1. Introduction

YMCA South Australia Inc., YMCA South Australia Youth and Family Services Inc., and its affiliates (collectively, YMCA South Australia) considers the privacy of individuals to be of paramount importance.

This policy outlines how YMCA South Australia will approach the collection, storage, disclosure, and use of personal information.

This policy has been prepared in accordance with current legislation.

In this policy, "we" and "us" refers to YMCA South Australia and "you" refers to any individual about whom we collect personal information.

2. Scope

YMCA South Australia reserves the right to amend this policy from time to time, with or without notice.

This policy applies to all individuals with access to our services and all workplace participants, including:

Our board members and any person serving YMCA South Australia on a committee or in an advisory capacity
Our employees, contractors and sub-contractors, consultants, labour hire employees, apprentices and volunteers

3. Policy Statement

YMCA South Australia is committed to managing personal information in accordance with the Australian

Privacy Principles (‘APP’) under the Privacy Act 1988 (Cth) (‘Privacy Act’) as amended, and in accordance with other applicable privacy laws.

For more information on the Privacy Act and the APP, please refer to the Office of the Australian

Information Commissioner – www.oaic.gov.au

4. Type of Personal Information Collected

4.1 Patrons

When you enquire about our services or when you become a patron of YMCA South Australia, a record is produced that includes your personal information.

The type of personal information that we collect will vary depending on the circumstances of collection and the kind of service that you request from us, but will typically include:

your name and contact details, including phone number and address
your age, sex, and date of birth
your emergency contact details
your bank account, credit card details, and payment history (e.g. for invoicing and payments of services, products and membership or personal credit information when you make payments to us)
your employment details
your health information, if you intend to use one of our venues or services where your health status may be a consideration
details regarding your participation in our membership programs
details / history of your preferences, interests, and behaviour relating to transactions, products, services, and activities with our digital services
your computer IP address when visiting our website
records of donations and transactions
your image, if you are photographed or recorded at one of our venues (including CCTV); and records of your communications and interactions with us, such as details of your previous dealings with us or any of the facilities managed by YMCA South Australia

4.2 Employees and applicants

YMCA South Australia collects personal information when recruiting personnel, such as your name, contact details, education, qualifications, medical information, membership of professional associations, and work history. Generally, we will collect this information directly from you. We may also collect personal information from third parties in ways that you would expect (e.g. from recruitment agencies or referees you have nominated). If we offer you a position, we may collect additional details such as your tax file number, bank details, superannuation information, identification documents, next of kin, and other information necessary to conduct background checks.

4.3 Other individuals

YMCA South Australia may collect personal information about other individuals who are not patrons or employees of YMCA South Australia. This includes members of the public who participate in events we are involved with; individual service providers and contractors to YMCA South Australia; and other individuals who interact with YMCA South Australia on a commercial basis. The kinds of personal information we collect will depend on the capacity in which you are dealing with YMCA South Australia. Generally, it would include:

your name and contact details, including phone number and address
your bank account, credit card details, and payment history (e.g. for invoicing and payments of services, products and membership or personal credit information when you make payments to us)
your health information, if you intend to use one of our venues or services where your health
status may be a consideration
details regarding your participation in our membership programs
your computer IP address when visiting our website
your image, if you are photographed or recorded at one of our venues (including CCTV); and
records of your communications and interactions with us, such as details of your previous dealings with us or any of the facilities managed by YMCA South Australia

4.4 Visitors to our websites

The way in which we handle the personal information of visitors to our websites is discussed below.

5. How Personal Information is Collected

YMCA South Australia collects personal information reasonably necessary to carry out our business, to assess and manage our patrons’ needs and to provide services, including recreation and fitness, swimming and aquatics, outside school hour care, youth empowerment and community strengthening. The purpose for which YMCA South Australia usually collects and uses personal information depends on the nature of your interaction with us, but may include:

Program and service provision
Administration
Training
Recruitment and employment (e.g. payroll, taxation, superannuation)
Work health & safety
Research, service development and quality assurance
Donations
Responding to enquiries and complaints
Personal information may be collected from various sources, including:
Training application forms
Customer enquiry and feedback forms (whether physical or digital)
Donation forms
Transactions you make with us and our centres (e.g. making a booking, using a membership card, participating in a promotion or competition, registering for a survey; or using a related digital service)
Any correspondence via phone, email, e-card, mail or facsimile
Social media pages that we control
Responses to employment advertisement
Employees, volunteers and contractors
Voting member registers
Registrations for events and programs
Affiliated or related companies
Third-parties who assist us to operate our business

All information is collected in a fair and lawful manner and as permitted by law. YMCA South Australia is committed to ensuring that all individuals are aware of the purpose of the collection of the information. You are not obliged to provide personal information however, failure to do so may result in YMCA South Australia being unable to provide services or products to you.

5.1 Children

YMCA South Australia will not intentionally collect, use or disclose personal information about anyone under the age of 16 years unless the consent of a parent or legal guardian has been obtained.

5.2 Website

Accessing the YMCA South Australia website at www.sa.ymca.org.au will not require any identification or any other personal information and therefore users retain anonymity. YMCA South Australia does however collect personal information, suggestions and feedback provided by visitors through the following sections on the website:

‘Contact us’
‘Provide feedback’
eNewsletter Distribution
Donation form
Other forms

This information and the ideas provided may be used to assist in making improvements to the website or to YMCA South Australia operations. On no occasion will a person’s name or personal details be
published without permission.

Where emails or e-cards are forwarded to an email address or contact person listed on this website, the sender’s address will not be added to a mailing list and will be only used by YMCA South Australia to contact the sender. Once the office has responded to any feedback or complaint, the sender’s contact information will be destroyed in a secure manner.

YMCA South Australia’s websites use cookies. A “cookie” is a small file stored on your computer's browser, which assists in managing customised settings of the website and delivering content.

We collect certain information such as your device type, browser type, IP address, pages you have accessed on our websites and on third-party websites. You are not identifiable from such information. You can use the settings in your browser to control how your browser deals with cookies. However, in doing so, you may be unable to access certain pages or content on our website.

YMCA South Australia's websites may contain links to third-party websites. YMCA South Australia is not responsible for the content or privacy practices of websites that are linked to our website.

5.3 Anonymity

YMCA South Australia will provide individuals with the opportunity of remaining anonymous or using a pseudonym in their dealings with us where it is lawful and practicable (for example, when making a general enquiry). Generally, it is not practicable for YMCA South Australia to deal with individuals anonymously or pseudonymously on an ongoing basis. If we do not collect personal information about you, you may be unable to utilise our services or participate in our events, programs, or activities we manage or deliver.

5.4 Maintenance and Storage of Personal Information

Where YMCA South Australia requires personal information to be collected, every effort will be made to ensure the information is accurate, complete and up to date. YMCA South Australia will take reasonable steps and use appropriate security mechanisms to ensure that the personal information held is protected from misuse, loss and interference and from unauthorised access, modification or disclosure. Any person who on behalf of YMCA South Australia, uses or discloses personal information held by YMCA South Australia must have appropriate authorisation to do so. We take steps to destroy or de-identify information that we no longer require.

6. Use and Disclosure of Personal Information

6.1 Provision of Services

The purposes for which we may use and disclose your personal information will depend on the services we are providing you, but may include:
for the purpose requested
to process a booking or application that you have made and
to conduct and administer memberships

We may use images or audio-visual recordings that identify you for promotional purposes where you would reasonably expect this to occur. We may disclose information to third parties we engage in order to provide our services, including contractors and service providers used for data processing, data analysis, customer satisfaction surveys, information technology services and support, website maintenance or development, printing, archiving, mail-outs and market research.

6.2 Other Entities

Personal information may also be shared between related and affiliated entities of YMCA South Australia. Third parties to whom we have disclosed your personal information may contact you directly to let you know they have collected your personal information and to give you information about their privacy policies.

6.3 Administrative Functions

YMCA South Australia will also use and disclose personal information for a range of administrative, management and operational purposes. This includes:

administering billing and payments and debt recovery
planning, managing, monitoring and evaluating our services
quality improvement activities
statistical analysis and reporting
training staff, contractors and other workers
risk management and management of legal liabilities and claims (e.g. liaising with insurers and legal representatives)
responding to enquiries and complaints regarding our services
obtaining advice from consultants and other professional advisers and
responding to subpoenas and other legal orders and obligations

6.4 Marketing

YMCA South Australia may use or disclose your personal information for the purpose of informing you about our services, upcoming promotions and events, or other opportunities that may interest you.

When we contact you, it may be by mail, telephone, email or SMS.

If you do not want to receive direct marketing communications, you can opt-out at any time by contacting us using the contact details in Section 15.

If you opt-out of receiving marketing material from us, we may still contact you in relation to its ongoing relationship with you.

6.5 Other Purposes

We may use and disclose your personal information for other purposes explained at the time of collection or otherwise as set out in this Privacy Policy.

YMCA South Australia will take reasonable steps to protect personal information from loss, misuse, unauthorised access, disclosure or inappropriate or accidental destruction.

Disclosure of sensitive information will be in accordance with the APP.

7. Data Security

We hold personal information electronically and in hard copy form, both at our premises and with the assistance of our service providers. Personal information may be collected in paper-based documents and converted to electronic form for use or storage (with the original paper-based documents either archived or securely destroyed).

Personal information collected will be stored in a secure environment at all times. We maintain physicalsecurity over paper and electronic data stores, such as through locks and security systems at our
premises. We also maintain computer and network security, e.g. we use firewalls (security measures for the Internet) and other security systems such as user identifiers and passwords to control access to our computer systems.

Our websites do not necessarily use encryption or other technologies to ensure the secure transmission of information via the internet. Users of our websites are encouraged to exercise care in sendingpersonal information via the internet.

Where information is stored off site, YMCA South Australia will ensure confidentiality agreements with the archival suppliers are in place and maintained. All such suppliers are to be screened to ensure that they maintain security and confidentiality requirements.

Patron health information is to be retained for a minimum of seven (7) years following the last occasion on which a service is provided. Where information was first collected while the individual was a child, it is to be retained until he/she is twenty-five (25) years of age or for seven (7) years, whichever is the greater.

We will keep personal information as long as we need it for the purposes in clause 6.0 of this policy, after which time we will destroy or de-identify the personal information.

Otherwise we may keep personal information for any period required by law.

Employment documents and records, including payroll records, are to be retained for periods of time as prescribed by the relevant legislation both during and post-employment. Employees may request access to their personal file. However, files are not to be removed from the office location in which they are stored and access is to be supervised. At the discretion of the Manager – People, Risk, & Compliance, documents may be copied or printed and provided to the employee – original copies are not to be removed from files other than for copying purposes.

All credit card and personal financial data collected by YMCA South Australia is handled in accordance with the Payment Card Industry Data Security Standard (PCI DSS).

8. Openness

YMCA South Australia will be open and transparent about the type of personal information collected and the ways in which it is used and stored. The YMCA South Australia Privacy Policy is available to the community, members and third parties upon request and on YMCA South Australia’s website.

9. Disclosure Overseas

We are a South Australian organisation and accordingly, it is unlikely that your personal information will be disclosed to overseas recipients, unless you are utilising our digital staff and volunteer card, in which case, it is likely your personal information will be disclosed to overseas recipients. Those recipients are likely to be located in the United States. Unless we have your consent, or an exception under the Australian Privacy Principles (APPs) applies, we will only disclose your personal information to overseas recipients where we have taken reasonable steps to ensure that the overseas recipient does not breach the APPs in relation to your personal information.

10. Access and Correction

Where personal information is obtained and retained, you are entitled to access that record. To request access to your personal information, please contact us using the contact details provided in Section 15. You will not be charged for making a request to access your personal information but you may be charged for the reasonable time and expense incurred in compiling information in response to your request. We will take reasonable steps to confirm the identity of any individual seeking access your personal information. Unless required by law, no person may have access to any personal information pertaining to any other person.

We will take reasonable steps to ensure that the personal information we collect, use or disclose is accurate, complete and up-to-date. However, if you consider any personal information we hold about you is inaccurate, out-of-date, incomplete, irrelevant or misleading you are entitled to request correction of the information.

We will respond to processing, access and correction requests promptly upon request.

YMCA South Australia may decline your request to access or correct your personal information in certain circumstances in accordance with the APP, including where it would be unlawful. If we do refuse your request, we will provide you with a reason for our decision and in the case of a request for correction, we will include a statement with your personal information about the requested correction. Any health information collected by YMCA South Australia will not be deleted during the period of time it is required to be held. Amendments or alterations to health information are to be recorded on a separate form and attached to the original file.

11. Identifiers

YMCA South Australia may be required to collect an individual’s identifiers such as a tax file number, Medicare number or social security number for the provision of services. Where collected, these identifiers will not be adopted by YMCA South Australia as our own identifier or disclosed to agencies, unless required or permitted by law.

12. Transfer or Closure of Health Services

In the event of local YMCA South Australia managed health services (i.e. medical suite, massage service, physiotherapy service, sports medicine service, health and fitness club) being transferred, sold, leased, or ceasing operation, the Association is required to enact notification and transfer procedures as directed by the appropriate State / Territory legislation.

13. Sensitive Information

In limited circumstances, we may collect information that is considered sensitive information. The type of sensitive information that we may collect includes:

racial or ethnic origin
religious beliefs or affiliations or philosophical beliefs
membership of a professional or trade association or union
sexual orientation or practices
health information (such as physical and mental health, disabilities, health preferences, use of health services, bodily donations, or genetics)
genetic information about an individual that is not otherwise health information or
biometric information

If YMCA South Australia is required to collect sensitive information about an individual, it will only be collected and transferred to other parties as outlined at the time of collection with the individual’s consent, unless an exemption applies.

14. Contact and Complaints

You may contact us at any time if you have any questions or concerns about this Privacy Policy or about the way in which your personal information has been handled.

You may make complaints about the manner in which your personal information is being handled by submitting a form via the website or contacting the Chief Executive Officer or any other person nominated by the Chief Executive Officer.

We will first consider your complaint to determine whether there are simple or immediate steps that can be taken to resolve the complaint. We will respond to your complaint in accordance with YMCA South Australia’s Complaints and Grievance Policy.

If your complaint requires consideration that is more detailed or investigation, we will acknowledge receipt of your complaint within a week and endeavour to complete our investigation into your complaint promptly. We may ask you to provide further information about your complaint and the outcome you are seeking. We will then typically gather relevant facts, locate and review relevant documents, and speak with individuals involved.

In most cases, we will investigate and respond to a complaint within 30 days of receipt of the complaint.

If the matter is more complex or our investigation may take longer, we will let you know.

If you are not satisfied with our response to your complaint, or consider that we may have breached the APP, you may refer your complaint to the Office of the Australia Information Commissioner by using the contact details on the OAIC website (www.oaic.gov.au).

15. Contact Details

The contact details for YMCA South Australia are:
Address: Level 10, 44 Waymouth Street, Adelaide SA 5000
Phone: (08) 8200 2500
Email: contact@ymcasa.org.au

16. Roles and Responsibilities

Department / Area	Role / Responsibility
Board Directors	Oversee the development, monitoring and review of the Policy and related systems. Review and approve as appropriate.
Chief Executive Officer	Ensure appropriate training is provided to all staff and volunteers to foster a responsible working environment. Ensure clear guidelines that delineates inappropriate behaviour that is acceptable and reinforce the potential ramifications for such behaviour to all staff and volunteers.
Senior Management	Responsible for the promotion of a culture that encourages respect and consideration for the privacy and use of people’s private information is lawful. Adhering to the requirements of the Privacy Policy.
All employees (including Managers, Directors, Coordinators, Team Leaders), Volunteers and Contractors	Responsible for adhering to the requirements of the Privacy Policy and ensuring they understand their responsibilities.

17. Breaches of this Policy

Any breaches of this policy by a workplace participant may result in YMCA taking disciplinary action against that person, which may include termination of employment / services. In circumstances where a workplace participant breaches this policy and it involves a breach of any Australian law, we may notify the police or other relevant government authority.

18. Definitions

Australian Privacy Principles or APP are contained in the Privacy Act. YMCA South Australia means YMCA South Australia Inc., YMCA South Australia Youth and Family Services Inc. and related and affiliated entities.
Personal Information is defined in the Act and means information or an opinion, whether true or not, and whether recorded in a material form or not, about an identified individual, or an individual who is
reasonably identifiable.

Sensitive Information is defined in the Privacy Act as information or an opinion about an individual’s:
racial or ethnic origin
political opinions or membership of a political association
religious beliefs or affiliations or philosophical beliefs
membership of a professional or trade association or union
sexual orientation or practices
health information
genetic information about an individual that is not otherwise health information
biometric information that is to be used for the purpose of automated biometric verification or biometric identification
biometric template
Privacy Act means the Privacy Act 1988 (Cth).
Patron means a person who is a customer, client, or paying guest.

Workplace Participants means:

Our board members and any person serving YMCA South Australia on a committee or in an advisory capacity
Our employees, contractors and sub-contractors, consultants, labour hire employees, apprentices, and volunteers

19. Supporting Documents

Privacy rights in South Australia are established in accordance with the privacy related legislation:

Privacy Act 1988 (Cth)
Telecommunications Act 1997 (Cth)
Telecommunications (Interception and Access) Act 1979 (Cth)
Criminal Law Consolidation Act 1935 (SA)
Surveillance Devices Act 2016 (SA)
Freedom of Information Act 1991 (SA)
Summary Offences Act 1953 (SA)
Electronic Communications Act 2000 (SA)
Equal Employment Opportunity Act 1987 (Cth)
Privacy (Tax File Number) Rule 2015 (Cth)
Payment Card Industry (PCI) Security Standards Council
YMCA South Australia – Complaints and Grievance Policy
YMCA South Australia – Code of Conduct Policy
YMCA South Australia – Membership Terms and Conditions
YMCA South Australia – IT Incident Management Plan
YMCA South Australia – Incident, Reporting and Investigation Procedure
YMCA South Australia – Child, Young and Other Vulnerable Persons Safety code of Conduct Procedure

20. Monitoring and Evaluation

YMCA South Australia will monitor and evaluate the Privacy Policy every two (2) years to ensure the systems and process remains relevant and consistent with ‘best practice’ business management principles.