Policy Statement

Highlands Campus is committed to protecting the privacy of its workers and other persons, and is bound by the Australian Privacy Principles (APPs) contained in the Commonwealth Privacy Act. This Policy sets out how Highlands manages and uses personal information provided to or collected by it. Highlands may, from time to time, review and update this Privacy Policy to take account of new laws and technology, changes to operations and practices at Highlands, and to ensure the policy remains appropriate to the changing environment.

1. Scope

This policy applies to Highlands Campus Board Members, all Officers, Workers and Other Persons at the Campus and describes the type of information the Campus collects, how the information is handled, how and to whom the information is disclosed, and how the information may be accessed.

2. Definitions

Worker – Employees, contractors, subcontractors, outworkers, apprentices and trainees, work experience students, volunteers and PCBUs who are individuals if they perform work for the business.

Other Persons – Board members, church attendees, children, students, youth, parents/caregivers and visitors. 3. Type of Information the Campus Collects and How is it Collected

The type of information Highlands collects and holds includes (but is not limited to) personal information, including health and other sensitive information, about:

• Children and parents and/or guardians (‘Parents’) before, during and after the course of a child’s enrolment at the Campus:

  •  Name, contact details (including next of kin), date of birth, gender, language background, previous school and religion

  •  Parents’ education, occupation and language background

  •  Medical information (eg; medical management plans, immunisation records, details of special needs

    and/or allergies, absence notes, medical reports and names of doctors)

  •  Conduct and complaint records, or other behaviour notes, and school reports

  •  Information about referrals to government welfare agencies

  •  Counselling reports

  •  Health fund details and Medicare number

  •  Any court orders

  •  Volunteering information

  •  Photos and videos of events at the College, Kindy & Early Learning, and Outside School Hours Care

• Job applicants, staff members, volunteers and contractors:

  • Name, contact details (including next of kin), date of birth and religion 

  • Information on job application

  • Professional development history

  • Salary and payment information, including superannuation details

  • Medical information (eg; details of disability and/or allergies and medical certificates)

  • Complaint records and investigation reports

  • Leave details

  • Photos and videos at Campus events

  • Workplace surveillance information

  • Work emails and private emails (when using work email address) and internet browsing history

• Other persons who come into contact with Highlands including name and contact details and any other information necessary for the particular contact with Highlands.

Information may also be collected through the Highlands websites and social media pages, Family Law Court Orders or Agreements, special needs agencies and training courses.

Highlands will destroy any unsolicited personal information that is not directly related to our service operations unless it adversely impacts the health, safety and wellbeing of a person or persons at the Campus. If this occurs, Highlands will contact the appropriate Government authorities and take action as directed while protecting the confidentiality of the individuals concerned.

Personal Information You Provide

Highlands will generally collect personal information held about an individual by way of social media and website interaction; forms filled out by Workers or Other Persons, face-to-face meetings and interviews, emails and telephone calls.

Information Collected via Websites

Highlands uses cookies and other internet technologies to manage Campus websites, Facebook pages and certain online products and services. These technologies are not used to collect or store personal information unless users have opted in to such a feature.

The Highlands Internet server logs the following information which is provided by a user’s browser for statistical purposes only:

• The type of browser and operating system

• The Internet Service Provider (ISP) and top level domain name

• The address of any referring web site; and

• The computer’s IP address

This information is used by Highlands for aggregated statistical analyses or systems administration purposes only. No attempt will be made to identify users or their browsing activities, except where required by or under law.

Cookies

A “cookie” is a packet of information that allows the Highlands server to identify and interact more effectively with a user’s computer.

When accessing a Highlands website, a temporary or “session cookie” is allocated that assigns a unique identification number. A different identification number is sent upon each website visit. Cookies do not identify individual users, they identify a user’s internet browser type and ISP. Shortly after ending interaction with a Highlands website, the cookie expires. This means it no longer exists on an individual’s computer and therefore cannot be used for further identification or access to their computer.

Without cookies certain personalised services within websites cannot be provided to users, accordingly, users may not be able to take full advantage of all website features if cookies have been disabled.

Links to Other Sites

Highlands websites may contain links to other external sites and Highlands is not responsible for the privacy practises or the content of such external websites. Highlands would encourage individuals to read and understand the privacy policies on those websites prior to providing any information to them.

Searches

Search terms that are entered when using Highlands search engines are collected, but are not associated with any other personal information collected.

Personal Information Provided by Other People

In some circumstances, Highlands may be provided with personal information about an individual from a third party; for example a report provided by a medical professional, a reference from another school, early learning centre, church or workplace, Family Law Court orders or agreements, special needs agencies or training courses.

How Highlands Uses the Personal Information Provided

Highlands will use personal information it collects from you for the primary purpose of that collection and for such other secondary purposes that are related to the primary purpose of collection and reasonably expected by you, or to which you have consented1. Highlands may also use your personal information to comply with legal obligations, such as the protection and welfare of individuals or to protect the vital interests of you or another person; for example, in pastoral situations, where as an entity within the International Network of Churches (INC), Highlands Church may share information with INC if required in the circumstances.

4. Enrolled Children and their Parents/Carers

In relation to personal information of enrolled children and their parents, Highlands’ primary purpose of collection is to enable the Campus to provide education to children enrolled at the Campus, exercise its duty of care and perform necessary associated administrative activities which will enable children to take part in all the activities of the Campus. This includes satisfying the needs of parents, the needs of the children and the needs of Highlands throughout the whole period that a child is enrolled at Highlands.

The purposes for which Highlands uses personal information of children and their parents include:

• To keep parents informed about matters related to their child’s education, through correspondence, newsletters and magazines

• Day-to-day administration of Highlands

• Looking after children’s educational, social and medical wellbeing

• Entry onto Campus waiting list applications

• Seeking donations and marketing for the Campus

• To satisfy the legal obligations of the Campus and allow the Highlands Christian College and HighlandsKindy & Early Learning to discharge their duty of care

In some cases, where personal information is requested by Highlands about a child or parent, if the information requested is not provided, Highlands may not be able to enrol or continue the enrolment of a child or permit a child to take part in a particular activity.

On occasions, information such as academic and sporting achievements, Campus activities and similar news are published in Highlands newsletters, magazines, on the Highlands intranet and website, and this may include photographs and videos of activities such as sporting events, school camps and excursions. Highlands will obtain permission from children’s parents or guardian (and from the child if appropriate) to include photographs, videos or other identifying material in promotional material, or otherwise make this material available to the public such as on the internet.

5. Job Applicants, Staff Members and Contractors

In relation to personal information of job applicants, staff members and contractors, Highlands’ primary purpose of collection is to assess and (if successful) to engage the applicant, staff member or contractor, as the case may be. Personal information such as name, address and resume details may be kept on file if the application is unsuccessful in case another position becomes available.

The purposes for which Highlands uses personal information of job applicants, staff members and contractors include:

• To assess the application – we may also make notes and prepare a confidential report in respect of the application

• To administer the individual’s employment or contract, as the case may be

• For insurance purposes

• To satisfy the legal obligations of the Campus, eg; criminal record checks, Court Orders, Blue Card checks, etc. in relation to child protection legislation

• Seeking donations and marketing for the Campus

6. Volunteers

Highlands obtains personal information about volunteers who assist the Campus in its functions or conduct associated activities, such as church activities, college activities and alumni associations, etc. to enable Highlands and the volunteers to work together effectively.

The purposes for which Highlands uses personal information of volunteers include:

• To assess an application – we may also make notes and prepare a confidential report in respect of the application

• For insurance purposes

• To satisfy the legal obligations of the Campus, eg; criminal record checks, Court Orders, Blue Card checks, etc. in relation to child protection legislation

• Seeking donations and marketing for the Campus

7. Church Attendees and Visitors

Many Highlands church services, conference meetings, testimonials, baptism services and leadership meetings are recorded and images of people attending and participating in church services, conferences, or other recordings may be used or shown in part for promotional purposes, resource material and commercial activities.

By attending such church services and/or conference sessions, or being involved in testimonials for example, you agree to Highlands using your image and personal information in these recordings.2

If you provide your personal information to Highlands Church, you consent to being contacted generally for pastoral care or follow up.

8. Marketing and Fundraising

Highlands considers marketing and seeking donations for the future growth and development of the Campus an important part of ensuring that a quality learning environment continues to be provided in which both children and staff thrive; and that Campus initiatives, programs and events provide valuable outcomes to the community. Personal information held by Highlands may be disclosed to organisations that assist in fundraising, such as the alumni association, or on occasion, external fundraising organisations.

Parents, staff, contractors and other members of the wider Highlands community may from time to time receive fundraising information. Campus publications, like newsletters and magazines, which include personal information, may also be used for marketing purposes.

If you would like to opt-out of direct marketing please contact Highlands Reception on enquiries@hcct.org.au or 07 4617 6555.

9. Disclosure of Personal Information

Where permitted or obliged to do so by Australian law, Highlands may disclose personal information, including sensitive information, held about an individual for educational, legal, administrative, marketing and support purposes. This may include to:

• Another school or early learning service or staff at another school or early learning service

• Government departments (including for policy and funding purposes)

• Authorised officers when Highlands Kindy & Early Learning is assessed and rated under the National Education and Care Law and Regulations

• Medical practitioners

• People providing educational, support and health services to the Campus, including specialist visiting teachers, (sports) coaches, volunteers, counsellors and providers of learning and assessment tools

• Providers of learning and assessment tools

• Assessment and educational authorities, including the Australian Curriculum, Assessment and Reporting Authority (ACARA) and NAPLAN Test Administration Authorities (who will disclose it to the entity that manages the online platform for NAPLAN)

• People providing administrative and financial services to the Campus

• Software companies that provide tailored computer-based educational tools for children

• Recipients of Highlands publications, such as newsletters and magazines

• Children, parents or guardians

• Anyone you authorise Highlands to disclose information to

• Anyone to whom Highlands is required or authorised by law, including child protection laws, to disclose information

10. Sending and Storing Information Overseas

Highlands may disclose personal information about an individual to overseas recipients, for instance, to store personal information with ‘cloud’ service providers which are situated outside Australia or to facilitate a school exchange and in these cases will ensure compliance with the APPs and other applicable privacy legislation.

Highlands may use online or ‘cloud’ service providers to store personal information and to provide services to the Campus that involve the use of personal information, such as services relating to email, instant messaging and education and assessment applications. Some limited personal information may also be provided to these service providers to enable them to authenticate users that access their services. This personal information may be stored in the ‘cloud’ which means that it may reside on a cloud service provider’s server which may be situated outside Australia.

11. Sensitive Information

In referring to ‘sensitive information’, Highlands means: information relating to a person’s racial or ethnic origin; political opinions; membership of a political association, religious beliefs or affiliations, membership of a professional or trade association, membership of a trade union, philosophical beliefs, sexual preferences or practices, criminal record, health information or biometric information about an individual.

Sensitive information will be used and disclosed only for the purpose for which it was provided or a directly related secondary purpose, unless you agree otherwise, or the use or disclosure of the sensitive information is required by law.

12. Anonymity

Where possible, Highlands will allow people to interact anonymously or use a pseudonym. For example, if an individual contacts the Campus with a general question, they do not need to provide Highlands with their name unless it is required to adequately respond to the question. However, for most functions and activities, Highlands will usually need a person’s name, contact information and enough information about the particular matter to enable an enquiry, request, complaint or application to be handled fairly and efficiently.

13. Management and Security of Personal Information

Highlands has steps in place to protect the personal information the Campus holds from misuse, interference and loss, unauthorised access, modification or disclosure by use of various methods including: locked storage of paper records, password access rights to computerised records, anti-virus and ‘malware’ software and data backup systems.

All Highlands staff and volunteers are required to sign and comply with the Confidential Information section within the Highlands Code of Conduct, agreeing to respect the confidentiality of all personal information and the privacy of individuals. This includes conducting confidential conversations with parents or with other staff in an area away from other children, parents and staff.

Staff and volunteers must obtain authorisation from a child’s parent prior to posting any photos of their child on any Highlands social media page.

In relation to Highlands Kindy & Early Learning and Highlands Outside School Hours Care, staff must also comply with the Highlands Kindy & Early Learning and Highlands Outside School Hours Care Social Media Policy.

14. Data Breaches

It will be deemed that an ‘eligible data breach’ has occurred if:

• There has been unauthorised access to, or unauthorised disclosure of, personal information about one or more individuals (the affected individuals)

• A reasonable person would conclude there is a likelihood of serious harm to any affected individuals as a result

• The information is lost in circumstances where:

  • Unauthorised access to, or unauthorised disclosure of the information is likely to occur

  • Assuming unauthorised access to, or unauthorised disclosure of the information was to occur, a reasonable person would conclude that it would be likely to result in serious harm to the affected individuals.

  • Highlands will also consider how long the information has been accessible.

  • Serious harm may include serious physical, psychological, emotional, economic and financial harm, as well as serious harm to reputation.

What must the Campus do in the event of an ‘eligible data breach’?

If Highlands suspects that an eligible data breach has occurred, it will carry out a reasonable and expedient assessment/investigation within 30 days.

If such an assessment/investigation indicates there are reasonable grounds to believe an eligible data breach has occurred, then Highlands will be required to lodge a statement with the Privacy Commissioner (Commissioner). Where practical to do so, Highlands will also notify the affected individuals. If it is not practical to notify the affected individuals, Highlands will publish a copy of the statement on its website, or publicise it in another manner.

Exception to notification obligation

An exception to the requirement to notify will exist if there is a data breach and immediate remedial action is taken, and as a result of that action:

• There is no unauthorised access to, or unauthorised disclosure of the information
• There is no serious harm to affected individuals and as a result of the remedial action, a reasonable person would conclude the breach is not likely to result in serious harm

15. Social Media

Highlands expects that people involved with the Campus who use social networking sites and services, video and photo sharing sites and blogging sites such as, but not limited to, Facebook, Google+, Snapchat, Instagram, LinkedIn, Flickr, YouTube, Tik-Tok, Twitter, Zoom, Skype, SMS will observe the following when using these mediums:

• Demonstrate ethical and respectful values and behaviour online in the same way that is expected in- person and abide by any relevant Code of Conduct

• Not use the Highlands name, logo and/or uniform in any way that could damage the reputation of the Campus and ensure that any personal online contributions cannot be interpreted as a view held by Highlands

• Not share photos of persons where they are clearly identified as members of the Highlands Christian College, Highlands Kindy & Early Learning or Highlands Outside School Hours Care community, nor share photos of any Highlands Christian College, Highlands Kindy & Early Learning or Highlands Outside School Hours Care activity including outside hours events (the exception being Campus staff, with the appropriate permissions, publishing content via an official Campus social media site)

• Not commit any slander, cyberbullying, harassment, exclusion, stalking, threatening, intimidating, masquerading or doxing (doxing is the intentional online exposure of an individual’s identity, private information or personal details without their consent)3

• Not posting, viewing or distributing explicit, offensive, racist, sexist, obscene or inappropriate material4

• Understand that any criminal behaviour will be reported to the Police to investigate, following which, Highlands has no further control over the matter

16. Access and Correction of Personal Information

Under the Privacy Act an individual has the right to seek and obtain access to any personal information which Highlands holds about them and to advise Highlands of any perceived inaccuracy. There are some exceptions to this right set out in the Act. Children will generally be able to access and update their personal information through their parents, but older children may seek access and correction themselves.

To make a request to access or to update any personal information Highlands holds about you or your child, please complete the form attached as Appendix 1 and forward it to Campus Reception at enquiries@hcct.org.au. Highlands will respond to a request for access to personal information within 30 calendar days of receiving the written request and may require you to verify your identity and specify what information you require. Highlands may charge a fee to cover the cost of verifying your application and locating, retrieving, reviewing and copying any material requested. If the information sought is extensive, Highlands will advise the likely cost in advance. If Highlands cannot provide you with access to that information, you will be provided with written notice explaining the reasons for refusal.

Highlands will take reasonable steps to ensure that any personal information is accurate, up to date, complete, relevant and not misleading.

17. Consent and Rights of Access to the Personal Information of Children

Highlands respects every parent’s right to make decisions concerning their child’s education. Generally, Highlands will refer any requests for consent and notices in relation to the personal information of a child to the child’s parents. Highlands will treat consent given by parents as consent given on behalf of the child and notice to parents will act as notice given to the child.

As mentioned above, parents may seek access to personal information held by Highlands about them or their child by contacting the Campus Reception, however, there will be occasions when access is denied. Such occasions would include where release of the information would have an unreasonable impact on the privacy of others, or where the release may result in a breach of the Campus duty of care to a child or the Privacy Act

Highlands may, at its discretion, on the request of a child grant that child access to information held by the Campus about them, or allow a child to give or withhold consent to the use of their personal information, independently of their parents. This would normally be done only when the maturity of the child and/or the child’s personal circumstances warrant it.

18. Secure Record Destruction

To comply with the APPs, Highlands will take reasonable steps to destroy personal information in a secure manner or ensure it is de‐identified if the information is no longer required for any purpose for which it may be used or disclosed5.

19. Enquiries and Complaints

If you would like further information about the way Highlands manages the personal information it holds, or wish to make a complaint about a breach of the APPs, please email enquiries@hcct.org.au, or contact Campus Reception on 07 4617 6555. Highlands will investigate any complaint and will notify you of the making of a decision in relation to your complaint as soon as is practical after it has been made.

20. Access to Personal Information (Request/Denial)

1 This includes information collected by Highlands Kindy & Early Learning that is required to comply with the National Education and Care Law and Regulations and to promote learning under the Early Years Learning Framework

2 Highlands Church reserves the right to photograph and record church events, however strives to ensure that photography and videography are used in safe and positive ways. Highlands will not knowingly and intentionally post any photo, video or other recording that would be embarrassing, objectionable or hurtful to any clearly, personally identifiable individual in the recording.

If you see a photo on a Highlands website or social media page that includes you or your child and would like it removed, please contact Highlands on 07 4617 6555 or via enquiries@hcct.org.au. Please note that images from video or live stream messages are unable to be removed.

3 Criminal Code Act 1995 (Cth)

4 Child Protection Act 1999 (Qld)