Introduction

Our organisation (Golden Cobra Martial Arts Incorporated) is committed to protecting the privacy and security of the personal information we collect, store, and process. This policy outlines our practices and principles regarding the handling of personal data to ensure compliance with applicable laws and regulations, including the Privacy and Data Protection Act 2014 (Vic) and the Health Records Act 2001 (Vic), and to foster trust and transparency with our members.

Scope

This policy applies to all members (inclusive of committee members and instructors), and third parties who have access to personal information held by our organisation. It covers all data processing activities, including the collection, storage, use, and sharing of personal data. This scope includes use of Software from Clubworx, Slack, Mail Chimp and website management for member records and notifications to members as well as financial records using MYOB and Health management via member records and hard copies.

Definitions

• Personal Data: Any information that relates to an identified or identifiable individual.
• Data Subject: The individual to whom the personal data pertains.
• Data Controller: The entity that determines the purposes and means of processing personal data.
• Data Processor: The entity that processes personal data on behalf of the Data Controller.
• Processing: Any operation performed on personal data, such as collection, storage, use, transfer, or deletion.

Principles

Our privacy and security practices are guided by the following principles:

Lawfulness, Fairness, and Transparency

We process personal data lawfully, fairly, and in a transparent manner. We inform data subjects about the purposes of data collection and processing and obtain their consent where required.

Purpose Limitation

We collect and process personal data only for specified, explicit, and legitimate purposes. We do not use personal data for purposes incompatible with the original intent without obtaining further consent.

Data Minimisation

We collect only the personal data that is necessary for the purposes for which it is processed. We ensure that the data is adequate, relevant, and limited to what is necessary.

Accuracy

We take reasonable steps to ensure that personal data is accurate, complete, and up-to-date. We correct or delete inaccurate or incomplete data without undue delay.

Storage Limitation

We retain personal data only for as long as necessary to fulfill the purposes for which it was collected, or as required by law. We securely delete or anonymise personal data that is no longer needed.

Integrity and Confidentiality

We implement appropriate technical and organisational measures to protect personal data from unauthorised access, disclosure, alteration, and destruction. This includes encryption, access controls, and regular security assessments.

Accountability

We are accountable for our compliance with privacy and security principles. We maintain records of data processing activities, conduct regular audits, and provide training to those required on data protection.

Data Subject Rights

We respect the rights of data subjects and provide mechanisms for them to exercise their rights, including:

• Right of Access: Data subjects have the right to access their personal data and obtain information about its processing.
• Right to Rectification: Data subjects can request the correction of inaccurate or incomplete personal data.
• Right to Erasure: Data subjects can request the deletion of their personal data under certain conditions.
• Right to Restriction of Processing: Data subjects can request the restriction of processing their personal data under certain conditions.
• Right to Data Portability: Data subjects can request a copy of their personal data in a structured, commonly used, and machine-readable format.
• Right to Object: Data subjects can object to the processing of their personal data under certain conditions.
• Right to Withdraw Consent: Data subjects can withdraw their consent to data processing at any time.

Data Security Measures

We implement comprehensive security measures to protect personal data, including:

• Access Control: We restrict access to personal data to authorised personnel only, based on their roles and responsibilities.
• Data Anonymisation: We anonymise personal data where possible to reduce the risk of identification.
• Security Training: We provide regular training to employees on data security best practices and policies.
• Incident Response: We have established procedures for responding to data breaches and security incidents, including notification to affected data subjects and authorities, in compliance with the Privacy and Data Protection Act 2014 (Vic).
• Regular Audits: We conduct regular audits and assessments of our data security practices to identify and mitigate risks.

Third-Party Data Processing

We ensure that third parties who process personal data on our behalf adhere to our privacy and security standards. This includes:

• Due Diligence: We conduct due diligence on third-party data processors to assess their data protection practices.
• Data Processing Agreements: We enter into data processing agreements with third parties that outline their responsibilities and obligations regarding data protection.
• Monitoring and Audits: We regularly monitor and audit third-party data processors to ensure compliance with our privacy and security standards.

Policy Review and Updates

We review and update this policy regularly to ensure it remains compliant with applicable laws and reflects our current data protection practices. We communicate any significant changes to this policy to our employees, clients, and stakeholders.

Contact Information

If you have any questions or concerns about this policy or our data protection practices, please contact us at:

Golden Cobra Martial Arts Inc.
85 Station St, Ferntree Gully, VIC 3156
T (03) 9754 7892
E enquiries@goldencobra.org.au

Conclusion

Protecting the privacy and security of personal data is a top priority for our organisation. By adhering to the principles and practices outlined in this policy, we aim to build trust with our clients, employees, and stakeholders, and ensure the responsible handling of personal information.