Privacy Policy

1. Introduction and Our Commitment

Common Initiative Limited ("Common Initiative", "we", "us", "our") is a charity registered with the Australian Charities and Not-for-profits Commission. We work with refugee and immigrant adults aged 18 years and over who are experiencing poverty, distress, disadvantage, isolation or misfortune.

We are trusted with information people may never have shared with an organisation before. Dignity is one of our values, and privacy is what that value looks like in practice. We comply with the Australian Privacy Principles (APPs) under the Privacy Act 1988 (Cth) as though we were an APP entity, regardless of our turnover in any given year — the standard is set by the risk to the people we serve, not by our revenue.

This policy applies to everyone acting for Common Initiative — directors, employees, contractors, mentors, volunteers and anyone performing work on our behalf — and to all personal information we handle, whether held electronically or on paper. A plain-language summary of this policy is available to program participants, and we will arrange interpreting or translation on request.

2. The Kinds of Personal Information We Collect

We collect only what we need for a purpose set out in this policy. Depending on your relationship with us, this may include:

• Enquirers: Name, contact details, preferred language, and a short description of what is being sought.
• Applicants and participants: Identity and contact details, date of birth, residency or humanitarian status sufficient to confirm eligibility, cultural background and interpreter needs, financial hardship, housing situation, education and work history, health or counselling needs where relevant to the assistance sought, safeguarding information, and program participation and outcomes.
• Mentors and volunteers: Identity, contact and emergency details, skills and availability, referee checks, Working with Vulnerable People registration or police check results, and training records.
• Donors and supporters: Name, contact details, donation history, receipting information and communication preferences.
• Website visitors: Information submitted through contact or enquiry forms, and technical data such as IP address, device, browser and pages visited.

We do not require identity documents at first contact. You can make an enquiry without providing evidence of income, health or immigration status — we ask for supporting evidence only once program fit is established, and only to the extent needed for the decision being made.

3. Dealing With Us Anonymously

You may make a general enquiry, ask about our programs, give feedback or make a complaint anonymously or using a pseudonym, and we will help where we can. We cannot assess an application for financial assistance, arrange a payment to a provider, or match a mentor without knowing who you are, because we must verify eligibility and account for charitable funds. We will explain this before asking for identifying details.

4. Sensitive Information

Much of the information that comes to us — health, ethnic origin, criminal record checks — is sensitive information that attracts higher protection under the Privacy Act. We collect it only with your consent and only where reasonably necessary for our functions, unless required or authorised by law or where a serious threat to life, health or safety makes collection necessary. We ask for the minimum needed, restrict access to those who need it for their role, and never use sensitive information for fundraising or marketing.

We collect residency or visa information only to confirm eligibility, and we do not require details of a protection claim. We do not collect personal information for immigration compliance purposes, and we do not disclose it to the Department of Home Affairs or law enforcement except where required by law or necessary to prevent a serious threat to life, health or safety. If being identified would place you or your family at risk, tell us — we will record it, restrict access, and take it into account in every decision about your information.

5. How We Collect Information

Wherever reasonable and practicable, we collect personal information directly from you — through forms, interviews, program activities, correspondence, our website and events. We sometimes receive information from others, such as a referring settlement service (with your consent), a family member enquiring on your behalf, an education provider reporting progress, or a screening body confirming a check. If we receive information about you from someone else, we will take reasonable steps to tell you what we hold and why, unless doing so would be unreasonable or create a safety risk. Unsolicited information we could not have collected ourselves is destroyed or de-identified as soon as practicable.

6. Consent and Interpreters

Consent must be voluntary, informed, current and specific. We obtain separate consent for separate things — assessment, referral to a named provider, contact with an employer, and use of your story or photograph are not the same decision. You can withdraw consent at any time. We offer an interpreter at no cost for assessment and consent conversations, and interpreters are bound by confidentiality.

7. Why We Use Your Information

We handle personal information to:

• Assess eligibility and benevolent need against our charitable objects.
• Arrange and pay for education, deliver employment and mentoring programs, and arrange counselling, essential medical care and accommodation support.
• Screen mentors and volunteers and meet our safeguarding obligations.
• Communicate with you about your application, programs and outcomes.
• Meet audit, grant acquittal, governance and legal obligations — using de-identified data wherever it will do the job.

We do not sell, rent, trade or licence personal information. We do not give donors or corporate partners access to participants' personal information, and we never make assistance conditional on agreeing to publicity, marketing or research participation.

8. Who We Disclose Information To

With your consent, and limited to what is needed, we may disclose information to:

• Education and training providers — enrolment and fee information, to pay fees directly.
• Employers and host organisations — your résumé and skills, case-by-case for a named opportunity.
• Mentors — your first name, goals and industry background, never your full file.
• Counselling, health and housing services — referral information for a warm referral to a named service.
• Funders and grantmakers — de-identified, aggregated outcome data as standard; identified case material only with your separate written consent.
• Auditors, insurers, lawyers, IT providers and regulators — where necessary for our operations or required by law, under confidentiality.

We may disclose information without consent only in limited circumstances: to lessen or prevent a serious threat to life, health or safety; where a child or another person is at risk of harm; where required or authorised by law (such as a court order); to investigate suspected unlawful activity; or to establish or defend a legal claim. Every such disclosure is recorded, and we will tell you first wherever it is safe and lawful to do so.

9. Overseas Disclosure

We do not routinely send personal information overseas for program purposes. However, some technology we use — email, file storage, our database, communication and payment tools — may store or process data on servers located outside Australia. Before personal information is disclosed to an overseas recipient, we take reasonable steps to ensure the recipient does not breach the APPs, ordinarily by contract, or we obtain your informed consent.

10. Automated Decisions

Decisions about eligibility, assistance, mentor matching and appeals are made by people, not software. We do not use artificial intelligence or automated scoring tools to make or recommend decisions about individuals. If this ever changes, we will update this policy before the change takes effect.

11. Data Quality and Security

We take reasonable steps to keep personal information accurate, up to date and complete, and to protect it from misuse, interference, loss and unauthorised access, modification or disclosure. Our controls include role-based need-to-know access, multi-factor authentication, encrypted devices, written confidentiality undertakings from everyone acting for us, secure storage of the minimal paper records we keep, and annual review of systems and access.

12. Retention and Destruction

We keep personal information only for as long as needed for its purpose or as long as the law requires — whichever is longer. For example, enquiries that do not proceed are kept for 12 months; participant assistance records and financial records for 7 years, consistent with ACNC and Corporations Act obligations. At the end of the retention period we securely destroy records or de-identify them so no individual can reasonably be identified.

13. Data Breaches

We treat every suspected data breach seriously and apply the Notifiable Data Breaches scheme process as a matter of policy: contain the breach immediately, assess it within 30 days, and — where serious harm is likely — notify affected individuals and the Office of the Australian Information Commissioner as soon as practicable. Every breach is recorded, reported to our Board, and followed by a review.

14. Photographs, Stories and Marketing

We obtain separate, specific, written consent before using anyone's photograph, name, likeness or story, and consent to receive assistance is never consent to publicity. You may withdraw at any time. Every marketing email identifies us and includes a working unsubscribe facility in line with the Spam Act 2003; opting out of fundraising communications never affects the assistance you receive. We do not sell, rent or exchange supporter lists.

15. Website, Cookies and Identifiers

When you visit our website, our hosting and analytics tools may record technical information such as IP address, device and browser type, and pages visited, used only to keep the site working and secure and to understand how it is used. Where we use cookies beyond those strictly necessary, we will say so and provide a means to decline them — see our Cookie Policy. We do not adopt government identifiers (such as Medicare or Centrelink numbers) as our own identifier for any person.

16. Access, Correction and Complaints

You may ask for access to the personal information we hold about you and ask us to correct anything that is wrong, out of date, incomplete or misleading. There is no charge for making a request. We acknowledge requests within 7 days and respond within 30 days, and we can explain your file with an interpreter present. If we refuse access or correction, we will explain why in writing and tell you how to complain. If we do not agree information is inaccurate, you may ask us to attach a statement of your view to the record.

If you believe we have mishandled your personal information, contact our Privacy Officer — making a complaint will not affect the assistance you receive:

• Email: admin@commoninitiative.com.au
• Phone: 0451 420 636

A complaint may be made in writing or verbally, in any language, and an interpreter, family member or advocate may make it on your behalf. We acknowledge complaints within 7 days and respond in writing within 30 days. If you are not satisfied with our response, or we do not respond within 30 days, you can complain to the Office of the Australian Information Commissioner (OAIC) at www.oaic.gov.au or by calling 1300 363 992.