This policy explains what personal information Care & Culinary collects, why we collect it, how we look after it, and what you can do if you have a concern. We have tried to write it in plain English. If anything is unclear, call us on 0451 115 196 and we will talk it through.
Who we are
Care & Culinary is a registered NDIS provider on the Gold Coast, Queensland, operated by Care and Culinary Pty Ltd. We run baking programs for NDIS participants and school holiday baking workshops for children.
- ABN: 67 702 199 602
- ACN: 702 199 602
- Phone: 0451 115 196
- Email: info@careandculinary.com.au
Because we provide disability supports, we are bound by the Privacy Act 1988 and the Australian Privacy Principles, whatever the size of our business. We also follow the privacy requirements of the NDIS Practice Standards and the NDIS Code of Conduct.
What information we collect
We only collect information we actually need to deliver our programs safely. Depending on the program, that may include:
- Contact details — name, phone number, email address and postal address.
- NDIS details — NDIS number, plan dates, how the plan is managed, and plan manager or support coordinator contact details.
- Support needs — information about disability, health, communication and sensory needs, so we can run sessions that work for the person.
- Allergies and dietary requirements — essential in a kitchen.
- Emergency contacts.
- For children’s workshops — each child’s name, age and gender (you can choose “prefer not to say”), any allergies, dietary requirements or support needs, and the parent or guardian’s name, email, phone number and home address, which we keep with the booking record.
- Photo consent — whether you agree to your child being photographed. You choose this when you book, and saying no does not affect the booking.
- Your agreement to our booking terms — we record when you accepted them, and which version.
- Payment details — when you pay for a workshop online, your card details go directly to our payment processor, Stripe. We never see or store them. Stripe receives only your name, email and the payment itself — your children’s details are never sent to Stripe. We receive a record that you paid.
- Photos and video — only with written consent. See “Photos and video” below.
Sensitive information
Information about someone’s health or disability is “sensitive information” under the Privacy Act and gets the highest level of protection. We only collect it with consent, only when it is reasonably needed to deliver a support safely, and we limit who can see it.
How we collect it
- Directly from you, or from the person you nominate to act for you.
- From a parent or guardian, for children.
- From a support coordinator, plan manager or other provider — only with your consent.
- Through the enquiry form on this website.
You do not have to give us information. If you choose not to, we may not be able to provide a support safely, and we will explain why.
Why we use it
We use personal information to:
- respond to your enquiry;
- deliver our programs safely, including planning around support needs and allergies;
- prepare service agreements and invoices, and claim payment through the NDIS;
- contact you about your booking;
- meet our obligations as a registered NDIS provider, including record keeping and incident reporting.
We do not sell personal information. We will not use it to send you marketing unless you have asked us to, and you can opt out at any time.
Who we share it with
We only share personal information when we need to, and only as much as is needed:
- your plan manager, or the NDIA, to process payment for supports;
- your support coordinator, with your consent;
- the NDIS Quality and Safeguards Commission, when the law requires us to — for example, to report certain incidents;
- emergency services, if someone’s health or safety is at risk;
- Stripe, to process payments for the kids workshop;
- our website host, Hostinger, which stores this website and the enquiries sent through it;
- other businesses that help us operate, such as our email and accounting providers, who must keep it confidential.
Information stored overseas
We do not deliberately send personal information overseas. However, some of the services we use may store data on servers outside Australia:
- Stripe, which processes online payments, may store payment and contact information in the United States and other countries.
- Hostinger, which hosts this website and its enquiry records, may store data outside Australia.
Before using a service like this, we take reasonable steps to make sure it protects personal information to a standard similar to the Australian Privacy Principles.
Photos and video
We sometimes take photos in sessions to celebrate participants’ work. We will only take or publish a photo of someone with their written consent — or a parent or guardian’s written consent for a child. That consent will say exactly where the photo may be used, such as this website or social media.
You can say no, and it will not affect the support you receive. You can also withdraw consent at any time and we will remove the photo from anything we control. We never publish a child’s full name alongside their photo.
This website
The enquiry form. When you send an enquiry, the details you enter are emailed to us and stored securely in our website system so that nothing gets lost. We use them only to respond to you.
Cookies and tracking. This website does not use advertising cookies or analytics tracking. If that ever changes, we will update this policy first.
Fonts. The typefaces on this site are loaded from Google Fonts. When a page loads, your browser connects to Google’s servers, which receive your device’s IP address. Google’s handling of that data is covered by its own privacy policy.
How we keep it safe
We take reasonable steps to protect personal information from misuse, loss, and unauthorised access or disclosure. Access is limited to the people who need it to do their job. We keep records for as long as we need them, and for as long as NDIS record-keeping rules require. After that, we securely destroy or de-identify them.
If there is a data breach
If personal information we hold is involved in a data breach that is likely to cause serious harm, we will notify the people affected and the Office of the Australian Information Commissioner, as required by the Notifiable Data Breaches scheme.
Seeing and correcting your information
You can ask to see the personal information we hold about you, and ask us to correct anything that is wrong, out of date or incomplete. Contact us on 0451 115 196 or info@careandculinary.com.au. We will respond within 30 days. If we cannot give you access, we will explain why in writing.
Making a privacy complaint
If you think we have mishandled your personal information, please tell us first so we can put it right. See our feedback and complaints process. We will respond within 30 days.
If you are not satisfied with our response, you can complain to the Office of the Australian Information Commissioner (OAIC). Complaints to the OAIC must be made in writing.
- Online: oaic.gov.au/privacy/privacy-complaints
- Email: oaicintake@oaic.gov.au
- Post: GPO Box 5288, Sydney NSW 2001
- Enquiries line: 1300 363 992
Changes to this policy
We may update this policy from time to time. The date at the top of this page shows when it last changed.