Version 1, 22 July 2026

1. About this policy

This Privacy Policy explains how Melaythenner Teeackana Warrana (Heart of Country) Aboriginal Corporation (MTWAC, we, us or our) collects, holds, uses and discloses personal information through our website, programs, membership processes, event registrations, donations, online store, enquiries and other activities.

MTWAC respects the privacy of community members, applicants, visitors, supporters, customers, partners, volunteers and other people who interact with us. We recognise that some information we collect may be culturally sensitive, personally sensitive, or may relate to Aboriginal heritage, ancestry, family connections and community identity.

MTWAC manages personal information in accordance with the Privacy Act 1988 (Cth) and the Australian Privacy Principles to the extent they apply to our activities. Even where a specific legal obligation does not apply, MTWAC aims to handle personal information carefully, respectfully and transparently.

2. What personal information we collect

The kinds of personal information we collect depend on how a person interacts with MTWAC. This may include:

• name and contact details, including email address and phone number;
• home address and postal address, where required for membership or other purposes;
• date of birth, where required for membership or eligibility assessment;
• information submitted through website contact forms, membership forms, event registrations, online store orders, donation processes, enquiries, feedback or correspondence;
• details of event registrations, attendance, accessibility requests, dietary requirements or other information needed to manage an event;
• online store and donation transaction details, such as the item purchased, donation amount, transaction date and contact details associated with the transaction;
• technical information about website visits, such as device, browser, pages visited, approximate location information and website usage information collected through cookies or analytics tools;
• images, stories, names, recordings or other content provided to us for publication, cultural, historical, community, program or archival purposes; and
• any other personal information a person chooses to provide to us.

Membership applications may include more sensitive information, including birth certificates, family tree information, statutory declarations and information about family, ancestry, community connection or Aboriginal heritage. MTWAC treats this information with particular care.

3. Sensitive information

Sensitive information is a special category of personal information under Australian privacy law. It can include information or an opinion about a person's racial or ethnic origin, health information and other protected categories.

MTWAC may collect sensitive information where it is reasonably necessary for our functions or activities and where the person has provided consent or the collection is otherwise permitted by law. For example, MTWAC may need to collect information about Aboriginal heritage, ancestry, family connections or community connection to assess membership applications, support governance requirements, provide culturally appropriate programs, or manage community-related services.

Where we collect sensitive information, we will only use or disclose it for the purpose for which it was collected, a directly related purpose reasonably expected by the person, with consent, or where required or authorised by law.

4. How we collect personal information

We collect personal information in a range of ways, including when a person:

• uses our website or submits a contact form;
• applies for membership;
• uploads documents as part of a membership application;
• registers for an event or training session;
• makes a donation or purchase through our online store;
• contacts us by email, phone, online form, social media or in person;
• participates in MTWAC programs, consultations, meetings, activities or events;
• applies for employment, volunteering or partnership opportunities; or
• otherwise provides information to MTWAC.

We will usually collect personal information directly from the person concerned. Sometimes we may collect information from another person or organisation, for example where a family member provides information in support of a membership application, where a referee provides information, or where a payment provider provides transaction information.

5. Website analytics, cookies and similar technologies

MTWAC uses Google Analytics to understand how people use our website and to improve website content, navigation and performance. Google Analytics may use cookies or similar technologies to collect information such as pages viewed, time on site, browser type, device type, approximate location and referring website.

Google Analytics information is generally aggregated or reported in a way that helps us understand website usage trends. We do not use Google Analytics to identify individual website visitors. However, analytics identifiers, cookies, IP address information and device information may be personal information in some circumstances.

People can usually disable cookies through their browser settings. If cookies are disabled, some website features may not work as intended.

Google may process analytics information using infrastructure located outside Australia. MTWAC will not state that analytics data remains only in Australia unless this has been technically and contractually verified.

6. Contact forms and enquiries

When a person submits a contact form, MTWAC collects the information provided in the form, currently expected to include name, email address and phone number, together with the content of the enquiry and any related technical information needed to receive and respond to the enquiry.

We use this information to respond to the enquiry, provide information, manage requests, keep appropriate records and improve our services and communications.

7. Membership applications

MTWAC collects information from membership applicants so we can assess eligibility, communicate about the application, meet governance and record-keeping requirements, maintain the membership register and administer member rights and obligations.

Membership applications may collect name, email address, phone number, home address, postal address, date of birth and supporting documents. Supporting documents may include birth certificates, family tree information and statutory declarations.

Membership applications and supporting documents are submitted through a secure online process and stored within MTWAC's Microsoft 365 environment. Supporting documents are not stored on the website. Access is restricted to authorised MTWAC officers and personnel who require the information to assess membership applications, administer memberships, meet governance obligations or carry out related administrative functions. MTWAC implements reasonable administrative, technical and physical safeguards to protect membership information from misuse, interference, loss, unauthorised access, modification and disclosure.

Supporting documents submitted with a membership application are retained only for as long as reasonably necessary to assess and administer membership, comply with legal obligations and resolve disputes. Where those documents are no longer required, MTWAC will take reasonable steps to securely destroy or permanently de-identify them.

8. Events, training and registrations

MTWAC may collect personal information to manage events, training, cultural activities, community gatherings, ticketing, attendance, communications, safety, accessibility, dietary requirements, refunds and records.

Some event registrations may be processed through third-party platforms or payment providers. Where a person registers or pays through a third-party platform, that provider may collect and process information under its own privacy terms as well as providing MTWAC with information needed to manage the event.

9. Donations, online store and payments

MTWAC's donations and online store may redirect users to Square or another payment/store platform. When a person makes a donation or purchase through Square, Square may collect payment and transaction information directly from that person. MTWAC may receive information needed to process the order, receipt the donation, respond to customer enquiries, deliver goods or services, manage refunds, keep financial records and comply with legal obligations.

MTWAC does not need to collect or store full payment card details on its website where payments are processed through Square. Payment information is handled by the payment provider according to its own terms and privacy notices.

10. Why we use personal information

MTWAC may use personal information to:

• respond to enquiries and communicate with people;
• assess, process and administer membership applications and membership records;
• deliver programs, services, cultural activities, training and events;
• manage registrations, attendance, ticketing, payments, refunds and customer support;
• process donations, online store orders and related receipts or records;
• manage volunteering, employment, partnerships, consultations and community engagement;
• maintain governance, financial, administrative, insurance and legal records;
• publish approved stories, images, acknowledgements or community content where permission has been obtained;
• improve our website, communications, programs and services;
• protect the safety, security and integrity of our website, systems, people and information;
• comply with legal obligations and respond to lawful requests from regulators, courts or government agencies.

11. Disclosure of personal information

MTWAC may disclose personal information where reasonably necessary for the purposes described in this policy, including to:

• MTWAC board members, officers, staff, contractors, volunteers or committee members who need the information for their role;
• technology, website, hosting, Microsoft 365, email, analytics, security and IT service providers;
• event, ticketing, training, payment, store, donation or booking service providers;
• professional advisers, insurers, auditors and legal advisers;
• government agencies, regulators, funding bodies or law enforcement bodies where required or authorised by law;
• delivery, logistics or fulfilment providers for online store orders;
• another person or organisation with the person's consent; and
• other recipients where disclosure is required or authorised by law.

We do not sell personal information.

12. Overseas disclosure and overseas processing

Some of MTWAC's service providers may store, process or access information outside Australia. This may include providers such as Google, Microsoft, Square, website hosting providers, email delivery services, security providers or other technology services used by MTWAC.

The countries in which information may be processed can depend on the provider, the service configuration and the provider's infrastructure. Where practicable, MTWAC will identify the likely countries involved. At the time of drafting, likely overseas processing may include the United States and other countries where those providers or their subprocessors operate.

Before disclosing personal information to an overseas recipient, MTWAC will take reasonable steps required by Australian privacy law, where applicable, to ensure the overseas recipient does not breach the Australian Privacy Principles in relation to that information, unless an exception applies.

13. Security of Personal Information

MTWAC takes reasonable steps to protect the personal information it holds from misuse, interference and loss, and from unauthorised access, modification and disclosure.

These measures may include:

• secure website connections (HTTPS) for the transmission of information;
• secure cloud-based systems for storing electronic records;
• restricting access to personal information to authorised personnel who require it to perform their duties;
• password protection, multi-factor authentication and other appropriate access controls;
• regular software updates and security maintenance of our systems;
• confidentiality obligations applying to staff, volunteers and authorised personnel; and

While MTWAC takes reasonable steps to protect personal information, no method of electronic transmission or storage is completely secure. Accordingly, MTWAC cannot guarantee the absolute security of information transmitted over the internet.

14. Retention and destruction

MTWAC will keep personal information for as long as reasonably necessary for the purpose for which it was collected, for related administrative, governance, cultural, historical, legal, insurance, audit or funding purposes, or as required by law.

Membership records and supporting documents may need to be retained for governance, evidentiary and membership administration purposes. MTWAC should adopt a specific records retention schedule for membership applications, including how long unsuccessful applications and supporting documents are retained.

When personal information is no longer required, MTWAC will take reasonable steps to destroy it or de-identify it, unless retention is required or authorised by law or is reasonably necessary for archival, cultural, governance or dispute-related purposes.

15. Access and correction

A person may request access to personal information MTWAC holds about them, or ask us to correct information they believe is inaccurate, out of date, incomplete, irrelevant or misleading.

Requests should be sent to MTWAC using the privacy contact details below. We may need to verify the person's identity before responding. In some circumstances, we may refuse access or correction where permitted by law, for example where providing access would unreasonably affect another person's privacy, reveal evaluative information, prejudice an investigation, or breach legal obligations. If we refuse a request, we will explain the reason where it is reasonable and lawful to do so.

16. Privacy complaints

A person who has a concern about how MTWAC has handled their personal information can contact us using the privacy contact details below. The complaint should include enough information for us to understand and investigate the concern.

MTWAC will acknowledge the complaint within a reasonable time and aim to respond after considering the matter. If the person is not satisfied with our response, they may be able to contact the Office of the Australian Information Commissioner (OAIC).

17. Third-party websites and services

Our website may link to third-party websites or services, including Square, Google Maps, social media platforms, event platforms or other external services. MTWAC is not responsible for the privacy practices of third-party websites or services. People should review the privacy notices of those third parties before providing information to them.

18. Changes to this policy

MTWAC may update this Privacy Policy from time to time. The current version will be published on our website. Significant changes may also be communicated through other appropriate channels.

19. Privacy contact details

Email: admin@mtwac.org.au

Phone: 0492 987 144