Mary Ward International is committed to protecting the privacy and personal information of everyone we engage with: our partners, supporters, staff, volunteers, and the communities we serve. We understand that trust is central to our mission. We take our responsibility to handle personal information with care, transparency, and respect seriously.
This policy provides a framework for Mary Ward International Australia Limited to address privacy, confidentiality, and data security for employees, volunteers, donors, and others whose personal information the organisation processes.
This policy explains how Mary Ward International manages personal information about employees, volunteers, donors, and others associated with its activities. Paragraph 11 deals specifically with employees. If there is a conflict between paragraph 11 and other paragraphs, paragraph 11 applies to employees.
Mary Ward International is committed to ensuring that individuals' right to privacy, dignity and confidentiality is recognised and respected, and that the personal information Mary Ward International holds is managed in accordance with the Privacy Act 1988 (Cth) (“Privacy Act”) and with the Australian Privacy Principles in the Privacy Act.
Guided by the Loreto values of freedom, justice, sincerity, verity, and felicity, we ensure every interaction respects each person's dignity and rights. These values guide our approach to privacy and data protection, grounding our work in honesty, fairness, and care.
5.1 Types of information collected
Mary Ward International may collect and hold personal information about individuals, that is, information that can identify individuals. The kinds of information Mary Ward International typically collects include name, address, contact details such as phone numbers, and email address, as well as financial information (bank account or credit card details) when donations are made. When an individual applies for a job or volunteering opportunity at Mary Ward International, the organisation may collect employment and educational history, Working with Children Checks, Police Checks, and related information, including health information such as past or current injuries, illnesses, or disabilities.
In most cases, Mary Ward International will collect personal information directly from an individual, unless it is unreasonable or impracticable to do so.
Mary Ward International will generally only collect sensitive information about an individual if the individual consents to the collection of the information and the information is reasonably necessary for one or more of Mary Ward International’s functions or activities. However, Mary Ward International may also collect sensitive information in some other limited circumstances, including when authorised by law.
5.2 Personal information
Mary Ward International handles the personal information of many individuals, including those who assist with its services, such as potential employees, volunteers, and contractors.
those who may provide support to Mary Ward International
donors
Mary Ward International collects, holds, uses, discloses and otherwise handles personal information where it is reasonably necessary for the purposes of carrying out its business and operations as a charity. This includes:
when an inquiry is made to Mary Ward International to subscribe to an occasional publication.
maintaining accurate fundraising and donor records, including for the purposes of processing donations and issuing tax receipts.
when an individual provides Mary Ward International with a resume or an application for employment, engagement, or volunteering.
to process applications for employment and volunteer roles, including considering an individual’s capacity to fulfil the inherent requirements of the job for which they have applied.
to liaise with Project Partners to facilitate volunteer placements.
to conduct and seek support for fundraising activities.
acknowledging support and providing information to educate and raise awareness of Mary Ward International’s activities and the projects and programs it supports.
to respond to comments and suggestions.
to investigate a complaint.
identifying and informing interested individuals of resources, services and/or issues that may be of interest or relevance.
maintaining business records for accounting, billing and other internal administrative purposes.
personal information as disclosed to and to which consent has been provided by an individual.
collection and use as would otherwise reasonably be expected.
collection and use as required or permitted by law.
Where personal information is used or disclosed, Mary Ward International first takes steps that are reasonable in the circumstances to ensure the information is relevant to its intended purpose.
5.3 Methods of collection
Mary Ward International collects personal information lawfully and only as necessary for our functions. We collect information for the purposes described in this policy, unless otherwise notified.
Personal information is generally collected directly from individuals using Mary Ward International’s standard forms, over the internet, via email, or by telephone. The organisation may also collect personal information from application or registration forms, and from third parties who help with its activities.
Personal information may be collected indirectly if it is unreasonable or impracticable to collect it directly. Mary Ward International also collects personal information from sources such as an information services provider or a publicly maintained record. Generally, Mary Ward International collects information from other sources only when it is unreasonable or impracticable to collect it directly from individuals.
Mary Ward International also uses data collection devices, such as “cookies,” to monitor its online resources. Cookies are small files placed on a computer’s hard drive when someone accesses these resources. Cookies provide information such as a computer’s IP address, the date and time of visits, and the resources accessed. As with other information it collects, Mary Ward International uses personal information obtained from cookies only for the purposes set out in this policy.
Mary Ward International uses social media and online forums to communicate and provide services. Information shared in these forums may be read, collected, and used by us.
Information Mary Ward International collects about individuals will not be traded, sold, or rented to other organisations for marketing or solicitation. In most cases, Mary Ward International will use or disclose personal information only for the primary purpose it was collected. Generally, this means disclosure for a purpose in paragraph 5.2. This can include disclosure to third parties performing administrative, promotional, research, IT, or other services, if engaging those third parties was the primary reason for collecting the information.
However, there may be times when Mary Ward International uses or discloses personal information for a secondary purpose, provided that such use or disclosure is lawful. For example, where:
The individual gives consent for Mary Ward International to do so.
The secondary purpose is related to the primary purpose of collection, and the individual would reasonably expect Mary Ward International to use or disclose the personal information for the secondary purpose.
MWI needs to take action regarding suspected unlawful activity or serious misconduct.
The use is required or authorised by law.
Mary Ward International may also disclose personal information to the organisation’s affiliates, the Loreto Sisters and Loreto Ministries Limited, for the purposes set out in this policy. These disclosures are confidential and subject to agreements prohibiting the misuse of personal information, in line with the protections set out in this policy.
Mary Ward International may disclose personal information to overseas recipients for administrative or other business management purposes. Before disclosing any personal information to an overseas recipient, Mary Ward International takes reasonable steps in the circumstances to ensure the overseas recipient complies with the Australian Privacy Principles or is bound by a substantially similar privacy scheme.
Where an overseas recipient does not comply with the Australian Privacy Principles and is not bound by a substantially similar privacy scheme, Mary Ward International will not disclose personal information to the overseas recipient unless the individual consents to the overseas disclosure, or it is otherwise required or permitted by law.
In some instances, Mary Ward International may use and disclose an individual’s personal information to provide them with information and updates about the organisation’s services, including via email, SMS, post, or by telephone. In most cases, this occurs only when personal information is collected from the individual. If an individual no longer wishes to receive these types of communications from Mary Ward International, they should contact Mary Ward International’s Privacy Officer at the details provided below or through any opt-out mechanism contained in a communication.
Mary Ward International holds personal information in both paper-based and electronic files. Electronic information is stored on secure servers. Mary Ward International takes all reasonable steps in the circumstances to ensure that all personal information it holds is protected from misuse, interference, loss, unauthorised access, modification or disclosure. Mary Ward International’s employees, volunteers and contractors who have access to Mary Ward International’s records are obliged to treat all personal information confidentially.
No personal data transmission over the internet can be guaranteed to be 100% secure. Whilst Mary Ward International strives to protect an individual’s personal information from misuse, loss or unauthorised access, the organisation cannot guarantee the security of any information an individual transmits or receives from Mary Ward International’s online services. These activities are conducted at an individual’s own risk. As soon as Mary Ward International receives a transmission, the organisation makes its best efforts to ensure its security.
Mary Ward International will destroy or de-identify personal information in circumstances where it is no longer required for the purposes for which it was collected or for any secondary purpose permitted under the Australian Privacy Principles and the Privacy Act, unless Mary Ward International is otherwise required or authorised by law to retain the information.
Mary Ward International endeavours to ensure the personal information collected, held, used and disclosed is accurate, complete, relevant, current and not misleading. If an individual believes the personal information Mary Ward International holds on them requires correction, they can contact Mary Ward International on the details provided below. An individual may also request access to their personal information for any other reason.
Mary Ward International aims to respond to requests for access within 30 days.
There are instances where Mary Ward International will not provide an individual with access to their personal information. Examples of when Mary Ward International may refuse an individual’s request for access include:
The personal information is part of an employee record (see paragraph 11).
The personal information relates to legal proceedings, and the requested information would not be discoverable.
providing access would reveal Mary Ward International's intentions regarding negotiations with the individual and would prejudice those negotiations.
Giving access would unreasonably infringe on others' privacy.
The request is frivolous or vexatious.
Mary Ward International is not obliged to correct personal information if it does not agree that it requires correction and may refuse to do so.
If an access or correction request is refused, a written notice stating the reasons for the refusal and the available complaint mechanisms will be provided.
Mary Ward International may seek to recover reasonable costs incurred for providing access to personal information.
If an individual requests access to their health information, this request must be in writing, dated and contain the following:
the individual’s name and address.
details of the specific health information that the individual wishes to access.
information about the way in which the individual wishes to have access (for example, inspection or receipt of a copy).
If an individual makes a verbal request for access, Mary Ward International will ask the individual to make the request in writing. Before providing access to health information, Mary Ward International may require evidence of an individual’s identity or authority.
When an individual requests a correction to health information held by Mary Ward International, and Mary Ward International is satisfied that the information is inaccurate, out of date, incomplete, or misleading, Mary Ward International will take steps to correct it. Mary Ward International will address any requests to correct health information within 30 days.
If an access or correction request is refused, a written notice stating the reasons for refusal will be provided.
The safety of children is very important to Mary Ward International. Mary Ward International asks that children under 18 have a parent or guardian verify their contact with the organisation. Whilst Mary Ward International will make every reasonable effort to ensure that children’s privacy and other rights are not compromised, it is ultimately the responsibility of parents to monitor their children’s internet usage.
This paragraph explains how Mary Ward International manages employee records for current and former employees.
Upon commencement of an individual’s employment at Mary Ward International, Mary Ward International will collect certain personal information from the individual, which will form part of their employee records. Mary Ward International will usually request that this information be provided in writing.
While employee records are exempt from the Privacy Act 1988 (Cth), Mary Ward International will nevertheless, where appropriate, deal with an employee record in a manner that is respectful, consistent with its employer obligations, and that protects the security of personal information. Mary Ward International will take reasonable steps to protect employee records from loss, unauthorised access, or other misuse. This includes storing employee records in secure filing cabinets in restricted-access areas and on password-protected computer systems.
Mary Ward International will generally not provide an individual or any other person with access to the individual’s employee records simply on request. Mary Ward International will only provide access if required by law, for example, under a subpoena, in response to a law enforcement agency notice, or as required by legislation or a court order. However, if an employee or former employee requests health information held by Mary Ward International, this will be dealt with in accordance with paragraph 9.2.
It is important that employee records are up to date and accurate. If an individual’s personal information becomes outdated or requires correcting, they should contact Mary Ward International and provide the correct information.
Mary Ward International may change this Privacy Policy to ensure compliance with the Privacy Act. When changes are made, the updated Privacy Policy will be posted on Mary Ward International’s website.
If an individual has a question in relation to this Privacy Policy, a complaint about the way in which Mary Ward International has handled their personal information, or wishes to make a request for access to, or correction of, their personal information, please contact: Mary Ward International’s Privacy Officer on (03) 8832 0411 or email mwiaustralia@loreto.org.au.
At all times, privacy complaints will be treated seriously, dealt with promptly, and kept confidential. Mary Ward International’s Privacy Officer will inform individuals of the outcome of their complaint.
If an individual is dissatisfied with the outcome of their complaint, they may refer the complaint to the Office of the Australian Information Commissioner (www.oaic.gov.au).
Mary Ward International Board
Approves the Privacy Policy.
Oversees implementation and ensures all reporting requirements are fulfilled.
Board Chair
Ensures that appropriate resources are made available to implement the Privacy Policy effectively.
Executive Officer
Is accountable for taking all practical measures to implement this Privacy Policy.
Facilitates a regular review of the Privacy Policy.
Board and committee members, employees, volunteers and contractors
Are familiar with the content of the Privacy Policy and their legal obligations with respect to the policy.
Are observant, aware of key risk indicators, and report any concerns.
Personal information is information or an opinion (including information or an opinion forming part of a database) that is recorded in any form and whether true or not, about an individual whose identity is apparent, or can reasonably be ascertained, from the information or opinion, but does not include information of a kind to which the Health Records Act 2001 applies.
Health information means:
personal information about an individual’s physical, mental or psychological health (at any time).
personal information about an individual’s disability (whether current, pre-existing or future).
personal information about an individual’s expressed wishes about the future provision of health services.
personal information about a health service provided, or to be provided to the individual.
other personal information collected to provide, or in providing, a health service.
other personal information about an individual in relation to organ donation or donation of body parts or substances.
other personal information that is genetic information about an individual in a form that could predict their health or the health of their descendants, but does not include information that is exempt under legislation.
Sensitive information is a type of personal information that includes, amongst other things, details about racial or ethnic origin, religious beliefs, criminal history, or health and medical information.
The Australian Privacy Principles outline how most Australian Government agencies, all private sector and not-for-profit organisations with an annual turnover of more than $3 million, all private health service providers, and some small businesses (collectively called ‘APP entities’) must handle, use, and manage personal information.
Employee record in relation to an employee means a record of personal information relating to the employment of the employee. Some examples of employee records are health information about the employee and personal information about:
the engagement, training, disciplining or resignation of the employee.
The termination of the employee's employment.
The terms and conditions of the employee's employment.
the employee’s personal and emergency contact details.
the employee’s performance or conduct.
the employee’s hours of employment.
the employee’s salary or wages.
the employee’s membership in a professional or trade association.
the employee’s trade union membership.
the employee’s recreation, long service, sick, personal, maternity, paternity or other leave.
the employee’s taxation, banking or superannuation affairs.
Internal policies
Safeguarding Policy
Communications Policy
Conflict of Interest Policy
External Complaints Policy
Record Management Policy
Risk Management Policy
Loreto Code of Conduct
Legislation
Mary Ward International’s management of privacy will comply with the following:
Privacy Act 1988
Do Not Call Register Act 2006
Spam Act 2003
Service level accreditation standards and non-accreditation standards
Approved by: Chair, Mary Ward International Board
Endorsed by: Chair, Mary Ward International Board
Support: Mary Ward International Executive Officer
Review: This policy will be reviewed every three years or earlier if required
Responsible Person: Mary Ward International Board
Date Created: 2018
Scheduled Review Date: November 2028
Contact: Kirstin Del Beato (Executive Officer)
Version: 2.0
Status: Approved
Authorisation Name: Soulla Nicodimou (Acting Chair)
"*" indicates required fields
