Approved by Board: 29th April, 2026       

1. Policy statement and purpose

Shining Within Ltd (Shining Within) is committed to protecting the privacy, confidentiality, and security of personal information collected through its activities, partnerships, and operations.

This policy outlines how Shining Within collects, uses, stores, and discloses personal information in accordance with the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs).

Shining Within also adheres to relevant data security standards, including the Payment Card Industry Data Security Standard (PCI DSS), where applicable.

This policy aims to:

• Clearly state Shining Within’s commitment to protecting personal information
• Explain how personal information is collected, used, and disclosed
• Describe how information is stored and safeguarded
• Outline individuals’ rights to access, correct, or request deletion of their information
• Ensure transparency and accountability in all data handling practices

Shining Within primarily operates as a funding, partnership, and capacity building organisation and may collect personal information through:

• Donations and supporter engagement
• Newsletter subscriptions and communications
• Partnerships and program activities
• Scholarship and training initiatives
• Events, volunteering, and applications
• Communications, storytelling, and impact reporting
• Website interactions and digital platforms

2. Scope and application

This policy applies to all personal information handled by Shining Within, including information relating to:

• Donors, supporters, and members of the public
• Board members, volunteers, contractors, and advisors
• Partner organisations and their personnel
• Scholarship recipients, trainees, and program participants
• Individuals whose stories, images, or data are shared with consent

This policy applies to all people acting on behalf of Shining Within, including:

• Board Directors and committee members
• Employees
• Volunteers and interns
• Contractors, consultants, and advisors

3. Guiding principles

Shining Within’s approach to privacy is guided by the following principles:

• Respect for privacy and dignity
  Personal information is handled respectfully and in a way that protects the dignity and rights of individuals.
• Compliance with legal obligations
  Shining Within complies with the Privacy Act 1988 (Cth), the Australian Privacy Principles, and other applicable laws.
• Data minimisation
  Only personal information that is necessary for legitimate organisational purposes is collected.
• Purpose limitation
  Personal information is used only for the purpose for which it was collected, unless consent is obtained or required by law.
• Security and confidentiality
  Reasonable steps are taken to protect personal information from misuse, interference, loss, unauthorised access, modification, or disclosure.
• Transparency and accountability
  Individuals are informed about how their information is used, and Shining Within is accountable for its data practices.
• Trauma-informed and ethical handling
  Special care is taken when handling sensitive information, particularly relating to trauma survivors, to avoid harm, exploitation, or re-traumatisation.

4. Definitions

• Personal information
  Information or an opinion about an identified individual or an individual who is reasonably identifiable.
• Sensitive information
  A subset of personal information including health information, trauma history, beliefs, or other information requiring higher protection.
• Collection
  The gathering, acquiring, or obtaining of personal information.
• Disclosure
  Making personal information accessible or visible to others outside Shining Within.

5. Collection of personal information

Shining Within collects personal information that is reasonably necessary for its functions and activities.

Information may be collected:

• Directly from individuals (e.g. donation forms, website forms, emails, or phone communications)
• Through interactions such as donations, newsletter subscriptions, event registrations, volunteering applications, and general enquiries
• Through partner organisations (with appropriate consent and safeguards)
• During program delivery, training, or scholarship processes
• Through website analytics and digital tools

Types of information collected may include:

• Name and contact details
• Mailing or residential address
• Email address and telephone number
• Donation and payment information
• Date of birth or age
• Gender
• Occupation or professional background
• Communication preferences
• Feedback, survey responses, or correspondence
• Images, stories, or testimonials (with consent)

Sensitive information will only be collected where:

• It is reasonably necessary for Shining Within’s activities, and
• Consent has been obtained, or
• Required or authorised by law

6. Use and disclosure of personal information

Shining Within uses personal information for purposes including:

• Managing donations and issuing tax-deductible receipts
• Communicating with donors, partners, and stakeholders
• Providing updates on programs, impact, and fundraising activities
• Delivering programs, scholarships, and training
• Managing event participation and volunteer engagement
• Monitoring, evaluation, and reporting
• Responding to enquiries, requests, or complaints
• Complying with legal and regulatory obligations

Personal information may be disclosed to:

• Board members, volunteers, and authorised representatives where required
• Third-party service providers (e.g. payment platforms, IT providers, CRM systems, cloud storage providers)
• Regulatory authorities where required by law
• Professional advisors (e.g. auditors, legal advisors)
• Partner organisations where relevant and appropriate, and with appropriate safeguards

Shining Within does not sell or rent personal information.

7. Overseas disclosure

As Shining Within partners with organisations overseas, personal information may be disclosed to overseas partners or stored on overseas servers.

Shining Within will take reasonable steps to ensure that:

• Overseas recipients handle personal information in a manner consistent with this policy
• Appropriate safeguards, agreements, and due diligence processes are in place

8. Data storage and security

Shining Within takes reasonable steps to protect personal information, including:

• Secure digital systems and platforms (e.g. CRM systems)
• Password protection and access controls
• Restricted access to sensitive information
• Secure storage and transmission of data
• Engagement of reputable third-party providers
• Compliance with relevant data security standards (including PCI DSS where applicable)

Where personal information is no longer required, it will be securely destroyed or de-identified where appropriate.

9. Access, correction, and deletion

Individuals have the right to:

• Request access to their personal information
• Request correction of inaccurate or incomplete information
• Request deletion of their personal information, subject to legal and regulatory obligations

Requests should be made in writing to Shining Within.

Shining Within will respond within a reasonable timeframe.

10. Marketing and communications

Shining Within may send communications relating to:

• Programs and impact updates
• Fundraising campaigns and donation opportunities
• Events and engagement opportunities

Individuals may opt out of receiving communications at any time by:

• Using the unsubscribe function in emails, or
• Contacting Shining Within directly

11. Complaints and concerns

If an individual has concerns about how their personal information has been handled, they may contact Shining Within.

Privacy Contact Officer

Email: info@shiningwithin.org.au

Complaints will be:

• Taken seriously and handled promptly
• Investigated fairly and confidentially
• Responded to in a timely manner

If a person is not satisfied with the response, they may contact the Office of the Australian Information Commissioner (OAIC):

Website: www.oaic.gov.au

12. Data breaches

Shining Within will take data breaches seriously and will:

• Assess and contain any breach promptly
• Notify affected individuals where appropriate
• Comply with the Notifiable Data Breaches (NDB) scheme where applicable
• Take steps to prevent recurrence

This policy should be read in conjunction with the Data Breach Response Procedure.

13. Roles and responsibilities

Board of Directors

• Oversee compliance with privacy obligations
• Ensure appropriate systems and controls are in place

Chair / Privacy Contact

• Act as the primary contact for privacy enquiries and complaints
• Ensure issues are managed appropriately

Staff, volunteers, and representatives

• Comply with this policy
• Handle personal information responsibly
• Report any data breaches or concerns

Partners

• Handle personal information in accordance with agreed standards
• Ensure appropriate consent and safeguards are in place