Privacy Policy

§ 01Who we are

The data controller and Australian Privacy Officer for the purposes of this policy is Islamic Aid Worldwide Project Ltd, ABN 68 686 194 034, trading as Hearts of Hope Foundation. The Foundation is a registered charity with the Australian Charities and Not-for-profits Commission (ACNC).

You can reach our Privacy Officer by email at privacy@heartsofhope.org.au or by writing to 119 Telegraph Road, Bald Hills QLD 4036, Australia.

§ 02What we collect

We only collect personal information that is reasonably necessary for one of the activities described in this policy. Depending on how you interact with us, we may collect:

• Donor information name, email, phone number, donation amount, designated initiative, frequency, and (where applicable) payment metadata such as last-four card digits and transaction reference (we do not store full card numbers; payments are handled by our payment processor).
• Partner / corporate enquiry information your name, business name, work email, phone, area of partnership interest, indicative budget, and the contents of your enquiry.
• Volunteer and applicant information name, contact details, the role applied for, and any working-with-children check or referee details you provide for safeguarding-screened roles.
• Beneficiary and referral information names and limited household details of children and families supported through Play for Hope Australia and other programs, where this is necessary to deliver the support. Where we hold this information, it is provided by referral partners (schools, councils, sporting clubs, community workers) under written agreements; we do not solicit it directly from families. See § 10 Children, beneficiaries, and safeguarding records.
• Communication records emails, letters, and call notes you send us, and the unsubscribe / contact-preference choices you make.
• Limited technical information server logs from our hosting provider that include IP address, browser, and the pages requested. See § 08 Cookies and analytics.

We do not knowingly collect “sensitive information” (as defined in the Privacy Act health, racial origin, religion, sexual orientation, criminal record, etc.) unless it is necessary for a specific safeguarding or program-eligibility purpose, in which case we collect only with consent and store it under restricted access.

§ 03How we use your information

We use personal information only for purposes that are reasonably connected to your interaction with us. Specifically:

• To process your donation and issue a tax-deductible receipt that complies with TR 2005/13;
• To respond to your enquiry, application, or complaint;
• To deliver the program or service you have applied for, or that you are participating in as a partner, volunteer, or referral organisation;
• To send you occasional impact updates and donor communications, where you are an existing donor or have opted in;
• To meet our legal, governance, and reporting obligations to the ACNC, ATO, and state and territory fundraising regulators;
• To investigate fraud, abuse, or safeguarding concerns;
• To improve our website, programs, and services in aggregate, non-identifying ways.

We will not use your personal information for a purpose unrelated to the one for which it was collected without your consent, except where required or authorised by law.

§ 04Who we share it with

We share personal information only as follows:

• Service providers who act on our behalf under contract for example, our payment processor, email service provider, accounting and bookkeeping firm, and IT hosting provider. These providers are bound by confidentiality and data-protection terms and are not permitted to use your information for their own purposes.
• Program delivery partners schools, councils, sporting clubs, and community organisations involved in delivering a program you are part of, on a need-to-know basis.
• Regulators and auditors the ACNC, ATO, state and territory fundraising regulators, our external auditor, and any other body to which we are required by law to report.
• Law enforcement and safeguarding authorities where we are required by law to disclose, or where disclosure is reasonably necessary to prevent or investigate harm to a child or vulnerable person.

We do not sell, rent, or trade personal information for marketing purposes. We do not share donor lists with other charities or commercial third parties.

§ 05Storage, security, and overseas transfers

We store personal information in cloud services operated by reputable providers (including Australian and international cloud platforms). Some of our service providers process data in jurisdictions outside Australia for example, email and analytics providers headquartered in the United States or the European Economic Area. Where we transfer personal information overseas, we take reasonable steps to ensure the recipient handles it in a manner consistent with the APPs.

We protect personal information using a combination of access controls, encryption in transit (HTTPS / TLS), encryption at rest where our providers offer it, role-based access for staff and volunteers, and regular review of accounts with access to donor and beneficiary records.

No system is perfectly secure. If a notifiable data breach occurs, we will assess and respond in accordance with the Notifiable Data Breaches scheme under Part IIIC of the Privacy Act, and we will notify affected individuals and the OAIC where the scheme requires.

§ 06How long we keep your information

We keep personal information only for as long as we have a legitimate reason to hold it.

• Donor and receipt records at least 7 years from the end of the financial year of the donation, to meet tax record-keeping obligations.
• Partner and enquiry records for the duration of any partnership, plus 7 years for accounting and audit purposes.
• Volunteer and safeguarding records in accordance with our Safeguarding Policy and any obligation under state and territory child-safe regimes.
• Marketing contact preferences for as long as you remain on our supporter list or until you ask us to delete your record, whichever is sooner.

When we no longer need personal information, we delete or de-identify it.

§ 07Access, correction, and deletion

You have the right to ask us what personal information we hold about you, to correct it if it is wrong, and (subject to our legal obligations) to ask us to delete it. We will respond to access and correction requests within a reasonable period usually within 30 days. We do not charge for access requests unless they are unusually large or repeated.

To exercise any of these rights, email privacy@heartsofhope.org.au and tell us what you would like us to do. We may ask you to verify your identity before acting on a request.

§ 08Cookies and analytics

The Foundation's website does not currently set non-essential cookies, run a third-party analytics platform (e.g. Google Analytics), or embed advertising tracking pixels. Server logs that record IP address and pages requested are kept for short periods by our hosting provider for security and reliability purposes only.

If we add analytics or non-essential cookies in future, we will publish a cookie notice and for visitors located in the EU, UK, or other consent-required jurisdictions present a consent banner before any non-essential cookies are set. This page will be updated at the same time.

§ 09Email, SMS, and the Spam Act 2003

When we send you a commercial electronic message for example, a donation impact update, a campaign appeal, or an event invitation we comply with the Spam Act 2003 (Cth):

• We send you commercial electronic messages only where you have given us express consent (e.g. by opting in) or where consent can reasonably be inferred (e.g. you are an active donor or partner and the message relates to that relationship);
• Every commercial electronic message identifies the Foundation as the sender and includes our contact details;
• Every commercial electronic message includes a functional unsubscribe link or instruction. We action unsubscribe requests within 5 business days.

You can also unsubscribe at any time by emailing privacy@heartsofhope.org.au. Transactional emails such as donation receipts and replies to enquiries you have sent us are not commercial electronic messages and will be sent regardless of marketing preferences.

§ 10Children, beneficiaries, and safeguarding records

The Foundation supports children and vulnerable people. Personal information about a child or a family in one of our programs is some of the most sensitive information we hold, and we treat it accordingly.

• We do not solicit personal information directly from children. Beneficiary records are created from referrals by partner schools, councils, sporting clubs, or community workers under written agreements that require informed consent from the parent or legal guardian.
• Beneficiary records are kept under restricted access. They are seen only by the small number of staff and contractors directly involved in delivering the support, and by external auditors or regulators where they have a lawful right of access.
• We do not name, photograph, or otherwise identify a beneficiary child in fundraising materials, social media, or impact reports without explicit written consent from the parent or legal guardian. Where we report on outcomes, we do so in aggregate, non-identifying terms.
• Safeguarding incident records (including any disclosure or report of harm) are kept in accordance with our Safeguarding Policy and any obligation under state and territory child-safe regimes (e.g. the National Principles for Child Safe Organisations and any Reportable Conduct Scheme that applies to us).

§ 11EU and UK donors (GDPR / UK GDPR)

If you are located in the European Economic Area or the United Kingdom at the time you give us your personal information, the EU General Data Protection Regulation (GDPR) and the UK GDPR apply to that information regardless of the Foundation's Australian status. In addition to the rights set out above, you have the right to:

• Restrict or object to processing of your personal data;
• Receive a portable copy of the personal data you have given us, in a commonly-used machine-readable format;
• Withdraw consent at any time, where we are processing on the basis of consent;
• Lodge a complaint with the data protection authority in your jurisdiction (e.g. the UK Information Commissioner's Office).

Our lawful bases for processing under the GDPR are (a) consent for marketing communications, (b) contract to process your donation or partnership, (c) legitimate interests to manage donor relationships and run our programs, and (d) legal obligation to meet our tax and charity-law obligations. To exercise any GDPR right, contact our Privacy Officer at privacy@heartsofhope.org.au.

§ 12Complaints and the OAIC

If you think we have mishandled your personal information, please contact our Privacy Officer first. We will acknowledge your complaint within 7 days and respond substantively within 30 days. Most privacy concerns can be resolved quickly when raised directly with us.

If you are not satisfied with our response, you can lodge a complaint with the Office of the Australian Information Commissioner (OAIC) at oaic.gov.au/privacy/privacy-complaints. If you are in the UK or EU, you can also complain to your local data protection authority.

§ 13Changes to this policy

We will update this policy from time to time. Material changes for example, a change in the purposes for which we collect information, or a new analytics or marketing service that processes personal data will be flagged at the top of this page for at least 30 days following the change.

Personal information already held continues to be governed by the version of this policy in force at the time it was collected, except where you consent to the new terms or where the new terms are required by law.