This policy explains how [[TO FILL: organisation legal name]] ("SOWA", "we" or "us") collects, uses, stores and discloses your personal information. It follows the structure of the Australian Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs).
[[LEGAL TO CONFIRM: whether the Privacy Act applies to this organisation (e.g. the small business exemption), and if not, whether we state that we follow the APPs voluntarily]]
1. What we collect
When you sign up for an event, the details you enter on the form:
- your name and email (required);
- your phone number (optional);
- your age group (required, so we know whether you are under 18);
- your school or workplace (optional);
- how you heard about the event (optional);
- dietary or access needs (optional);
- your answers to any extra questions the organisers set for that event;
- whether you agree to event photos being used for promotion, and your agreement to this policy.
We also record when you signed up, which site language you used, and whether staff checked you in on the day.
Under-18s: if the event requires parental consent and you choose an under-18 age group, we also collect a parent or guardian’s name and phone number, and their confirmation that they consent to you taking part.
Sensitive information: dietary or access needs can reveal sensitive information such as health or religious beliefs. This field is entirely optional, collected only if you fill it in, and used only to plan the event. [[LEGAL TO CONFIRM: whether separate express consent is needed for this]]
When you browse the site: a cookie called sowa-locale remembers the language you chose, for one year, and holds nothing else. The site does not currently use analytics, advertising or tracking cookies; if that changes we will update this policy first. Our hosting provider may briefly keep technical information such as IP addresses in server logs. [[TO CONFIRM: hosting provider and how long it keeps logs]]
2. Protection against abuse
To stop automated sign-ups from filling events or sending floods of email, the sign-up form has two safeguards:
- Cloudflare Turnstile: when switched on, the form runs Cloudflare’s Turnstile check. It reads some device and browser signals to tell people from bots, and when you submit, we send the check result and your IP address to Cloudflare to verify. Cloudflare handles this information under its own privacy policy.
- Rate limits: we turn your IP address and email address into a one-way keyed hash and keep only that hash and a count of attempts, never the raw IP address. These records are deleted automatically by the database within about 24 hours.
3. How we use it
- to confirm your place, manage capacity and contact you about the event if needed (for example a change of time or place);
- to arrange food and access support you asked for;
- to check you in on the day and, if you are under 18, confirm parental consent;
- only if you agreed, to use event photos that include you on SOWA’s website and social media;
- to prevent abuse and keep the site secure.
We do not sell or rent your personal information, and we will not use your sign-up details to send you promotional messages unrelated to the event without your consent.
4. Confirmation email
When you sign up, we email the address you gave with your name and the event’s time and place (and the joining link for online events). The email is sent through [[TO CONFIRM: email service provider]]. To cancel or change your registration, just reply to that email.
5. Where it is stored and how we protect it
Registration data is stored in a MongoDB Atlas cloud database in the Sydney region (in Australia). [[TO CONFIRM: check the database region before launch]] The website is hosted by [[TO CONFIRM: hosting provider and region]].
Our safeguards include HTTPS on every page, role-based access to the admin, encryption at rest by the database provider, and rate-limit records that store only hashes, never raw IP addresses.
6. Who can see your information
- SOWA staff: admin accounts have one of three roles: admin, editor or contributor. Only admins and editors can view registrations and export a sign-up list (CSV file) to run the event; contributors cannot see registrations. Only admins can delete a registration. Exported lists are for internal use only.
- Service providers that process some information on our behalf to run the site: MongoDB (database), Cloudflare (bot check), our email service provider and our hosting provider. They may use it only to provide their service.
- [[TO CONFIRM: whether sign-up lists are shared with co-hosts or venues; if so, which fields and why]]
Otherwise we disclose your information only with your consent, when the law requires it, or to lessen a serious threat to someone’s life, health or safety.
7. Overseas disclosure
The registration database is in Australia. However, Cloudflare is a US company, so your IP address and browser signals may be processed outside Australia during the bot check, and our email and hosting providers may also process information overseas. [[TO CONFIRM: where each provider processes data]]
8. How long we keep it
- Rate-limit records: up to about 24 hours, deleted automatically.
- Registrations: kept until [[TO FILL: retention period, e.g. 12 months after the event]], then deleted or de-identified. The site does not delete registrations automatically yet; an admin clears them by hand on this schedule. [[TO CONFIRM: clean-up process and who is responsible]]
You can ask us to delete your registration sooner at any time (see section 10).
9. Anonymity and pseudonyms
You can browse this site without giving us any personal information. To sign up for an event we need your name and email so we can manage places, send your confirmation and contact you; without them we cannot complete your sign-up.
10. Access, correction and deletion
Email [[TO FILL: contact email]] to see, correct or delete the personal information we hold about you. To protect your information we may first check your identity. We will reply within 30 days, free of charge. If the law stops us from doing what you ask, we will explain why in writing.
11. Data breaches
If a data breach is likely to cause you serious harm, we will notify you and the Office of the Australian Information Commissioner (OAIC) as the law requires. [[LEGAL TO CONFIRM: whether the Notifiable Data Breaches scheme applies to this organisation]]
12. Complaints
If you think we have mishandled your personal information, please contact us first at [[TO FILL: contact email]]. We will reply within 30 days. If you are not satisfied with our response, you can complain to the OAIC:
- Website: www.oaic.gov.au
- Phone: 1300 363 992 (from outside Australia +61 2 9942 4099)
- Post: GPO Box 5288, Sydney NSW 2001
13. Changes to this policy
We may update this policy from time to time. Each update changes the version number and “last updated” date at the top of this page; we will flag significant changes on the site.
14. Contact us
- Organisation: [[TO FILL: organisation legal name]]
- Email: [[TO FILL: contact email]]
- Postal address: [[TO FILL: postal address, if any]]