This policy describes how Foundation for Young Australians (FYA) will collect, handle and protect personal and sensitive information. 

Personal information means information about an identified individual, or an individual who is reasonably identifiable. 

Our work means that we regularly collect, use and store personal information about children and young people, as well as adults.

This policy explains why we collect and hold information, how it is stored and protected, and the choices you can make about your personal information.

You can contact FYA if you have a question or comment about this policy, want to request access or correct your personal information, or want to make a complaint about how we are managing your personal information.

• privacy@fya.org.au  
• (03) 9055 1188
• https://www.fya.org.au/contact-us 
• Privacy Officer, Foundation for Young Australians, GPO Box 239, Melbourne, Victoria 3001

FYA respects individual privacy and is committed to protecting personal information. FYA applies the Australian Privacy Principles (APP) contained in the Privacy Act 1988. 

Types of personal and sensitive information we collect

You can communicate with FYA anonymously or using a pseudonym. However, for some activities or processes, we will need your name, contact details and other information.

FYA collects and holds personal and sensitive information so we can deliver our work and programs, manage our relationships with donors and other supporters, keep people informed about our activities, and comply with the law. 

FYA will only collect personal and sensitive information through transparent, fair and legal methods. 

Whenever reasonably possible, we will collect personal and sensitive information directly from you. Sometimes, other people will give your information to us. This includes organisations we are working with to deliver programs, your parent or guardian, or someone else.

We will only collect sensitive information with your consent, and when we need the information for our activities. For example, we may ask for information about your age, gender, race, ethnicity, religion, lived experience of the justice, state care or mental health systems, economic status, whether you are a carer, and health or access needs. This is so we can understand who is participating in our programs, and how to make them accessible for you.

The types of personal and sensitive information we collect and hold about you will depend on the relationship we have with you. This includes: 

• identifying information, such as your name, where you work or study, and your role there; 
• contact information, such as your postal address, email address and telephone number; 
• your image, such as photos or videos;
• your age, gender, race, ethnicity, religion, and health or access needs;
• your lived experience of the justice system, state care or mental health system; economic status and whether you are a carer;
• financial information, such as details for you to make a donation, or details required for us to pay you; 
• details of how we work with you, or programs you participate in; 
• responses to surveys, evaluation forms and evaluation interviews; and 
• records of our communications with you, including any messages you send us. This may also include your IP address.

If you are applying for a paid or volunteer position, we will collect other types of information. This will depend on the type of role you are applying for. This could include:

• employment history and qualifications
• references
• Working With Children Check results (for people aged 18 and over) 
• criminal history check results (specific roles only)

You can read more about this in our Working with Children Checks and Police Checks Policy.

In some circumstances, we allow individuals the option of not identifying themselves, or of using a pseudonym, when dealing with us (for example, when viewing our website or making general phone queries). Donations may also be made anonymously, but in this case, FYA may not be able to issue a tax-deductible receipt.

The nature of the business carried on by FYA means that, generally, it is not possible for us to deal with individuals or organisations in an anonymous way.

We collect information using different methods. We will usually collect this directly from you. If you are under 15 years old, we will ask permission from your parent or guardian to collect this information from you. 

Online through our website and other channels

Personal information is collected through the FYA website and other online channels when you make a financial transaction; sign up to receive information from FYA; send a message through our contact form; email us; complete a form; or submit personal information into our website or the website of a third-party vendor acting for FYA for any other reason. 

We can also collect personal information when you participate in an online meeting, including through the use of transcription software. We will tell you when we are doing this.

Credit card details collected through the FYA website are held securely by our third-party payment gateway. FYA does not store these details. All other personal information collected by FYA through the FYA website is stored securely and only accessible by authorised FYA representatives. 

To improve its website FYA collects standard information about website visitors, including by using cookies. Cookies are pieces of data that a website transfers to a device for record-keeping purposes. This information is accessed by FYA anonymously and in aggregate so we can track statistics about website usage. This information can also be accessed by Google Analytics. FYA will not attempt to identify you or your browsing activities except where required by law. 

In person and by phone

Personal information is collected by phone and in person. This includes when you make a donation, work or volunteer for us, apply to participate in activities or evaluation, or request information from FYA. All personal information is stored securely where it is only accessible by authorised FYA representatives. 

By third-parties 

FYA will sometimes ask third-parties to collect personal information for us. They can do this through online and offline channels. This information will be covered by the third-party’s own privacy policy and practices. Examples of third-parties include recruitment agencies, ticketing platforms and other digital providers.

Third-parties collecting personal information for FYA will identify themselves to you, so you can make informed decisions about when and how you disclose your personal information. FYA will take reasonable measures, contractual and otherwise, to ensure that third-parties contracted to collect information for us will protect personal information to the same standard as FYA. However FYA cannot control or be held liable for the business practices of third-parties to whom personal information is provided.

FYA collects and holds personal and sensitive information so we can deliver our work and programs, manage our relationships with donors and other supporters, keep people informed about our activities, and comply with the law. FYA will use personal information for these purposes, and for other related purposes for which you would reasonably expect it to be used. We will do this with your consent, or without consent where permitted by law. 

To keep you informed about our work, we will use your personal information in order to send you marketing materials about our activities. You can opt-out of receiving marketing communications from us by contacting us or following the “unsubscribe” link in the communication. 

FYA will only share personal information with others when necessary. These include:

• partners, such as organisations we are working with to deliver programs you are participating in, 
• auspiced organisations you are making a donation to; 
• third-parties, to enable them to perform specific functions required by FYA (e.g. delivering events in person or online, sending communications, transcription, conducting surveys, collecting donations, etc);
• software providers, including those based overseas;
• professional advisers, including lawyers and auditors;
• entities where the sharing is permitted or required by law. 

FYA will disclose personal information to external service providers located overseas so that they can provide us with services in connection with the operation of our business, such as IT services and data storage. The countries where these overseas providers are located include the United States of America, the United Kingdom, the European Union, New Zealand.

When sharing information, FYA will take measures to ensure that third-parties safeguard personal information as well as we do, and that personal information is only kept for as long as is necessary to fulfil the required function.

FYA will store personal information in hard copy and electronic form. We will store it ourselves, and with third-party storage providers. We will take reasonable steps to make sure information is stored securely:

• hard copies are stored securely
• IT systems are protected by passwords and antivirus software 

FYA will destroy or deidentify personal or sensitive data when the Privacy Act requires us to do so. This includes when that data is no longer required. This includes information about participants, employees and volunteers, donation and donor data, and other sensitive information. 

If we receive personal information that we have not requested, and that we do not require to deliver our work or activities, we will take reasonable steps to deidentify or destroy that information.

You have the right to request access to and correct personal information we hold about you, subject to parameters and exceptions listed in the Privacy Act 1988. Our contact details are below.

If we cannot provide or correct the information you request, we will let you know why we cannot comply with your request. Examples are where it would interfere with the privacy of others or result in a breach of confidentiality.

To protect the integrity and security of the information we hold, we will ask that you follow a defined access procedure. This may include steps to verify your identity. 

In certain cases we will charge you an administration fee for providing you with access to the information you have asked for. We will inform you of this before proceeding.

If you are concerned about how we are managing your personal information and think we have breached the Australian Privacy Principles, or any other relevant obligation, please contact us using the details below. 

We will deal with the matter within 30 days. We will keep you informed of the progress of our investigation. If we have not responded to you within a reasonable time or if you feel that your complaint has not been resolved satisfactorily, you can contact us to discuss your concerns. 

You can also make a complaint to the Office of the Australian Information Commissioner (OAIC). You can obtain further general information about your privacy rights and privacy law from the OAIC: 

• 1300 363 992 
• www.oaic.gov.au/privacy/privacy-complaints/lodge-a-privacy-complaint-with-us  
• OAIC, GPO Box 5288, Sydney NSW 2001

This policy is in place to ensure compliance with FYA’s responsibilities. Failure to follow this policy will be investigated and treated as a serious matter and may result in disciplinary action.

From time to time it may be necessary for us to review and revise our Privacy Policy. We may notify you about changes to this Privacy Policy by posting an updated version on our website. We encourage you to check our website from time to time to ensure you are familiar with our latest Privacy Policy.