1. Purpose
This Privacy and Data Protection Policy explains how WestCycle Incorporated collects, holds, uses, discloses, protects, retains, destroys and de-identifies personal information. WestCycle is committed to protecting the privacy and confidentiality of personal information and to handling personal information in a fair, transparent and secure way. This policy is written to align with the Australian Privacy Principles (APPs) under the Privacy Act 1988 (Cth), as well as other privacy, records, employment, funding, insurance and governance obligations that may apply to WestCycle. When we collect your personal information, our commitment to the protection and privacy of your personal information is our priority.
2. Scope
This policy applies to personal information handled by WestCycle across its memberships, events, programs, advocacy, consultation, communications, website, employment, volunteer, governance, funding and operational activities.
This policy applies to WestCycle Board and committee members, employees, contractors, volunteers, officials, coaches, administrators and any other person who collects, accesses, uses or manages personal information on behalf of WestCycle. These people are expected to understand and comply with this policy when performing work or duties for WestCycle, including when working away from the workplace or using digital systems.
3. Types of Information
Personal information means ‘information or an opinion (including information or an opinion forming part of a database), that is recorded in any form and whether true or not, about an individual whose identity is apparent, or can reasonably be ascertained, from the information or opinion.’ Personal information can be almost any information linked to someone, including but not limited to:
- Name
- Sex
- Age
- Marital status
- Education
Sensitive information is a type of personal information. It may include information about health, disability, racial or ethnic origin, political opinions, memberships, religious or philosophical beliefs, criminal record or other sensitive matters. Health information includes information about a person’s health, disability, medical needs or the provision of health services. WestCycle only collects sensitive or health information where it is reasonably necessary for its activities, where the individual has consented, or where collection is otherwise permitted or required by law.
4. What Information WestCycle May Collect
The type of personal information WestCycle collects depends on the nature of the individual’s interaction with us. We aim to describe the categories of information we may collect rather than list every possible data field.
- Contact and identification information such as name, contact details, date of birth or other details needed to identify or communicate with an individual.
- Membership, club, participation and event information, including registration details, membership status, emergency contact details, participation history and relevant eligibility or accreditation information.
- Payment and transaction information including details needed to process payments, refunds, membership fees, event entries, merchandise purchases or other transactions.
- Health, medical, accessibility, dietary, emergency or safety information where relevant to safe participation in events, programs or activities.
- Survey, research, consultation and advocacy information, including responses to surveys, consultation feedback, travel patterns, preferences or other information provided voluntarily.
- Website and digital interaction information, such as website forms, cookies, online service use, newsletter subscriptions, event platforms, analytics and digital communications.
- Employment, volunteer, contractor and governance information, where relevant to recruitment, onboarding, employment, volunteering, Board or committee work, training, compliance, insurance or safety.
- Other information voluntarily provided to WestCycle or reasonably required for WestCycle to deliver its activities, meet obligations or respond to enquiries.
5. How WestCycle collects information
WestCycle collects personal information by fair and lawful means. Where practicable, we collect information directly from the individual so the information is accurate, current and provided with context. We may collect information through:
- Membership subscriptions and renewals
- Event and program registrations and participation
- Volunteer, official, coach, staff, contractor and Board/committee processes
- Surveys, research, consultation activities and advocacy engagement
- Website visits, cookies, forms, online platforms and other digital services
- Newsletter subscriptions, email, phone, written correspondence and social media interactions
- Payment processing and transaction systems
- Third-party platforms or partners that support WestCycle activities, where appropriate
At or before collection, or as soon as practicable afterwards, WestCycle will take reasonable steps to tell individuals why information is being collected, how it will be used, the consequences if information is not provided, and how the individual can access, correct or complain about the handling of their information.
6. Anonymity and Pseudonymity
Where lawful and practicable, individuals may interact with WestCycle anonymously or using a pseudonym. In many cases, however, WestCycle needs to identify an individual to provide memberships, event entries, insurance coverage, refunds, safety support, qualification checks, communications, complaints handling or other services. If identification is required and information is not provided, WestCycle may not be able to provide the requested service or activity.
7. Why WestCycle uses personal information
WestCycle uses personal information for the primary purpose for which it was collected and for related purposes that an individual would reasonably expect. WestCycle may use personal information to:
- Deliver memberships, events, programs, services, training, resources and other riding-related activities
- Process registrations, payments, refunds, merchandise, memberships and other transactions
- Communicate with members, participants, volunteers, stakeholders, funders, partners and the broader riding community
- Manage safety, risk, insurance, emergency response, event operations and incident reporting
- Conduct research, surveys, evaluation, consultation and advocacy activities
- Improve services, systems, website experience, communications and organisational performance
- Meet legal, employment, funding, insurance, governance, audit, record-keeping and reporting obligations
- Respond to enquiries, complaints, access requests and correction requests
- Manage staff, contractors, volunteers, officials, coaches, Board and Committee arrangements
WestCycle will not use or disclose personal information for a different purpose unless the individual has consented, the use or disclosure is related to the original purpose and reasonably expected, or the use or disclosure is otherwise permitted or required by law.
8. Destruction and De-identification of personal information
WestCycle will take reasonable steps to destroy personal information when it is no longer needed by us or for legal requirements, so that it cannot in any way be recovered.
WestCycle will review any alleged breach of this procedure on a case-by-case basis. If the alleged breach is of a serious nature (such as using social media in a way that constitutes harassment) the person shall be given an opportunity to respond in relation to the alleged breach.
Employees who fail to comply with this procedure may face disciplinary action. In serious cases termination of employment or contract may result.
9. Disclosure of personal information
WestCycle may disclose personal information where reasonably necessary for its activities, where an individual has consented, where disclosure is expected in the circumstances, or where required or authorised by law. This may include disclosure to:
- Service providers that support WestCycle operations including cloud data storage, payment processing, email marketing, event registration, survey hosting, website, IT and administrative services
- Event partners, delivery partners, member organisations, clubs, officials, volunteers, insurers, emergency services, traffic management providers, medical providers or other parties involved in delivering events and programs
- Funding bodies, auditors, regulators, government agencies, insurers, legal advisers or other parties where required for reporting, compliance, safety, governance or legal purposes
- Other parties where the individual has provided consent or would reasonably expect the disclosure in connection with the relevant activity
- WestCycle does not sell personal information. WestCycle will take reasonable steps to ensure that third parties that handle personal information on its behalf manage that information securely and consistently with this policy and applicable privacy obligations.
10. Direct marketing and communications
WestCycle may use personal information to send communications about WestCycle memberships, events, programs, news, advocacy, surveys, consultation opportunities, services, fundraising or other riding-related activities where the individual has consented or would reasonably expect to receive those communications. WestCycle will provide a simple way to opt out of direct marketing communications and will respect opt-out requests. WestCycle will only use sensitive information for direct marketing where the individual has consented or where otherwise permitted by law.
11. Overseas disclosure and third party systems
Where possible data should be stored in Australia to ensure compliance with the Australian Privacy Principles (APP).
To effectively operate our organisation and deliver our services, WestCycle may disclose personal information to third-party service providers located outside of Australia. These include providers who assist us with cloud data storage, payment processing, email marketing and survey hosting.
Currently, we disclose personal information to recipients located in the United States of America, Canada and Singapore.
Before disclosing personal information to an overseas recipient, WestCycle will take reasonable steps to ensure that the recipient treats the data securely and handles it in a manner consistent with the Australian Privacy Principles. This includes conducting due diligence on the provider’s security measures and executing contracts that enforce strict data protection obligations.
12. Government related identifiers
WestCycle will not adopt, use or disclose a government related identifier as its own identifier of an individual unless permitted or required by law.
13. Information quality and correction
WestCycle takes reasonable steps to ensure that personal information it collects, uses and discloses is accurate, complete, current and relevant for the purpose for which it is used. Individuals can contact WestCycle to ask for their personal information to be corrected if they believe it is inaccurate, incomplete, out of date or misleading.
If WestCycle agrees the information should be corrected, it will take reasonable steps to correct it and, where appropriate, notify relevant third parties. If WestCycle does not agree to a requested correction, it will provide reasons where required and may attach a statement to the information noting the individual’s request.
14. SECURITY of personal information
WestCycle takes reasonable steps to protect personal information from misuse, interference, loss, unauthorised access, modification or disclosure. Security measures may include:
- Password-protected systems and account controls
- Role-based access controls and access limited to authorised personnel with a need to know
- Secure cloud-based services and supplier due diligence
- Physical and electronic security controls
- Staff, volunteer and contractor awareness of privacy obligations
- Processes for managing suspected or actual data breaches
- Secure destruction or de-identification when information is no longer required
WestCycle personnel must only access personal information that is required for their role, must not share accounts or passwords, and must report any suspected privacy or data security incident as soon as practicable through WestCycle’s internal reporting process.
15. Retention, destruction and de-identification
WestCycle retains personal information only for as long as reasonably necessary to fulfil the purposes for which it was collected and to meet legal, insurance, governance, employment, funding, audit, tax, record-keeping and operational requirements. When personal information is no longer required, WestCycle will take reasonable steps to securely destroy it or de-identify it so that it can no longer reasonably identify an individual.
16. Access to personal information
Individuals may request access to personal information WestCycle holds about them by contacting WestCycle using the details in this policy. WestCycle will respond within a reasonable timeframe.
There may be circumstances where WestCycle cannot provide access, such as where providing access would unreasonably affect another person’s privacy, reveal confidential information, prejudice an investigation, breach legal obligations or where another lawful exception applies. If access is refused, WestCycle will provide written reasons where required.
17. PRIVACY COMPLAINTS AND ENQUIRIES
If an individual has a question about this policy, wishes to access or correct personal information, or wants to make a privacy complaint, they can contact:
WestCycle Incorporated
Email: info@westcycle.org.au
WestCycle will investigate privacy complaints and endeavour to respond within a reasonable timeframe. If an individual is not satisfied with WestCycle’s response, they may lodge a complaint with the Office of the Australian Information Commissioner (OAIC).
18. Data breaches
If WestCycle becomes aware of an actual or suspected data breach involving personal information, it will take reasonable steps to contain the incident, assess what has occurred, reduce the risk of harm, and determine whether notification is required. Where required by law, WestCycle will notify affected individuals and relevant regulatory authorities.
19. Privacy and data collection
Our Privacy and Data Protection Policy reflects the Australia Privacy Principles located in Schedule 1 of the Privacy Amendment (Enhancing Privacy Protection) Act 2012.
Our Policy reinforces the commitment by WestCycle that our practices will respect and protect the rights of the individual. The policy will enable WestCycle to deal with inquiries or complaints from individuals about WestCycle’s compliance with the Australian Privacy Principles.
WestCycle shall be open about its practices in respect of information gathering, use and dissemination, and will only solicit and/or retain personal information that is required to enable the Company to carry out its operations, and any personal information that WestCycle is required to solicit and/or retain by law.
WestCycle shall determine the level of access to personal information held by the Organisation, to ensure that such information is only to those persons who require access. Where required, information shall be stored in secure lockable locations; access to information that is stored in computer systems shall be restricted to authorised personnel by the use of password protection.
WestCycle shall restrict the active collection of personal information to that which is required in order to deliver a particular service. WestCycle will not knowingly collect sensitive information about any persons and/or seek any identifying information about an individual unless there is a legal requirement to do so (e.g. Tax file number for employees).
Personal information that is voluntarily provided to WestCycle by any individual – either external or internal to the Company – shall be used only for the purposes for which it was provided.
WestCycle will ensure that accountability for privacy is delegated to a specific individual. Each individual employee is responsible for carrying out his or her duties in accordance with this policy.
20. Review and approval
This policy will be reviewed annually, or earlier if there are material changes to WestCycle’s activities, systems, information handling practices, legal obligations or privacy risks.
Internal control systems and procedures will be audited regularly to ensure that they are effective in minimising the risk of non‐compliance with this policy. This document should not be modified without the approval of the WestCycle Board. All employees are required to understand and comply with this policy and to follow the requirements set out in this policy.
This policy will be reviewed annually, or earlier if there are material changes to WestCycle’s activities, systems, information handling practices, legal obligations or privacy risks.
Internal control systems and procedures will be audited regularly to ensure that they are effective in minimising the risk of non‐compliance with this policy. This document should not be modified without the approval of the WestCycle Board. All employees are required to understand and comply with this policy and to follow the requirements set out in this policy.
