Privacy Policy

1. Statement of Context and Purpose

1.1 Gold Coast Legacy (‘GCL’, ‘we’, ‘our’) is committed to ethical practices and standards. This includes respecting the privacy of all personal information in its possession.

1.2 This policy aims to:

1. outline how GCL handles personal, sensitive and health information to comply with applicable privacy legislation;
2. direct Workers on the responsible collection and handling of personal information; and
3. support the principle of responsible and transparent handling of personal information by GCL.

2. Scope

2.1 This policy applies to all employees, Legatees, contractors, volunteers and other authorised personnel required to perform functions on behalf of GCL or on GCL’s premises.

2.2 This policy is not intended to override or form part of the terms of any award, enterprise agreement or contract that applies to an employee, but should be considered a reasonable direction to staff. As such all employees, volunteers, contractors and other authorised personnel are expected to abide by this policy and report any suspected or known breaches of this policy.

3. Related Documents

3.1 Relevant legislation which governs how GCL handles personal information:

1. Archives Act 1983 (Cth)
2. Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs)

4. Definitions

4.1 Access means the ability to view, obtain or retrieve information in any form to any other person.

4.2 Disclosure amounts to making the information accessible or visible to others outside the organisation holding the information.

4.3 Hold means the information in the possession or under the control of GCL.

4.4 Loss means that the physical whereabouts of information is unknown, including both hard and/or soft copies, and involves the failure to preserve or maintain the information in a known place. Loss does not include the intentional destruction or de-identification of information.

4.5 Misuse means personal information is misused if it’s used in a way that contravenes any of the information or principles of this policy, which deal with use and disclosure.

4.6 Modification means the changing, removing or adding of components to the original information.

4.7 Personal information means any information or an opinion, including information or an opinion forming part of a database, that is recorded in any form and whether true or not, about an individual whose identity is apparent, or can be reasonably ascertained from the information or opinion.

4.8 Sensitive information means information or an opinion, that is also personal information, about an individual’s:

1. racial or ethnic origin;
2. political opinions;
3. membership of political associations;
4. religious beliefs or associations;
5. philosophical beliefs or affiliations;
6. membership of a professional or trade association;
7. membership of a trade union;
8. sexual orientation or practices;
9. criminal record.

It also includes health information about an individual, genetic information, or biometric information or templates.

4.9 Unauthorised access, modification or disclosure means access, modification or disclosure of information that is considered unauthorised where an individual:

1. has no proper authority to access, modify or disclose the information;
2. exceeds their authority by acting beyond their power; or
3. misuses their authority to access, modify or disclose the information.

4.10 Worker is broadly defined, and for the purposes of this policy means:

1. an employee;
2. a contractor or subcontractor used by GCL;
3. an employee of a contractor or subcontractor used by GCL;
4. an employee of a labour hire company used by GCL;
5. an apprentice or trainee or work experience student employed by or hosted by GCL;
6. a student gaining work experience or undertaking a vocational placement with GCL;
7. a volunteer or Legatee.

5. Information We Collect

5.1 It is necessary for GCL to collect personal information in order to deliver certain services and programs. We will always try to collect information directly from the individual or their authorised representative within the requirements of applicable privacy law where it is reasonably necessary and practicable to do so.

5.2 Personal information may be collected when interacting with our staff including when completing physical or online forms, over a telephone call, postal mail, email, in person, via our website such as our online donation, and social media sites.

5.3 In some circumstances, we may collect personal information from a third party where it is unreasonable or impracticable to collect it directly from the individual.

5.4 We may collect personal information about:

1. Beneficiaries
2. Family members of beneficiaries
3. Workers
4. Prospective Workers
5. Donors
6. Workers at other Legacy Clubs
7. Referrers
8. Service providers
9. Visitors to our website
10. Members of the public who interact with GCL.

5.5 The types of personal information collected and held by Gold Coast Legacy will depend on how individuals engage with GCL and our services and may include:

1. names, date of birth, occupation, marital status, residential details, details of dependents, date of death;
2. pension, medical, clinical, advocacy, personal case, social work and rehabilitation files;
3. financial information, including income and asset details;
4. service history;
5. photographic images and recordings; and
6. communication and marketing preferences.

5.6 Where personal information is provided to GCL that is unsolicited or not reasonably necessary for one or more of our functions or activities, GCL will:

1. de-identify or destroy the information if it is not to be retained; or
2. if the information is to remain identified and be retained, provide the person to whom the information relates with a copy of the relevant privacy collection statement explaining the purposes of collection where practicable, where such a statement has not already been provided.

5.7 Sensitive information will only be collected if it is directly related to the primary purpose for which the information will be collected or as required by law or with the individual’s specific and informed consent.

5.8 The sensitive information collected by GCL relates mostly to:

1. health or medical information, including mental health and disabilities; and
2. age, racial or ethnic origin of an individual, for example for inclusion into statistics or the indigenous veteran database.

5.9 In certain circumstances, personal information may be collected by people or organisations acting and providing services on behalf of GCL, such as:

1. contracted health, rehabilitation and aged care service providers;
2. medical and health care professionals in the case of partnership or outsourcing;
3. contracted Information and Communications Technology (ICT) providers; and
4. other Legacy clubs.

Records collected or created for or on our behalf are under the control of GCL and the same privacy protections apply.

5.10 Gold Coast Legacy may also collect personal information from a government agency, such as the Department of Veterans Affairs (DVA), to obtain service history information, support requests and other pertinent information to administer either support or pension claims.

5.11 Individuals can choose to remain anonymous or use a pseudonym where practicable, but this may limit our ability to engage with individuals or provide our services, such as identifying and verifying beneficiaries eligible to receive pensions and allowances.

6. Use and Disclosure

6.1 GCL does not sell, rent or trade personal information to, or with, third parties.

6.2 GCL generally uses and discloses personal information for the primary purpose for which it was collected. These primary purposes include but are not limited to:

1. assisting with pension claims, compensation and advocacy;
2. providing case management, social and emotional support services;
3. hosting and facilitating programs, activities and events;
4. administering our relationships with beneficiaries, donors and Workers;
5. managing our relationships with other Legacy clubs, service providers and affiliates;
6. facilitating administrative, marketing, planning, product and service development;
7. conducting research and quality assurance;
8. referring individuals to other organisations for services or support;
9. complying with relevant laws and regulations as a registered charity and Public Benevolent Institution;
10. responding to inquiries and complaints.

6.3 In certain circumstances, GCL may use or disclose personal information in its possession for a different purpose, the secondary purpose, where the secondary purpose:

1. is related to the primary purpose for which the information was collected, or in the case of sensitive information, directly related to the primary purpose;
2. is required or authorised under Australian law;
3. is reasonably necessary for enforcement related activities;
4. is otherwise permitted under privacy laws; or
5. where we have consent from the individual.

6.4 We may disclose personal information to third parties where it is reasonably necessary for the purpose of collection or a secondary purpose exists. This may include but is not limited to:

1. other Legacy Clubs or similar organisations;
2. banking institutions;
3. law enforcement and government bodies;
4. insurers and professional advisors;
5. service providers and suppliers; or
6. as required by law.

6.5 GCL may disclose personal information in our promotional material and on social media platforms, for example, when we use photos or recordings from our events in which individuals are reasonably recognisable. Generally, GCL will seek consent from the individual where this is reasonably practicable.

6.6 Although the information of a deceased individual is not regulated by privacy law, Gold Coast Legacy will continue to respect the sensitivities of family members when using or disclosing such information.

7. Direct Marketing

7.1 GCL may use or disclose personal information for the purpose of direct marketing where individuals have provided consent, or it is reasonably expected and related to the primary purpose of collection. GCL may communicate about:

1. new goods or services being offered by GCL;
2. making further charitable donations;
3. future opportunities to assist GCL with its work; and
4. its activities.

7.2 Individuals can opt-out of receiving direct marketing communications by contacting GCL in writing or, if applicable, by using the unsubscribe link in an email.

8. Storage and Security

8.1 Gold Coast Legacy will store personal information in a variety of formats, including hard copy and digital, for example, electronic databases. We use a range of IT and physical security systems to protect the personal information we hold and take reasonable steps to ensure that information is protected from misuse, interference, loss, unauthorised access, modification and disclosure.

For example, we implement technical measures for data storage and protection, apply access controls to restrict access, use or disclose personal information, and enter into contractual arrangements with third parties that cover the authorised use and disclosure of personal information, including any cross-border transfer of data outside Queensland or Australia, consistent with applicable privacy law.

8.2 GCL may contact individuals to determine whether personal information collected should be retained. If we no longer require the personal information, we will take reasonable steps to destroy or de-identify the personal information, unless it is prohibited by law.

8.3 Gold Coast Legacy will take reasonable steps to ensure that personal information we hold is:

1. accurate, complete and up to date;
2. protected from misuse, loss, unauthorised access, modification or disclosure; and
3. securely destroyed or permanently de-identified when no longer required.

8.4 When using contracted service providers, we take reasonable steps to ensure they are subject to a law, binding scheme or contract that provides substantially similar protection of personal information.

9. Access and Correction

9.1 Access

9.1.1 Individuals may request access to personal information which GCL holds about them using the contact details in section 10.1. We cannot provide an individual with the personal information of a partner or family member without consent or other lawful authority, such as to a legal guardian, nominated representative or authorised agent acting on behalf of an individual.

9.1.2 There is no cost associated with requesting access to personal information. GCL will respond to most requests for access to personal information within 30 days of the request being received. In some circumstances, a request for personal information can be refused or restricted, including where the release of information may interfere with the privacy of others, or the information is subject to legal professional privilege. If Gold Coast Legacy decides to refuse or restrict access to the information a written notice of the reasons for refusal will be provided.

9.2 Correction

9.2.1 Individuals may make a request to GCL to update personal information that is out-of-date, incomplete, incorrect or misleading using the contact details in section 10.1. We will respond to most requests for correction of personal information within 30 days of the request being received. There is no cost associated with requesting correction of personal information.

9.3 We may ask individuals to verify their identity before GCL provides access to or corrects personal information.

10. Privacy Complaints

10.1 Individuals may contact us with their privacy concern or complaints. All privacy directed inquiries and complaints should be directed to:

10.2 We may ask individuals to verify their identity before giving. We encourage individuals to provide:

1. a brief description of the privacy concern;
2. any action the individual or GCL has taken to fix the problem; and
3. copies of any relevant documents.

10.3 GCL aims to acknowledge complaints received by telephone and email within two (2) working days and to resolve the issue within 30 days. For complaints received by mail, Gold Coast Legacy aims to provide acknowledgement within fourteen (14) working days and to resolve the issue within 30 days. If the matter is complex, it may take longer. In such cases, we will ensure the individual is given the contact details of the person assigned to managing their complaint and will keep them informed of progress and an expected resolution date.

10.4 Where an individual is dissatisfied with the way GCL handles their privacy related complaint, they may contact the Office of the Australian Information Commissioner on 1300 363 992 or via the internet at www.oaic.gov.au.

10.5 For more information about our privacy handling practices or this Policy contact the GCL Privacy Officer.