Policy 3 of 6
Privacy Policy
To explain what personal information we collect, why, how we protect it, and what rights people have over it.
ADOPTED
This policy was adopted by the board of The Schaffa Foundation, recorded as adopted on 22 September 2026. It is reviewed at least every two years, and sooner if the law changes or an incident shows a gap.
Our approach
We hold no more personal information than the work requires, and we keep it no longer than we need it. Many of the people whose information we hold are in vulnerable circumstances, and some of our volunteers are students under 18. That shapes everything below.
What we collect
| Who | What we hold | Why |
|---|---|---|
| Donors | Name, email, phone, amount, payment method, and any message sent with the gift | To issue receipts, meet tax record-keeping obligations, and thank people |
| Volunteers | Name, email, phone, the Sundays requested, hours worked, assessments, and any documents sent to us | To run the roster and to certify volunteer service for schools, universities and awards bodies |
| Subscribers | Name and email | To send the monthly newsletter |
| Guests at a service | Nothing. We do not record names, take details, or keep any register of the people we serve | Not applicable |
WORTH STATING PLAINLY
We do not collect information about the people who come to eat. There is no sign-in, no assessment, no register and no photographs. That is a deliberate part of how the service works, not an oversight.
How we protect it
- Accounts have no passwords. Access is by a single-use sign-in link, valid for a limited window, spent only when the person confirms it.
- Sign-in links are never written into any log or record. A log shows that a link was sent and when, never the link itself.
- Records of correspondence are kept for twelve months and then removed automatically.
- A volunteer can only ever see and edit their own record, and can never alter their own hours or sign-off.
- Access to donor and volunteer records is limited to board members and those staff and volunteers who need it to do their job.
- Payment card details are never held by us. Card payments are processed by our payment provider.
Who we share it with
We do not sell, rent or trade personal information, ever.
We share it only where we must: with our payment provider to process a donation, with our email provider to send a message, with the Australian Taxation Office where tax law requires it, and with a school, university or awards body where a volunteer has asked us to confirm their service to them.
We tell a third party only what is needed. A confirmation of volunteer service contains the hours, dates and assessment; it does not contain anything else we hold about that person.
Consent and withdrawing it
The newsletter is opt-in. An account is created automatically when someone donates or volunteers, because it holds their own record and their own receipts, but it is only ever reachable from a link sent to their address.
Anyone can unsubscribe at any time using the link in any email. An opt-out is applied to every record we hold for that person, not just the one they clicked from.
Access, correction and complaints
Anyone may ask what personal information we hold about them, ask for it to be corrected, or ask for it to be deleted where we are not required to keep it. Write to admin@streetbuffet.org.au and we will respond within 30 days.
Internal notes written about a person by our team are part of what we hold about them and may be disclosed in response to such a request.
If someone is unhappy with how we have handled their information they may complain to us under the Complaints and Feedback policy, and if still unsatisfied, to the Office of the Australian Information Commissioner.