Privacy Policy

This Privacy Policy relates to website address is: https://oha.org.au and the Old Haileyburians Association (OHA).

The Privacy Policy defines the Old Haileyburians approach for managing personal information collected as part of the Association’s activities and is designed to ensure the OHA meets the requirements of the Australian Privacy Principles (APPs) and its obligations under the Privacy Act 1988 (the Privacy Act).

The policy applies to the management of personal information collected by the OHA in the course of its operations, including that which is collected by solicited and unsolicited means and is applicable to the management of any personal information which is under the control of the OHA.

The management of personal information refers to the circumstances in which we obtain personal information, how we use and disclose that information and how we manage requests to access, dispose of and/or change that information.

The policy is not applicable to information which is under the control of any third party to which the OHA provides personal information in accordance with this policy.

What is personal data and how to we collect it?

Personal information is information or an opinion about an individual from which they can be reasonably identified. The OHA may collect personal information from an individual in their capacity as an alumni, visitor or others who come into contact with the OHA.

If it is reasonable and practical to do so, the OHA will collect personal information directly from the individual.

In the course of providing membership services we may collect and hold:

Personal Information including:
- Name(s)
- Residential and mailing address
- Phone numbers and email address
- Date of birth
- Next of kin / emergency contact details
- Photographic images, and
- Attendance records
Sensitive Information including:
- Nationality
- Country of birth
- Professional memberships/registrations
- Family court orders, and
- Criminal records

When visitors leave comments on the site we collect the data shown in the comments form, and also the visitor’s IP address and browser user agent string to help spam detection.

An anonymised string created from your email address (also called a hash) may be provided to the Gravatar service to see if you are using it. The Gravatar service privacy policy is available here: https://automattic.com/privacy/. After approval of your comment, your profile picture is visible to the public in the context of your comment.

Generally, the OHA will seek consent from the individual in writing before collecting their sensitive information.

Unsolicited Information

The OHA may be provided with personal information without having sought it through our normal means of collection. This is known as “unsolicited information” and can be collected by:

Misdirected postal mail – Letters, notes, documents
Misdirected electronic mail – Emails, electronic messages
Employment applications sent to us that are not in response to an advertised vacancy
Information entered into or stored in online systems and platforms
Information communicated through mail, email, telephone or verbal communication.

Unsolicited information obtained by the OHA will only be held, used or disclosed if it is considered as personal information that could have been collected by normal means. If that unsolicited information could not have been collected by normal means it will be destroyed, permanently deleted or de-identified as appropriate.

Collection and use of Sensitive Information

The OHA will only collect sensitive information if it is:

reasonably necessary for one or more of its functions or activities, and the individual has provided consent
required to meet legislative requirements
necessary to lessen or prevent a serious threat to life, health or safety
another permitted general situation
another permitted health situation.

The OHA may share sensitive information with other entities in our organisational structure, but only if necessary to provide our products or services.

Use of Personal Information

The OHA only uses personal information that is reasonably necessary for one or more of our functions or activities (the primary purpose) or for a related secondary purpose that would be reasonably expected by the individual, or for an activity or purpose to which an individual has consented.

The OHA’s primary uses of personal information include, but are not limited to:

Providing membership experience to all alumni
Satisfying our legal obligations including our duty of care and child protection obligations
Keeping members informed as to School community matters through correspondence, newsletters and magazines
Marketing, promotional and fundraising activities
Supporting the activities of the Haileybury Foundation
Supporting community-based causes and activities, charities and other causes in connection with the School’s functions or activities
Helping us to improve our day-to-day operations
Systems development; developing new programs and services; undertaking planning, research and statistical analysis
Engagement of volunteers, club members, ambassadors and councillors.

We will only use or disclose sensitive or health information for a secondary purpose if an individual would reasonably expect us to use or disclose the information and the secondary purpose is directly related to the primary purpose.

We may share personal information with related bodies corporate, but only if necessary for us to provide our services.

The OHA may disclose information about an individual to overseas recipients only when it is necessary, for example, to facilitate a student exchange program. The OHA will not send information about an individual outside of Australia without their consent.

Storage and Security of Personal Information

The OHA stores personal information in a variety of locations including, but not limited to:

Local servers
Remote servers
Hard copy files
Personal devices, including laptop computers
Third-party storage providers such as cloud storage facilities

The OHA takes all reasonable steps to protect the personal information we hold from misuse, loss, unauthorised access, modification or disclosure.

These steps include, but are not limited to:

Restricting access and user privilege of information by staff depending on their role and responsibilities
Educating staff and students on protection of personal passwords
Ensuring hard copy files are stored in lockable filing cabinets in lockable rooms. Staff access is subject to user privilege
Implementing physical security measures around the School buildings and grounds to prevent break-ins
Ensuring our IT and cyber security systems, policies and procedures are implemented and up-to-date
Monitoring staff compliance with internal policies and procedures when handling personal information
Undertaking due diligence with respect to third-party service providers who may have access to personal information, including customer identification providers and cloud service providers, to ensure as far as practicable that they are compliant with the APPs or a similar privacy regime
The destruction, deletion or de-identification of personal information we hold that is no longer needed or required to be retained by any other laws.

Media

If you upload images to the website, you should avoid uploading images with embedded location data (EXIF GPS) included. Visitors to the website can download and extract any location data from images on the website.

Cookies

If you leave a comment on our site you may opt-in to saving your name, email address and website in cookies. These are for your convenience so that you do not have to fill in your details again when you leave another comment. These cookies will last for one year.

If you visit our login page, we will set a temporary cookie to determine if your browser accepts cookies. This cookie contains no personal data and is discarded when you close your browser.

When you log in, we will also set up several cookies to save your login information and your screen display choices. Login cookies last for two days, and screen options cookies last for a year. If you select “Remember Me”, your login will persist for two weeks. If you log out of your account, the login cookies will be removed.

If you edit or publish an article, an additional cookie will be saved in your browser. This cookie includes no personal data and simply indicates the post ID of the article you just edited. It expires after 1 day.

Embedded content from other websites

Articles on this site may include embedded content (e.g. videos, images, articles, etc.). Embedded content from other websites behaves in the exact same way as if the visitor has visited the other website.

These websites may collect data about you, use cookies, embed additional third-party tracking, and monitor your interaction with that embedded content, including tracking your interaction with the embedded content if you have an account and are logged in to that website.

Responding to Data Breaches

The School maintains procedures for responding to data breaches, including initial containment, formal investigation the formation of a data breach response team.

If we have reasonable grounds to believe that a data breach has occurred which is likely to result in serious harm to any individual, Haileybury will:

Enact procedures to contain and investigate the data breach
Attempt to notify the affected and or at-risk individuals directly or, if it is not possible to notify individuals directly, publish a statement on our website and through appropriate public channels, and
Provide a statement to the Office of the Australian Information Commissioner (OAIC) including details of the breach.

Disclosure of Personal Information

Personal information is used for the purposes for which it was given to the OHA, or for purposes which are directly related to one or more of our functions or activities.

Personal information may be disclosed to government agencies, other parents, other schools, employees, recipients of School publications, visiting teachers, counsellors and coaches, our service providers, agents, contractors, business partners, related entities and other recipients from time-to-time, if the individual:

has given consent; or
would reasonably expect the personal information to be disclosed in that manner.

Haileybury may disclose personal information without consent or in a manner which an individual would reasonably expect if:

we are required to do so by law
the disclosure will lessen or prevent a serious threat to the life, health or safety of an individual or to public safety
disclosure is reasonably necessary for a law enforcement related activity
another permitted general situation applies
another permitted health situation exists.

Quality of Personal Information

We take all reasonable steps to ensure the personal information we hold, use and disclose is accurate, complete and up-to-date, including at the time of using or disclosing the information.

If the OHA becomes aware that the personal information is incorrect or out of date, we will take reasonable steps to rectify the incorrect or out of date information.

Access and Correction of Personal Information

You may submit a request to the OHA to access the personal information we hold, or request that we change or update the personal information. Upon receiving such a request, we will take steps to verify your identity before granting access or correcting the information.

If we reject the request, you will be notified accordingly. Where appropriate, we will provide the reason/s for our decision. If the rejection relates to a request to change personal information, an individual may make a statement about the requested change and we will attach this to their record.

How long we retain your data

If you leave a comment, the comment and its metadata are retained indefinitely. This is so we can recognise and approve any follow-up comments automatically instead of holding them in a moderation queue.

For users that register on our website (if any), we also store the personal information they provide in their user profile. All users can see, edit, or delete their personal information at any time (except they cannot change their username). Website administrators can also see and edit that information.

What rights you have over your data

If you have an account on this site, or have left comments, you can request to receive an exported file of the personal data we hold about you, including any data you have provided to us. You can also request that we erase any personal data we hold about you. This does not include any data we are obliged to keep for administrative, legal, or security purposes.

Where we send your data

Visitor comments may be checked through an automated spam detection service.

Complaints

The OHAy takes all complaints seriously. Privacy complaints can be made to the Director of Development and Alumni Relations and will be handled in accordance with our Complaints Procedures.