances, we may collect Personal Information that is Sensitive Information. The type of Sensitive Information that we may collect includes:

• racial or ethnic origin;
• religious beliefs or affiliations or philosophical beliefs;
• membership of a professional or trade association or union;
• sexual orientation or practices;
• health information (such as physical and mental health, disabilities, health preferences, use of health services, bodily donations or genetics);
• genetic information about an individual that is not otherwise health information; or
• biometric information and templates.

If YMCA South Australia is required to collect Sensitive Information about an individual, it will only be collected and transferred to other parties as outlined at the time of collection with the individual’s consent, unless an exemption applies.

Government related identifiers

YMCA South Australia may be required to collect an individual’s government related identifiers such as a tax file number, Medicare number, Department of Veterans’ Affairs number, or Centrelink customer reference number for the provision of services. Where collected, these identifiers will not be adopted by YMCA South Australia as our own identifier or disclosed to agencies, unless required or permitted by law.

Why and how Personal Information is Collected

YMCA South Australia collects Personal Information which is reasonably necessary to carry out our business, to assess and manage our Patrons’ needs and to provide services, including recreation and fitness, swimming and aquatics, outside school hours care, youth empowerment and community strengthening.

The purposes for which YMCA South Australia usually collects and uses Personal Information depends on the nature of your interaction with us, but may include:

• program and service provision;
• administration;
• training;
• recruitment and employment (e.g. payroll, taxation, superannuation);
• work health and safety;
• research, services development and quality assurance;
• donations;
• promotions or marketing;
• responding to enquiries and complaints.

Personal information may be collected from various sources, including:

• membership / program application forms;
• training application forms;
• customer enquiry and feedback forms (whether physical or digital);
• donation forms;
• transactions you make with us and our centres, whether digitally or in-person (e.g. making a booking, using a membership card, participating in a promotion or competition, registering for a survey or using a related digital service);
• any correspondence with us via phone, email, e-card, mail or facsimile;
• via social media pages or social media accounts that we control;
• via CCTV and recorded telephone discussions which we have advised you about at the commencement of the telephone discussion;
• responses to employment advertisements;
• employees, volunteers and contractors;
• voting member registers;
• registrations for events and programs;
• affiliated or related companies; and
• third-parties who assist us to operate our business and deliver our services.

All Personal Information is collected in a fair and lawful manner and as permitted by law. YMCA South Australia is committed to ensuring that, wherever practicable, all individuals are aware of why their Personal Information is being collected or would reasonably expect it to be collected.

You are not obliged to provide Personal Information. For more details on what happens when you deal with us anonymously or by using a pseudonym, please see Section 5.6 of this policy.

Anonymity and the use of pseudonyms

YMCA South Australia will provide individuals with the opportunity of remaining anonymous or using a pseudonym in their dealings with us where it is lawful and practicable to do so (for example, when making a general enquiry). Generally, it is not practicable for YMCA South Australia to deal with individuals anonymously or pseudonymously on an ongoing basis. If we do not collect Personal Information about you, you may be unable to utilise our services or participate in our events, programs, or the activities we manage or deliver. It may also constrain our ability to adequately investigate any incidents or complaints you make to us.

We take steps to destroy or de-identify Personal Information that we no longer require.

Use and Disclosure of Personal Information

Provision of Services

The purposes for which we may use and disclose your Personal Information will depend on the nature of your interaction with us, but may include:

• the purpose(s) we make known to you, when we request your Personal Information (or shortly thereafter);
• to process a booking or application that you have made;
• to deliver our services to you; and
• to conduct and administer memberships.

Administrative functions

YMCA South Australia will also use and disclose Personal Information for a range of administrative, management and operational purposes. These include:

• administering billing payments and debt recovery;
• planning, managing, monitoring and evaluating our services;
• quality improvement activities;
• customer satisfaction surveys;
• information technology services and support;
• maintenance, hosting or development of our website;
• statistical analysis and reporting;
• data analysis and data processing;
• printing, archiving and mailouts;
• market research;
• training staff, contractors and other workers;
• risk management and management of legal liabilities and claims (e.g. liaising with insurers and legal representatives);
• responding to enquiries and complaints regarding our services;
• obtaining advice from consultants and other professional advisers; and
• responding to subpoenas and other legal orders and obligations.

Marketing

YMCA South Australia may use or disclose your Personal Information to inform you about our services, upcoming promotions and events, or other opportunities that may interest you. When we contact you, it may be by mail, telephone, email or SMS.

If you do not want to receive direct marketing communications from us, you can opt-out at any time by contacting us using the contact details in Section 13.

If you opt-out of receiving marketing material from us, we may still contact you in relation to our ongoing relationship with you.

We may use Personal Information that you have provided to us, such as your name and email address, to conduct targeted marketing campaigns via online platforms, including Google, Facebook or Meta. For example, we may use:

• the Customer Match functionality provided by Google, which enables us to use information that you have shared with us, in order to create advertisements or marketing material which is targeted to you and other people like you. For further information on how Customer Match works, including how it uses your information, please refer to “About Customer Match” which is available at https://support.google.com/google-ads/answer/ or any other URL that Google may provide from time to time;

• the Custom Audiences functionality provided by Meta, to create an audience for advertising. For further information on how Custom Audiences works, please refer to “About Custom Audiences” which is available at
  https://en-gb.facebook.com/business/help or any other URL that Meta may provide from time to time; and

Mailchimp, to send you direct marketing materials and other promotional information. For more information on how Mailchimp works, please refer to “About Mailchimp” which is available at https://mailchimp.com/about/ or any other URL that Mailchimp may provide from time to time.

If you do not want to receive targeted marketing via these online platforms, you can adjust your Google, Facebook or Meta ad settings. For example, you can control Customer Match advertisements that you see on Google Services, in your Google ad settings. Similarly, you can control the Facebook advertisements that you see, by going to the Facebook settings and adjusting your ad preferences. If you do not want to receive Mailchimp emails, please use the unsubscribe facility in those emails.

Other entities

Personal Information may also be shared between related and affiliated entities of YMCA South Australia.

Third parties to whom we have disclosed your Personal Information may contact you directly to let you know they have collected your Personal Information and to give you information about their privacy policies and practices.

Other purposes

We may use and disclose your Personal Information for other purposes which are set out in this policy or explained before, at the time of, or as soon as practicable after collection.

Storage and security of Personal Information

YMCA South Australia takes reasonable steps and uses appropriate security mechanisms to ensure that the Personal Information we hold is protected from misuse, loss and interference and from unauthorised access, modification or disclosure.

We hold Personal Information electronically and in hard copy form, both at our premises and with the assistance of our service providers. Personal information may be collected in paper-based documents and converted to electronic form for use or storage (with the original paper-based documents either archived or securely destroyed).

Personal information collected will be stored in a secure environment at all times. We maintain physical security over paper and electronic data stores, such as through locks and security systems at our premises. We also maintain computer and network security, e.g. we use firewalls (security measures for the Internet) and other security systems such as user identifiers and passwords to control access to our computer systems.

Our websites do not necessarily use encryption or other technologies and we cannot guarantee the secure transmission of Personal Information via the internet. Users of our websites are encouraged to exercise care in sending Personal Information via the internet.

Where information is stored off site, YMCA South Australia will ensure confidentiality agreements with the archival suppliers are in place and maintained. All such suppliers are to be screened to ensure that they maintain security and confidentiality requirements.

Any person who on behalf of YMCA South Australia, uses or discloses Personal Information held by YMCA South Australia must have appropriate authorisation to do so.

Patron health information is to be retained for a minimum of seven (7) years following the last occasion on which a service is provided. Where information was first collected while the individual was a child, it is to be retained until he/she is twenty-five (25) years of age or for seven (7) years, whichever is the greater.

We will keep Personal Information as long as we need it for the purposes in clause 6 of this policy, after which time we will destroy or de-identify the Personal Information.

Otherwise we may keep Personal Information for any period required by law.

Employment documents and records, including payroll records, are to be retained for periods of time as prescribed by the relevant legislation both during and post-employment. Employees may request access to their personal file. However, files are not to be removed from the office location in which they are stored and access is to be supervised. At the discretion of the Head of People & Culture, documents may be copied or printed and provided to the employee – original copies are not to be removed from files other than for copying purposes.

All credit card and personal financial data collected by YMCA South Australia is handled in accordance with the Payment Card Industry Data Security Standard (PCI DSS).

Openness

YMCA South Australia is open and transparent about the type of Personal Information collected and the ways in which it is used and stored. This policy is available to the community, members and third parties upon request and on our website.

Disclosure overseas

We are a South Australian organisation and accordingly, our disclosure of your Personal Information to overseas recipients is limited. Some of our services require the use of online platforms or cloud-based servers, where it is likely that your Personal Information will be disclosed to overseas recipients. For example, where you utilise our digital staff and volunteer card or gymnasium services, those overseas recipients include but are not limited to recipients located in the United States, Poland or other European countries respectively.

Unless we have your consent, or an exception under the APPs applies, we will only disclose your Personal Information to overseas recipients where we have taken reasonable steps to ensure that the overseas recipient acts consistently with the APPs in relation to your Personal Information.

Access and correction

Where Personal Information is obtained and retained, you are generally entitled to access that record. To request access to your Personal Information, please contact us using the contact details provided in Section 13.

We will review your request and may require you to provide further information, to verify your identity. A reasonable administrative fee that covers our time spent in locating, collating and retrieving the Personal Information (together with the costs of postage) may be charged to cover our costs in providing you with access. We will notify you of the administrative fee before it is incurred, so that you have the option of withdrawing your request for access.

We will respond to your request within a reasonable period by either providing you with access, or if we refuse your access request, by providing you with reasons. Generally, requests may be denied where:

(a) we believe your request is frivolous or vexatious;

(b) we are entitled or required to reject a request under the Privacy Act or any other law;

(c) we are unable to verify your identity to our reasonable satisfaction; or

(d) you have not paid the administrative fee (if any).

If you believe that any Personal Information we hold about you is inaccurate, incomplete or out-of-date, please contact us on the contact details provided in Section 13.

We will review your request and respond to it within a reasonable period. If we do not consider that the Personal Information is inaccurate, incomplete or out-of-date, we will let you know and provide our accompanying reasons. You may ask us to include a statement (to accompany your Personal Information), recording your view that the Personal Information is inaccurate, incomplete, misleading or out-of-date.

Any health information collected by YMCA South Australia will not be deleted during the period of time it is required to be held. Amendments or alterations to health information are to be recorded on a separate form and attached to the original file.

Transfer or closure of Health Services

In the event of local YMCA South Australia managed health services (i.e. medical suite, massage service, physiotherapy service, sports medicine service, health and fitness club) being transferred, sold, leased, or ceasing operation, YMCA South Australia is required to enact notification and transfer procedures as directed by the appropriate State / Territory legislation.

Contact and complaints

You may contact us at any time if you have any questions or concerns about this policy or about the way in which your Personal Information has been handled.

You may make complaints about the manner in which your Personal Information is being handled by submitting a form via the website or contacting the Chief Executive Officer or any other person nominated by the Chief Executive Officer, on the details shown below.

We will first consider your complaint to determine whether there are simple or immediate steps that can be taken to resolve the complaint. We will respond to your complaint in accordance with YMCA South Australia’s Complaints and Grievance Policy.

If your complaint requires consideration that is more detailed or an investigation, we will acknowledge receipt of your complaint within a week and endeavour to complete our investigation into your complaint promptly. We may ask you to provide further information about your complaint and the outcome you are seeking. We will then typically gather relevant facts, locate and review relevant documents, and speak with individuals involved.

In most cases, we will investigate and respond to a complaint within 30 days of receipt of the complaint. If the matter is more complex or our investigation may take longer, we will let you know.

If you are not satisfied with our response to your complaint, or consider that we may have breached the APPs, you may refer your complaint to the Office of the Australian Information Commissioner by using the contact details on the OAIC website (www.oaic.gov.au).

Contact details

The contact details for YMCA South Australia are:

Address: Level 10, 44 Waymouth Street, Adelaide SA 5000

Phone: (08) 8200 2500

Email: contact@ymcasa.org.au

Marked to the attention of: Chief Executive Officer

Roles and Responsibilities

Breach of the Policy

Any breaches of this policy by a Workplace Participant may result in YMCA taking disciplinary action against that person, which may include termination of their employment or, in the case of an entity, its services.

In circumstances where a Workplace Participant breaches this policy and it involves a breach of any Australian law, we may also notify the police and/or any other relevant government authority.

Definitions

Australian Privacy Principles or APPs are contained in Schedule 1 of the Privacy Act.

Patron means a person who is a customer, client or paying guest.

Personal Information is defined in the Privacy Act and means information or an opinion, whether true or not, and whether recorded in a material form or not, about an identified individual, or an individual who is reasonably identifiable.

Privacy Act means the Privacy Act 1988 (Cth) as amended from time to time.

Section means a section of this policy.

Sensitive Information is defined in the Privacy Act as information or an opinion about an individual’s:

• racial or ethnic origin;

• political opinions or membership of a political association;

• religious beliefs or affiliations or philosophical beliefs;

• membership of a professional or trade association or a trade union;

• sexual orientation or practices;

• health information;

• criminal record;

• genetic information about an individual that is not otherwise health information;

• biometric information that is to be used for the purpose of automated biometric verification or biometric identification; or

• biometric templates.

Workplace Participants means:

• our board members and any person serving YMCA South Australia on a committee or in an advisory capacity;

• our employees, contractors and sub-contractors, consultants, labour hire employees, apprentices, and volunteers.

Key Relevant Documents

Privacy rights in South Australia are established in accordance with privacy related legislation which includes but is not limited to:

• Legislation
  • Privacy Act 1988 (Cth);
  • Telecommunications Act 1997 (Cth);
  • Telecommunications (Interception and Access) Act 1979 (Cth);
  • Criminal Law Consolidation Act 1935 (SA);
  • Surveillance Devices Act 2016 (SA);
  • Freedom of Information Act 1991 (SA);
  • Summary Offences Act 1953 (SA);
  • Electronic Communications Act 2000 (SA);
  • Equal Employment Opportunity (Commonwealth Authorities) Act 1987 (Cth);