Privacy policy

This policy explains how Light of Hope Foundation Inc. (“the Foundation”, “we” or “us”) handles personal information. It covers what we collect, why we collect it, who we share it with, how we protect it, and the choices you have.

It applies to information we receive through this website, by email, phone or post, and through our programs, courses, events, volunteering, partnerships and donations.

“Personal information” means information or an opinion about you, where you are identified or could reasonably be identified. It can include your name, contact details or photo and, in some cases, an IP address.

Light of Hope Foundation Inc. is a registered charity based in Caulfield South, Victoria. It has operated since 2005.

You can send us questions, requests and complaints about privacy by:

• Email: admin@lhfoundation.org.au (please put “Privacy” in the subject line)
• Phone: 1300 009 322
• Post: Privacy, Light of Hope Foundation Inc., 668 Glen Huntly Road, Caulfield South VIC 3162
• Our contact page

The Privacy Act 1988 (Cth) contains 13 Australian Privacy Principles (APPs). The Act doesn’t cover every not-for-profit. Many with an annual turnover of $3 million or less are not covered, unless an exception applies, for example because they provide a health service or trade in personal information.

Whether or not the Act applies to us, we have chosen to handle personal information in line with the APPs, and this policy is written to meet them.

Victoria’s Health Records Act 2001 also applies to private sector organisations that handle health information in Victoria, and it has no exemption for small organisations. When we handle health information, such as allergy details, we also follow the Health Privacy Principles in that Act.

We collect only what we reasonably need. What that is depends on how you deal with us and on the activity. It may include:

• your name and contact details, such as your email address, phone number and postal address
• what you tell us in messages, and how you prefer to be contacted
• registration details for programs, courses and events
• an emergency contact, for in-person activities
• dietary or allergy information, and any access needs you’d like us to know about, so you can take part safely and comfortably
• photos, recordings, stories, recipes or other material you choose to share
• for volunteers: your availability, interests and skills, and the results of any checks the law requires for the role
• for partners: the names and work contact details of people at partner organisations
• for donors: details PayPal shares with us, such as your name, email address, the amount and any note
• technical information recorded by our website host when you visit (see Our website, cookies and tracking)

Some kinds of personal information are “sensitive” under privacy law and need extra care. Depending on the activity, we may collect:

• health information, such as allergies, health-related dietary needs or information about your wellbeing
• your cultural background, or racial or ethnic origin, for example in our cultural and storytelling programs
• religious beliefs, for example if you tell us about celebrations or customs that matter to you

We only collect sensitive information with your consent, and only when it’s reasonably necessary for the activity, unless the law requires or allows us to collect it without consent.

You choose what to tell us. No one has to discuss personal history or trauma to take part.

We don’t ask for diagnoses or detailed trauma histories in our general contact form. Please do not include detailed medical information in the general enquiry form.

We don’t provide treatment, clinical or crisis services.

Wherever we can, we collect information directly from you, for example when you:

• email, phone or write to us
• use the contact form on this website
• register for or join a program, course, event or activity
• apply to volunteer, or volunteer with us
• donate through PayPal
• work with us as a partner organisation
• share a story, photo, recipe or other material with us

Sometimes we receive information about you from someone else, such as:

• PayPal, when you donate
• a family member, carer or support person who contacts us for you, with your agreement
• a partner organisation or practitioner who refers you to us, with your agreement
• referees you name when you apply to volunteer

If we receive personal information we didn’t ask for, we’ll check whether we could have collected it ourselves. If we couldn’t, we’ll destroy or de-identify it as soon as practicable, where it’s lawful and reasonable to do so.

Our contact form works differently from most. It doesn’t send your details to us or store them anywhere. When you submit it, it opens the email app on your own device with a pre-filled email to admin@lhfoundation.org.au. Nothing reaches us unless you choose to send that email.

The form asks for:

• your name
• an email address or phone number
• the topic of your enquiry: programs, volunteering, partnerships, donations or other
• your message
• how you’d prefer us to contact you (optional)

Before you continue, it asks you to tick this statement: “I agree to Light of Hope Foundation using these details to respond to my enquiry.” We use your details to reply, and to follow up on the program, volunteering, partnership or donation you asked about. If you don’t give us a way to contact you, we won’t be able to reply.

Once you send it, your message is handled like any other email to us. Our email is hosted on Microsoft 365. Your own email provider also handles the message, under its own privacy terms. We don’t share enquiries with anyone else except as explained in Who we share information with.

You can ask to see or correct the information, or make a complaint, as explained later in this policy.

If we ever connect the form to an online form service, we’ll update this policy first to say which service we use and where it stores information.

We keep this website simple.

• We don’t use analytics, advertising, tracking pixels, social media embeds or marketing cookies.
• Our fonts and images are hosted with the website itself, so your browser doesn’t fetch them from other companies.
• We don’t set any cookies for ordinary visitors.

Our website host, Vercel Inc., keeps technical records when you visit. These can include your IP address, an approximate location worked out from it, your browser and device type, the pages requested and the time of each request. They are used to deliver the website, keep it secure and fix problems.

Vercel is a US company and handles these records under its own privacy notice (opens in a new tab). They may be processed in the United States and other countries.

We don’t use these records to identify individual visitors, unless we need to look into misuse or a security problem, or the law requires it.

Links on our website to other sites, such as government websites, Lifeline, PayPal, Google Maps and Volunteering Victoria, take you to sites with their own privacy policies and cookies.

If we ever plan to add analytics, embedded content, marketing tools or cookies, we’ll update this policy before we do.

We use personal information to:

• reply to your enquiries and keep in touch about what you asked about
• run our programs, courses, events and activities, including keeping people safe and meeting access, dietary and allergy needs
• manage volunteering, including applications and any checks we need to carry out
• receive and record donations
• work with partner organisations
• share stories, photos or cultural material, only in the ways you have agreed to
• send you news or updates, if you’ve asked to hear from us or would reasonably expect to
• improve our programs, using feedback
• keep our website and systems secure
• meet our legal, reporting, insurance and governance obligations, and deal with complaints, incidents or claims

We only use your information for another purpose if you agree, if you would reasonably expect it and it’s related to the original purpose (directly related, for sensitive information), or if the law requires or allows it.

We don’t use computer programs to make decisions about you that could significantly affect your rights or interests. If that ever changes, we’ll update this policy first.

We share personal information only when it’s needed for the purposes in this policy, when you agree, or when the law requires or allows it. Depending on the situation, we may share it with:

• service providers who help us operate, such as Microsoft (email), Vercel (website hosting) and PayPal (donations), and providers of services such as IT, storage or accounting
• partner organisations or practitioners involved in an activity, with your agreement
• our insurers, auditors or professional advisers, where needed for a claim, an audit or advice
• government bodies and regulators, where the law requires it
• emergency services or other appropriate people, where we reasonably believe it’s necessary to lessen or prevent a serious threat to anyone’s life, health or safety, or to public health or safety, and it isn’t reasonable or practicable to ask for your consent
• police or other authorities, where we suspect unlawful activity or serious misconduct connected with our work and sharing is needed to take appropriate action
• anyone else you ask us to share it with

When we give information to a service provider, we take reasonable steps to make sure they protect it and use it only to provide their service to us.

We never sell, rent or trade personal information. We don’t give it to other organisations for their own marketing, and we don’t buy mailing lists.

Some of the services we use may store or process personal information outside Australia:

• Vercel, our website host, is based in the United States. Technical records from your visits may be processed in the United States and other countries.
• Microsoft 365, which hosts our email, may store or process data in Australia or overseas, depending on the services involved.
• PayPal collects your payment details directly, under its own privacy statement (opens in a new tab), and says it may process personal information in the United States and other countries.

Based on the services we use today, the country most likely to receive personal information from us is the United States. Other countries may be involved where these providers operate.

Before we disclose personal information to someone overseas, we take reasonable steps to make sure it will be handled consistently with the Australian Privacy Principles, unless an exception in privacy law applies.

We may send you news about our programs and events, or ask for your support, if you’ve agreed to hear from us or would reasonably expect to, and the law allows it.

We don’t use sensitive information, such as health information or your cultural background, for marketing.

Every email or text message we send about our work will identify us, include our contact details and give you an easy way to unsubscribe. These steps reflect the Spam Act 2003 (Cth) and the Australian Privacy Principles.

You can opt out at any time, free of charge, by using the unsubscribe link, replying to the message or contacting us. We’ll act on your request within 5 working days.

You can also ask us where we got your contact details, and we’ll tell you unless it’s impracticable or unreasonable to do so.

You can ask us a general question without giving your name, or by using a different name.

For some things we do need to know who you are, such as registering for a program, volunteering, handling a donation or responding to a request for your own information. In those cases it isn’t practical to deal with you anonymously, or the law requires us to identify you.

Because our contact form opens your own email app, we will see your email address when you send your message. If you’d rather not share it, you can phone us with a general question without giving your name.

Some programs invite people to share stories, photographs, family recipes or cultural knowledge. Sharing is always your choice. No one has to discuss personal history or trauma to take part.

Before we use anything you share beyond the activity itself, for example on this website, in printed materials, in displays or in course resources, we’ll ask for your consent and explain how it will be used.

• We’ll ask how you’d like to be credited: by your full name, first name only, another name, or not at all.
• If material shows or involves other people, we’ll ask for their consent too, or leave them out.
• If something has cultural significance to your family or community, tell us about any limits on how it can be shared, and we’ll respect them.
• If photos are taken at an event, we’ll let people know, and you can ask not to be photographed.

You can withdraw your consent to future use at any time by contacting us. We’ll stop using the material in new ways and remove it from our website within a reasonable time. We can’t always recall copies that have already been printed or shared by others, but we won’t include the material in anything new.

Our terms of use explain the permission you give us to use material you share.

Where a young person is involved, we consider whether they are mature enough to understand and agree to how their information will be used. If they aren’t, we ask a parent or guardian to decide for them.

We always ask a parent or guardian, as well as the young person, before publishing a photo, story or other material that identifies someone under 18.

If you’re under 18, please talk with a parent, guardian or another trusted adult before sending us personal information.

We store personal information electronically, using our email and other service providers, and keep any paper records secure.

We take reasonable steps to protect it from misuse, interference and loss, and from unauthorised access, change or disclosure. They include:

• giving access only to people who need it for their role
• using password-protected accounts, with multi-factor sign-in where it’s available
• keeping any paper records secure
• asking the people who handle personal information to do so carefully

No system is completely secure, and email is not a fully secure way to send information. Please don’t send detailed medical information by email.

We keep personal information only for as long as we need it for the purpose we collected it, or for as long as the law requires, for example for financial records.

When we no longer need information and don’t have to keep it, we take reasonable steps to destroy it securely or de-identify it.

If personal information we hold is lost, or accessed or disclosed without permission, we’ll act quickly to contain the problem and assess the risk of harm. We aim to finish that assessment within 30 days, and sooner where we can.

If a breach is likely to cause serious harm, we’ll tell the people affected as soon as practicable and suggest steps they can take to protect themselves.

If the Privacy Act applies to us, we’ll also notify the Office of the Australian Information Commissioner (OAIC), as the Notifiable Data Breaches scheme requires.

You can ask to see the personal information we hold about you. You can also ask us to correct it if it’s wrong, out of date, incomplete, irrelevant or misleading.

To make a request, contact us using the details in Who we are and how to contact us. We may need to confirm your identity first.

We’ll respond within a reasonable time, usually within 30 days. If your request is about health information, we’ll respond within 45 days at most, as Victorian law requires.

It’s free to make a request and to have your information corrected. If giving you access would involve significant cost, such as copying a large number of records, we may ask for a reasonable fee. We’ll tell you before we go ahead.

Occasionally the law allows us to refuse access, for example if giving access would unreasonably affect someone else’s privacy or pose a serious threat to someone’s life, health or safety. If we refuse access, or don’t agree to a correction, we’ll explain why in writing and tell you how to complain.

If we don’t agree to a correction, you can ask us to attach a statement to the record saying you believe it’s wrong. We’ll take reasonable steps to do so.

If you’re worried about how we’ve handled your personal information, please tell us first. Contact us in writing using the details in Who we are and how to contact us, with as much detail as you can.

We’ll acknowledge your complaint promptly and aim to give you a response within 30 days. We’ll treat your complaint confidentially, and making one won’t affect your involvement with us.

If you’re not happy with our response, or haven’t heard back within 30 days, you may be able to take your complaint further:

• Office of the Australian Information Commissioner (OAIC): visit oaic.gov.au (opens in a new tab), lodge a complaint online (opens in a new tab) or phone 1300 363 992. The OAIC handles complaints about organisations covered by the Privacy Act.
• Health Complaints Commissioner (Victoria), for complaints about health information: visit hcc.vic.gov.au (opens in a new tab) or phone 1300 582 113.

If you need an interpreter, you can call the Translating and Interpreting Service on 131 450.

We review this policy from time to time and update it when our practices or the law change. We’ll always update it before adding any new website tool, form service or tracking.

The date at the top of this page shows when it was last updated. If we make a significant change, we’ll also put a notice on our website.

This policy is free. If you’d like it in another format, such as a printed copy, please contact us.

We don’t provide treatment, clinical or crisis services, and messages to us may not be read straight away.

If you or someone else is in immediate danger in Australia, call 000. If you need crisis support, call Lifeline on 13 11 14. You can also speak with your doctor or another trusted health professional about ongoing support.

You’ll find more options on our Need help now page.