Privacy Policy

1. PURPOSE

This policy describes how International Women’s Development Agency (IWDA) collects, uses, discloses, stores and manages personal information, and fulfils its obligations under the Privacy Act 1988 (Cth) (Privacy Act) and the Australian Privacy Principles (APP) contained in the Privacy Act.

Personal information means information or an opinion about an identified individual, or an individual who is reasonably identifiable. This policy details the personal information collected by IWDA, including why IWDA holds personal information, how it is protected, and the choices individuals can make about their personal information.

2. SCOPE

This policy applies to all entities and individuals engaging with IWDA including, but not limited to:

  • Donors and supporters;
  • Staff, volunteers and consultants;
  • Contractors and service providers;
  • Survey respondents and research participants;
  • Website users and event attendees.

3. POLICY

IWDA respects individual privacy and is committed to protecting personal information. IWDA applies the Australian Privacy Principles, and is guided by the Code of Ethics and Professional Conduct of the Fundraising Institute of Australia (FIA).

Collection and storage of personal information

IWDA collects and retains personal information necessary to assist in achieving our mission, managing our relationships with donors and other supporters, keeping people informed of our activities, strengthening the organisation through fundraising, and complying with legal requirements.

IWDA collects personal information only by fair and lawful means and, whenever reasonably possible, directly from the individual.

IWDA collects personal information in a range of ways, including when individuals make a donation, subscribe to updates, attend events, participate in campaigns, surveys or research, apply for or undertake employment or volunteer roles, visit IWDA’s website, engage with IWDA, or otherwise provide information to IWDA or to a service provider acting on IWDA’s behalf.

If IWDA receives unsolicited personal information, IWDA will assess whether it could have collected the information under the Privacy Act. If not, and if it is lawful and reasonable to do so, IWDA will destroy or de-identify the information.

The types of personal information collected include:

  • identifying information, such as your name;
  • contact information, such as your postal address, email address and telephone number;
  • financial information, such as the payment details for donations;
  • details of any services or training we provide;
  • records of our communications and other interactions with you, including messages you send us;
  • information about your engagement with IWDA communications, events, campaigns and appeals, including your communication preferences and interaction data (for example, whether you open emails or click links).

IWDA collects sensitive information only with consent and only when the information is reasonably necessary for the activities of IWDA. For example, IWDA will collect sensitive information through the Equality Insights Survey for the purpose of understanding deprivation.

IWDA takes reasonable steps to destroy or de-identify personal information where required under the Privacy Act, including where the information is no longer required for the purposes for which it was collected or any related legal, regulatory, accounting or operational purpose. This includes donation and donor data, employee data and other sensitive information.

Individuals contacting IWDA may request anonymity, with the exception of donors who wish to receive tax receipts, as limited personal information is necessary in order to issue acknowledgement of contributions for tax purposes. IWDA will practice donor confidentiality and will only publicly identify IWDA donors with their advance knowledge and permission.

Equality Insights

When conducting the Equality Insights Survey, IWDA ensures:

  • Participation is voluntary and, where possible, individuals may choose to keep their data anonymous, though it will not be anonymous to enumerators conducting the survey;
  • Informed consent is obtained and documented;
  • Enumerators and supervisors follow privacy and confidentiality protocols;
  • Contractual agreements with external research firms include privacy clauses ensuring compliance with Australian privacy laws.

Online Privacy

To improve its website, IWDA collects standard information about website visitors, including cookies provided by a third party such as Google Analytics. This information is accessed by IWDA anonymously and in aggregate to track website usage. This information may also be accessed by Google Analytics. However, IWDA will make no attempt to identify individual users or their browsing activities except where required by law. Individuals may opt out of Google Analytics tracking by adjusting browser settings or using Google’s opt-out tool.

Personal information collected through the IWDA website or the website of a third-party vendor acting on IWDA’s behalf (e.g. donations, newsletter sign-ups, workshops sign-ups, petitions) is stored securely and accessible only to authorised IWDA representatives. Credit card details collected online are securely handled by our third-party payment processors, IWDA does not store these details.

Offline Privacy

Personal information collected over the phone or in person is stored securely. Credit card details collected over the phone or in person are encrypted in our database, and all personal information is stored securely where it is only accessible by authorised IWDA representatives.

Third-parties

Personal information collected by third-party vendors on IWDA’s behalf, either through online or offline channels, is subject to that vendor’s privacy policy and practices, in addition to this policy.

IWDA requires third-party vendors that collect personal information on its behalf to identify themselves as doing so, where practicable, and to collect personal information only by lawful and fair means, so as to support individuals to make informed decisions about when and how they disclose their personal information.

IWDA may disclose personal information to third-party service providers for the purposes described in this policy, including where those providers supply, operate or support computer programs (including data analytics programs) and other automated tools.

IWDA takes reasonable steps to ensure that third-party service providers handle personal information in accordance with applicable privacy laws, including by issuing instructions, imposing contractual obligations and taking steps to understand how those providers use personal information and how their outputs may inform IWDA’s activities.

IWDA also takes reasonable steps to ensure that personal information disclosed to service providers is safeguarded to a standard no less protective than IWDA’s own. However, IWDA cannot control the business practices of independent third parties.

Use of personal information

IWDA collects and retains personal information to:

  • Achieve its mission and manage relationships with donors and supporters;
  • Keep individuals informed about IWDA’s activities;
  • Strengthen fundraising and advocacy efforts;
  • Comply with legal requirements.

IWDA may send you fundraising, marketing or other communications about our activities and those of our partner organisations where permitted by law, including where you have consented or where it is otherwise reasonable to expect that IWDA would use your personal information for that purpose.

You can opt out of receiving marketing communications from us at any time by contacting us or following the “unsubscribe” link in the communication.

Occasionally we may allow like-minded organisations to contact you with information that may be of interest to you, including some organisations located outside Australia, where permitted by law and where you have not opted out. Those organisations allow us to do the same and this way we can reach more people with vital information.

IWDA does not share personal information with third parties unless:

  • The individual provides explicit consent;
  • The data is shared with contracted service providers (e.g. external marketing agencies) for necessary IWDA functions;
  • Disclosure is required by law.

When sharing personal information with contractors or service providers, IWDA uses contractual arrangements and other reasonable steps to ensure that personal information is used only for authorised purposes, protected appropriately and retained only for as long as necessary.

Use of automated tools

IWDA may use computer programs (including data analytics programs) and other automated tools, including tools provided by third-party service providers, for fundraising, marketing, advertising, website functionality, internal workplace processes and supporter engagement purposes.

IWDA does not use automated tools to make, or to do things substantially and directly related to making decisions about an individual’s eligibility for services, rights or entitlements, or that could otherwise significantly affect an individual’s rights or interests.

Consistent with the above, the tools IWDA uses may analyse personal information, including contact, engagement, external and internal feedback, demographic, geographic and online interaction data, to generate insights and recommendations relating to IWDA operations and activities.

The outputs of these tools may be used to segment audiences, identify engagement opportunities, optimise communication, advertising and fundraising, personalise content, summarise feedback, assist with drafting communications and performance reflections, and review content.

Some routine decisions, such as audience segmentation, communication optimisation, advertising optimisation and the personalisation of suggested donation amounts, may be made on an automated basis. These decisions do not affect an individual’s substantive rights or entitlements. In other cases, outputs are provided as recommendations for IWDA personnel to consider.

IWDA does not treat automated outputs as determinative. IWDA maintains human oversight of its activities and may review, adjust or override outputs where appropriate.

IWDA also takes reasonable steps to ensure that its use of automated tools is fair, proportionate and limited to information reasonably necessary for the relevant purpose, including by taking reasonable steps to distinguish between uses involving personal information and uses involving de-identified information only.

Overseas disclosure

IWDA may disclose personal information to overseas recipients in limited circumstances where this is required by the nature of our work.

Circumstances where IWDA may disclose personal information overseas include where arranging travel for a contractor engaged by IWDA, supporting professional networking between contacts in Australia and overseas, engaging overseas-based service providers, or working with partners in countries where IWDA is actively engaged, including those listed on our website.

Where we disclose personal information overseas, including to providers with servers based overseas, we take reasonable steps to ensure that the recipient handles the information in a manner consistent with Australian privacy law, unless an exception applies.

Accessing and correcting personal information

IWDA takes reasonable steps to ensure that the personal information we collect, use and disclose is accurate, up to date, complete and relevant, having regard to the purpose for which it is used or disclosed.

Individuals may request access to, or correction of, personal information held by IWDA, subject to certain exceptions under the Privacy Act. Requests should be made to IWDA’s Privacy Officer using the contact details in this policy.

IWDA will respond to access and correction requests within a reasonable period. IWDA will provide access in the manner requested where it is reasonable and practicable to do so, and may require verification of identity before granting access or making a correction. IWDA may charge a reasonable administrative fee for providing access, and will notify individuals in advance if this applies.

Where a request for correction is made, IWDA will take reasonable steps to correct the information so that it is accurate, up to date, complete, relevant and not misleading, having regard to the purpose for which it is held.

There may be circumstances where IWDA does not provide access or make a correction, including where an exception under the Privacy Act applies. In those cases, IWDA will provide written reasons and information about how to make a complaint, where it is reasonable and lawful to do so.

Individuals may also contact IWDA for more information about how IWDA uses automated tools in relation to personal information, or if they believe their personal information has been handled unfairly or incorrectly in connection with those tools.

Data Retention and Breach Response

IWDA retains personal information only for as long as necessary for the purposes for which it was collected, including any related legal, regulatory, accounting or operational purposes.

When personal information is no longer required, IWDA takes reasonable steps to destroy or de-identify it securely.

IWDA takes reasonable steps to protect personal information we hold from misuse, interference and loss, and from unauthorised access, modification or disclosure. These steps may include physical, technical and administrative safeguards appropriate to the nature of the information and the circumstances in which it is held.

IWDA has a Business Continuity Plan which outlines whole-of-organisation plans and procedures for the recovery of business-critical processes. A key reference document is IWDA’s Data Breach Response Plan, which outlines the approach to managing potential security incidents, including:

  • Investigating suspected breaches;
  • Notifying affected individuals as required; and
  • Notifying regulatory authorities as required.

Personnel Records

IWDA collects, stores, and processes personal information of staff, volunteers, and consultants in compliance with Australian privacy laws and workplace regulations. This includes, but is not limited to:

  • Employment records, including contracts and position details;
  • Payroll and banking details for salary, superannuation and other payments;
  • Performance evaluations and professional development records;
  • Workplace health and safety information, including leave records and medical records where required.

This information is collected only for the purposes of employment administration, workplace safety, legal compliance, and organisational management.

Access to staff records is strictly limited to authorised personnel within IWDA’s leadership, finance, and people & culture teams, and to third-party service providers where necessary for the purposes described in this policy. For example, IWDA may provide payroll and banking details to its outsourced payroll provider to facilitate payroll processing.

IWDA implements secure storage and data protection measures, including encryption and restricted access controls, to safeguard employment-related information.

As noted above, where personal information is disclosed to service providers, including where it is disclosed or stored overseas, IWDA takes reasonable steps to ensure that it is protected and handled in accordance with the measures described in this policy.

Employment records are retained only for as long as necessary to meet contractual, legal, and regulatory obligations. When records are no longer required, they will be securely deleted or archived in compliance with relevant laws.

Staff members may request access to or corrections of their personal information by contacting IWDA’s Privacy Officer. However, access may be restricted where it interferes with legal obligations or the privacy of others.

4. PRIVACY ENQUIRIES & COMPLAINTS

IWDA is committed to working with individuals to obtain a fair resolution of any privacy concerns.

If you are concerned about the way in which we are managing your personal information and think we may have breached the Australian Privacy Principles, or any other relevant obligation, please contact us using the contact details set out below.

We will acknowledge and deal with the matter within a reasonable time and will keep you informed of the progress of our investigation.

If we have not responded to you within a reasonable time or if you feel that your complaint has not been resolved satisfactorily, you can contact us to discuss your concerns or make a complaint to the Office of the Australian Information Commissioner (OAIC).

Please contact us by calling (+61 3) 8373 2500, emailing privacy@iwda.org.au, or writing to:

The Privacy Officer
IWDA
PO Box 64, Flinders Lane
Victoria, Australia, 8009

You are also entitled to make a complaint to the Office of the Australian Information Commissioner (OAIC). You can obtain further general information about your privacy rights and privacy law from the OAIC by:

  • calling their Privacy Hotline on 1300 363 992;
  • visiting their website at www.oaic.gov.au;
  • writing to:

The Australian Information Commissioner
GPO Box 5288
Sydney NSW 2001

5. REVIEW AND AMENDMENT

Chief Executive Officer, with support from the IWDA Leadership Team as required, is responsible for the administration, interpretation, and application of this Policy.

The Policy will be reviewed every year and may be amended at the discretion of the CEO.

6. REFERENCES/RELATED DOCUMENTS