This policy was authorised by the National Ethnic Disability Alliance Council on the 29 June 2025.
Section 1: Privacy Statement
This Privacy Policy outlines how the National Ethnic Disability Alliance Incorporated (NEDA) will collect, use, disclose, and safeguard your personal information in accordance with the Privacy Act 1988 (Commonwealth) and the Australian Privacy Principles (APPs).
Protecting your personal information is essential to NEDA’s mission of advocating for the rights and inclusion of people with disability from culturally and linguistically diverse (CALD) backgrounds.
It applies to everyone who interacts with us—whether you’re a member, Council Director client, participant, volunteer, contractor, or staff member—and covers all our activities, including those on our website and social media platforms.
Section 2: Personal Information
What is Personal Information?
“Personal information” has the meaning given in the Privacy Act 1988 (Commonwealth). In general terms, it refers to any information or opinion about an individual who is identified or reasonably identifiable. This includes, but is not limited to:
- Name
- Mailing or street address
- Email address
- Telephone number
- Age or birth date
- Language(s) used
- Information about your interests if you are a member of our organisation
- Information about your life experiences if you choose to share your story with us
- Details you provide when you respond to surveys or participate in consultation activities
- Feedback about your experience engaging with us
What is Sensitive Information?
“Sensitive information” is a subset of personal information that is subject to stricter handling requirements under the Privacy Act. It includes information or opinions about an individual’s:
- Racial or ethnic origin
- Political opinions
- Religious or philosophical beliefs
- Membership of a trade union or professional association
- Sexual orientation or practices
- Visa or immigration status
- Criminal record
- Health or disability status
- Access needs
We may collect sensitive information for the purposes of advocacy, research, or reporting, particularly to understand the demographics of people responding to surveys, or participating in consultations or focus groups. We will not disclose sensitive information without your express consent, unless required or authorised by law.
Section 3: Collection and Use of Personal Information
We collect, hold, use and disclose personal information so that we can perform our activities and functions, including promoting disability rights, conducting advocacy, and representing people with disability from culturally and linguistically diverse (CALD) backgrounds.
We may collect personal information when you:
- Visit our website
- Complete a membership application
- Make enquiries about our activities or request information
- Participate in our advocacy, education, or research activities
- Respond to surveys, consultations or focus groups
- Share your story or experiences with us
- Participate in events we organise
- Contact us via phone, email, post, social media, or in person
- Are referred to us by another organisation or government agency
- Authorise someone to act on your behalf (e.g., a carer or guardian)
- Engage with us as a supplier or service provider, including providing contact details, ABN, banking information, or registration numbers for procurement, verification, and reporting purposes.
We may use your personal information to:
- Communicate with you
- Provide access or interpreting supports
- Inform our policy, advocacy and research work
- Improve our activities and website
- Maintain internal records and administrative functions
- Comply with legal obligations and reporting requirements
- Consider applications for employment or volunteering
- Report to funding bodies using de-identified data
- Facilitate procurement processes, verify supplier credentials, and meet reporting obligations to government donors
Wherever possible, we will seek your prior consent before using or disclosing your personal information for any secondary purpose, unless such use is reasonably expected or required by law.
Section 4: Disclosure of Personal Information to Third Parties
We may disclose your personal information to third parties to support our functions, including advocacy, service delivery, and organisational operations.
We may disclose personal information to:
- Our staff members for internal purposes
- Third-party contractors or service providers who assist us with IT systems, website hosting, communications, and administrative support
- Funding bodies such as the Department of Social Services and/or Department of Health, Disability and Ageing, to meet reporting requirements
- Specific organisations for authorised purposes, such as lodging reports or submissions, where you have provided express consent
Where information is shared with third parties, we take reasonable steps to ensure they maintain the confidentiality of your personal information and use it only for the purposes for which it was disclosed.
The third parties we work with are located within Australia, except for MailChimp, a US-based secure email marketing and contact management platform – see section on Overseas storage below.
We will not sell, rent, or trade your personal information to any third party.
Section 5: Storage and Security of Personal Information
We are committed to ensuring that the personal information we collect is stored securely and protected from misuse, interference, loss, and unauthorised access, modification, or disclosure.
How we store your information
Most of our electronic records are stored on secure cloud-based servers located in Australia. These systems are protected by:
- Secure Access Controls via user name, complex password and Multifactor Authentication
- Firewall and security plug-ins
- Regular data backups, including on secondary secure cloud-based servers
Access to personal information is restricted to authorised personnel only.
Retention and disposal
When your personal information is no longer needed for the purpose for which it was collected, we will take reasonable steps to destroy or permanently de-identify it. However, some information may be retained for a minimum period as required by law or funding agreements.
Overseas storage
NEDA stores member information using Mailchimp, a secure email marketing and contact management platform. Mailchimp implements a range of safeguards to protect personal data, including encrypted data transmission (TLS), password hashing, two-factor authentication, and regular security audits. Data is stored on secure servers located in the United States, and Mailchimp complies with international privacy standards such as SOC 2, ISO 27001, and the EU-U.S. Data Privacy Framework. Access to member data is restricted to authorised NEDA personnel, and Mailchimp’s infrastructure is designed to prevent unauthorised access, loss, or misuse of information.
Section 6: Your Rights and Controlling Your Personal Information
We respect your rights to access, control, and correct your personal information. You have the following options available to you:
Choice and Consent
By providing personal information to us, you consent to its collection, use, and disclosure in accordance with this Privacy Policy. You are not required to provide personal information, but if you choose not to, it may affect your ability to engage with us, our activities or communications.
Access and Correction
You may request access to the personal information we hold about you at any time. We will provide access unless there is a legal reason to withhold it. If you believe any information we hold is inaccurate, incomplete, or outdated, you may request a correction. If we do not agree with the correction, we will add a note to your record indicating your disagreement.
We may require identification before releasing or amending your information. Most requests will be handled free of charge, though a reasonable fee may apply if the request involves substantial effort.
Restricting Use
You may choose to restrict the collection or use of your personal information. For example, you can opt out of receiving direct marketing communications at any time by contacting us or using the unsubscribe options provided.
Information from Third Parties
If we receive personal information about you from a third party, we will protect it as described in this Privacy Policy.
There may be circumstances in which we may require you to provide personal information about someone else to us, including, but not limited to instances which support our functions and activities, such as developing a case study or quoting a person. In such cases, you must provide the person’s written consent to do so.
Section 7: Website
Our website information is stored on secure cloud-based servers located in Australia. These systems are protected by:
- Access control procedures
- Strong password protection
- Firewall and security plug-ins
- Regular data backups
Cookies
Cookies are small summary files placed on your computer or device which enable website owners to automatically recognise your computer and greet you each time you visit their website. We do not use cookies on our website to track or store personal information. However, when we embed content from third-party websites (such as YouTube), cookies from those platforms may be placed on your device.
Most browsers are set by default to accept cookies. If you do not wish to accept cookies, you can adjust your browser settings to block them. Please note that rejecting cookies may affect how embedded third-party content is displayed.
Accessibility Tool
We use the UserWay Accessibility Widget on our website to enhance accessibility for users with disabilities. This tool helps ensure our content is usable by individuals with diverse needs, including those who require screen readers, keyboard navigation, or visual adjustments.
When you interact with the UserWay widget, limited technical data may be collected. This data is used solely to improve accessibility features and ensure the widget functions correctly. It is not used for marketing purposes and is not shared with third parties, except as required by law or for service provision. For more information, please refer to UserWay’s Privacy Policy.
Third-Party Links
Our website may contain links to other websites operated by third parties. These websites are not governed by this Privacy Policy, and we are not responsible for their privacy practices or content. We recommend reviewing the privacy policies of any external websites you visit.
Section 8: Direct Marketing
We may send you direct marketing communications that we believe may be of interest to you. These may include updates about our advocacy work, news, upcoming events, and opportunities to participate in consultations or campaigns.
These communications may be sent via email or SMS (text messages). You may opt out of receiving marketing communications at any time by contacting us directly, or using the unsubscribe facility provided in the communication.
We do not use third-party contractors to send marketing communications, and we do not share your personal information with other organisations for their own direct marketing purposes.
Section 9: What Happens If We Can’t Collect Your Personal Information?
If you choose not to provide personal information, we may be unable to:
- Provide you with information about our activities
- Tailor our communications and engagement to your preferences
- Offer you access to certain activities or opportunities to participate in consultations or advocacy
Where possible, we will allow you to interact with us anonymously or using a pseudonym. For example, if you contact us with a general enquiry, we will not require your name unless it is necessary to respond appropriately. However, for most of our functions and activities, we usually require your name and contact information.
Section 10: Data breaches
A data breach happens when personal information that is held by NEDA has been lost or accessed or disclosed without authorisation. Such as when a device is lost or stolen, a database is hacked, or personal information is mistakenly given to the wrong person.
If we suspect a data breach, we will:
- analyse if an incident has or is occurring
- assess the scope, impact and severity of the incident
- implement a resolution plan
- identify and notify affected stakeholders
- confirm when the incident has been resolved
We will also notify the Office of the Australian Information Commissioner (OAIC) if a data breach involving personal information is likely to result in serious harm to one or more individuals or we have not been able to prevent the likely risk of serious harm with remedial action.
Section 11: Changes to This Privacy Policy
We may update this Privacy Policy from time to time to reflect changes in legislation, organisational practices, or the way we engage with individuals and communities.
Any changes to this Privacy Policy will be published on our website. We encourage you to check our website periodically to ensure you are aware of the most current version.
Section 12: Related Documents
This Privacy Policy should be read in conjunction with the following documents and standards, where applicable:
- Privacy Act 1988 (Commonwealth)
- Australian Privacy Principles
- United Nations Convention on the Rights of Persons with Disabilities (UNCRPD)
- Any applicable grant or funding agreements
Section 13: Complaints and Contact Information
If you have any questions about this privacy policy, any concerns or wish to make a complaint regarding the treatment of your privacy or a possible breach of your privacy or the Australian Privacy Principles, please use the contact us form on our website or email our Projects Team, NEDA:
Email: projects@neda.org.au
Postal Address: Hardwick House, Unit 1, 6 Phipps Close, DEAKIN ACT 2600, Canberra
We will treat your requests or complaints confidentially. Our representative will contact you within a reasonable time after receipt of your complaint to discuss your concerns and outline options regarding how they may be resolved. We will aim to ensure that your complaint is resolved in a timely and appropriate manner.
If you indicate a preference for a method of communication and we need to communicate with you, we will endeavour to use your preferred method of communication whenever practical to do so.
If you are dissatisfied with our response, please email our Chief Executive Officer: ceo@neda.org.au. You also have the right to make a complaint to the Office of the Australian Information Commissioner (OAIC) by phoning 1300 363 992 or by emailing enquiries@oaic.gov.au.
