Privacy Policy

1. About this policy

This Privacy Policy explains how gumbaynggirrjagun.org ("we", "us", "our", "the Site") collects, uses, stores, discloses, and protects personal information. It applies to all visitors to the Site and to anyone who contacts us via email, contact form, or other channel listed on our contact page.

We comply with the Australian Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs) contained in Schedule 1 of that Act. Where you are located outside Australia, your rights may be additionally governed by laws applicable in your jurisdiction (including the EU/UK GDPR, the California Consumer Privacy Act, and other equivalent regimes); we apply the higher of the applicable standards where the law requires us to.

2. What personal information we collect

We collect three categories of information:

2.1 Information you give us directly

• Your name, email address, and any other content you include when you contact us via email or our contact form.
• Any other information you voluntarily provide in correspondence, including (where you choose to share it) your gambling experiences with operators we review.

2.2 Information collected automatically when you visit the Site

• Technical data: IP address (anonymised after 30 days), browser type and version, device type, operating system, screen size, referring URL, language preferences.
• Usage data: Pages viewed, time spent on each page, scroll depth, links clicked (including outbound affiliate clicks), session duration.
• Cookies and similar technologies: See section 6 below and our cookie policy for details.

2.3 Information from third-party services

• Web analytics: Aggregated, pseudonymised reports from Google Analytics 4 about how visitors arrive at and use the Site.
• Affiliate tracking platforms: When you click an affiliate link to an operator we review, the destination operator's affiliate platform records the click. We may receive aggregated, hashed reports about which affiliate clicks converted into registrations, but we do not receive your personal details from the operator.
• Email service provider: If you contact us, your email is processed via our email provider's servers; we do not share email contents with any third party other than the email provider itself.

We do not collect:

• Government identification documents (passport, driver's licence numbers).
• Bank account numbers, credit card details, or any payment instrument data.
• Health information.
• Sensitive personal information as defined under s.6 of the Privacy Act 1988, unless you voluntarily disclose it in correspondence and we determine it is necessary to retain it to respond to you.

3. Why we collect it and how we use it

We collect personal information for the following purposes:

We do not use your personal information to:

• Send unsolicited marketing emails. We do not operate a newsletter.
• Sell, rent, or licence to third parties for marketing purposes. We do not sell data.
• Build a personalised player profile of your gambling activity. We have no such system.

4. Who we share it with

We share personal information only as follows:

• Service providers under written agreement, including: our hosting provider (which processes server logs), our email provider (which processes inbound email), Google (Analytics), and our content delivery network. Each is bound by data protection agreements that mirror the protections in this policy.
• Affiliate platforms receive the technical fact of your click on an outbound link to their operator. We do not pass on identifying personal data; the click record is associated with our affiliate ID, not with you personally.
• Law enforcement and regulators when required by Australian law or court order, or where we believe disclosure is necessary to prevent serious harm.
• Successors in the event of a business sale, merger, or restructure, under the same protections.

We do not sell personal information. We have never sold personal information. We will not sell personal information.

5. International data transfers

Some of our service providers (notably Google Analytics, our hosting provider, and our CDN) may process data in jurisdictions outside Australia, including the United States and the European Union. Where this occurs, we rely on appropriate contractual safeguards (such as Standard Contractual Clauses or the equivalent under the receiving jurisdiction's privacy framework). Under APP 8, we remain accountable for the handling of your information by these providers.

6. Cookies and similar technologies

The Site uses cookies and similar technologies. Briefly:

• Strictly necessary cookies keep the Site running (e.g. session management) and cannot be opted out of without breaking the Site.
• Analytics cookies (Google Analytics 4) measure aggregated traffic patterns. You can opt out via the cookie banner on your first visit or by installing the Google Analytics Opt-out Add-on.
• Affiliate tracking cookies are set by the operator you click through to, on the operator's domain. They are not under our control. See the destination operator's privacy policy for details.

For the complete cookie inventory, retention periods, and opt-out mechanism, see our cookie policy.

7. How long we keep your information

Where you have requested erasure (see section 8), we delete your data within 30 days unless retention is legally required.

8. Your rights under the Privacy Act and other applicable laws

Under the Australian Privacy Principles, you have the right to:

• APP 12 — Access the personal information we hold about you. Request via [email protected].
• APP 13 — Correction of any personal information that is inaccurate, out of date, incomplete, irrelevant, or misleading.
• Lodge a complaint about how we have handled your personal information — first with us, and (if unresolved) with the Office of the Australian Information Commissioner (OAIC) at oaic.gov.au or by phoning 1300 363 992.

If GDPR/UK GDPR applies to you, you additionally have rights to erasure, portability, objection to processing, and restriction of processing. To exercise these, email [email protected].

We respond to all access requests within the 30-day window required under APP 12.4. There is no fee for an access or correction request.

9. Children's privacy

The Site is strictly for adults aged 18 years or older. We do not knowingly collect personal information from anyone under 18. If you believe a person under 18 has provided personal information to us, please contact [email protected] and we will delete it immediately.

10. How we protect your information

We apply commercially reasonable safeguards:

• HTTPS / TLS on every page; no plaintext HTTP.
• Encryption at rest for stored correspondence.
• Access controls restricting personal-information access to the smallest number of authorised staff.
• Vendor due diligence on all third-party service providers.
• No retention of payment details because we do not process payments.

No security system is perfect. If we ever experience a data breach affecting Australian residents that is likely to result in serious harm, we will notify you and the OAIC under the Notifiable Data Breaches scheme in Part IIIC of the Privacy Act.

11. Changes to this policy

We may update this Privacy Policy from time to time. The "Last updated" date at the top of this page reflects the most recent revision. Material changes will be communicated via a banner on the Site for at least 30 days. Continued use of the Site after the effective date of an update constitutes acceptance of the revised policy.

12. Contact us about privacy

Privacy questions, access requests, correction requests, or complaints:

Email: [email protected] Postal: [Registered business name], [Street address], [Suburb], [State] [Postcode], Australia Response time: Within 30 days, per APP 12.4 and 13.

If you are not satisfied with our response, you may lodge a complaint with the OAIC at oaic.gov.au.

Effective: [DD Month YYYY] · Last updated: [DD Month YYYY]