Part A: Our Personal Information Handling Practices

Our obligations under the Privacy Act

This privacy policy sets out how the TC360 complies with the obligations under the Privacy Act 1988 (Cth) (Privacy Act). TC360 is bound by the Australian Privacy Principles (APPs) in the Privacy Act which regulate how organisations may collect, use, disclose and store personal information, and how individuals may access and correct personal information held about them.

Collection of Personal and Sensitive Information

The nature and extent of personal and sensitive information collected by TC360 varies depending on the type of interaction with TC360.

Under the Act people must be given an option to access any TC360 Services on an anonymous basis or using a pseudonym if possible and lawful.

TC360 collects personal and sensitive information for multiple purposes from customers/beneficiaries, donors, business partners, TC360 people and online users including but not limited to:

TC360 Customers and Beneficiaries

Kind of information collected:

• contact details (name, address, email etc.)
• personal details including date of birth, gender
• information on personal issues and experiences, relationships,
  family background, supports customers may have in the community
• areas of interest
• health information and/or medical history
• credit card numbers or bank account details

How the information is collected:

• membership applications
• telephone

Purpose for which TC360 uses the information:

• to provide TC360 services
• to provide customers/beneficiaries with the most appropriate services for their needs
• to meet any requirements of government funding for programs
• to monitor and evaluate existing services and plan for future services
• to produce annual reports and for research purposes which may involve contracted organisations
• to comply with legal obligations

 

TC360 Members (Health, Fitness and Wellbeing participants)

Type of information collected:

• contact details (name, address, telephone numbers, email etc.)
• date of birth
• health information and/or medical history
• credit card details
• expiration date of credit card
• areas of interest

Purpose for which TC360 uses the information:

• to provide appropriate TC360 services (including tailored Health and Fitness Programs)
• to provide communication updates and ensure transparency
• to process payments, donations and provide accurate receipts
• to facilitate ongoing fundraising and marketing activities
• to provide info about TC360
• to receive invitations to upcoming events and activities
• to recognise your support of TC360

TC360 Business Partners

Type of information collected:

• contact person’s name, the name of the organisation which employs the person, telephone numbers, fax number, street and postal address, email address and position title
• areas of interest by category and industry
• bank details (if TC360 is to receive payment or make payment for services received)
• Australian Business Number (ABN)
• type of support (e.g. workplace giving, goods in kind, program support, volunteering)

How the information is collected:

• communications, email, flyers

Purpose for which TC360 uses the information:

• to provide TC360 services
• to process donations and provide accurate receipts
• to pay for services
• to establish and manage partnerships
• to receive services from you or the organisation which employs you
• to manage TC360 ‘s relationship with the business partner
• to provide information about TC360’s services
• to update the company on TC360 appeals for public donations, programs and services

 

TC360 People (volunteers, employees, delegates) and candidates for volunteer work and prospective employees

Type of information collected:

• contact details (name, address, telephone numbers, email etc.)
• personal details including personal details of emergency contact person(s)
• date of birth
• country of birth, citizenship, residency and/or visa details
• details of current/previous employment or volunteer involvement
• skills and experience
• languages spoken and written
• qualifications, driver’s license details
• information and opinions from referees for prospective employees and candidates for volunteer work
• a Police Check will be required for all roles in TC360 (particularly those involving children, young people and other vulnerable individuals). Individuals will be required to provide certain information for a Police Check. There are different arrangements for Police Checks in each state and territory of Australia. In some cases, the Police Check will be received directly by TC360 and then stored securely or destroyed.
• in some situations, it is necessary for TC360 to collect or receive information about an individual’s health. In this circumstance, TC360 will advise why the information is being collected and whether and to whom it will be released.

Purpose for which TC360 uses the information:

• to provide TC360 services
• to process an application to become a member, volunteer or employee of our organisation
• to facilitate a placement in an appropriate service or position
• to assist with services whilst an individual is employed or engaged as a volunteer with TC360
• to provide feedback on performance as a volunteer or employee
• to meet legislative responsibilities to all volunteers and employees
• to obtain feedback from individuals about their experiences
• to assist TC360 to review and improve its programs and services to keep individuals informed about TC360 developments and opportunities
• to provide information about TC360 services
• to facilitate further involvements with TC360 (e.g. Disability supports, membership, donor)

Additional Information

The website may from time to time contain links to other websites. TC360 stresses that when an online user accesses a website that is not the TC360 website, it may have a different privacy policy. To verify how that website collects and uses information, the user should check the website policy for that site.

How Information is Collected

Where possible, personal and sensitive information is collected directly from the person through various means, including telephone and in-person interviews, appointments, forms and questionnaires. In some situations, TC360 may also obtain personal information about people from a third-party source.

Collection of Health Information

As part of administering TC360 services, health information may be collected. For example, TC360 collects health information (such as medical history) from some customers/beneficiaries/ gym members participating in TC360 programs. When collecting health information, TC360 will obtain consent to such collection and explain how the information will be used and disclosed.

If health information is collected from a third party (such as a doctor), TC360 will inform the person that this information has been collected and will explain how this information will be used and disclosed.

TC360 will not use health information beyond the consent provided, unless further consent is obtained or in accordance with one of the exceptions under the Privacy Act or in compliance with another law. If TC360 uses health information for research or statistical purposes, it will be de-identified if practicable to do so.

Use and disclosure of Personal Information

TC360 will only use personal information for the purposes for which it was given, or for purposes which are related to TC360 functions or activities.

For the purposes referred to in this Privacy Policy (discussed above under ‘Collection of Personal and Sensitive Information‘), personal information may also be disclosed to other external organisations including:

• Government departments/agencies who provide funding for some TC360 services
• Contractors who manage some of the services we offer, such as distribution centres who may send information on behalf of TC360. Steps are taken to ensure they comply with the APPs when they handle personal information and are authorised only to use personal information in order to provide the services or to perform the functions required by TC360;
• Doctors and health care professionals, who assist with delivery of services;
• Other regulatory bodies, such as WorkSafe;
• Nominated referees and/or former employers of persons applying to work or volunteer at TC360
• TC360 professional advisors, including our accountants, auditors and lawyers.

 

Except as set out above, TC360 will not disclose an individual’s personal information to a third party unless one of the following applies:

• the individual has consented
• the individual would reasonably expect us to use or give that information for another purpose related to the purpose for which it was collected (or in the case of sensitive information – directly related to the purpose for which it was collected)
• it is otherwise required or authorised by law
• it will prevent or lessen a serious threat to somebody’s life, health or safety or to public health or safety
• it is reasonably necessary for us to take appropriate action in relation to suspected unlawful activity, or misconduct of a serious nature that relates to our functions or activities
• it is reasonably necessary to assist in locating a missing person
• it is reasonably necessary to establish, exercise or defend a claim at law
• it is reasonably necessary for a confidential dispute resolution process
• it is necessary to provide a health service
• it is necessary for the management, funding or monitoring of a health service relevant to public health or public safety
• it is necessary for research or the compilation or analysis of statistics relevant to public health or public safety
• it is reasonably necessary for the enforcement of a law conducted by an enforcement body.

 

TC360 does not usually send personal information out of Australia. 

Security of Personal and Sensitive Information

TC360 takes reasonable steps to protect the personal and sensitive information we hold against misuse, interference, loss, una​uthorised access, modification and disclosure.

These steps include password protection for accessing our electronic IT system, securing paper files in locked cabinets and physical access restrictions. Only authorized personnel are permitted to access these details.

When the personal information is no longer required, it is destroyed in a secure manner or deleted according to our Records Disposal Policy.

Access to and correction of personal information

If an individual requests access to the personal information we hold about them, or requests that we change that personal information, we will allow access or make the changes unless we consider that there is a sound reason under the Privacy Act or other relevant law to withhold the information or not make the changes.

Requests for access and/or correction should be made to the CEO of Thrive Community 360. For security reasons, request must be submitted in writing with proof of identity. This is necessary to ensure that personal information is provided only to the correct individuals and that the privacy of others is not undermined.

In the first instance, TC360 will generally provide a summary of the information held about the individual. It will be assumed (unless told otherwise) that the request relates to current records. These current records will include personal information which is included in TC360 databases and in paper files, and which may be used on a day-to-day basis.

We will provide access by allowing the person to inspect, take notes or print outs of personal information that we hold about them. If personal information (for example, name and address details) is duplicated across different databases, TC360 will generally provide one printout of this information, rather than multiple printouts.

All reasonable steps will be taken to provide access or the information requested within 14 days of request. In situations where the request is complicated or requires access to a large volume of information, we will take all reasonable steps to provide access to the information requested within 30 days.

TC360 may charge reasonable fees to reimburse the cost incurred relating to the request for access to information, including photocopying and delivery cost of information stored off site. If an individual can establish that personal information TC360 holds about her/him is not accurate, complete or up to date, TC360 will take reasonable steps to correct our records.

Access will be denied if:

• the request does not relate to the personal information of the person making the request;
• providing access would pose a serious threat to the life, health or safety of a person or to public health or public safety;
• providing access would create an unreasonable impact on the privacy of others;
  the request is frivolous and vexatious;
• the request relates to existing or anticipated legal proceedings;
  providing access would prejudice negotiations with the individual making the request;
• access would be unlawful;
• denial of access is authorised or required by law;
• access would prejudice law enforcement activities;
• access would prejudice an action in relation to suspected unlawful activity, or misconduct of a serious nature relating to the functions or activities of TC360
  access discloses a ‘commercially sensitive’ decision making process or information; or
• any other reason that is provided for in the APP’s or in the Privacy Act.

If we deny any access to information, we will set our reasons for denying access. Where there is a dispute about right of access to information or forms of access, this will be dealt with in accordance with the complaint’s procedure set out below.

Complaints Procedure

If you have provided personal and sensitive information, or we have collected and hold personal and sensitive information, people have a right to make a complaint and have it investigated and dealt with under this complaint’s procedure.

If there is a complaint about TC360 privacy practices or our handling of personal and sensitive information, people should contact the Chief Executive Officer.

All complaints will be logged on our database.

A privacy complaint relates to any concern that regarding TC360 privacy practices or our handling of personal and sensitive information. This could include matters such as how information is collected or stored, how information is used or disclosed or how access is provided to personal and sensitive information.

The goal of this policy is to achieve an effective resolution of your complaint within a reasonable timeframe, usually 30 days or as soon as practicable.

However, in some cases, particularly if the matter is complex, the resolution may take longer.

Once the complaint has been made, we will try to resolve the matter in several ways, such as:

• Request for further information: We may request further information from the person, including details of any relevant dates and documentation. This will enable us to investigate the complaint and determine an appropriate solution. All details provided will be kept confidential.
• Discuss options: We will discuss options for resolution with the person and listen to suggestions about how the matter might be resolved
  Investigation: Where necessary, the complaint will be investigated. We will try to do so within a reasonable time frame. It may be necessary to contact others to proceed with the investigation.
• Conduct of our employees: If the complaint involves the conduct of an employee, it will be raised with the employee concerned and seek their comment and input in the resolution of the complaint.
• The complaint is substantiated: If the complaint is found to be substantiated, the person will be informed of this finding. We will then take appropriate agreed steps to resolve the complaint, address their concerns and prevent the problem from recurring.
  If the complaint is not substantiated, or cannot be resolved to the persons satisfaction, but this Privacy Policy has been followed, TC360 may decide to refer the issue to an appropriate intermediary. For example, this may mean an appropriately qualified lawyer or an agreed third party, to act as a mediator.
  At the conclusion of the complaint, if the person is still not satisfied with the outcome, they should be advised to take the complaint to the Office of the Australian Information Commissioner at www.oaic.gov.au.
  We will keep a record of all complaints and the outcomes.

 

We are unable to deal effectively with anonymous complaints as they are unable to be investigated and followed up. If an anonymous complaint is received we will note the issues raised and, where appropriate, try to investigate and resolve them appropriately.