Policy

Member privacy

The short version

We collect only what we need to run sessions, keep players safe and take payment.
A player’s details are seen by her parents and by the club people who need them, and by no one else.
We do not sell or rent anyone’s information, and we do not run advertising.
Our website and records are kept on a server in Malaysia. Some services we use, such as Stripe and Cloudflare, also handle information outside Australia.
You can see and correct your family’s details in My account, and you can ask us for anything else we hold.

Who we are

This policy is for El!te Development Foundation Incorporated (ABN 35 685 584 021), a not-for-profit basketball development club in Canberra. “We” and “the club” mean the Foundation. To contact us, use the Contact page on this website.

We are a small organisation. We follow the Australian Privacy Principles as good practice, whether or not the law requires it of us. Our focus is the skill growth and physical safety of our players.

What we collect

Your account: your name, email address, phone number, address, and a date of birth where we need one (for example, for birthday emails).
Your children’s details: name, date of birth, gender, school, medical notes and allergies, a profile picture if you add one, the player’s number, teams and current club, and whether photos of her may be published.
Volunteers and coaches: Working with Vulnerable People (WWVP) registration number and expiry date, and a photo of the card if you add one.
Payments: what you bought or booked, the amount, how you paid (card brand and last four digits, or Apple Pay, Google Pay or Zip), and Stripe’s references. Stripe takes your card details. We never see or keep your full card number.
Sessions and teams: bookings, invitations and your answers, attendance, team places and game results.
Sign-in and devices: when you sign in, which device you use, and an alert when a new device signs in to your account. Club staff actions in the back office are logged with who did them and when.
Messages and forms: enquiries, testimonials, incident and injury reports, and concerns or complaints you send us.
Photos: see our Photography and social media policy.

Why we collect it

To run training, camps and teams, take bookings and payments, and send receipts.
To look after players’ safety and welfare, including first aid and emergencies, and to meet our duty of care.
To contact families about sessions, teams, travel and club business.
To check that coaches and volunteers hold a current WWVP registration.
To keep the records the club must keep, and to answer concerns and complaints.
To send birthday wishes. A player’s birthday email goes to her parents or carers. A member’s goes to the member.

Who can see your information

Access follows people’s jobs.

Parents and carers see their own family’s details in My account.
Coaches and managers see the players in the teams they look after, including medical alerts, so they can keep players safe.
Committee members and other club officers can see members, bookings and orders, and the club Inbox. Each officer sees only the parts of the back office their role needs.
Money (orders, refunds, fees) is seen by the Treasurer and the people who run the shop and uniforms.
Concerns and complaints are kept separate. Only the small group of people holding safeguarding permission can open them. A person with a conflict of interest steps aside and sees nothing of that case.
Other members can see a player on the members-only Our players page only if her parent has switched profiles on and she has agreed. It shows her first name, surname initial, number, age group, club, teams and a short line she or her family wrote. It never shows her date of birth, address, school, contacts or parents.

Everyone who can open the back office signs in with their own account. Committee members and officers must also use a two-step sign-in code. We keep a record of who changed what.

Who we share it with

We share information only when it is needed.

Basketball ACT, for player registration, insurance and competition.
Stripe, which processes payments.
Cloudflare, which delivers our website and runs a bot check (Cloudflare Turnstile) on forms.
Brevo, which relays the emails the club sends.
Our server host (Hostinger), which supplies the server we run on.
Google Fonts, which supplies the website’s lettering and so sees your device’s address when a page loads.
Travel providers, but only the essentials, such as names for a booking list or a medical alert.
Police, child protection services and other authorities when the law requires it or a child may be at risk.

We do not sell or rent your information, and we do not use it for advertising.

Where it is kept

The club’s website, database and email run on a server in Malaysia. Every night, a copy of the database and of all stored files (including photos and sealed safeguarding records) is encrypted and sent to a private computer at the club’s home base in Canberra. That computer keeps unchangeable daily, weekly and monthly snapshots. The server host also keeps its own separate weekly backup. Stripe, Cloudflare and Brevo handle information in other countries as well.

Photos and other files are stored on the same server, away from the public part of the website. Concerns and complaints that have been closed are sealed in an encrypted archive that nobody can edit.

How long we keep it

We do not delete records automatically. This is how we work.

Players and former members: when a player or member becomes inactive, we keep their record ready in the background for 3 months, so a family can switch themselves back on with everything still there. After that we archive it. An archived record is still kept, but it is out of everyday use.
Volunteers and coaches (WWVP records): we treat them the same way, 3 months after the person becomes inactive, unless the law requires us to keep them longer. The website sends WWVP expiry reminders to the volunteer and the club, so cards are renewed on time.
Financial records: kept for at least seven years.
Safeguarding records: sealed in an encrypted archive that nobody can edit, and never deleted automatically. We keep them securely for at least 45 years, because child safety records may be needed long after the event.

Your rights

See and correct: parents can see and update their family’s details in My account at any time, including medical notes and emergency contacts. Please keep them current, especially before travel. Ask us for anything else we hold about you.
Photos: you can change or remove photo permission whenever you like.
Emails: newsletters and sale emails have an unsubscribe link, and we honour it. Receipts, bookings, safety and account emails still arrive, because you need them.
Deleting: you can ask us to remove your information. We will remove what we can. We may have to keep some records, such as financial records and safeguarding records.

Email

We email people who are members, parents or carers of players, or who have been invited to a session. We do not buy mailing lists.

Cookies and tracking

We do not use advertising or tracking cookies. We use cookies only to keep you signed in, to recognise your own browser when you sign in, and to remember your light or dark preference. The bot check on our forms is run by Cloudflare.

Children

Parents and carers manage the details of players under 18. From 18, the player decides for herself.

Questions and complaints

Use the Contact page on this website. If you think we have handled your information badly, you can also use the Raise a concern or complaint page on this website. You can contact the Office of the Australian Information Commissioner (oaic.gov.au) or the ACT Human Rights Commission (hrc.act.gov.au), which both deal with privacy complaints.

Changes

We will update this page when how we handle information changes. The “In effect from” date shows the current version.

‹ All policies