Privacy Policy

Holyoake recognises privacy as an important right of individuals.

We are committed to protecting personal information by complying with applicable privacy laws and taking reasonable steps to safeguard information from misuse, interference, loss, unauthorised access, modification and disclosure. Holyoake handles personal information in accordance with the Privacy Act 1988 (Cth), the Australian Privacy Principles, and the Privacy and Responsible Information Sharing Act 2024 (WA).

This privacy policy is intended to explain how Holyoake collects, holds, uses and discloses personal information, how individuals may access and correct their personal information, and how privacy complaints may be made and handled.

Anonymity and pseudonymity

In most circumstances, it is impractical for people to communicate with us anonymously. We need to identify you to assist you effectively.  However, in circumstances where it is lawful and practicable to do so, we will provide you with the option of not identifying yourself, or using a pseudonym, when entering into communications with us.

Collection of personal information

Personal information means information or an opinion about an individual whose identity is apparent or can reasonably be ascertained from the information or opinion. The personal information which we collect, store, use and disclose may include:

• your name;
• your contact details;
• your age or date of birth;
• your current occupation; and
• any other personal information provided by you during your interactions or correspondence with Holyoake.

Some personal information is considered ‘sensitive information’ for the purposes of the Privacy Act. Where necessary, and in some circumstances, we may need to collect sensitive information about you to be able to provide an effective service. For example, where necessary to provide our services to you, this might include information about your:

• health,
• racial or ethnic origin
• criminal history.

We only collect personal information by lawful and fair means where reasonably necessary for our functions or activities as a not-for-profit organisation providing support to individuals, families and communities who are impacted by alcohol, other drugs and related mental wellbeing challenges.

When asking you to provide personal information, Holyoake will inform you of the purpose of gathering such information, the nature of the third parties to whom Holyoake may provide that information, and Holyoake’s contact details.

We collect personal information which;

• you provide to us in the course of engaging in Holyoake’s counselling and support programs,
• you provide to us in the course of updating or changing your details;
• you provide to us in order to subscribe or sign up to our groups, newsletters or email lists;
• you provide via our website in the course of providing comments or feedback;
• is contained in documents or correspondence you provide to us;
• you provide to us in person, by phone, by post, via our website or via other forms of electronic communication; or
• is provided to us by third parties who have disclosed that information to us (and only if it would be unreasonable or impracticable to collect the information directly from you).

Subject to certain exceptions under the Privacy Act, we only collect sensitive information about you if you consent to the collection of the information and the information is reasonably necessary for one or more of Holyoake’s functions or activities.  The provision of sensitive information to Holyoake on a voluntary basis will be taken to be consent for this purpose.

In the course of providing our services, we may collect personal information (including sensitive information) indirectly from publicly available sources or from third parties such as a consumer’s:

• authorised representative, if one exists;
• referring agency, if one exists;
• other service providers, if one (or more) exist; or
• medical practitioner, if one exists.

Disclosure

We may collect, store (in hard copy or electronic form), use or disclose and otherwise process your personal information for the primary purpose of conducting and supporting our functions or activities and to provide you with our products and services.

Without limiting the foregoing, specific situations in which we disclose information are detailed below.

Under Law

Holyoake may be required to provide part or the whole of your personal record on the production by the Court of a subpoena, court order, or under certain legislative requirements. This is a court order that cannot be ignored. Holyoake staff may also have to discuss your information subject to a court order.

Under Ethical Circumstances

An ethical obligation to use or disclose personal information may arise for Holyoake where it believes the use or disclosure is necessary to lessen or prevent a serious threat to the life, health or safety of any individual, or to public health or safety.

Disclosure to third parties

In the course of providing our services, we may provide personal information (including sensitive information) to third parties such as a consumer’s:

• authorised representative, if one exists;
• referring agency, if one exists; or
• medical practitioner, if one exists.

In every instance outlined above, this disclosure is related to the primary purpose of collection and will require the consumer’s consent.

More generally, Holyoake uses a number of service providers to whom we disclose personal information. These include providers that host our website servers, manage our IT and manage our human resources information.  To protect the personal information we:

• enter into a contract or MOU which requires the service provider to only use or disclose the information for the purposes of the contract or MOU
• include special privacy requirements in the contract or MOU, where necessary.

Complaints and reviews

If a consumer makes a complaint, we will usually give a copy of the complaint to the respondent and, where relevant, affected third parties.  If a complainant or applicant requests that only limited information is disclosed to the respondent, we may not have enough information to be able to fairly proceed with the matter.  The respondent must have sufficient information to respond to the matter in a meaningful way.

Review of Holyoake decisions

We may disclose personal information to another review body if a complainant or respondent seeks an external review of Holyoake’s decision or makes a complaint to a State or Commonwealth Ombudsman.

Disclosure to the media

We only provide the media with personal information relating to a complaint if the complainant has consented.

Disclosure of sensitive information

We only disclose a consumer’s sensitive information for the purposes for which it is given to us or for directly related purposes that would reasonably be expected or if the consumer has consented.

Disclosure of personal information overseas

Generally, we only disclose personal information overseas so that we can properly handle the complaint or application. For example, if:

• the respondent to a complaint is based overseas;
• an Australian-based respondent is a related body corporate to an overseas company; or
• a consumer has complained to an overseas entity and Holyoake about the same or a related matter.

If we disclose personal information to a third party in a country which does not have equivalent privacy laws to Australia (including with respect to access and enforcement), we will take reasonable steps in the circumstances to ensure that the overseas recipient does not breach the Privacy Act in respect of that personal information.

Web traffic information is disclosed to Google Analytics via our websites. Google stores information across multiple countries. For further information see Google Data Centers and Google Locations. When a consumer communicates with us through a social network service such as LinkedIn, Facebook or Instagram, the social network provider and its partners may collect and hold a consumer’s personal information overseas.

Sector entity arrangements

Where Holyoake provides services under arrangements with Western Australian public sector entities, Holyoake may also be required to comply with applicable privacy, confidentiality, information sharing, breach notification and recordkeeping obligations under the Privacy and Responsible Information Sharing Act 2024 (WA), including any Information Privacy Principles or contractual requirements that apply to Holyoake as a contracted service provider.

Social media and cookies

We use a range of tools provided by third parties, including Google, and our web hosting company to collect or view website traffic information. These sites have their own privacy policies. We also use cookies and session tools to improve a consumer’s experience when accessing our websites. The information collected by these tools may include the IP address of the device used and information about sites that IP address has come from, the pages accessed on our site and the next site visited. We use the information to maintain, secure and improve our websites and to enhance a consumer’s experience when using them. In relation to Google Analytics, you can opt out of the collection of this information using the Google Analytics Opt-out Browser Add-on.

We use social networking platforms such as X (Twitter), Facebook and YouTube to communicate with the public about our work. When someone communicates with us using these services we may collect their personal information, but we only use it to help us to communicate with the consumer and the public. The social networking service will also handle a consumer’s personal information for its own purposes. These sites have their own privacy policies.

Direct marketing

Unless you request otherwise, we may also use your personal information for marketing purposes to send you news, information about our activities and general promotional material which we believe may be useful or of interest to you. If you do not want us to use your personal information in this manner, please contact us using the contact details provided above in “Section 3 – Open and transparent management of personal information” or via our online feedback form, and we will give effect to your request as soon as possible.

Quality of personal information

To ensure that the personal information we collect is accurate, up-to-date and complete we:

• record information in a consistent format;
• where necessary, confirm the accuracy of information we collect from a third party or a public source;
• promptly add updated or new personal information to existing records; and
• regularly audit our contact lists to check their accuracy.

We also review the quality of personal information before we use or disclose it.

Storage and security of personal information

Holyoake stores personal information using secure cloud-based and on-premises systems. Where practicable, personal information is stored in Australia, however some information may be processed or stored by authorised third-party service providers located in Australia or overseas. Where personal information is disclosed or stored overseas, Holyoake takes reasonable steps to ensure that appropriate privacy, security and confidentiality protections are in place in accordance with applicable privacy laws.

Holyoake takes reasonable steps to protect the personal information we hold from misuse, interference, loss, and unauthorised access, modification or disclosure by:

• regularly assessing privacy and information security risks;
• implementing technical, administrative and physical security controls to mitigate identified risks;
• restricting access to personal information to authorised personnel only;
• maintaining procedures for responding to actual or suspected data breaches; and
• conducting periodic internal and external reviews, audits and assurance activities to assess the effectiveness of these measures.

Employees must ensure that information is collected, stored, accessed, retained and disposed of in accordance with policies and procedures. Records will only be retained and disposed of in accordance with policies and procedures and applicable legislative requirements.

Accessing and correcting a consumer’s personal information

Under the Privacy Act (Australian Privacy Principles 12 and 13) a consumer has the right to ask for access to personal information that we hold and ask that we correct that personal information. The consumer can ask for access or correction by contacting us (Refer to PROC Client Access to their Record) . If a consumer asks, we must give access to the consumer’s personal information and take reasonable steps to correct it if we consider it is incorrect, unless there is a law that allows or requires us not to.

We will ask the consumer to verify their identity before we give access to a consumer’s information or correct it, and we will try to make the process as simple as possible. If we refuse to give access to, or correct, a consumer’s personal information, we must notify the consumer in writing setting out the reasons.

We do not levy a charge in respect of the making of a request for access to personal information held by us.  However, we may charge you for the reasonable costs incurred by us in providing you with access to the personal information held by us.

If we make a correction and we have disclosed the incorrect information to others, the consumer can ask us to tell them about the correction. We must do so unless there is a valid reason not to.

If we refuse to correct a consumer’s personal information, the consumer can ask us to associate with it (for example, attach or link) a statement that the consumer believes the information is incorrect and why.

Changes to privacy policy

Holyoake reserves the right to amend this privacy policy from time to time. If we do so, the amended privacy policy will be posted as soon as practicable following that amendment on our webpage www.holyoake.org.au.

How to make a complaint

If a consumer wishes to complain to us about how we have handled their personal information this can be verbally or in writing. If a consumer needs help lodging a complaint, they can contact us. If we receive a complaint about how we have handled a consumer’s personal information we will determine what (if any) action we should take to resolve the complaint. If we decide that a complaint should be investigated further, the complaint will be handled by a senior officer than the officer whose actions are the object of the complaint.

If you are not satisfied with our handling of your complaint, you may lodge a complaint with the Office of the Australian Information Commissioner (OAIC).  For more information about doing so, visit https://www.oaic.gov.au/privacy/privacy-complaints/.

Contact details

Privacy enquiries, access or correction requests, and privacy complaints may be directed to Holyoake by telephone, email, post, or through the contact channels published on this, Holyoake’s official website.