Privacy

VACCA Privacy Policy

1. Target Audience

This document (our Privacy Policy) outlines VACCA's policy on handling personal information in relation to individuals who are in contact with VACCA, including:

Job seekers;
Carers;
Clients and their families; and
Individuals using our websites, buying a good or a service or making a donation.

The policy includes information held on VACCA websites at the domains vacca.org, awards.vacca.org, deadlystory.com and linkupvictoria.org.au (Websites). As such, this Privacy Policy should be read in conjunction with the related Terms and Conditions for those websites, which can be found here.

NOTE: VACCA staff should refer to internal VACCA policies and procedures for further guidance regarding their privacy obligations.

2. Introduction

At the Victorian Aboriginal Child and Community Agency Coop Ltd (VACCA) ABN 44 665 455 609, we understand and acknowledge the importance of maintaining the privacy of individuals and families who are in contact with us. VACCA takes the responsibility of protecting and managing personal information very seriously: we are committed to protecting the privacy of the information that we collect about you. All personal information collected and held by VACCA will be governed by up to date policies and treated and maintained with integrity and confidentiality.

We are bound by the Australian Privacy Principles (APPs) in the Privacy Act 1988 (Cth). Additionally, as an agency funded by the Victorian Government, we are also bound by Victorian legislation (Privacy Legislation), including the Information Privacy Principles (IPPs) in the Privacy and Data Protection Act 2014 (Vic). These Acts also regulate how organisations may collect, use, disclose and store personal information, and how individuals may access and correct personal information held about them.

3. Terminology

In this policy, the expressions we, us and our are references to VACCA. The expressions you and your refer to each and every individual whose personal information we may handle from time to time. References to the terms personal information, sensitive information and health information have the meaning used in applicable Privacy Legislation.

4. Whose personal information do we collect?

We collect personal information from our staff, job applicants, carers and their families, students, members, the board of directors, clients and their families, volunteers and purchasers of our resources of goods and services, and supporters or potential supporters (donations, gifts in kind, sponsorships and the like).

5. How does VACCA collect your personal information?

Personal information will generally be collected in the following ways:

when you contact us via telephone, email, websites or other avenues;
through the completion of forms;
via donations;
by registering your interest or support;
by participating in our services; and
via use of VACCA Websites or VACCA social media sites.

VACCA will usually collect personal information directly from you and with your consent. However, we sometimes need to collect information from a third party, such as a carer, trustee, school or tertiary institution, an authorised representative or from publicly available sources. Personal information may also be collected from other individuals or organisations in the course of business or employment at VACCA.

Where VACCA collects personal information from a third party, we will take such steps as are reasonable in the circumstances to notify you, or ensure you are aware, of that collection and the circumstances for that collection.

6. What personal information does VACCA collect?

VACCA will only collect personal information if it is relevant and reasonably necessary for one of our functions, services or activities.

This includes, but is not limited to, the following types of personal information:

your name;
your age, gender, date of birth;
your contact details, including home address, email address and telephone number;
the name of your employer and other employment details; and
other information from which you are identifiable or reasonably identifiable.

7. Purpose of collection

We collect and handle a range of personal information for the purposes of carrying out our work, including services, campaigns, communications, events and other general activities.

The purposes for which we may collect personal information include, but are not limited to:

for provision of our services or business or activities;
for communication with you regarding the provision of our services or activities to you;
for dealing with related parties, including schools or tertiary institutions, employers, carers, or government agencies and other service providers;
for verifying your identity;
for addressing any issues or complaints that arise in the course of our relationship;
to send news and information about our services, activities, events, campaigns, products and general promotional material which we believe may be useful to you, by email, post, social media or other mediums;
for facilitating operational and administrative requirements in relation to our organisation and services;
where you are an employment candidate, for assessing your suitability for employment; and
for improving our services and organisation.

The services VACCA offers include:

residential care;
family violence services;
foster and kinship care;
child protection services;
guardianship services;
family and disability services;
therapeutic services;
education and training;
community events;
cultural services, events and camps;
Link-up Victoria services to the stolen generations and their families (linkupvictoria.org.au);
Deadly Story Cultural Portal for Aboriginal children (deadlystory.com);
Mollie Dyer Awards (awards.vacca.org); and
any services, goods, and resources listed on the Websites.

8. Collection of confidential information

Where, as part of our service provision, personal information is given to us in confidence about a third party who is not receiving our service, we will:

confirm with the person providing the information that the information is to remain confidential;
record the information only if it is relevant to the provision of our service or the care of the person providing the information;
take reasonable steps to ensure that the information is accurate and not misleading; and
take reasonable steps to record that the information is given in confidence and is to remain confidential.

9. Collection of sensitive and health information

Sometimes we may need to collect sensitive information about you. This might include information about your health, racial or ethnic origin, association memberships, religious beliefs, sexual orientation or criminal history. When collecting sensitive information from you, we will obtain your consent to such collection, except where otherwise provided in the applicable Privacy Legislation.

As part of administering our services, we may collect health information, which is a subset of sensitive information. For example, VACCA collects health information (such as medical history) from some clients who are part of specific programs, such as our residential services, kinship care or foster care programs. When collecting health information from young people and adults, we will obtain your consent, or where appropriate, the consent of your parent or guardian, to such collection and explain how the information will be used and disclosed.

If we collect health information from a third party (such as your doctor) we will inform you that this information has been collected and will explain how this information will be used and disclosed.

10. Consent

You (or, where appropriate, your parent or guardian) may withdraw your consent for VACCA to collect, use or disclose your personal information at any time by contacting the Privacy Officer (details provided below). However, without access to your personal information for the purposes listed above, we may be unable to provide our services to you.

In some circumstances (for example when a third party such as a parent wants to see client information) VACCA may need to determine whether the individual can and will provide consent.

There are no specific rules determining when an individual has capacity to provide consent. The Office of the Australian Information Commissioner recommends that as a general principle 'a young person is able to give consent when he or she has sufficient understanding and maturity to understand what is being proposed' and both the Office of the Victorian Information Commissioner and Victorian Health Complaints Commissioner have expressed support for a similar principle.

The ability to provide consent will depend on the age of the individual and whether they have an intellectual disability that may prevent them from having sufficient understanding of what they are consenting to.

At your request, we will provide you with further information about our consent process.

11. Use and Disclosure

We will normally use or disclose your personal information only for the purposes that it was given to us, and for purposes that are related to one of our services or activities.

Except as otherwise provided for under applicable Privacy Legislation, VACCA will not use or disclose personal information for purposes other than those connected with the primary purpose of collection set out in this Privacy Policy, or a reasonably related secondary purpose, which VACCA believes the individual should reasonably expect.

Secondary purposes can include the disclosure of information to third party contractors brought in to provide technical or other services to VACCA, and who are unable to avoid accessing or using personal information in the course of their work.

As part of the contractual agreements VACCA enters into with funders, VACCA is required to provide reports on program performance and client data. All personal information collected by VACCA as part of this agreement is de-identified before it is provided to the funding body in either written or verbal reports or through the transfer of information through electronic databases.

We may also disclose your personal information to external organisations, including:

Government departments, such as the Department of Health and Human Services, who provide funding for VACCA services or assist us to deliver services;
contractors who manage some of the services that we offer to you. We take reasonable steps to ensure that these contractors comply with Privacy Legislation when they handle your personal information and they are authorised only to use personal information in order to provide the services or to perform the functions required by VACCA;
doctors and health care professionals who assist us to deliver our services;
external auditors appointed by VACCA or regulatory authorities;
other regulatory bodies;
referees or former employers of VACCA employees and volunteers, and candidates for VACCA employee and volunteer positions; and
our professional advisors, including our accountants, auditors and lawyers.

From time to time, we may also provide certain de-identified information to Government departments, organisations, agencies or individuals who provide funding for VACCA's services, in the form of statistics or case studies. This is in addition to the disclosures mentioned above.

Except as set out above, we will not disclose your personal information to a third party unless one of the following applies:

you, or where appropriate your parent or guardian, (or the individual for whom you are the representative) have consented;
if we believe you would reasonably expect us to use or disclose the information for another purpose related to the purpose for which it was collected (or in the case of sensitive information, directly related to the purpose for which it was collected);
if it will prevent or lessen a serious threat to somebody’s life, health, welfare or safety or to public health, public safety or public welfare;
it is necessary to provide a public health service;
it is necessary for the management, funding, improvement or monitoring of a health service relevant to public health or safety;
if it is reasonably necessary for the prevention, detection, investigation of a breach of law, or the enforcement of a law conducted by an enforcement body;
it is reasonably necessary to assist in locating a missing person;
it is reasonably necessary to the conduct of proceedings before a court or tribunal, or for a confidential dispute resolution process;
it is reasonably necessary to comply with our obligations (including incident reporting requirements) under funding agreements with the Government, including for the purpose of providing services to an individual in accordance with that funding agreement and for the relevant government department's auditing and monitoring of our record-keeping;
it is permitted or required pursuant to any applicable law, including the reportable conduct scheme under the Child Wellbeing and Safety Act 2005 (Vic) as well as obligations under the Children, Youth and Families Act 2005 (Vic), the Family Violence Protection Act 2008 (Vic), the Working with Children Act 2005 (Vic); or
where required for compliance with Information Sharing Schemes operating in Victoria, including the Child Information Sharing Scheme (CISS), the Family Violence Information Sharing Scheme (FVISS) and the Multi-Agency Risk Assessment and Management Framework (MARAM).

12. Marketing and communications

We may collect, use and disclose personal information to contact you about our activities and to provide you with our newsletters, reports, invitations to events, awards, questionnaires, petitions, and requests for support. We may share information that we have received through our marketing activities to trusted third parties such as our mailing house and our bank. We may contact you using several different mediums for example by phone, mail, email, social media, SMS etc.

We may generate engagement with you, including by collaboration with third parties, in various ways such as petitions, pledges, quizzes, surveys, competitions, questionnaires or the like to build our list of potential supporters. We will utilise data gathered from these activities for the purposes of seeking further support and interest in our work to further our cause.

Notwithstanding the above, VACCA will not use or disclose an individual's personal information for the purposes of direct marketing unless:

the individual had consented to receive direct marketing materials; or
the individual should reasonably expect VACCA to use the personal details for this purpose; or
VACCA believes the individual would be interested in the material but it is impractical for VACCA to obtain consent.

VACCA will endeavour to incorporate an option for the individual to elect to stop further communication, should they choose to do so. However, in some cases VACCA may continue to provide information to the individual about changes to VACCA's terms and conditions for the supply of goods or services, questionnaires and other factual information, as this is not regarded as "direct marketing" under the Privacy Act 1988 (Cth) and may not be considered a commercial electronic message under the Spam Act 2003 (Cth).

You can also contact us on (03) 9287 8800 or via feedback@vacca.org if you do not wish to receive further communications from us.

13. Online services

When you access services, one or more of VACCA Websites or connect with us through social media, we or our third-party service providers, or affiliates, may use "Cookies" (small data files placed on your device that do not identify individuals personally but do identify devices). We may also use software such as JavaScript (code in the source HTML of the web page, that is transparent to the user) or similar technology.

You can find out more about cookies at www.allaboutcookies.org and www.youronlinechoices.eu

Cookies on Websites allow us to:

remember your details and preferences when you return;
maintain the continuity of your browsing session (e.g. maintaining a shopping cart, making an enquiry or donation);
use Google Analytics to collect information such as demographics and interests, visits to VACCA Websites, what you have previously viewed or clicked on and how you found the Website or page(s) you visited, length of visit and pages viewed, track the number of unique visitors to the site; and
tailor our advertising to individuals such as past visitors or 'look alike' groups of past visitors (or other identified groups) through advertising networks on other websites.

Using these analytics tools allows us to keep our website services relevant, optimised, easy to use and up to date and helps us understand how people use and engage the sites and information presented.

You can set your browser to notify you when you receive a Cookie, and this will provide you with an opportunity to either accept or reject it in each instance. Please note that if you do this, it may affect some of the functions on VACCA Websites and we may not be able to provide you with the full range of services through the VACCA Websites if we are not provided with the information collected through Cookies and Google Analytics.

We take great care to protect your personal information on Websites and whenever you communicate with us. Once we receive your personal information, we take reasonable steps to protect its security.

We may also use your personal information such as your name, email or mobile number to identify you on social media platforms (linkedin.com, Facebook, Instagram, and alike) and utilise this data to seek like audiences and increase our reach on a particular platform. You may update your privacy settings on your social media platforms if you do not permit this use. This may be used to increase participation on our website or social media platforms, seek donations and support, e-newsletter sign ups, gain notification of VACCA community events or news.

14. Quality of the Information that we hold

We take reasonable steps to ensure that the personal information that we collect, use or disclose is relevant, accurate, complete and up to date. If at any time you wish to update your personal information, you can do so by contacting our Privacy Officer (details of which are set out below).

VACCA will take reasonable steps, consistent with its obligations under Privacy Legislation, to correct the information within a reasonable time.

15. Security of the Information we hold

We take reasonable steps to protect the personal information that we hold from misuse, loss, interference and from unauthorised access, modification and disclosure.

The steps taken by VACCA to ensure security include:

password protection and firewalls;
secure servers;
encryption of credit card details for accessing electronic IT systems;
securing paper files in locked cabinets; and
physical access restrictions.

Our systems are regularly audited to ensure that only authorised personnel are permitted to access these details.

When using one or more of the VACCA Websites, individuals should be aware that data transmission over the internet cannot be guaranteed as totally secure. Individuals or organisations transmitting or transacting information over any Website do so at their own risk.

16. Where does VACCA store the personal information?

Robust security protocols, systems and processes are employed by VACCA in relation to the physical and electronic storage of personal information. Typically, VACCA will store personal information within secure cloud technology environments and electronic databases, and in the case of hard copy files, in secure physical storage.

17. Retention and Disposal of Information

VACCA commits to securely retaining client records in accordance with applicable law, including standards established under the Public Records Act 1973 (Vic) and the obligations of our funding agreements. Subject to the requirements of applicable law and our funding agreements, where personal information is no longer necessary for any purposes for which the information was collected, VACCA will take such steps as are reasonable in the circumstances to destroy in a secure manner or permanently de-identify personal information.

Information that is retained will be archived in such a way that preserves Aboriginal cultural values and identity, facilitates easy retrieval, yet does not compromise the security of the personal information maintained by VACCA. Personal information that is the subject of a funding agreement will ultimately be disposed of to, or at the direction of, the relevant government department or the Keeper of Public Records.

18. Access and Correction of information that we hold

If you request access to the personal information we hold about you, or request that we change that personal information, we will allow access or make the changes to your personal information unless we consider there is a sound reason under the Privacy Legislation to withhold the information or not to make the changes.

Requests for access should be made to the Privacy Officer (details of which are set out below). VACCA does not charge a fee to individuals who request access to their personal information. However, VACCA may require individuals to meet VACCA's reasonable costs in providing access if this is required. For security reasons, you will be required to lodge your request in writing and provide proof of identity. This is necessary to ensure that personal information is only provided to the correct individuals and the privacy of others is not undermined.

Request for Release of Information – Personal

We will take all reasonable steps to respond to your request for access to personal information within 14 days of your request. In situations where the request is complicated or requires access to a large volume of information, we will take reasonable steps to respond to your request for access to the requested information within 45 days of your request, or within 30 days of your request in the case of health information (as required by the Health Records Act 2001 (Vic)). The individual's written correspondence and VACCA's response will then be placed on the individual's VACCA hard copy file.

Following receipt of a request for access to or correction of personal information from you, VACCA will, within a reasonable timeframe (and in accordance with the requirements under the Privacy Legislation):

provide access or reasons for denial of access; or
correct the personal information or provide reasons for refusal to correct personal information; or
provide reasons for the delay in responding as soon as practicable but no later than the timeframe required under the Privacy Legislation.

In general, access will be denied where:

the request does not relate to the personal information of the person making the request;
providing access would pose a serious threat to the life, health or safety of any individual;
providing the information would have an unreasonable impact on the privacy of other individuals;
the request for access is frivolous or vexatious;
the information relates to existing or anticipated legal proceedings and the material would not be accessible through a process of discovery;
providing access would prejudice negotiations with the individual making the request;
providing access would be unlawful;
denying access is required or authorised by law;
providing access would be likely to prejudice:
- an investigation of possible unlawful activity;
- law enforcement activities;
- prevention, detection, investigation, prosecution or punishment of a criminal offence, breach of law or seriously improper conduct;
- the preparation for, or conduct of, proceedings before a court or tribunal; or
- an action relating to suspected unlawful activity, or misconduct of a serious nature relating to the functions or activities of VACCA;
access discloses a commercially sensitive decision-making process, in which case an explanation of the decision rather than access to the specific information will be given; or
any other reason that is provided for under Privacy Legislation.

Where an individual is given access to personal information and establishes that the information is not accurate, complete or up to date, VACCA will take reasonable steps to correct the information accordingly. If the individual and VACCA disagree about the accuracy of the information, the individual may request VACCA, via the Privacy Officer, to add a statement claiming that the information is not accurate, complete or up to date. VACCA will take all reasonable steps to do this.

If VACCA refuses to provide access or make changes, it will provide reasons for doing so to the individual making the request. Where there is a dispute about your right of access to information or forms of access, this will be dealt with in accordance with the complaints procedure set out below.

19. Complaints Procedure

If you have provided us with personal information, or we have collected and hold your personal information, you have a right to make a complaint and have it investigated and dealt with under this complaints procedure.

If you have a complaint about VACCA's privacy practices or our handling of your personal information or sensitive information, please contact our Privacy Officer (details of which are set out below).

If you remain unsatisfied with the way VACCA has handled the privacy issue, individuals can contact an independent advisor of the Office of the Australian Information Commissioner for guidance or advice about alternative courses of action available. VACCA will provide its full cooperation if this occurs.

Anyone (including but not limited to staff, students, clients, volunteers and carers) who wishes to obtain more information about privacy can visit the following Government websites:

https://ovic.vic.gov.au/ (Victorian website - Office of the Victorian Information Commissioner
www.oaic.gov.au (Federal website - Office of the Australian Information Commissioner)
https://hcc.vic.gov.au/ (Victorian website - Health Complaints Commissioner, for details relevant to the handling of health information).

20. Unique Identifiers

VACCA may assign unique identifiers for clients where it is necessary to enable the organisation to carry out its functions and services efficiently.

We will not normally adopt as our own, an identifier of an individual that has been assigned by a Government organisation or agency.

We will not disclose an identifier assigned to an individual unless the disclosure is permitted under relevant Privacy Legislation.

21. Anonymity

Where lawful and practicable, VACCA will take all reasonable steps to comply with a request to access our services on an anonymous basis or using a pseudonym. However, we may not be able to deliver the services in question if you do not provide us with the personal information requested.

22. Trans-border Data Flows

VACCA does not generally send your personal information offshore, or (in relation to personal information subject to the Privacy and Data Protection Act 2014 (Vic) or health information subject to the Health Records Act 2001 (Vic), outside the State of Victoria). If we are otherwise required to send information outside of these locations we will take such steps as are reasonable in the circumstances to protect your personal information, by either ensuring to our reasonable satisfaction that the destination has similar protections in relation to privacy or that we enter into contractual arrangements with the recipient of your personal information that safeguards your privacy.

23. Changes to this Privacy Policy

VACCA reserves the right to review, amend and/or update this Privacy Policy from time to time. Any changes will be published on the VACCA Website. Individuals may obtain a copy of VACCA's current Privacy Policy (this document) from this Website or by contacting VACCA.

24. How to contact us

You can obtain further information in relation to this Privacy Policy, or provide us with any comments, by contacting the VACCA Privacy Officer at:

Victorian Aboriginal Child and Community Agency (VACCA)
340 Bell Street
Preston Victoria 3072
Phone: (03) 9287 8800
Email: feedback@vacca.org

ABN 44 665 455 609

For information about privacy generally, or if your concerns are not resolved to your satisfaction, you can contact the Office of the Australian Information Commissioner on 1300 363 992 or via http://www.oaic.gov.au.