Privacy
Privacy Policy.
Effective 14 October 2026. WAssup aims to collect less, protect what it keeps, and put people before publicity.
Privacy at a glance
WAssup Community Services is a small, grassroots Western Australian initiative. We collect only the personal information we reasonably need to respond to people, coordinate the WAssup 108 Speakers Program, manage contributions and keep proper records.
In particular:
- we do not sell, rent or trade personal information;
- donor and supporter names are not published without permission;
- public funding reports use combined figures and anonymous ledger entries; a person or organisation is identified only with permission;
- we do not ask people to send passwords, verification codes, card details, identity documents, detailed health records or private information about a child through ordinary email, social media or messaging;
- photos, video, audio, quotes and stories are published only with appropriate permission, with stronger safeguards for children, young people and people in vulnerable circumstances;
- WAssup does not install advertising trackers or third-party analytics; optional YouTube players connect to YouTube when a visitor chooses to load a video;
- people can ask to access or correct their personal information, and may ask us to delete it where we do not need to keep it; and
- privacy questions, requests and complaints can be sent to wassup@wassup.au.
1. Who we are
WAssup Community Services (WAssup) is currently operated by Scott Bibby as a sole trader under ABN 49 495 986 762 in Western Australia.
This policy explains how WAssup collects, holds, uses, shares, protects and disposes of personal information. It applies to WAssup's website, the WAssup 108 Speakers Program, fundraising and donations, enquiries, organisational contacts, supporters, volunteers, suppliers, events and other current WAssup activities.
This policy does not govern the independent privacy practices of a recipient organisation, bank, Containers for Change operator, social-media platform or another third party. Their own privacy terms apply when a person deals directly with them.
2. Our privacy standard
WAssup handles personal information in accordance with the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs) where they apply. WAssup also chooses to use the APPs as its general privacy benchmark where it is not legally required to do so.
The Privacy Act can apply to some small organisations regardless of turnover, including in connection with certain health services, Commonwealth contracts or trading in personal information. WAssup does not sell or trade personal information. If WAssup's structure, services or contracts change, we will reassess which legal obligations apply.
The Privacy and Responsible Information Sharing Act 2024 (WA) principally applies to Western Australian public-sector entities and may also affect an organisation through particular government contract terms. WAssup will meet any obligations that apply to it under a government contract or other law.
Electronic fundraising and promotional communications will also be managed in accordance with applicable requirements of the Spam Act 2003 (Cth) and Do Not Call Register Act 2006 (Cth).
This policy does not limit any privacy right or remedy available under applicable law.
3. What personal information we may collect
Depending on how a person or organisation deals with WAssup, we may collect:
- a person's name, pronouns and contact details;
- their organisation, position, professional contact details, town or community;
- the content of emails, letters, messages, telephone calls, voicemails and meeting notes;
- information provided in an enquiry, introduction, nomination, proposal, complaint or feedback;
- information needed to assess, coordinate, purchase, deliver, store and account for a speaker-and-microphone kit;
- supporter and donation details, such as the payer's name, organisation, payment reference, contribution amount and date, where these appear in banking or Containers for Change records;
- preferences about contact, public acknowledgement or anonymity;
- photographs, video, audio, quotes, stories and the permissions attached to them;
- volunteer, contractor, supplier or governance information where relevant;
- records of access, correction, deletion and privacy complaints; and
- basic technical information recorded by website infrastructure, such as an IP address, browser or device type, date and time, requested page, referring page and security logs.
WAssup's website does not currently process card payments. WAssup will never ask for a banking password, card PIN or one-time verification code.
4. Sensitive information
Sensitive information can include health and disability information, racial or ethnic origin, Aboriginal or Torres Strait Islander status, religious or philosophical beliefs, political opinions, sexual orientation and criminal-history information.
WAssup does not seek sensitive information merely because it may be interesting or useful later. We will collect it only when it is reasonably necessary for a legitimate WAssup activity and we have consent or another lawful basis.
If someone volunteers sensitive information that WAssup does not need, we will avoid recording it or will securely delete or de-identify it where lawful and practicable. An initial enquiry should not include detailed health records, case notes, identity documents or sensitive information about another person.
Before starting an activity that routinely requires health, disability, trauma or other sensitive information about individual clients, WAssup will carry out a privacy impact assessment, adopt activity-specific collection notices and safeguards, and update this policy.
5. How we collect personal information
We usually collect information directly from the person concerned when they contact WAssup by email, telephone, voicemail, letter, in person, Facebook, WhatsApp or another channel they choose.
We may also collect information:
- from an organisation or professional contact acting with the person's knowledge or where the referral would reasonably be expected;
- through an introduction or nomination;
- from publicly available professional or organisational sources, such as an organisation's official website or public directory;
- from a bank, payment record or Containers for Change service in connection with a contribution;
- from a recipient organisation, supplier or delivery provider while coordinating the program; or
- automatically through standard website and security logs.
If we receive unsolicited personal information, we will decide whether it is reasonably necessary and lawful for us to keep. If not, we will take reasonable steps to delete or de-identify it.
6. Why we collect, use and share information
WAssup may handle personal information to:
- answer enquiries and communicate with people and organisations;
- assess and coordinate prospective and confirmed recipient organisations;
- purchase, deliver and account for equipment;
- manage donations, contributions, sponsorships and Containers for Change activity;
- issue acknowledgements or receipts and maintain financial, tax and audit records;
- provide public recognition where the person or organisation has agreed to it;
- maintain accurate program registers, consent records and public accountability information;
- coordinate volunteers, contractors, suppliers, partnerships, media and events;
- send requested updates or lawful fundraising communications;
- protect people, property, accounts and systems, and respond to suspected fraud, misuse or safety concerns;
- respond to access requests, complaints, legal obligations and disputes; and
- evaluate and improve WAssup's work using aggregated or de-identified information where practicable.
We will not use personal information for an unrelated purpose unless the person consents or the use is otherwise permitted or required by law.
7. Choice, anonymity and pseudonyms
People can browse wassup.au without identifying themselves. A person may also make a cash or container contribution anonymously where the relevant collection method permits it.
People may use a pseudonym when dealing with WAssup where this is lawful and practical. We may need a real name or verified organisational contact where it is required to arrange delivery, provide a receipt, investigate a complaint, protect safety, comply with law or reliably identify a program custodian.
8. Donor and supporter privacy
WAssup's commitment to public financial transparency does not mean publishing private donor information.
WAssup may publish combined totals for income, expenditure, balances, purchases and deliveries. The public program ledger may show transaction dates, general sources, amounts and running balances without naming donors. WAssup will not publish a donor's or supporter's name, contact details or bank reference unless they have clearly agreed to that specific acknowledgement.
Public recognition is optional. A decision to remain anonymous will not reduce the value WAssup places on a contribution.
9. Children, young people and people in vulnerable circumstances
WAssup works with organisations that support children, young people and people who may be in vulnerable circumstances. We apply extra care to information that could expose someone to stigma, discrimination, unwanted attention, financial harm or risks to physical or emotional safety.
As a general rule:
- WAssup communicates about a child or young person through an appropriate parent, guardian, school, youth service or responsible organisation;
- WAssup does not seek private case information about an individual child or young person;
- support is not conditional on agreeing to publicity;
- WAssup does not publish an individual's private contact details, precise whereabouts or sensitive personal story;
- identifiable photographs, video, audio, quotes or stories require specific and informed permission;
- for a child, permission must include a parent or guardian's authority and the child's agreement where the child has capacity to understand the proposed use;
- for an older young person, WAssup will consider their capacity, safety, wishes and the requirements of the responsible organisation and applicable law;
- consent must describe the intended channels and purpose and must not be bundled into an unrelated agreement; and
- a person may withdraw consent for future use. WAssup will take reasonable steps to remove material under its control, although it may not be possible to retrieve printed material or copies already shared by others.
Where a recipient organisation supplies media or a story, WAssup will seek confirmation that the organisation has authority to provide it for the proposed use. WAssup may still decline to publish material if publication could be unsafe, unfair or inconsistent with community expectations.
10. Aboriginal community information and cultural protocols
WAssup recognises that respectful information practice extends beyond the legal definition of personal information. Community stories, cultural knowledge, images, names and recordings may be sensitive or subject to cultural authority even when they are not legally classified as personal information.
WAssup will:
- consult the relevant Aboriginal community-controlled organisation or authorised community contact before publishing community-specific information or media;
- respect cultural restrictions, local protocols and requests concerning names, images, stories and deceased persons;
- avoid presenting community information as WAssup's property merely because WAssup received a copy; and
- correct, restrict or remove material under WAssup's control where an authorised community contact identifies a legitimate cultural, safety or consent concern.
11. Photographs, recordings, quotes and public stories
Permission to participate in a WAssup activity is separate from permission to be photographed, recorded, quoted or publicly identified.
WAssup will explain, in plain language, what is proposed, where the material may appear and whether a person's name, organisation or location will be included. We will seek fresh permission before a materially different use.
For public events, WAssup may use clear event notices for general crowd photography where appropriate, together with a practical way to opt out. We will not rely on a general event notice for a close-up, interview, personal story, sensitive context or identifiable child.
Where practical, WAssup will avoid publishing unnecessary location information and will remove embedded location metadata from media before publication.
12. Website information, cookies and external links
wassup.au is a static website. WAssup does not install third-party analytics, advertising cookies, tracking pixels or behavioural profiling. WAssup's hosting and security providers may create standard technical logs needed to deliver and protect the website.
The Mulan community page offers optional YouTube videos. A player connects to YouTube only after a visitor selects Load video. These players use YouTube’s privacy-enhanced domain, but YouTube may receive technical information when a player is loaded and apply its own privacy practices. Visitors can instead follow the link to the original upload. Community footage hosted directly by WAssup does not require a YouTube connection.
If WAssup introduces non-essential analytics or tracking in future, we will first update this policy and provide clear notice and an appropriate choice.
The website contains links to services such as Facebook, WhatsApp, Containers for Change and the Australian Business Register. Those providers may receive information when a person follows a link or uses their service. WAssup does not control their privacy practices, cookies or applications.
13. Who we may share personal information with
Where reasonably necessary for the purposes described in this policy, WAssup may share limited personal information with:
- the relevant recipient or prospective recipient organisation;
- equipment suppliers, couriers and delivery or logistics providers;
- banks, payment services and Containers for Change operators;
- website, domain, email, cloud-storage, telecommunications, messaging, social-media, security and IT providers;
- professional advisers, insurers, auditors or bookkeepers;
- volunteers or contractors who need the information for an authorised task and are subject to appropriate confidentiality expectations;
- regulators, courts, tribunals, law-enforcement bodies or government agencies where disclosure is authorised or required by law; and
- emergency, safeguarding or support services where disclosure is lawful and reasonably necessary to address a serious threat or protect a person.
We seek to disclose only the minimum information reasonably needed.
WAssup does not sell, rent or trade personal information or donor lists. We do not share a person's details with another organisation for that organisation's marketing without permission.
14. Overseas processing and disclosure
Some service providers used for email, cloud storage, website infrastructure, messaging, social media or AI-assisted administration operate internationally. Personal information may therefore be stored, processed or accessible outside Australia, including in the United States and in other countries where those providers or their subprocessors operate.
Provider locations can change and it may not be practicable to list every country. WAssup will use reputable providers, consider their privacy and security practices, limit the information provided, and take reasonable steps required by applicable Australian law before making an overseas disclosure.
People should avoid sending sensitive information through social media or ordinary messaging services. A person concerned about overseas processing can contact WAssup before providing information so that another practical channel can be considered.
15. AI-assisted tools and automated decisions
WAssup may use reputable AI-assisted or digital tools to help draft, organise or summarise routine administrative material. Where practicable, we will first remove or minimise personal information and will not knowingly submit detailed health records, identity documents or identifiable information about a child to a general-purpose AI tool.
AI-generated material is subject to human review. WAssup does not currently use a computer program to make, or substantially assist in making, decisions that could reasonably be expected to significantly affect an individual's rights or interests. In particular, AI does not decide whether an individual receives support or whether an organisation receives a speaker.
If this changes, WAssup will assess the privacy impact and update this policy and relevant collection notices before using the system for that purpose.
16. How we protect personal information
WAssup takes reasonable technical, physical and organisational steps appropriate to its size, activities and the sensitivity of the information. These include measures such as:
- limiting access to people who need the information for an authorised purpose;
- using reputable service providers and reviewing privacy and security settings;
- using strong, unique account credentials and multi-factor authentication where available;
- keeping devices, software and security protections up to date;
- avoiding unnecessary copies and insecure transfers;
- keeping private records separate from public program reporting;
- backing up important operational records appropriately;
- checking recipients before sending personal information; and
- securely deleting or de-identifying information when it is no longer needed.
No method of transmission or storage is completely secure. People should not send passwords, verification codes, full card details, identity documents, detailed health records or confidential case notes through ordinary email, social media or WhatsApp.
17. How long we keep information
WAssup keeps personal information only for as long as it is reasonably needed for the purpose for which it was collected, for public accountability, to resolve a complaint or dispute, or to meet a legal, insurance, tax or record-keeping obligation.
In general:
- financial, donation and tax records are kept for the period required by law, generally at least five years;
- recipient, purchase, delivery and asset-accountability records may be kept for the life of the program and for a reasonable period afterwards;
- publication and consent records are kept while the relevant material remains in use and for a reasonable period afterwards;
- complaint, incident and legal records are kept while they remain relevant to the issue and any applicable legal period; and
- routine enquiries and contact records are periodically reviewed and deleted or de-identified when there is no continuing need to retain them.
We will not keep personal information indefinitely merely because it might become useful. Deletion from backups and third-party systems may occur through their normal secure deletion cycles.
Public material removed from WAssup's own channels may remain in search-engine caches, web archives, printed material or copies made by other people. WAssup will take reasonable steps within its control but cannot guarantee deletion from systems it does not control.
18. Access, correction and deletion requests
A person may ask WAssup to:
- confirm whether we hold personal information about them;
- provide access to that information;
- correct information that is inaccurate, out of date, incomplete, irrelevant or misleading; or
- delete or de-identify information that WAssup no longer needs and is not required or justified to retain.
Requests should be sent to wassup@wassup.au with the subject line Privacy request. WAssup may need to verify identity, but will request only what is reasonably necessary and will use a proportionate verification method.
We will acknowledge a request within seven days and aim to provide a substantive response within 30 days. If more time is reasonably needed, we will explain why and provide an expected response date.
WAssup will not normally charge for making a request or for straightforward access. If access cannot be provided in the requested form, or must be refused or redacted to protect another person, legal privilege, safety or another lawful interest, we will explain the decision and available complaint options where required.
19. Fundraising and other communications
WAssup does not buy or use harvested contact lists. We may send an update, invitation or fundraising communication where a person has consented, would reasonably expect the communication, or the law otherwise permits it.
Electronic promotional messages will identify WAssup and provide a simple way to opt out where required. A person can opt out at any time by using the stated method or emailing wassup@wassup.au. We will action the request promptly and, for electronic commercial messages, within the period required by the Spam Act.
We may retain a minimal suppression record so that we can honour a do-not-contact request.
20. Data breaches
A data breach occurs when personal information is lost or accessed, changed or disclosed without authority.
If WAssup becomes aware of a suspected breach, we will act promptly to contain it, assess what happened and the risk of harm, take remedial steps, document the response and review how to prevent a recurrence.
Where notification is legally required, WAssup will notify affected people and the relevant regulator. Even where notification is not legally mandatory, we will notify affected people when doing so is reasonably necessary to help them reduce a serious risk of harm.
21. Privacy questions and complaints
Questions or complaints can be directed to:
Privacy contact: Scott Bibby
Organisation: WAssup Community Services
Email: wassup@wassup.au
Telephone: 0491 756 664
Location: Western Australia - WAssup does not operate a public office or accept walk-in visits.
Please use the subject line Privacy complaint and explain the concern, relevant dates and the outcome sought. Do not include more sensitive information than is necessary.
WAssup will acknowledge a complaint within seven days, investigate it fairly and aim to provide a written outcome within 30 days. If more time is required, we will explain why and provide an expected response date.
If a person is not satisfied and the Privacy Act applies, they may be able to complain to the Office of the Australian Information Commissioner. If the Privacy and Responsible Information Sharing Act applies to the relevant activity, they may be able to contact the Western Australian Office of the Information Commissioner. A person may also seek independent legal advice.
22. Changes to this policy
WAssup will review this policy at least annually and when its legal structure, activities, technology, service providers or information practices materially change.
The current version will be published at wassup.au with its effective date. If a change materially affects how existing personal information is handled, WAssup will provide additional notice where reasonable and obtain consent where required.