Privacy Policy | 500 Schools

500 Schools Foundation Limited (the Foundation) respects the privacy of the people whose personal information it holds. This policy sets out how the Foundation collects, holds, uses and discloses personal information, and how individuals can access, correct or seek deletion of the information the Foundation holds about them.

The Foundation is currently below the $3 million annual turnover threshold that triggers full compliance obligations under the Privacy Act 1988 (Cth). However, the Foundation handles personal information about donors, supporters and volunteers and is committed to meeting the standards of the Australian Privacy Principles (APPs) as a matter of good governance and to maintain the trust of those who support its work.

2. What Personal Information We Collect

The Foundation collects personal information only to the extent necessary to carry out its charitable activities. The information we may collect includes:

Donors and supporters: name, contact details (email address, phone number, mailing address), donation history, and communication preferences.
Directors and volunteers: name, contact details, background and qualifications relevant to their role, and conflict of interest disclosures.
Grant applications and funding bodies: contact details and correspondence with institutional funders.

The Foundation does not collect sensitive information (as defined in the Privacy Act) and does not currently collect information directly from or about the children and young people it seeks to benefit — that information is held by the schools and educational partners who deliver its programs.

3. How We Collect Personal Information

Personal information is collected directly from individuals – through conversations, correspondence, grant application processes, or when someone provides their details to receive updates from the Foundation. The Foundation does not purchase contact lists or obtain personal information from data brokers.

4. How We Use Personal Information

Personal information is used only for the purposes for which it was collected. These include:

communicating with donors and supporters about the Foundation's activities and the impact of their support;
processing donations and issuing receipts;
preparing grant applications and reporting to funders;
managing the Foundation's governance and administration; and
complying with legal and regulatory obligations.

The Foundation will not use personal information for any purpose other than those listed above without first obtaining the individual's consent.

5. Disclosure of Personal Information

The Foundation does not sell, rent or trade personal information. Information may be disclosed to:

the Foundation's professional advisers (legal, accounting, insurance) where necessary and subject to confidentiality obligations;
government agencies or regulators where required by law; and
banking institutions for the purpose of processing donations.

The Foundation will not disclose personal information to any other third party without the individual's consent.

6. Storage and Security

Personal information is stored securely and access is limited to directors and those with a direct need to access it for the purposes for which it was collected. The Foundation takes reasonable steps to protect personal information from misuse, interference, loss, unauthorised access, modification or disclosure.

Personal information is retained for as long as it is needed for the purpose for which it was collected, or as required by law. Financial records and correspondence related to donations are retained for at least seven years in accordance with the Foundation's record-keeping obligations under the Corporations Act 2001 (Cth) and the ACNC Act 2012 (Cth).

7. Access, Correction and Deletion

Individuals may at any time request access to, or correction of, the personal information the Foundation holds about them. Requests should be directed to the Chair (or, once appointed, the CEO). The Foundation will respond within 30 days.

Where an individual requests deletion of their personal information, the Foundation will do so unless it is required by law to retain it.

8. Privacy Complaints

If you believe the Foundation has mishandled your personal information or breached its privacy obligations, you may make a complaint to the Chair (or CEO). We will acknowledge your complaint within five business days and respond in full within 30 days.

If you are not satisfied with the Foundation's response, you may refer your complaint to the Office of the Australian Information Commissioner (OAIC) at oaic.gov.au or by calling 1300 363 992.

9. Contact

For any privacy-related queries, contact the Chair of 500 Schools Foundation Limited at the address noted in the ACNC Charity Register.

10. Review

This policy will be reviewed annually by the board, or earlier if there is a material change in the Foundation's activities, the information it holds, or applicable privacy law.

Legislative references: Privacy Act 1988 (Cth); Australian Privacy Principles (Schedule 1); ACNC/OAIC Managing People's Information and Data guidance (October 2024).