Privacy policy
1 Background
YMCA Whittlesea (Y Whittlesea, we, our) is committed to the responsible collection, handling, storage, protection and destruction of personal information in accordance with privacy law. We respect the privacy of our participants, parents, staff, volunteers and other visitors to our facilities.
Y Whittlesea has privacy obligations set out under the Commonwealth Privacy Act 1988 (Cth) (the Act) and the Australian Privacy Principles (the APPs) as well as the Health Records Act 2001 (Vic) and Health Privacy Principles (the HPPs). These laws govern how we collect, use, disclose and store Personal Information, and how you can access or correct your information.
2 Purpose
This Privacy Policy (Policy) outlines what is required to fulfil our commitment to privacy and confidentiality and describes how we manage Personal Information, including health and other sensitive information. It explains how Y Whittlesea collects, uses, discloses, and stores personal information, and how individuals may access or correct that information.
It also explains how individuals can make an enquiry or a complaint about a breach of privacy, and how complaints will be handled.
3 Scope
This Policy applies to all operations and services of Y Whittlesea, its staff, volunteers, contractors and visitors and anyone else acting for or on behalf of the organisation.
4 Definitions
Staff or Volunteer – any person employed by Y Whittlesea by either paid employment or contract are responsible for the daily implementation of this Policy during all operations of Y Whittlesea.
Contractors – any person engaged to carry out routine maintenance at the site/service
Personal Information – information (or an opinion) about a person, which could reasonably identify them.
Sensitive Information – a category of personal information that can include race or ethnicity, political opinions or membership, religious or philosophical beliefs, professional or trade association or union membership, sexual preferences or practices, criminal records, health information or genetic/biometric information such as fingerprints. Y Whittlesea has additional obligations for the management of sensitive information (including health information).
Visitors – any person who engages with Y Whittlesea programs and services.
5 Information we collect
5.1 In the course of undertaking and delivering our community, education, youth and disability services, functions and activities, the type of Personal Information we collect may vary depending on how individuals engage with us.
5. 2 The type of Personal Information held and collected by Y Whittlesea may include:
Name
Health information
Personal contact details including phone number, residential address and email address
Business contact details including email, job title and organisation
Date of birth
Banking details (including bank accounts, tax file numbers and superannuation)
Government or agency issued ID such as Medicare, driver’s license, current Working with Children Check
Next of kin details
Details of any Y Whittlesea services used
Parent / carer reference
Participant Centrelink reference
Family Court Orders and other documentation relating to parenting matters
Any other information provided to us or authorised by individuals for us to collect as part of their involvement with Y Whittlesea.
6 Use of Personal Information
6.1 Y Whittlesea will use and disclose Personal Information for the purpose for which we have collected it. This includes but is not limited to the following general purposes of:
To identify a person such as when assessing a person’s eligibility for enrolment into our services or assessing their needs to develop a care plan.
Delivering and managing our core community and disability related services, including billing and collecting fees.
To fulfill our obligations to persons enrolled or participating in our services.
To establish and manage the relationship with our employees, contractors and volunteers employment.
Researching, developing and improving Y Whittlesea services.
Fundraising and seeking donations.
To respond to general inquiries, service requests, and information requests from the Y Whittlesea community and members of the public.
For a purpose consented to.
To comply with our legal and regulatory requirements including registration obligations as a National Disability Inclusion Scheme (NDIS) provider and statutory reporting.
Marketing and promotion of services which the Y Whittlesea considers may be of interest to the person (with the option to opt-out).
6.2 We may also use and disclose Personal Information for a related secondary purpose where the individual reasonably expects, where we are authorised or otherwise required to by law, such as providing information to government departments or agencies.
6.3 We may also use or disclose health information only for the purpose it was collected or a directly related secondary purpose, or where the individual has consented to the disclosure.
7 How we collect information
7.1 As far as practical, we will always try to collect information about the person directly from them or their authorised representative within the requirements of applicable privacy law where it is reasonably necessary and practicable to do so. The purpose for the Y Whittlesea obtaining this information will be made clear at the time of collection. Personal information may be collected when interacting with our staff, completing physical or online forms, scanned copies of documents and certificates, postal mail, telephone, or email.
7.2 Information will be obtained in a private setting, and wherever possible, in the person’s preferred language if requested and as such an external interpreter service provider may be engaged.
7.3 We may also collect information about individuals from other sources such as contracted service providers who assist us to operate our business, or when the individual or their parent, legal guardian, carer or an authorised person, has consented to sharing information with us.
7.4 Y Whittlesea may collect, use or disclose personal information about anyone under the age of 18 with the consent of parents and as otherwise authorised by law, and may, in relation to a young person aged 15-17, collect use and disclose that young person’s personal information with their consent and as otherwise authorised by law.
7.5 Participants of our children’s and disability services will be reminded of their privacy rights on a regular basis (including annually at each reassessment if applicable).
7.6 Where Y Whittlesea receives personal information about an individual that is unsolicited or not reasonably necessary for one or more of our functions or activities, it will be deleted or de-identified, or we will notify the individual of its collection, its use, and their rights.
7.7 Individuals can choose to remain anonymous or use a pseudonym where practicable, but this may limit our ability to engage with individuals for the purpose intended or meet our legal and regulatory obligations. For example, we would not be able to enrol a student or fulfil our enrolment obligations.
8 Sensitive Information
8.1 Y Whittlesea generally only collects Sensitive Information if we are authorised with the individual’s consent or where it is required by law. This might include information about police checks, working with children checks, and health information.
8.2 If we require Sensitive Information for one or more of our functions or activities, we will only collect it from the individual or their authorised representative for a specific purpose.
9 Consent
9.1 By acquiring or using Y Whittlesea services, products or facilities, individuals consent to the reasonable collection, use and disclosure of personal information. Consent may be directly implied in the completion of an application, membership or registration form. Alternatively, consent may be indirectly implied (for example, personal information is given in order to send information regarding programs and services).
9.2 Before seeking a person’s consent to collect information, Y Whittlesea will inform the person about:
What kinds of information we wish to collect and our purpose for collecting such information.
Their rights to privacy and confidentiality.
Their right to refuse to give personal information and the consequences of such a refusal.
Their right to access their personal information.
Their right to complain if they think their information has been collected, used or stored inappropriately.
10 Disclosure of Personal Information
10.1 Y Whittlesea does not sell, rent or trade Personal Information to, or with, third parties.
10.2 Where necessary and appropriate, Y Whittlesea may disclose Personal Information to third-party organisations and/or individuals outside Y Whittlesea in order to provide the range and quality of services and programs. This includes:
Financial institutions.
Regulatory agencies or government bodies (such as the NDIS and Australian Tax Office).
Our contracted service providers, including Y Australia, who provide us with a range of professional and business services (such as organisations assisting us to improve our services).
Professional advisers (such as recruitment advisers, Y Whittlesea auditors, accountants, insurers, and lawyers).
Information technology vendors.
Externally hosted applications and software subscriptions (for example, for recruiting and onboarding of employees).
As required or authorised by law and government departments.
Or, otherwise where we have received consent from individuals.
11 Access and Correction
11.1 Y Whittlesea takes all reasonable steps to correct any information as required and ensure that the Personal Information collected, used and disclosed is accurate, complete, up to date and relevant whenever it is collected, used or disclosed. Individuals have a right to contact us about their privacy concerns or about Personal Information we may hold about them. Individuals have a right to:
Access and correct their Personal Information.
Opt-out at any time where our use and disclosure requires consent.
11.2 Individuals can contact us at any time using the details below and we will respond within a reasonable time.
11.3 Children’s Services and Disability Services participants are required to update their enrolment details annually, or whenever they experience a change in circumstances. In some cases, updates may be required on a program-by-program basis.
11.4 In some circumstances a request for access to information may be denied. These circumstances may include when:
Granting access would pose a serious threat to the life or health of the individual.
The information was given in confidence by another person, unless that other person consents.
It would have an unreasonable impact on the privacy of others.
It is unlawful or is required or authorised by law to withhold.
11.5 Access will only be denied to those parts of the individual’s records that concern the above circumstances. If access is denied, Y Whittlesea will give written notice that sets out the reasons for the refusal and how someone may make a complaint about the refusal.
11.6 For personal information to be released to the person, or transferred to another service, a Personal Information Request Form must be completed with adequate proof of identification and submitted to the relevant Area Director. All requests are to be processed within 30 days of receipt of application, at no charge.
12 Storage, Security and Protection of Personal Information
12.1 Y Whittlesea holds and stores data in hard copy documents, onsite and off site, or as electronic data in our software or systems, including cloud or other types of electronic storage. Where information is stored off site, Y Whittlesea has confidentiality agreements with the archival suppliers in place.
12.2 We use physical and technical safeguards to protect data from interference or unauthorised access, modification, use or disclosure. These include managed access controls to our systems and network, and security measures for access to premises as specified in the Data Collection, Storage & Destruction Protocol and Archiving Instructions.
12.3 Personal Information may be disclosed to third parties in Australia, where it is necessary to perform our core business functions and administer services consistent with this Policy.
12.4 We take reasonable steps to maintain the integrity and security of any data and personal information to prevent interference, misuse, unauthorised access or loss, such as implementing technical measures for data storage and protection and entering into contractual arrangements with third parties that cover data authorised used and disclose or personal information, including any cross-border transfer of data outside Victoria or Australia, consistent with applicable privacy law.
12.5 In the unlikely event of a security breach, or an eligible data breach, it will be dealt with according to current procedures maintained in the Y Whittlesea Business Continuity Plan.
13 Children's Privacy
13.1 Y Whittlesea has obligations to create a safe school environment for current and prospective students enrolled at our Early Learning Centres and Kindergartens, and Y Community School (the School). Accordingly, the School recognises that the rights of children and young people in relation to privacy might restrict access to the child’s/young person’s personal, sensitive or health information by parents or guardians.
13.2 The School will respect requests for privacy where permitted and appropriate in the circumstances, having regard to the child’s/young person’s capacity to consent and maturity, and any legal obligations.
13.3 Our child safety commitment and obligations to comply with Child Safety Law require that we maintain records and meet information sharing and reporting obligations in response to suspected child abuse. For more information, please refer to our Child Safety Policy (Organisation and Early Years).
14 Website Privacy
14.1 We will only collect personal information through our website whittlesea.ymca.org.au if it is provided by an individual to respond to an information request or inquiry.
14.2 Information recorded when users interact with our website includes:
IP address;
location data (where available and not disabled by the user);
the type of web browser used;
dates, times, and other user activity.
14.3 In most cases, we will not be able to reasonably identify a visitor to our website from the information collected. However, if cookies or similar technologies are linked with personal information we hold about a user, this cookie information becomes personal information and will be treated in the same manner as the personal information to which it has been linked. A cookie is a small text file that is sent to a device by the user’s web browser which then stores a record of the visit in the web browser used. Cookies enable the proper functioning of our website and assist us to improve our website browsing experience. Users can manage their cookie settings via their web browser privacy settings.
14.4 Our website also uses interfaces with social media sites such as Facebook, Instagram and YouTube and links to third party websites. Y Whittlesea is not responsible for the protection of personal information provided to third parties where individuals choose to navigate to them via our website. We recommend users review the privacy policy applicable to the website visited.
15 Contacting Us
15.1 If you have any concerns or complaints about our privacy practices, or wish to enquire about how your Personal Information is managed, please contact Y Whittlesea and direct these to the Office of the Y Whittlesea CEO.
15.2 All privacy related inquiries or complaints should be directed to the contact details below:
Email: contact@ywhittlesea.org.au
Phone: (03) 9407 6200
Address: PO Box 375, South Morang 3752
15.3 We may be able to assist with an inquiry over the telephone but, if not, you will be asked to put your question or complaint in writing and send to the above address.
15.4 We will endeavour for all written correspondence to be responded to within five (5) business days of being received. All complaints will be dealt with fairly and as quickly as possible.
15.5 If a complaint remains unresolved or our response is not considered satisfactory, you may apply to the Office of the Australian Information Commissioner (OAIC) at www.oaic.gov.au to have the complaint heard and determined, or in some circumstances, the Victorian Health Complaints Commissioner hcc.vic.gov.au or Freecall 1800 136 066.
16 Changes to our Privacy Policy
16.1 This policy will be reviewed every two years or more frequently if operational changes impact privacy and data management compliance. Updates may be published on our website without notice.
16.2 By continuing to use Y Whittlesea services and our website, individuals are deemed to have accepted any changes to our Privacy Policy.
16.3 This policy was last updated on 30/3/26.