Policy

Privacy Policy

Last reviewed March 2026.

Privacy Collection Statement

Arafmi Limited (ABN 43 336 198 526) and its related bodies corporate (Arafmi, we, us or our) may collect, use and disclose personal information about you.

Generally, we collect personal information directly from you, however on occasion we may need to collect additional personal information about you from third parties where collecting directly from you is unreasonable or impractical. We will usually notify you about instances of collection from third parties in advance, or where that is not possible, as soon as reasonably practicable after the information has been collected.

Generally speaking, we collect and use your personal information for the purposes of providing information, resources, goods and services to you or someone else you know, facilitating our internal business operations, and providing you with information about other goods and services that may be of interest to you.

If you request to deal with us anonymously or pseudonymously, we will take reasonable steps to comply with your request if it is possible and lawful. However, if you choose not to provide us with your personal information, or it’s incomplete or inaccurate, we may not be able to provide you with the information, resources, goods and services you are seeking.

We may disclose your personal information to our workers, consultants, related entities, government departments and agencies, and third parties who assist us in operating our business, third parties to whom you have agreed we may disclose your information, or as otherwise required or authorised by law. Our third party service providers are too numerous to list, and they change from time to time, but may include payment processors, insurers, IT and technology service providers, event organisers, and professional advisers. Some, such as technology service providers, may be located overseas in countries such as the United States of America, such as Google Analytics and Microsoft. You consent to this overseas disclosure and agree that by providing consent, APP 8.1 under the Privacy Act no longer applies, and we are not required to take reasonable steps to ensure that the overseas recipient does not breach the APPs in relation to that information.

You may choose to disclose your information to other individuals when participating in support groups, workshops, and events. While we request that all individuals respect the privacy of others and not disclose information received during those activities, individuals who are not our workers are not bound to comply with our privacy policy.

We may use and disclose personal stories you have provided to us as ‘case studies’, where those case studies have been appropriately de-identified, unless you have provided your express written consent that we may use and/or disclose your personal story as a case study without de-identification.

More detailed information about the types of personal information we collect from you, the way we use, disclose and secure your personal information, how you can access and correct that information, and how you can make a complaint about a breach of privacy can be found in our Privacy Policy, available at www.arafmi.com.au or by contacting us at:

Address: Arafmi Ltd, PO Box 248 New Farm QLD 4005

Email: info@arafmi.com.au

Phone: (07) 3254 1881 | 1300 554 660

Website: arafmi.com.au

Privacy and Confidentiality Policy

Policy Code	LOM 08.01
Person Responsible	CEO
Status (Draft/Approved)	Approved
Date Last Reviewed	March 2026

1.0 Purpose and Scope

This policy and procedure promote all parties safety and dignity by ensuring their personal information is managed appropriately, in line with risk-based considerations and relevant legislative and regulatory requirements.

This policy and procedure apply to all staff, contractors, and volunteers, and to all current and potential carers.

2.0 Policy Statement

Arafmi Limited (ABN 43 336 198 526) and its related bodies corporate (referred to in this document as Arafmi, we, us or our) recognises that your privacy is very important and we are committed to protecting the personal information we collect from you. The Privacy Act 1988 (Cth) (Privacy Act), and the Australian Privacy Principles (APPs) govern the way in which we must manage your personal information and this policy sets out how we collect, use, disclose and otherwise manage personal information about carers, participants, dependents, donors, Arafmi’s workers, and members of the public.

The handling of some personal information by Arafmi is exempt from certain obligations under the Privacy Act where it directly relates to a current or former employment relationship, and an employee record held by us (where ‘employee record’ means a record of personal information relating to the employee’s employment). This will not apply to all Arafmi workers, as not all workers are employees.

3.0 Definitions

Carers – Individuals who receive carers support, engage in carer activities, including events, forum, surveys.

Personal information – Recorded information (including images) or opinion, whether true or not, from which the identity (including those up to thirty years deceased) could be reasonably ascertained.

Sensitive information – Information or an opinion about an individual’s racial or ethnic origin, political opinions, membership of a political party, religious beliefs or affiliations, philosophical beliefs, membership of a professional or trade association, membership of a trade union, sexual preference or practices, or criminal record. This is also considered to be personal information.

Health information – Any information or an opinion about the physical, mental, or psychological health or ability (at any time) of an individual. This is also considered to be personal information.

Information Privacy – refers to the control of the collection, use, disclosure and disposal of information and the individual’s right to control how their personal information is handled.

Worker – an individual who performs work in any capacity, including as an employee, a contractor, a subcontractor, an outworker, an apprentice, a trainee, a student gaining work experience or a volunteer.

4.0 Procedure

Collection

Types of information collected

We may collect and hold personal information about you (that is, information that can identify you) that is relevant to our functions and activities. The kinds of information we collect and hold about you depends on our relationship with you and may include, but is not limited to:

your name, address, date of birth, gender, ethnicity;
your citizenship, visa details, identification documents (licence, passport etc);
telephone numbers and e-mail addresses,
bank account details, payment details, tax file number,
medical history or information provided by a health service.

For carers and workers, and for individuals who fall outside each of those groups, we may collect your name, contact details, and other information relevant to providing you with the information, goods and services you are, or someone else you know is, seeking.

If you are a Carer we will also generally, information on personal issues and experiences and relationships, and family background and support. In addition to this, we may collect and hold sensitive information about you in providing you with services, including your racial or ethnic background, or sexual orientation if you share this with us

If you are a prospective, current or former worker, we will collect and hold personal information necessary to administer all necessary employment processes. We are also required by the Fair Work Act 2009 (Cth) (FW Act) to collect certain information about employees. This information must be retained by Arafmi for a period of 7 years. We only collect sensitive information you if you consent to the collection of the information and if the information is reasonably necessary for the performance of our functions and activities.

Consent may be implied by the circumstances existing at the time of collection. There may also be circumstances under which we may collect sensitive information without your consent, as required or authorised by law.

We may also collect information through the use of our website and digital platforms, including user preferences, ‘cookie’ information, and geographical location.

Method of collection

We will generally collect personal information directly from you through a variety of avenues, including any of our standard forms, our volunteer and employment application process, registration and attendance at our workshops and events, via emails or other communications, via phone, in person, via our surveys (where applicable), via our website (including contact forms) and social media accounts.

There may, however, be some instances where personal information about you will be collected indirectly because it is unreasonable or impractical to collect personal information directly from you.

We will usually notify you about instances of collection from third parties in advance, or where that is not possible, as soon as reasonably practicable after the information has been collected.

If we receive unsolicited information about you that we did not request and which is not directly related to our functions or activities, we may be required to destroy or de-identify that information, providing it is lawful and reasonable to do so.

Purpose of collection

The personal information we collect and hold about you depends on your interaction with us. Generally, we will collect, use, and hold your personal information if it is reasonably necessary for or directly related to the performance of our functions and activities and for the purposes of:

providing information, resources, goods and services to you or someone else you know;
processing your donation or purchase and providing receipts, and communicating with you about how your donation is used;
facilitating our internal business operations, including:
1. establishing our relationship with you;
2. the fulfilment of any legal requirements;
3. maintaining and managing our relationship with you and communicating with you in the ordinary course of that relationship (including responding to feedback or complaints);
4. maintaining and managing the engagement of a worker, and terminating that engagement;
5. organising and facilitating support groups, workshops and events;
6. analysing our goods and services, carer needs, and worker needs with a view to developing new or improved goods and services or business operations;
7. contacting you to provide a testimonial for us; and
providing you with information about other goods and services that we or our related entities and other affiliated organisations offer that may be of interest to you.

Except as otherwise permitted by law, we only collect sensitive information about you if you consent to the collection of the information and if the information is reasonably necessary for the performance of our functions, as set out above.

Anonymity/Pseudonymity and failure to provide information

If you would like to access any information or any of our goods and services on an anonymous basis or using a pseudonym, please tell us. If this is possible and lawful, we will take all reasonable steps to comply with your request. However, we may not be able to provide the information, resources, or goods and services in question if we are not provided with the personal information requested.

If you are an applicant for a volunteer or employment position, refusal to provide personal information may mean we are unable to process your application. If you are a worker, refusal to provide personal information or consent to sensitive information being collected or held for the purposes set out in this privacy policy and any privacy collection statement may adversely affect our ability to comply with our legal obligations and our ability to continue our relationship with you.

Internet users

If you access our website, we may collect additional personal information about you in the form of your IP address, browser type, and date and time of visit.

Our website may contain links to other websites. We are not responsible for the privacy practices of linked websites and linked websites are not subject to our privacy policies and procedures.

Our website uses cookies. The main purpose of cookies is to identify users and to prepare customised web pages for them. Cookies do not identify you personally, but they may link back to a database record about you. We use cookies to monitor usage of our website and to create a personal record of when you visit our website and what pages you view so that we may serve you more effectively.

Use and disclosure

Generally, we only use or disclose personal information about you for the purposes for which it was collected (as set out above). We may disclose personal information about you to:

our workers, consultants, and other parties who require the information to assist us with facilitating our internal business processes, providing you with information, resources, goods and services, and with establishing, maintaining, managing, or ending our relationship with you;
our related entities to facilitate ours and their internal business processes;
if you are a worker: government departments and agencies, such as the Australian Taxation Office;
third party service providers who assist us in operating our business and providing you with information, resources, goods and services (including payment processors, payroll processors, insurers, superannuation funds, IT and technology service providers, event organisers, and professional advisers such as lawyers, accountants, and auditors) and these service providers may not be required to comply with our privacy policy;
third parties to whom you have agreed we may disclose your information or where the information was collected from you (or from an authorised discloser) for the purposes of passing it on to the third party; and
any other entity as otherwise permitted or required by law, including regulatory bodies such as WorkSafe.
If you are a carer, you may choose to disclose your information to other individuals when participating in support groups, workshops, and events. While we request that all individuals respect the privacy of others and not disclose information received during those activities, individuals who are not our workers are not bound to comply with our privacy policy.
If you are a carer, we may use and disclose personal stories you have provided to us as ‘case studies’, where those case studies have been appropriately de-identified, unless you have provided your express written consent that we may use and/or disclose your personal story as a case study without de-identification.
We may expand or reduce the business and this may involve the sale and/or transfer of control of all or part of our business. Personal information, where it is relevant to any part of the business for sale and/or transfer, may be disclosed to a proposed new owner or newly controlling entity for their due diligence purposes, and upon completion of a sale or transfer, will be transferred to the new owner or newly controlling party to be used for the purposes for which it was provided. Additionally, in circumstances of a business sale, we are required under the FW Act to transfer employment records for each employee transferring to the new employer on request by the new employer. This will not apply to all Arafmi workers, as not all workers are employees.
Sensitive information (including health or medical information) is only used and disclosed for the purposes for which it was collected, unless your further consent is obtained, or otherwise as permitted or required by law. If we use your health information for internal research or statistical purposes, we will de-identify the information first.

Disclosure of personal information overseas

We are assisted by a variety of external services providers to operate its business, some of whom may be located overseas. These third parties are too numerous to list, and they change from time to time. Some examples of the types of third parties including technology service providers who may be located in the United States of America, such as Google Analytics and Microsoft Office 365.

You consent to this overseas disclosure and agree that by providing consent, APP 8.1 under the Privacy Act no longer applies, and we are not required to take reasonable steps to ensure that the overseas recipient does not breach the APPs in relation to that information.

Direct marketing

We will never knowingly send you unsolicited commercial electronic messages. More information on the Spam Act 2003 (Cth) is available from the regulator’s website: www.acma.gov.au/spam.

If you subscribe to a mailing list offered by us, we may use or disclose your personal information (excluding sensitive information) for direct marketing purposes. We will obtain your specific consent to disclose sensitive information for the purposes of direct marketing our services. We may include third party offers in marketing materials we send to you.

You will be able to opt-out of direct marketing at any time with no charge to you, or request us to provide you with our source of information, by email to info@arafmi.com.au, or through the unsubscribe link found in all marketing emails we send. We will then ensure that your name is removed from our mailing list.

If you receive communications from us that you believe have been sent to you other than in accordance with this policy, or in breach of any law, please contact us using the details provided below.

Security

We store your personal information in different ways, including in paper and in electronic form. The security of your personal information is important to us. We take all reasonable measures to ensure that your personal information is stored safely to protect it from interference, misuse, loss, unauthorised access, modification or disclosure, including electronic and physical security measures.

Personal information collected is hosted on third party data servers located within Australia. We take reasonable steps to ensure any third party data storage suppliers we partner with have appropriate cyber and physical security controls in place.

Where personal information held is no longer necessary for our operations, Arafmi deletes information or permanently de-identifies it, subject to specific laws in respect of data retention.

Access and correction

You may access the personal information we hold about you, upon making a written request. We will respond to your request within a reasonable period. We may charge you a reasonable fee for processing your request (but not for making the request for access). For security reasons, you will be required to put your request in writing and provide proof of your identity.

This is necessary to ensure that personal information is provided only to the correct individuals and that the privacy of others is not undermined.

Subject to our obligations under the FW Act (with respect to current and former employees), we may decline a request for access to personal information in circumstances prescribed by the Privacy Act, and if we do, we will give you a written notice that sets out the reasons for the refusal (unless it would be unreasonable to provide those reasons), including details of the mechanisms available to you to make a complaint.

Employee records prescribed by the FW Act must be made available to an employee or their representative upon request. These employee records include general employment details, pay records, records relating to leave entitlements, records relating to superannuation contributions, records relating to individual flexibility arrangements, records relating to guarantees of annual earnings and termination of employment records. Under the Fair Work Regulations 2009 (Cth), we must make a copy of an employee record available in a legible form for inspection and copying on request by an employee or former employee to whom the record relates. If the employee record is kept at the premises at which the employee works or the former employee worked, we will make a copy available at the premises within 3 business days after receiving a request, or will post a copy of the employee record within 14 days after receiving a request.

If the employee record is not kept at the premises, we will, as soon as practicable after receiving a request, make a copy available at the premises or post a copy of the employee record to the employee or former employee. This paragraph will not apply to all Arafmi workers, as not all workers are employees.

It is essential that the information contained in our records is accurate, complete, and up to date. If, upon receiving access to your personal information or at any other time, you believe the personal information we hold about you is inaccurate, incomplete or out of date, please notify us immediately. We will take reasonable steps to correct the information so that it is accurate, complete and up to date. We may require you to fill in our Change of Details Request Form to ensure that personal information is corrected only by instruction from the appropriate individual.

If we refuse to correct your personal information, we will give you a written notice that sets out our reasons for our refusal (unless it would be unreasonable to provide those reasons), including details of the mechanisms available to you to make a complaint.

How to contact us

If you have any queries or concerns about our privacy policy or the way we handle your personal information, or you wish to make a complaint about a breach of the Privacy Act, the IP Act, the APPs, the IPPs, or a privacy code that applies to us please contact us using the details below and we will take reasonable steps to investigate the complaint and respond to you.

Address: Arafmi Ltd, PO Box 248, New Farm, QLD, 4005

Email address: info@arafmi.com.au

Telephone: (07) 3254 1881

Website www.arafmi.com.au

Calls to our telephone number can be made for a local call cost from fixed residential landlines anywhere in Australia, but calls from mobile and pay phones may incur higher charges. Check with your service provider for costings from mobile and pay phones.

If after this process you are not satisfied with our response, you can submit a complaint to the Office of the Information Commissioner, Queensland or the Office of the Information Commissioner, Australia.

The OIC website and OAIC website contain information on how lodge a complaint. If you make a complaint directly to the OIC or OAIC rather than to us, they may recommend you try to resolve the complaint directly with Arafmi in the first instance.,

Data Breaches and Reporting Requirements

In the event of a notifiable data breach, we are required to report the breach to the Office of the Australian Information Commissioner (OAIC), notify all parties involved in the breach, and act immediately to mitigate associated risks. Notifiable breaches are those which identify an individual and are determined as likely to cause ‘serious harm’ to an individual (including physical, psychological, financial or reputational harm).

In accordance with the terms of our Service Agreements, Arafmi Ltd must also report identifiable data breaches to the relevant government departments as soon as is practicable. Where breaches involve service user who are covered by the Child Protection Act 1999 or the Youth Justice Act 1992, the breach must additionally be reported to the Department of Communities, Disability Services and Seniors immediately.

Changes and updates

We reserve the right to review, amend and/or update this policy from time to time. If further privacy legislation and/or self-regulatory codes are introduced or our privacy policy is updated, we will summarise any substantial modifications or enhancements in this section.

Any substantial or material change to this policy will be communicated to our carers.

5.0 Roles and Responsibilities

Board

Treat privacy and data security as a key strategic risk, requiring reporting from the CEO on compliance status, significant breaches, and the effectiveness of data protection measures.
Ensure Arafmi dedicates sufficient financial and technological resources to protect confidential information, including investment in secure systems, cybersecurity and expert guidance

CEO

Foster a culture of privacy and confidentiality in Arafmi, clearly communicating its importances and setting the expectation of full compliance from all workers.
Implement this policy, ensuring clear accountability structures are in place.
Ensure timely and transparent reporting of any significant privacy breaches to the Board and relevant authorities, and oversee the investigation and remediation process.

Managers

Ensure workers understand and comply with privacy procedures.
Address any confidentiality issues or breaches within their team in a timely manner.
Initiate incident management process where a privacy breach has occurred.

Workers

Understand and implement this policy in daily tasks.
Collect, store, and dispose of all confidential information (both digital and physical) in accordance with this policy.
Report any suspected breaches, near misses or loss of data.

6.0 Related Legislation

Privacy Act (1988)
Privacy Amendment (Enhancing Privacy Protection) Act 2012
Information Privacy Act 2009 (Qld)
Fair Work Act 2009

7.0 Supporting Documents

Privacy Collection Statement