PRIVACY POLICY

This policy applies to The Sir Robert Menzies Memorial Foundation Limited (ABN 43 008 543 897), trading as the Menzies Leadership Foundation, and to this website at menziesfoundation.org.au.

We are bound by the Australian Privacy Principles in the Privacy Act 1988 (Cth). This policy explains what personal information we collect, why we collect it, who we share it with, and how you can access or correct it.

You can reach us at menzies@menziesfoundation.org.au or +61 3 9070 3489, or by post at Central House, L3/489 Toorak Road, Toorak VIC 3142.

We only collect personal information that we need for a specific purpose.

Donations are processed by Stripe. When you enter your card details they are sent directly from your browser to Stripe over an encrypted connection. They do not pass through, and are never stored on, our servers.

We receive only what we need to issue your receipt and answer questions about your gift: the amount, the date, the card brand and its last four digits, and whether the payment succeeded. Stripe handles your card information under its own privacy terms and its obligations as a payment processor.

• To process your donation and issue a receipt for tax purposes.
• To manage recurring donations, including telling you when a payment fails or a card is about to expire.
• To respond to your enquiry.
• To keep the records a registered charity is required to keep, including for the Australian Taxation Office and the ACNC.
• To send you news and updates about our work — but only if you have asked us to.
• To maintain the alumni community and, where relevant, to contact alumni about the Foundation's programs.

We do not sell personal information, and we do not trade or rent our supporter or alumni lists to anyone.

We send updates only to people who have opted in. Every such email carries an unsubscribe link, and you can also ask us to stop at any time by emailing menzies@menziesfoundation.org.au.

Unsubscribing does not stop transactional messages — receipts, reminders about a recurring donation, and answers to your enquiries — because those relate to a transaction you have entered into with us.

We use a small number of service providers to run this website and our donation system. They may handle your information only to provide their service to us, and may not use it for their own purposes.

• Stripe — payment processing. Receives your name, email address and payment details.
• Postmark — delivery of our emails, such as receipts and sign-in links. Receives your email address and the content of those messages.
• Our website provider — hosting, maintenance and technical support, which may involve access to the systems holding this information, and copies of transactional emails for support and record-keeping purposes.
• Google Analytics — website usage statistics, where enabled. This does not receive your name or contact details.

We may also disclose information where the law requires it, or where it is necessary to protect the Foundation, our people, or the public.

Stripe, Postmark and Google are based in the United States and may store or process information there or in other countries. Where we disclose information to an overseas recipient we take reasonable steps to ensure it is handled consistently with the Australian Privacy Principles, but we cannot control the laws of other countries.

We set one essential cookie, and only after you sign in: it keeps you signed in as you move between pages. You cannot use the donor portal or the staff area without it. We do not use advertising or tracking cookies of our own.

Some pages embed content from other services — podcast episodes from PodBean, and videos from YouTube or Vimeo. Those services may set their own cookies when their content loads. Their privacy policies apply to what they collect.

Donation and receipt records are kept for at least seven years, as required for taxation and charity reporting. Receipts are numbered in an unbroken sequence, so donation records are marked as refunded or cancelled rather than deleted — this is what allows our records to be audited.

Enquiries are kept only as long as needed to deal with them and to keep a reasonable record. Alumni records are held on an ongoing basis as part of the Foundation's history, and you can ask us to amend or remove yours.

Information is held on access-controlled servers, encrypted in transit, and reachable only by the small number of Foundation staff whose role requires it. Access to our administrative system is restricted by role and requires a single-use email link or a passkey. Actions that affect money or accounts are recorded in an audit log.

No system can be guaranteed completely secure. If a data breach occurs that is likely to cause serious harm, we will notify affected people and the Office of the Australian Information Commissioner as the Notifiable Data Breaches scheme requires.

You can ask us for a copy of the personal information we hold about you, and ask us to correct it if it is wrong. Email menzies@menziesfoundation.org.au and we will respond within a reasonable period, normally within 30 days. We may need to verify your identity first.

If you have donated, you can also see and update much of this yourself from Manage my giving.

If you think we have mishandled your personal information, please tell us at menzies@menziesfoundation.org.au so we can put it right. We will acknowledge your complaint and respond within a reasonable period.

If you are not satisfied with our response, you can complain to the Office of the Australian Information Commissioner at oaic.gov.au or on 1300 363 992.

We may update this policy as our practices or the law change. The current version is always the one published here, and the date it last changed is shown at the top of this page.