Privacy Policy
MBS Fitness is committed to providing quality services to you and this policy outlines our ongoing obligations to you in respect of how we manage your Personal Information. We have adopted the Australian Privacy Principles (APPs) contained in the Privacy Act 1988 (Cth) (the Privacy Act). The NPPs govern the way in which we collect, use, disclose, store, secure and dispose of your Personal Information. A copy of the Australian Privacy Principles may be obtained from the website of the Office of the Australian Information Commissioner at www.aoic.gov.au.
1 Who we are
MBS Fitness Initiative Inc. (ABN 99 419 382 883) is a registered charity supporting children and young people in Bridgewater, Tasmania. We refer to the Initiative as we, us or our. This policy covers www.mbsfit.org.au, Youth Fitness, the Active School Program and our associated community and fundraising activities.
We are committed to the Australian Privacy Principles in the Privacy Act 1988 (Cth) and applicable privacy laws. The Initiative is separate from the commercial business MBS Fitness Hobart. This policy concerns information handled by the Initiative, including by providers engaged to perform services on its behalf.
2 Information we collect
Depending on your relationship with us, we may collect your name, contact details, age or date of birth where needed for a program, parent or guardian details, school or referral details, emergency contacts, attendance, consent records, enquiries and feedback. We may also keep relevant incident and complaint records.
For safe and accessible participation, we may need health or other sensitive information such as relevant injuries, medical conditions, allergies, disability-related support needs or emergency plans. We collect only what is reasonably necessary. We normally seek express consent from the person able to give it, unless collection is otherwise required or permitted by law.
Donation records may include the donor's name and contact details, amount, date, payment reference, recurring-payment instructions and payment status. Payment details entered at checkout are processed through the payment service shown there. Please do not send full card numbers or security codes by email or through a general enquiry form.
For staff, contractors or volunteers, we may collect relevant contact, qualification, reference, screening and registration information. Photos, videos, testimonials and other identifiable publicity material are subject to the separate permissions explained below.
Website systems may collect information such as IP address, device and browser details, pages viewed, approximate location and security or error logs. Cookies and similar technologies are explained in our Cookie Policy.
3 How we collect information
We collect information directly through forms, conversations, email, telephone, registration, donations and participation. We may also receive necessary information from a parent or guardian, school, community partner, referrer, service provider or emergency responder where there is appropriate consent or another lawful basis.
People providing information about someone else must be authorised to do so. Where appropriate, we explain what information we receive, why we need it and how it will be used. Please avoid sending detailed health, safeguarding or family information through a general website message; contact us to arrange an appropriate way to provide it.
You may make a general enquiry without identifying yourself or by using a different name where practicable. We may need verified details to arrange safe participation, provide a receipt, manage a recurring donation or meet legal obligations. You may request that your donation is not publicly attributed to you even when we need a private transaction record.
4 Children and young people
We explain information handling in language suited to the young person and collect no more than needed. We assess a young person's ability to make a privacy decision according to their understanding and maturity. Where they cannot provide informed consent, we seek consent from a parent or guardian or another person lawfully authorised to act for them.
Parental permission for program participation is separate from privacy decision-making. We consider the young person's views, safety, legal rights and any relevant court orders when responding to requests for their information. Being a parent, teacher or referrer does not automatically give unrestricted access to a young person's records.
5 Why we use information
We use relevant information to answer enquiries, assess eligibility, arrange and deliver programs, make reasonable adjustments, communicate changes, support participant safety, manage attendance and consent, process donations, issue receipts and handle cancellations or complaints.
We also use information where reasonably necessary for staff and volunteer administration, accounting, insurance, safeguarding, program evaluation, grant reporting and legal obligations. We use de-identified or grouped information for reporting where practicable. We do not treat participation or a donation as permission for unrelated uses of personal information.
6 Who may receive information
Information may be shared on a need-to-know basis with authorised committee members, staff, volunteers and contracted coaches. Relevant schools, parents, guardians and community partners may receive information needed to organise a program or support safety, subject to consent, the young person's rights and applicable law.
We use service providers for website hosting, forms, payments, communications, administration and record storage. Our website and online forms use Wix. Payment services are identified at checkout. These providers may process information to perform their services, prevent fraud and meet their own legal obligations.
Where MBS Fitness Hobart or another provider delivers an Initiative program, we share only the information reasonably needed for the agreed service, safety and lawful administration. The commercial gym is not given permission to use Initiative donor or participant information for its own marketing merely because it supplies a venue or coaches.
We may disclose necessary information to professional advisers, insurers, auditors, emergency services, child protection authorities, police or regulators where authorised or required by law. Grant and donor reporting normally uses grouped or de-identified information. Identifiable information is supplied only with suitable consent or another lawful basis. We do not sell personal information or donor lists.
7 Overseas storage and processing
Information handled through Wix and other online providers may be stored or processed outside Australia. Wix identifies Israel, the United States and Ireland as core processing or storage locations. Its published service-provider network also includes Brazil, Mexico, Luxembourg, Lithuania, India, Germany, the United Kingdom, Ukraine and the Netherlands. The locations involved depend on the particular service and provider.
Further information is available in Wix's Privacy Policy and its list of subprocessors. The payment service you choose may also process information overseas; check the privacy notice presented with that service or contact us for assistance.
We take reasonable steps appropriate to the information and service to protect information handled overseas, including reviewing provider arrangements. Overseas processing does not remove obligations we have under Australian privacy law. We will provide relevant additional information when a collection or service requires it.
8 Photos videos and stories
We seek separate, specific permission before publishing identifiable photos, videos or personal stories in our website, social media, publicity or grant acknowledgements. For under-18s, we obtain parent or guardian permission and involve the young person appropriately. A school's permission to take a photo does not automatically authorise our promotional use of it.
You can decline without affecting program access, or withdraw permission for future use by contacting us. We will take reasonable steps to remove material from channels we control, although we may be unable to recall printed materials or copies shared by others. Safety and incident records may be retained where there is a lawful reason to do so.
9 Messages and your choices
We send necessary messages about an enquiry, enrolment, safety matter, donation, receipt or recurring-payment arrangement. Optional newsletters, fundraising appeals and promotional messages are sent where you have chosen to receive them or another lawful basis applies.
You may opt out of optional messages through the unsubscribe option provided or by contacting us. We action requests promptly and within five working days. Opting out does not stop essential communications about a current service or payment. Health information and children's private program records are not used to create advertising audiences.
10 Security and retention
We take reasonable steps to protect information against misuse, loss and unauthorised access, change or disclosure. These steps include limiting access to people who need it, using account protections, keeping paper records secure and requiring appropriate confidentiality from people handling information. No online service can be guaranteed completely secure.
We retain information for as long as reasonably needed for its purpose or required by law. Relevant charity financial and operational records are generally kept for at least seven years. Health, consent, incident, insurance and safeguarding records may require different or longer retention periods. We do not apply a blanket seven-year deletion rule to every participant record.
When information is no longer needed and no retention obligation applies, we take reasonable steps to securely destroy or de-identify it. If we suspect a data breach, we assess and respond promptly and notify affected people and regulators when required by law.
11 Access correction and deletion requests
Contact us to request access to your information, ask for a correction or request deletion of information no longer needed. We may ask for reasonable proof of identity or authority before acting. We aim to respond within 30 days and will explain if more time is needed.
There is no fee to make an access or correction request. If an access request involves a reasonable permitted charge, we will explain it before proceeding. Correction is free. Where we cannot provide access, make a correction or delete a record, we will explain the lawful reason and available complaint options. Deletion may be limited by record-keeping duties or the rights and safety of others.
12 Privacy complaints and updates
Address a privacy concern to the Privacy Contact, MBS Fitness Initiative Inc., at enquiries@mbsfit.org.au, on 0434 029 537, or at 115 Cove Hill Road, Bridgewater TAS 7030. Explain the concern and the outcome you seek. We will acknowledge the complaint, review it fairly and aim to provide a response within 30 days. A person involved in the complaint will not be the sole decision-maker on it.
If you remain dissatisfied, you can contact the Office of the Australian Information Commissioner on 1300 363 992. The OAIC generally asks that you first raise the matter with us and allow a reasonable response period.
We may update this policy as our activities or legal obligations change. The current version will appear on our website with its updated date. Material changes will be communicated where appropriate. An updated policy does not, by itself, create consent to a new use that requires your consent.