Privacy Policy

1. Policy Overview
Young Change Agents (YCA, we, us or our) respects privacy and is committed to protecting the personal information of the people we work with, including children and young people, parents and carers, educators, facilitators, mentors, customers, partners, supporters and website or platform users.

This Privacy Policy explains how YCA collects, holds, uses, discloses and protects personal information through our website at https://youngchangeagents.com, our platform at hhttps://app.youngchangeagents.com, our programs, services, events, communications and related technology (together, the Services).

YCA aims to handle personal information in a transparent, fair and secure manner, and in a way that is consistent with the standards reflected in the Privacy Act 1988 (Cth), the Australian Privacy Principles (APPs), applicable child safety obligations and good practice for organisations that work with children and young people.

2. Scope
This Privacy Policy applies to personal information collected or handled by YCA in connection with the Services. It applies whether the information is collected online, through our platform, through a school or program partner, in person, by email, through forms or surveys, or through another interaction with us.

This Privacy Policy should be read together with any collection notices, consent forms, school or program information, website terms, platform terms, child safety policies and other policies or procedures that apply to a particular program or activity.

3. Children and young people
YCA works with children and young people and recognises that their personal information requires additional care. We apply the following principles when handling information about children and young people:

• we collect only the personal information that is reasonably necessary for the relevant program, platform feature, service, safeguarding purpose or legal requirement;
• we seek to explain our privacy practices in language and formats that are appropriate for the audience, including shorter notices where suitable for children and young people;
• we do not seek to use children's personal information for targeted advertising or unrelated marketing;
• we do not publish a child or young person's name, image, video, voice, testimonial, project story or other identifying information publicly unless appropriate consent or permission has been obtained;
• we treat sensitive information about children and young people with particular care;
• we consider the best interests, safety and wellbeing of children and young people when making decisions about their personal information;
• we use access controls so that information about children and young people is available only to those who need it for their role; and
• we will take reasonable steps to respond appropriately if we become aware of a privacy, safety or safeguarding concern.

Where a program is arranged through a school, education provider, community organisation, parent, carer or other responsible organisation, YCA may rely on that organisation or adult to provide privacy notices, obtain permissions or confirm authority to share personal information with us, where it is reasonable and lawful to do so.

Where YCA seeks consent directly from a child or young person, we will consider whether they have sufficient understanding and maturity to make the relevant privacy decision. For younger children, or where the information is sensitive or the use is higher risk, we will generally seek consent or permission from a parent, carer, school or other responsible adult, unless another legal basis applies.

4. Key terms
Personal information means information or an opinion about an identified individual, or an individual who is reasonably identifiable, whether the information or opinion is true or not and whether recorded in a material form or not.

Sensitive information includes information or an opinion about matters such as health, disability, racial or ethnic origin, religious beliefs, political opinions, sexual orientation, criminal record, biometric information and membership of certain associations. YCA treats sensitive information as higher-risk information requiring additional care. Sensitive information also receives additional protection under the Privacy Act where that Act applies.

Child or young person means a person under 18 years of age. Program participant means a child, young person, student or other individual participating in a YCA program, platform activity, event or service.

5. Kinds of personal information we collect and hold
The kinds of personal information YCA collects and holds depend on your relationship with us and the Services you use. This may include:

• identity and contact details, such as name, preferred name, email address, phone number, address, school, organisation, role, year level, class or group;
• account and platform details, such as username, login details, profile information, authentication information, role or permissions, platform activity, user content and communications sent through the platform;
• program and participation information, such as registration details, attendance, program choices, team or group allocations, submitted work, project ideas, feedback, survey responses, impact data and certificates or outcomes;
• information about children and young people, such as name, age or date of birth, year level, school, parent or carer details, educator details, program participation, learning activities, consent records, images or recordings where consent has been obtained, and safeguarding or wellbeing information where relevant;
• sensitive information, such as health, disability, accessibility, dietary, cultural, demographic, wellbeing or safeguarding information, where it is reasonably necessary and we have consent or another lawful basis to collect it;
• educator, facilitator, mentor, partner, volunteer and contractor information, such as name, contact details, organisation, professional role, working with children check information where relevant, program involvement and communication records;
• customer, donor, sponsor and supporter information, such as contact details, organisation details, billing details, payment records, engagement history and communication preferences;
• technical and usage information, such as IP address, device identifiers, browser type, operating system, referring and exit pages, pages viewed, clickstream information, log files, cookie information, analytics information and security logs;
• communications information, such as emails, messages, enquiries, complaints, support requests and notes of interactions with us; and
• publicly available information or information provided by a school, organisation, program partner, parent, carer or third party where it is relevant to our Services.

YCA does not seek to collect more personal information than we need. If we receive unsolicited personal information that we did not request, we will consider whether we could have collected it lawfully. If not, we will take reasonable steps to destroy or de-identify it where lawful and reasonable to do so.

6. How we collect personal information
YCA may collect personal information:

• directly from you when you complete a form, register for an account, participate in a program, contact us, subscribe to communications, provide feedback, attend an event or otherwise interact with us;
• from a parent, carer, school, educator, employer, community organisation, program partner, funder, sponsor or other organisation involved in a program or service;
• from facilitators, mentors, volunteers, contractors or staff involved in delivering or supporting the Services;
  through the platform, website, cookies, analytics tools, logs, device information and other tracking technologies used to operate, secure and improve the
• Services;
• from third-party services that you choose to connect to the Services, such as single sign-on, authentication or communication services, where applicable; and
• from publicly available sources, but only where relevant to our functions or activities.

7. How we hold personal information
YCA holds personal information in electronic systems, cloud services, collaboration tools, customer relationship management systems, email systems, databases, forms, backups and, in limited cases, hard copy records. Personal information may be held by YCA directly or by third-party service providers and sub-processors acting on our behalf.

We take reasonable steps to protect personal information from misuse, interference and loss, and from unauthorised access, modification or disclosure. Our controls include role-based access, minimum necessary permissions, individual logins, password controls, two-factor authentication for administrator accounts and other higher risk accounts, staff training, onboarding and offboarding processes, and review of access permissions.

8. Why we collect, hold, use and disclose personal information
YCA collects, holds, uses and discloses personal information for the purposes for which it was collected, related purposes that would reasonably be expected, purposes you consent to, and purposes required or permitted by law. These purposes include:

• delivering, administering and improving our programs, platform, events, services and technology;
• creating and managing accounts, user roles, permissions and platform access;
• communicating with participants, parents, carers, educators, schools, partners, customers, mentors, volunteers, contractors and supporters;
• supporting program delivery, including registrations, participation, team or group allocation, resources, submissions, certificates, feedback and reporting;
• providing technical support, responding to enquiries, resolving issues and maintaining the security and integrity of the Services;
• managing permissions, consents, media releases, child safety and safeguarding requirements;
• assessing, responding to or reporting safety, wellbeing, safeguarding, legal, regulatory or risk issues;
• conducting analytics, evaluation, impact measurement and service improvement, preferably using aggregated or de-identified information where practical;
• administering relationships with schools, program partners, funders, sponsors, customers, suppliers, volunteers and contractors;
• sending service, administrative, operational and security communications;
• sending marketing or engagement communications to adults or organisational contacts where permitted, with a simple opt-out mechanism;
• maintaining business records, financial records, audit records, insurance records and legal records; and
• complying with laws, court orders, regulatory requests, mandatory reporting obligations and other legal obligations.

YCA will not use sensitive information for direct marketing. YCA will not use personal information about children and young people for unrelated marketing or targeted behavioural advertising.

9. Consequences if information is not provided
You may choose not to provide some personal information. However, if personal information requested by YCA is not provided, YCA may be unable to provide access to some Services, create or administer an account, register a participant, deliver a program, provide support, issue certificates, respond to an enquiry, meet child safety or safeguarding obligations, process a payment, communicate with you, or comply with legal or contractual obligations.

Where information is optional, we will aim to make that clear. For example, consent to use an identifiable image, video, testimonial or project story for public promotion should generally be separate from participation in a program.

10. Who we may disclose personal information to
YCA may disclose personal information to the following recipients where reasonably necessary for the purposes described in this Privacy Policy:

• YCA staff, contractors, facilitators, mentors, volunteers and representatives who need the information for their role;
• schools, educators, parents, carers, community organisations, program partners, funders or sponsors involved in the relevant program or service;
• service providers and sub-processors that help us operate our website, platform, forms, CRM, email, cloud hosting, analytics, collaboration, security, support, finance and administrative systems;
• professional advisers, insurers, auditors and consultants;
• government, regulatory, law enforcement, child protection, emergency or safety bodies where required or permitted by law, or where necessary to protect safety, health or wellbeing;
• other users or participants, but only to the extent that a platform feature, program design, collaboration activity or privacy setting makes information
• visible to them and this is reasonably necessary or has been notified; and
  other third parties where you have consented or where disclosure is otherwise required or permitted by law.

YCA does not sell personal information.

11. Images, video, testimonials, case studies and public content
YCA may collect or use images, video, audio recordings, testimonials, case studies, project stories or other content involving participants, educators, mentors or partners. For children and young people, YCA will take particular care and will seek appropriate consent or permission before publishing identifying material on public websites, social media, marketing material, media releases, reports or other public channels.

Participation in a YCA program should not depend on agreeing to public promotional use of a child or young person's identifying information, unless that use is integral to the program and has been clearly explained in advance.

If consent is withdrawn, YCA will take reasonable steps to stop future use and remove content under its control. YCA may not be able to retrieve material already distributed, cached, archived, printed, copied or shared by others before consent was withdrawn.

12. User content and platform visibility
Users may submit content through the platform or Services, such as program responses, project ideas, feedback, messages, files, comments, images or other materials. YCA does not intend for children's platform content to be public by default.

Depending on the relevant program and platform settings, user content may be visible to YCA staff, facilitators, educators, mentors, program partners, team members, classmates or other authorised users. YCA will take reasonable steps to configure access in a way that is appropriate for the program, privacy expectations and child safety context.

Users should not post or upload personal information about another person unless they have authority or permission to do so. Users should not upload sensitive, harmful or unnecessary information about themselves or others.

13. Cookies, analytics, log files and device information
YCA may use cookies, pixels, web beacons, analytics tools, log files and similar technologies to operate, secure, maintain and improve the website, platform and Services. These technologies may collect information such as IP address, browser type, device type, operating system, pages viewed, referring and exit pages, dates and times of access, clickstream information, interactions with links and email engagement information.

You can usually control or disable cookies through your browser settings. Some features of the website or platform may not function properly if cookies are disabled.

YCA generally does not need precise geolocation information from children and young people. If a Service requires location information, YCA will provide notice and will collect the minimum location information reasonably necessary for that purpose.

14. Sub-processors and third-party service providers
YCA uses third-party service providers and sub-processors to support the delivery, security, maintenance and improvement of the Services. Sub-processors may store, process or have access to personal information on YCA's behalf. They include application-level providers, infrastructure providers and operational tools.

The current list of key sub-processors is set out in Appendix 1. YCA will review and update this list when there are material changes to its technology stack or data processing arrangements.

15. Overseas disclosure, storage and processing
YCA is likely to disclose personal information to overseas recipients because some of our service providers and sub-processors operate in multiple countries or provide support, hosting, storage, backup, analytics or security services from overseas.

The countries in which personal information is likely to be processed or stored include Australia, the United States of America, Singapore, European Union countries, and other countries where our service providers maintain infrastructure, personnel, support operations or sub-processors. Appendix 1 identifies the likely countries for key providers where practicable.

Where YCA discloses personal information overseas, YCA will take reasonable steps that are appropriate in the circumstances and, where the Privacy Act applies, steps required by the APPs. This may include due diligence, contractual protections, technical safeguards, security controls, limiting data shared with providers, and maintaining an internal register of key systems and service providers.

16. Direct marketing and communications
YCA may send service, administrative, operational and security communications where necessary for the Services. YCA may also send newsletters, updates, event information or engagement communications to adult subscribers, educators, partners, customers, supporters or organisational contacts where permitted by law.

YCA will provide a simple way to opt out of direct marketing communications. YCA will not use sensitive information for direct marketing and will not send direct marketing communications to children or young people unless the communication is part of a program or service they are participating in and is appropriate in the circumstances.

17. Security
YCA takes reasonable steps to protect personal information from misuse, interference and loss, and from unauthorised access, modification or disclosure. These steps may include:

• role-based access permissions and minimum necessary access;
• individual logins for systems containing personal information;
• two-factor authentication for administrator accounts and other higher-risk accounts;
• secure password requirements and account management controls;
• onboarding, role change and offboarding processes;
• staff, contractor and volunteer privacy training;
• secure cloud hosting and reputable service providers;
• encryption, backups, logging and monitoring where appropriate;
• review of data collection, storage and processing practices; and
• incident response and data breach procedures.

No method of transmission or storage is completely secure. YCA cannot guarantee that unauthorised access, alteration, disclosure or loss will never occur, but will take reasonable steps to prevent, detect and respond to privacy and security incidents.

18. Retention, deletion and de-identification
YCA keeps personal information for as long as reasonably necessary for the purposes for which it was collected, including service delivery, program administration, safeguarding, legal, insurance, audit, reporting and record keeping purposes. Retention periods may vary depending on the type of information and the relevant program or relationship.

Where personal information is no longer required, YCA will take reasonable steps to destroy, delete, anonymise or de-identify it, unless YCA is required or permitted by law to retain it. YCA may retain de-identified or aggregated information for evaluation, impact reporting, research, service improvement and organisational reporting.

19. Access and correction
You may request access to personal information YCA holds about you, or request correction of personal information you believe is inaccurate, out of date, incomplete, irrelevant or misleading. Requests should be made using the contact details below.

YCA may need to verify your identity before responding. In some cases, YCA may refuse access or correction where permitted by law, for example where access would unreasonably affect another person's privacy or would prejudice safety, legal or investigation interests.

For children and young people, YCA will consider the child's age, maturity, best interests, safety, the nature of the information and the role of any parent, carer, school or responsible organisation when responding to access or correction requests.

20. Complaints and privacy concerns
If you have a question, access request, correction request, complaint or privacy concern, please contact:

Privacy Officer, Young Change Agents
Email: hello@youngchangeagents.com 
Website: https://youngchangeagents.com 
Postal address: Suite 102, 66-74 Clarence Street, Sydney, NSW, 2000, Australia

YCA will acknowledge privacy complaints within 5 business days where practicable. YCA will assess the complaint, may ask for further information, and will aim to provide a substantive response within 30 calendar days. If more time is reasonably required, YCA will explain the reason and provide an expected timeframe for response.

If you are not satisfied with YCA's response, you may contact the Office of the Australian Information Commissioner at https://www.oaic.gov.au. 

21. Data breaches
If YCA suspects that personal information has been lost, or accessed or disclosed without authorisation, YCA will assess and respond to the incident in accordance with its Data Breach Policy and applicable law.

Where the Notifiable Data Breaches scheme applies and notification is required, YCA will notify affected individuals and the Office of the Australian Information Commissioner if there is an eligible data breach that is likely to result in serious harm.

Where a breach involves a school, partner or program participant, YCA will also consider any contractual, safeguarding, school notification or regulatory obligations that may apply.

22. Changes to this Privacy Policy
YCA may update this Privacy Policy from time to time. The current version will be available on our website. If we make material changes to how we handle personal information, we will take reasonable steps to notify affected individuals, schools, partners or users where appropriate.

Appendix 1 - Sub-processors and third-party service providers