Privacy Policy
1. Our Commitment to Privacy
Giant Steps Australia and Giant Steps Melbourne (“Giant Steps”, “GSA”, “GSM”, “we”, “our” or “us”) are committed to protecting the privacy, dignity and confidentiality of the people whose personal information we collect and hold.
This Privacy Policy explains how Giant Steps collects, holds, uses, discloses and protects personal information and how individuals may access or correct their information or raise a privacy concern.
This policy applies across Giant Steps’ activities, including our Sydney and Melbourne schools, Adult Autism Services, therapy and clinical services, training and community programs, fundraising and events, websites, employment and volunteer activities, and other services operated by Giant Steps in Sydney and Melbourne.
2. Privacy Laws
Giant Steps manages personal information in accordance with the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs).
Where applicable, Giant Steps also manages health information in accordance with the Health Records and Information Privacy Act 2002 (NSW) and the Health Records Act 2001 (Vic), together with other applicable education, disability, child protection, safeguarding, health, NDIS and recordkeeping requirements.
Where different privacy or recordkeeping requirements apply, Giant Steps will apply the requirements relevant to the particular information, service and jurisdiction.
3. The Personal Information We Collect
The information we collect depends upon an individual’s relationship with Giant Steps.
This may include names and contact details; dates of birth and identity information; student and participant records; enrolment and attendance information; educational and assessment information; family and carer details; emergency contacts; health, disability, therapy and medical information; behaviour, wellbeing and support information; safeguarding and child protection information; photographs, video and audio recordings; information about government or NDIS funding and services; financial and payment information; donation, fundraising and event information; complaints and incident information; court orders and other legal information; information about volunteers, contractors and job applicants; and information generated through an individual’s interactions with Giant Steps and our digital services.
Some of this information is sensitive information, including health and disability information, racial or ethnic origin, religious beliefs, criminal record information and other information classified as sensitive under applicable privacy law.
We collect sensitive information only where it is reasonably necessary for our functions and activities and where consent has been provided or collection is otherwise authorised or required by law.
4. How We Collect Personal Information
Giant Steps generally collects personal information directly from individuals, parents, guardians, carers or authorised representatives.
Information may be collected through enrolment and service applications, online forms and portals, meetings and interviews, email, telephone, correspondence, assessments, service delivery, fundraising activities, events and interactions with our websites.
We may also receive information from third parties where appropriate, including other schools, education authorities, medical and allied health professionals, NDIS providers, government agencies, referees, service providers and other people authorised to provide information to us.
If we receive unsolicited personal information, we will determine whether we could lawfully have collected it. Where we are not permitted or required to retain it, we will take reasonable steps to destroy or de-identify it.
5. Why We Collect, Use and Disclose Personal Information
Giant Steps collects, holds, uses and discloses personal information where reasonably necessary to provide education, therapy, disability and other support services; assess enrolment or eligibility for services; provide appropriate educational, health, wellbeing and behavioural support; meet our duty of care and safeguarding responsibilities; communicate with students, participants, families and carers; administer NDIS and other funding arrangements; manage incidents and complaints; meet government reporting and regulatory requirements; conduct organisational administration, finance, insurance and risk management; manage employment, recruitment, contractors and volunteers; operate fundraising campaigns, donations and events; communicate with our community; maintain the security of our people, facilities and technology; and comply with our legal obligations.
If we need to use personal information for another purpose, we will do so only where permitted by law or with appropriate consent.
6. Children, Students and Participants
Giant Steps recognises the particular importance of protecting personal information relating to children, young people and people with disability.
Parents, guardians and authorised carers will ordinarily be involved in privacy notices, consent and requests concerning a child or participant where appropriate.
However, Giant Steps will also consider an individual’s age, maturity, capacity, circumstances, legal rights and best interests when determining how consent, access and disclosure should be managed.
7. Health and Sensitive Information
Because of the nature of our services, Giant Steps may hold health, disability, therapy, behavioural, safeguarding and other sensitive information.
We apply additional care to the handling of this information. It will generally only be used or disclosed for the purpose for which it was collected, a directly related purpose that is reasonably expected, with consent, or where otherwise authorised or required by law.
8. Disclosure to Other Organisations
Where reasonably necessary, Giant Steps may disclose personal information to other schools and education providers; Australian and State government departments and education authorities; health, therapy and disability service providers; NDIS-related organisations; medical practitioners and emergency services; professional advisers including lawyers, auditors and insurers; information technology and cloud service providers; payment, fundraising and event service providers; contractors supporting Giant Steps; and other organisations or individuals where the person has authorised the disclosure or where disclosure is required or permitted by law.
Giant Steps requires service providers handling personal information on our behalf to provide appropriate privacy, confidentiality and security protections.
9. Cloud Services and Overseas Disclosure
Giant Steps Australia uses approved cloud-based and third-party service providers to support its educational, therapeutic, administrative, communication and operational activities.
Some service providers may store, process or provide support for personal information from locations outside Australia.
Where Giant Steps is likely to disclose personal information to an overseas recipient, we will take reasonable steps to ensure that the information is handled in accordance with applicable privacy requirements.
Where required by the Australian Privacy Principles, Giant Steps will identify the countries in which overseas recipients are likely to be located, where it is practicable to do so.
10. Artificial Intelligence and Automated Systems
Giant Steps may use approved artificial intelligence and automated technologies to assist with appropriate administrative and productivity activities.
Giant Steps does not permit sensitive or identifiable Giant Steps information to be entered into public or non-approved AI services. Where approved organisational AI services are used, personal information should be minimised or de-identified wherever practicable.
AI systems are intended to assist staff and do not replace appropriate professional judgement regarding students, participants, families or staff.
Giant Steps will maintain appropriate governance over AI technologies and will review its privacy disclosures when new technologies or automated decision-making processes are introduced.
11. Security of Personal Information
Giant Steps takes reasonable physical, technical and organisational measures to protect personal information against misuse, interference, loss, unauthorised access, modification and disclosure.
These measures include appropriate access controls, information security safeguards, secure storage, staff confidentiality obligations, security awareness and controls governing third-party service providers.
12. Retention and Secure Disposal
Giant Steps retains personal information only for as long as reasonably required for the purpose for which it was collected or as required by applicable legal, regulatory, safeguarding, operational or risk-management requirements.
Some records may require extended retention because of education, health, child protection, safeguarding, legal or regulatory obligations.
Where personal information is no longer required and Giant Steps is not legally required to retain it, we will take reasonable steps to securely destroy it or de-identify it.
13. Photographs, Video and Media
Giant Steps may collect photographs, video recordings or other media for educational, service delivery, communication, community, fundraising and promotional purposes.
Giant Steps will manage such material consistently with applicable consent, safeguarding and privacy requirements and any choices communicated by students, participants, parents, guardians or authorised representatives.
14. Fundraising and Communications
Fundraising is an important part of Giant Steps Australia’s activities.
We may use appropriate contact information to communicate with members of the Giant Steps community about news, events, fundraising activities and ways to support our work.
Individuals may request at any time that they no longer receive marketing or fundraising communications by using the unsubscribe facility provided or by contacting Giant Steps.
15. Our Website
When a person visits a Giant Steps website, we may collect technical information such as IP address, browser and device information, pages visited and information collected through cookies or similar technologies.
This information may be used to operate and secure our website, understand website usage and improve our services.
Information voluntarily submitted through website forms, donations, event registrations or enquiries will be handled in accordance with this Privacy Policy.
16. Data Breaches
Giant Steps maintains processes for responding to suspected or confirmed privacy and security incidents.
Where a data breach is likely to result in serious harm and meets the requirements of the Notifiable Data Breaches scheme, Giant Steps will notify affected individuals and the Office of the Australian Information Commissioner as required by law.
We will also comply with any additional notification obligations that apply to particular information or services.
17. Access and Correction
Individuals may request access to personal information Giant Steps holds about them and may request correction where information is inaccurate, incomplete, out of date, irrelevant or misleading.
Giant Steps may need to verify the identity and authority of the person making the request.
There may be circumstances in which access cannot be provided or must be limited, including where providing access would unreasonably affect another person’s privacy, create a serious risk to health or safety, breach a duty of care or where another exception permitted by law applies.
Where Giant Steps refuses an access or correction request, we will provide an explanation where required by law.
18. Privacy Enquiries and Complaints
Questions, requests or concerns about privacy should first be directed to Giant Steps Australia.
Privacy complaints will be considered and investigated appropriately. We will aim to acknowledge and respond to complaints within a reasonable period.
If a person is not satisfied with our response, they may be entitled to contact the Office of the Australian Information Commissioner (OAIC). Complaints concerning health information may also be able to be made to the Information and Privacy Commission NSW or the Health Complaints Commissioner Victoria, depending on the circumstances and jurisdiction.
19. Contact Us
For privacy enquiries, requests for access or correction, or complaints, please contact:
Giant Steps Australia
Telephone: +61 2 9879 4971
Email: privacy@giantsteps.net.au
20. Changes to this Privacy Policy
Giant Steps may update this Privacy Policy from time to time to reflect changes to our operations, technologies, information-handling practices or legal obligations.