Privacy Policy

Why we do this

People trust us with their details, and parents trust us with information about their children. We believe that trust is a matter of honour. We treat what you tell us the way we'd want our own family's details treated. We only ever use it for the work you'd expect of us.

Avoiding extremes (Ecclesiastes 7:16-18). We steer between two extremes. One is carelessness with what people trust us with. The other is guarding information so rigidly that we cannot care for members, answer a parent or protect a child. We hold the middle by collecting only what we need, saying plainly what we do with it, and letting people see and correct their own details. Protecting children and meeting our legal duties are bright lines, not extremes: no privacy rule will stand in the way of a child's safety (Matthew 18:6).

At a glance

We do not sell your information. You can ask to see it, ask us to correct it, and ask us to stop sending you marketing at any time.

1. What this covers

This policy applies to Australian Christian Arts Limited (AChA, ABN 31 644 225 758). It covers all our programmes (the Australian Christian Orchestra, Choir, Youth Orchestra, Youth Choir and Productions) and events.

It covers the personal information of our members and their families, conductors, volunteers, audiences, donors, suppliers and website visitors. It binds everyone who handles that information for us, equally.

We follow the Australian Privacy Principles (APPs) in the Privacy Act 1988 (Cth) voluntarily, as good practice. We have not formally opted in to the Act. The Board can opt in later.

2. Our non-negotiables

What we collect and why

We collect only what is reasonably necessary for our work. That means:

• your contact and membership details

• for young members, the details that keep them safe (parent or carer contacts, emergency contacts, authorised collection people, and health, allergy and dietary information)

• Working With Children Check status for adults in child-related roles

• photos, audio and video from our activities

• payment and donation details (processed by our payment providers)

• website usage data

Some of this is sensitive information, such as health details or religious affiliation. We collect it only with your consent (a parent's or carer's for a young member). We also collect it where the law requires it, or to prevent a serious threat to someone's safety. We never use sensitive information for marketing.

Children and young people

Messages about a young member go to their parent or carer. A parent or carer gives the consents we need, including for photos and recordings.

Group and ensemble images are a normal part of taking part. Close-up or individually identifiable images need explicit written parent or carer consent before we use them in advertising or external promotion.

Only the Welfare Officer and the few people who need it see health and safety information. We share child-safety information with the NSW Police, the Child Protection Helpline or the Office of the Children's Guardian. We do this whenever the law requires it or a child's safety needs it. No privacy rule will stand in the way.

How we use and share it

We use personal information for running our programmes, keeping everyone safe, communicating with you, processing payments, meeting our legal duties and improving what we do. We send newsletters and appeals only to people who have agreed or would reasonably expect them. Every marketing message has a simple unsubscribe, and we act on it within 5 business days.

A person always makes any decision that significantly affects you, such as refusing or ending a membership. Automated systems help with routine work like reminders and routing. They never decide alone.

We share information only with:

• team members who need it

• service providers who work under written terms

• advisers who owe us confidentiality

• authorities, where the law requires or allows it

• anyone else you agree to

Some providers process information overseas, including in the United States. We take reasonable steps, mainly through contract terms, to make sure they handle it consistently with the APPs. The Privacy Officer can give you the current list.

Our online forms. Our feedback, concert and rehearsal feedback, complaint or concern, and faith questions forms run on Tally. Tally stores form answers in Belgium, in the European Union, and uploaded files with a provider in the European Union. Each answer is copied into our own records system, then deleted from Tally once we have checked it arrived safely. Complaint, concern and faith answers are never kept in Tally longer than that.

Keeping it safe, and for how long

We protect information with access limited to those who need it, multi-factor authentication, encryption where the platform supports it and privacy training.

If we suspect a data breach, we contain it at once. We assess within 30 days whether it is likely to cause serious harm. Where it is, we notify the people affected and the Office of the Australian Information Commissioner (OAIC).

We keep information only as long as we need it or the law requires. We never delete anything while a complaint, claim, investigation or legal process involving it is open.

Your rights, and how to complain

You can ask what we hold about you, ask for a correction, or ask us to delete what we no longer need. We may have to keep some records, such as child-safety or financial ones. Parents and carers can ask on behalf of a young member.

Email the Privacy Officer. We acknowledge your request within 5 business days and answer within 30 days, free of charge. If we refuse, we say why in writing.

If you're unhappy with how we've handled your information, tell the Privacy Officer first. We acknowledge your complaint within 5 business days and respond in writing within 30 days. This timeframe never applies to a child-safety concern; see the Child Safety Incident Reporting Pathway. You can also contact the OAIC. Because we follow the APPs voluntarily, it may not be able to investigate a complaint about us.

Example

A parent emails to ask what we hold about their 12 year old. The office confirms who they are and sends a copy within 30 days. It also corrects the emergency contact the parent pointed out.

The full detail behind each section is in the Privacy Policy Procedure.

If this policy isn't followed, and asking for an exception

Tell the Privacy Officer if you think this policy hasn't been followed. We look at what happened, who was or could have been affected, and whether it was careless, deliberate or repeated. A small slip gets a word and a fix. Harm or deceit gets a firm, fast response. Someone reaches out to the people involved with care, alongside the rule.

The same rules apply to everyone, including the CEO and the Board. To ask for an exception, ask the Board Chair in writing. The Chair decides with the Board and records it. If the request concerns the Chair, the Board decides. Legal duties (mandatory reporting, the Working With Children Check, the Privacy Act and whistleblower protections under the Corporations Act) can never be waived. No exception can override a child's safety.

Where to take a concern

Start with the Privacy Officer. If it isn't resolved, or it concerns the Privacy Officer, go to the CEO, then the Board Chair. Anything involving a child or young person goes to the Welfare Officer at once. See the Escalation and Reporting Paths Policy. Discuss a concern only with the HR Officer, the CEO or the Board (the Welfare Officer for child safety). Family and trusted friends outside AChA and the External Welfare Pastor are fine, and legal carve-outs always apply. See the Confidential Concerns and External Welfare Pastor Policy.

Roles and responsibilities

The Board of Directors approves this policy and decides whether AChA formally opts in to the Privacy Act.

The Privacy Officer is a director nominated by the Board, with the CEO as day-to-day delegate. The Privacy Officer answers requests and complaints, keeps the Privacy Register and leads the response to any breach.

The CEO is accountable for following this policy across AChA and for training the team.

The Welfare Officer looks after young members' safety information and child-safety concerns.

Everyone who handles personal information for AChA must use it only for the purpose it was collected. They must also keep it secure and report any suspected breach straight away.

Related policies and documents

• Privacy Policy Procedure

• Privacy and Data Protection Policy (internal)

• Internet and Cookie Policy

• Child Safety Policy

• Records Management Procedure

• Records Management Policy

• Talent and Media Release Policy

• Cybersecurity Policy

• AI and Automation Use Policy

• Complaints and Grievances Policy

Related laws: Privacy Act 1988 (Cth) and the Australian Privacy Principles (the Notifiable Data Breaches scheme is Part IIIC); Spam Act 2003 (Cth).

Definitions

Business day: Monday to Friday, excluding NSW public holidays.

Must, should, may: must means required, with no exception except through the written exception process. Should means expected, unless there is a good reason, which is recorded. May means permitted.

Personal information: information or an opinion about an identified, or reasonably identifiable, person.

Privacy Register: AChA's internal record of what personal information it holds, why, where, with which providers, in which countries, and for how long.

Sensitive information: a kind of personal information given extra protection, including health information, religious beliefs, sexual orientation and criminal record.

Young member: a person under 18 taking part in any AChA activity.

Review

We review this policy every 12 months. We review it sooner if the law changes, a serious breach or complaint occurs, or our systems change materially. The list already includes the automated decision transparency duty (10 December 2026). It also includes the Children's Online Privacy Code (to be registered by 10 December 2026).

Contact

Privacy Officer, Australian Christian Arts Limited

• Email: privacy@australianchristianarts.com

• Office: 02 8531 8678

• Office of the Australian Information Commissioner: oaic.gov.au, 1300 363 992