This Policy, and the handling of Personal Information by Australian Red Cross, must be consistent with the requirements of the Australian Privacy Principles, and must ensure that Australian Red Cross:

Australian Red Cross Society (“Australian Red Cross”, “we”) is committed to handling Personal Information in a lawful manner that protects people and supports the community’s trust.
This Policy sets out the principles that Australian Red Cross must follow when handling Personal Information, to ensure compliance with its obligations under the Privacy Act 1988 (Cth) and other applicable laws, regulations, industry standards and contractual obligations.

2 Scope and Audience

This Policy applies to:
(i) Personal Information collected in connection with Humanitarian Services activities of Australian Red Cross.
(ii) All Australian Red Cross People, contractors engaged by Australian Red Cross, and Suppliers who handle Personal Information for, or on behalf of, Australian Red Cross.
This Policy does not apply to Australian Red Cross Lifeblood, or to any Personal Information provided to Australian Red Cross Lifeblood.

Note: For a copy of Australian Red Cross Lifeblood’s Privacy Policy, please see lifeblood.com.au/privacy.

3 Policy

3.1 Intent

Is transparent about the way it handles Personal Information and the reasons why it is collected.
Only collects, uses and discloses Personal Information if necessary to perform its functions or activities.
Takes reasonable steps to keep Personal Information secure.
Conducts activities in accordance with this Policy and appropriate procedures.

3.2 Personal Information

Personal Information is information that identifies a person (or could reasonably lead to them being identified). The Personal Information that Australian Red Cross collects depends on the service, product, activity or program you are looking at or are participating in. Australian Red Cross only collects the minimum amount of information needed to perform its functions and activities, meet its obligations and to support you.
Some programs or services offered by Australian Red Cross may require collection of Sensitive Information. Australian Red Cross will seek your consent when collecting Sensitive Information.
The table below outlines when Australian Red Cross collects information, the types of information we collect, and how we use that information depending on the way you interact with Australian Red Cross.
When viewing this table, please keep in mind that depending on how you interact with Australian Red Cross, Personal Information may be collected over the phone, by email, by secure file sharing, via websites, via client portals, by social media, in writing or face-to-face:
1. Directly from you.
2. From third parties, including:
  1. Your guardian or a family member.
  2. Health professionals such as your doctor or your social worker.
  3. Government agencies, other service providers or partner organisations.
  4. Social media platforms (e.g., Facebook) or workplace giving platforms.
  5. Suppliers who provide services to Australian Red Cross, including but not limited to, recruitment agencies, IT platform providers, police check provider and visa check provider, marketing or fundraising agencies.

Note: If you have any questions or concerns regarding your privacy, or if you would like to make a complaint, please contact the Privacy Officer on 1800 733 276 (within Australia) or +61 3 9345 1800 (from overseas) or email privacy@redcross.org.au. For other options, please see section 3.9 of this policy.

About Clients and Beneficiaries

Enquire or apply for assistance or services, or otherwise communicate with Australian Red Cross
Agree to be referred to services of Australian Red Cross
Accept assistance or receive services from Australian Red Cross
Complete forms or respond to surveys
To assist and provide services to people who may be experiencing vulnerability, stress, or who have been affected by an emergency or disaster situation

About donors, retail store and online shop customers, and first aid & mental health students

Enquire or apply for our products or services
Receive or pay for our products or services
Participate in a training course such as first aid or mental health training
Make a donation or pledge, including a gift in your will
Sign up to participate in a fundraising activity, including raffles
Communicate with us, including through a form or survey

About current and prospective Australian Red Cross People

Make enquiries or contact us
Apply for a job (paid or volunteer) with Australian Red Cross
Work or volunteer with Australian Red Cross
Sign up to become an Australian Red Cross member or volunteer
Respond to a survey or fill out an Australian Red Cross form

About website visitors

Visit Australian Red Cross websites, social media pages or mobile applications
Contact Australian Red Cross through the website, a mobile application or via social media
Visit the Australian Red Cross online store
Make an application for support through an online application portal of Australian Red Cross
Send a request to access or correct your Personal Information
Submit feedback, or raise a concern or complaint

About Clients and Beneficiaries

Information that directly identifies you, such as your name and date of birth
Identity information, copies of identity documents (e.g. passport or visa) or government related identifiers
Contact information, such as email, address or phone number
Details of your emergency contacts, family members and next of kin
Details of assistance or services that Australian Red Cross is providing to you, and how you use the assistance or services provided
Information about you and your personal circumstances to help Australian Red Cross understand your needs
Details of Australian Red Cross communications or interactions with you
Sensitive Information, including information about your health, ethnic origin and main spoken language
Financial or banking information

About donors, retail store and online shop customers, and first aid & mental health students

Information that directly identifies you, such as your name and date of birth
Contact information, such as email, address or phone number
Details of products or services that Australian Red Cross provides to you and how you use those products or services
Information about donations and contributions to Australian Red Cross
Details of Australian Red Cross communications or interactions with you
Financial or banking information
Information required by law to enable us to provide you with our training courses, such as Unique Student Identifiers, demographic information and education information.
Images of you, which may include photographs and/or surveillance footage of public areas in and around places where Australian Red Cross provides services or operates programs

About current and prospective Australian Red Cross People

Information that directly identifies yosu, such as your name and date of birth
Identity information or copies of documents that identify you (e.g. passport, visa, driver’s licence or government related identifiers (e.g. Tax File numbers)
Contact information, such as email, address or phone number
Name and contact details of your emergency contacts
Recruitment information (e.g. in your resume, job application or references)
Employment information (e.g. tax information, performance information)
Financial or banking information
Details of Australian Red Cross communications or interactions with you
Details of your membership and volunteer roles, including type and length of service
Health information (e.g. medical certificates, health conditions where relevant)
Diversity information such as ethnicity, religion, disability, gender and sexuality
Compliance screening checks (e.g. police checks)
Images of you, which may include photographs and/or surveillance footage of public areas in and around places where Australian Red Cross provides services or operates its activities
Information about your browsing activity while connected to Australian Red Cross wi-fi and information you include on Australian Red Cross IT systems

About website visitors

Information about your use of websites, social media and mobile applications (analytics information)
Information about your response to and interaction with Australian Red Cross marketing
Information about your enquiry or communication with Australian Red Cross, including your name, age and contact information if provided
Your device’s IP address and approximate location

About Clients and Beneficiaries

Verify your identity
Answer your queries or communicate with you
Provide you with information about programs and services
Assess your eligibility for services and how Australian Red Cross can best help you
Provide you with humanitarian and emergency assistance
Provide you with other services, including referring you to other support providers or engaging with authorities or other organisations on your behalf
Take action in response to any safety and wellbeing concerns for you or others
Report to government or other funding bodies about how funding is used
Plan, fund, monitor and evaluate the services and programs operated by Australian Red Cross
Perform research to improve the way we provide humanitarian support and improve responses to emerging needs in the community
Receive feedback and complaints
Meet professional and legal obligations

About donors, retail store and online shop customers, and first aid & mental health students

Answer your queries or communicate with you, including communicating about the work of Australian Red Cross, Australian Red Cross fundraising activities, or our products or services
Inform you about, and manage your purchase of, our products and services
Process your donation and provide you with a tax receipt
Manage your donation or gift
Monitor and evaluate the engagement and relevance of certain content
Understand your communication needs
Combine information about you from different sources, for marketing purposes
Perform research and analysis to improve engagement with our donors and customers
Comply with our legal and other compliance obligations, including as a Registered Training Organisation. This may include reporting to government departments.

About current and prospective Australian Red Cross People

Answer your queries or communicate with you
Process job or volunteer applications
Commence, manage and support your employment, membership or volunteering role(s)
Recognise length of service with Australian Red Cross and issue awards
Process your membership, volunteering or employment application
Communicate with you about the work Australian Red Cross is involved in
Manage and respond to work, health and safety matters and conflicts of interest
Contact you about current or future job or volunteering opportunities
Receive feedback and complaints
Meet professional and legal obligations
Conduct reporting on Australian Red Cross People
Perform research to improve the way Australian Red Cross provides humanitarian support

About website visitors

Improve your experience or engagement with Australian Red Cross websites, mobile applications and social media
Personalise your experience on Australian Red Cross websites, mobile applications and social media
Match your name and profile to your online activity on Australian Red Cross websites and social media
Communicate with you and respond to your enquiries
Process your request to access or correct your Personal Information
Respond to your privacy complaint

Note about marketing: From time to time, Australian Red Cross may communicate with you in person, by email, phone, SMS, post or online about the work of Australian Red Cross, about Australian Red Cross fundraising events or opportunities, or about our products and services which we believe may be of interest to you. You can choose to not receive marketing communication at any time by emailing contactus@redcross.org.au or calling 1800 733 276 (within Australia) or +61 3 9345 1800 (if overseas).

Note about analytics: Analytics information helps Australian Red Cross understand how you use its websites or interact with it online. The information collected may include information to enable Australian Red Cross to personalise your experience on its websites. Australian Red Cross generally collects this information using cookies. More information about this is contained in the Cookie Notice which can be accessed at https://www.redcross.org.au/cookies/

3.3 Who Australian Red Cross shares your Personal Information with

Australian Red Cross will take reasonable steps to ensure that Australian Red Cross People and its contractors and Suppliers will only access your personal information on a ‘need-to-know’ basis.
In some situations, Australian Red Cross may disclose or share your Personal Information with people outside of Australian Red Cross.
Where practicable, Australian Red Cross will explain the reasons for disclosing your Personal Information before doing so. Australian Red Cross may share your personal information with other people if you have agreed or would expect it (or if Australian Red Cross is required or authorised by law to share your information or if it is necessary to keep someone safe).
The table below outlines some key examples of who Australian Red Cross may disclose your information to depending on the situation:

Reason for disclosing	Who we may disclose your information to
To provide assistance or support services to clients and beneficiaries	Government authorities engaged in humanitarian work, disaster relief or other activities where Australian Red Cross is involved, such as: i. State Emergency Services during a disaster relief activity that Australian Red Cross is involved in. ii. Services Australia to provide direct assistance to an Australian Red Cross client. Australian Red Cross partners, such as other support providers including (but not limited to) health service providers, translators, interpreters and other external parties who assist to provide Australian Red Cross products and services. The IFRC, ICRC, the Arolsen Archives and other Red Cross or Red Crescent Movement entities and National Societies (e.g. helping locate a missing person overseas). Government agencies who provide funding to Australian Red Cross.
To receive services from Suppliers	Australian Red Cross uses Suppliers to provide services and functions (e.g. IT systems, marketing, fundraising, printing, payment processing and website analytics) on its behalf which might require Personal Information to be shared. Australian Red Cross takes reasonable steps to ensure that (amongst other things) strict security and data breach reporting controls are in place, and Suppliers only process and use Personal Information for the purpose it was provided to them, and not for any other purpose.
To keep a child or adult safe	Emergency services (i.e., ambulance, police, fire or SES) where Australian Red Cross or Australian Red Cross People are concerned about a serious threat to the life, health or wellbeing of a person or you have agreed for us to contact them. Government bodies and community partners, for the purpose of child protection, vulnerable adult safeguarding or managing risk relating to domestic violence.
To provide products and services	People authorised by or responsible for you, such as an employer when you participate in a training program conducted by Australian Red Cross at your organisation.
To process donations	Australian Taxation Office, to enable a tax deduction for your donation or contribution to be processed.
To meet legal and compliance obligations	Government authorities, if required or authorised by law (e.g, to provide information about students completing first aid and mental health training).
Other reasons	Your representatives or advisors (e.g., where you request your information to be provided to your lawyer or financial advisor) Universities and research organisations (e.g., to allow research relating to disaster relief response to improve processes, which may include sharing de-identified data with other organisations to improve future emergency responses.) Other external organisations where Australian Red Cross has a lawful ability or requirement to disclose the information (e.g., providing video footage to police to investigate theft at Australian Red Cross or providing information to Police about a potential case of fraud, such as a fraudulent application for a grant).

3.4 Remaining anonymous

You can choose to remain anonymous and not provide your Personal Information when dealing with Australian Red Cross. However, there are some instances where Australian Red Cross is unable to provide products, services or opportunities (including grants) to you without obtaining Personal Information to verify your identity.

3.5 Storing and securing Personal Information (including overseas disclosures)

To ensure your Personal Information is appropriately protected, Australian Red Cross stores Personal Information within Australia or within jurisdictions that have comparable privacy laws where practicable. Some IT systems and applications used by Australian Red Cross are hosted overseas, including in Switzerland, the United States of America, the United Kingdom, and countries in the European Union such as Germany.
Australian Red Cross may also disclose Personal Information to entities located outside Australia, such as the ICRC, IFRC and other Red Cross or Red Crescent National Societies, where necessary to perform its functions and activities. When Australian Red Cross discloses Personal Information to an entity located overseas, Australian Red Cross will take reasonable steps to ensure that the entity handles your information in accordance with Australian privacy laws.
Australian Red Cross uses Suppliers to store specific types of Personal Information (such as analytics and credit card information) on its behalf. Personal Information stored by Suppliers relates directly to their functions and services and is stored in accordance with the contract with these Suppliers.
Australian Red Cross holds Personal Information in hard copy and electronic forms. Australian Red Cross uses a range of technological, operational and physical measures to protect Personal Information, including (but not limited to):
1. Education and training to ensure Australian Red Cross People understand their obligations when handling Personal Information.
2. Technological security measures, including firewalls, encryption of Personal Information during transit and at rest, anti-virus software, access controls, and multi-factor authentication (where possible).
3. Physical security measures, such as security passes to access offices.

3.6 Retaining Personal Information

Australian Red Cross keeps Personal Information for as long as it is needed for the purpose it was collected or for another lawful purpose.
Australian Red Cross is committed to securely destroying or de-identifying Personal Information where it is no longer required for the purpose it was collected or for another lawful purpose such as record-keeping.

3.7 Accessing, correcting and deleting your Personal Information

Australian Red Cross supports your rights to:
i. Access your Personal Information.
ii. Correct your Personal Information (where it is inaccurate, incomplete or out of date).
You may also request Australian Red Cross to delete your Personal Information. Australian Red Cross may not be able to delete your information if it is legally or contractually required to keep your Personal Information.
Please contact the Privacy Officer to request access to, correction or deletion of, your Personal Information:
1. Email: privacy@redcross.org.au
2. Post: C/- Privacy Officer, GPO Box 9949, Melbourne Vic 3001, Australia

Note: Australian Red Cross will only provide Personal Information to the individual which the Personal Information relates (unless you permit us or there is a lawful ability or requirement to provide it to someone else). Before processing your request, you will be required to verify your identity.

3.8 Data Incidents

Australian Red Cross will promptly investigate and respond to data incidents upon becoming aware of unauthorised access, disclosure of, or loss of Personal Information.
If a data incident occurs that is likely to result in serious harm to one or more individuals, Australian Red Cross will promptly notify people affected by the data incident and notify the Office of the Australian Information Commissioner (OAIC), in accordance with all applicable laws.

3.9 Who should you contact if you have further questions or concerns?

If you have any questions or concerns regarding your privacy, you can contact the Privacy Officer by:
1. Email: privacy@redcross.org.au
2. Telephone: 1800 733 276 (within Australia) or +61 3 9345 1800 (outside Australia)
3. Post: C/- Privacy Officer, GPO Box 9949, Melbourne Vic 3001, Australia
If you are not satisfied after asking a question, raising a concern or complaint with the Privacy Officer, and you want to escalate your concern, you should do so in writing to the CEO by email to ceo@redcross.org.au or post to C/- Office of the CEO, GPO Box 9949, Melbourne VIC 3001, Australia.

Note: The CEO may take any steps that they determine are appropriate in the circumstances (including referring the matter to a Board Committee ) or deciding not to take any further action.

c. While Australian Red Cross prefers to receive, assess, and respond to any privacy concerns directly to enable us to assess and take appropriate corrective action as quickly as possible, if you believe that Australian Red Cross has not adequately handled your privacy complaint, you may complain to the Office of the Australian Information Commissioner (OAIC).

Note: For details on how to lodge a privacy complaint with the OAIC, see oaic.gov.au/privacy.

4 Other

4.1 Definitions

Arolsen Archives	An international center on Nazi persecution with an archive of information about Nazi victims and survivors.
Australian Red Cross	Australian Red Cross Society, and for the purposes of this Policy is limited to Humanitarian Services. References to “we” in this Policy refer to Australian Red Cross. Note: For the purposes of this Policy, Australian Red Cross does not include products or services provided exclusively by Australian Red Cross Lifeblood.
Australian Red Cross Lifeblood	The same meaning as given to that term in the Rules.
Australian Red Cross People	As the context requires, all employees, volunteers, and members of Australian Red Cross (but excludes Australian Red Cross Lifeblood employees).
Board Committee	The same meaning as given to that term in the Rules.
Beneficiary	A person who receives a benefit from Australian Red Cross (e.g. cash grant recipient), but who is not an ongoing client.
Biometric Information	Electronic copy of your face, fingerprints, iris, palm, signature or voice that is used to identify you.
Client	A person who receives assistance or support services from Australian Red Cross.
Customer	A person who purchases goods or services from Australian Red Cross.
Donor	A person who donates money, property or other material benefits to Australian Red Cross.
Humanitarian Services	The teams and programs responsible for undertaking the humanitarian work of Australian Red Cross and the supporting functions required.
IFRC	International Federation of Red Cross and Red Crescent Societies.
ICRC	International Committee of the Red Cross.
OAIC	Office of the Australian Information Commissioner.
Personal Information	Has the same meaning as defined in the Privacy Act 1988 (Cth), being information or an opinion about an identified individual, or an individual who is reasonably identifiable whether the information or opinion is true or not, and whether it is recorded in a material form or not (i.e., in writing).
Rules	The rules of Australian Red Cross (as amended or substituted from time to time).
Sensitive Information	Has the same meaning as defined in the Privacy Act 1988 (Cth), being: Information or an opinion about an individual’s racial or ethnic origin, political opinions, membership of a political association, religious beliefs for affiliations, philosophical beliefs, membership of a professional or trade associations, membership of a trade union, sexual orientation or practices, criminal record. Health information about an individual. Genetic information about an individual that is not otherwise health information. Biometric information that is to be used for the purposes of biometric verification or biometric verification. Biometric templates.
Supplier	Third party suppliers engaged by Australian Red Cross to provide services to or on behalf of Australian Red Cross.

4.2 Related Documents

Data Incident Procedure.
Record Retention Procedure.
Information Access Security Policy.
Information and Knowledge Management Policy.
Information Security Management Policy.

4.3 Related legislation / standards

Privacy Act 1988 (Cth).
Spam Act 2003 (Cth).
Fundraising Institute of Australia Code.
Aged Care Quality Standards.

Privacy collection notice for website visitors and supporters

Who is collecting the information?
Australian Red Cross Society

Facts and circumstances of collection
We may collect your personal information in a number of ways, including:

directly from you (for example, when you visit our website or contact us by telephone)
from third parties (for example, our professional marketing and fundraising service providers)
from our website software (for example, cookies and other digital tracking and analytics)
from publicly available sources (for example, White Pages).

Is the collection being made because a law or Court order applies?
No law or Court order applies to the collection of this information.

Why does Red Cross need to collect this information?
We need to collect this information so that we may do one or more of the following:

process your donation or membership.
verify your identity
enable you to participate in our activities or fundraising campaigns, or provide you with information about our activities or fundraising campaigns including disaster appeals, newsletters, community fundraising appeals and other events such as the Human Race
provide you with a tax receipt at tax time
gain an understanding of your communication needs, or perform research and analysis to improve the way in which we engage with you.

We also use your information for direct marketing and targeted marketing. We use your information to promote our humanitarian activities, fundraising opportunities and other services that we think will interest you. This marketing may be by email, phone, SMS, post or online. You can opt out of direct marketing at any time by emailing contactus@redcross.org.au or calling 1800 RED CROSS (733 276).

The primary purpose for which the information is being collected
The primary purpose of collecting your information depends on why we initially collected your information. Typically, the primary purpose will be one or more of the following:

to process your donation
to process your membership
to enable you to participate in our activities (for example, The Human Race, Wills Day, etc)
to provide you with direct marketing
to provide you with a newsletter (if you have signed up on the website)
to process your online order

The secondary purposes (if any) for which Red Cross is collecting this information
The secondary purpose of collecting your information may be to:

keep you informed about our activities, campaigns and appeals
profile our supporters and people who may be interested in Australian Red Cross and conduct data analytics and data matching so that we better understand and connect with our supporter base and provide you with the high quality service and information that you expect from us
personalise your experience with Red Cross digital services, and to suggest appeals, products and services that might be of interest to you
display your name on our website for a fundraising leaderboard when participating in events like the Human Race
prevent and detect fraud
better understand who our supporters and others who deal with us are

What happens if Red Cross doesn't collect this information?
If Red Cross does not collect this information from you we may not be able to process your donation or membership, provide you with a donation receipt, enable you to participate in our activities, provide you with direct marketing or inform you about other services, products or campaigns that may be of interest to you.

Anonymity/Nickname
You can ask that we do not record your real name. Sometimes we may require your real name, for example, if you wish to be a member of Australian Red Cross or receive a donation receipt.

The organisations we usually disclose this information to are
We may disclose your information to third parties that provide services to us. These services include technology service providers, social media platforms and professional marketing and fundraising organisations who provide us with services such as letter printing, call centre, email, digital marketing, telemarketing, fundraising and data analysis. These organisations may provide us with other similar services. We may also disclose your information to organisations that provide us with information technology and banking services. We may also disclose your information if we are legally required to provide this information, for example by the Australian Taxation Office.

Access and correction
Information about accessing your information and requesting corrections is set out in the Red Cross Privacy Policy.

Complaints
Privacy concerns or complaints can be sent to:

Privacy Officer
Australian Red Cross Society
GPO Box 9949, Melbourne Vic 3001, Australia
Tel: 1800 RED CROSS (733 276)
Email: privacy@redcross.org.au

Information about how to complain is in the Red Cross Privacy Policy. You can also complain direct to the Office of the Australian Information Commissioner at oaic.gov.au

Will my information be stored offshore? 
Australian Red Cross stores Personal Information within Australia or within jurisdictions that have comparable privacy laws where practicable. Some IT systems and applications used by Australian Red Cross are hosted overseas, including in Switzerland, the United States of America, the United Kingdom, and countries in the European Union such as Germany.

Sometimes organisations that we may disclose your information to are located outside Australia. For example, we may disclose your information to service providers in New Zealand and the United States of America.

You can make a request not to receive direct marketing at any time by emailing contactus@redcross.org.au or calling 1800 RED CROSS (733 276).

Red Cross pays our respects to the Aboriginal and Torres Strait Islander custodians of the country where we work, and to Elders, past, present and emerging.

Learn about our Reconciliation Action Plan and how we can all make reconciliation real.

This website may contain the images, voices or names of people who have passed away.

About

Resources