Privacy Policy
1. Purpose
The Australian River Restoration Centre Limited (ARRC) collects and uses personal information to run ARRC, deliver projects, manage relationships, meet legal obligations and communicate with our community. This policy explains how ARRC collects, uses, stores, protects and discloses personal information.
2. Scope
This policy applies to personal information ARRC collects from employees, contractors, volunteers, directors, members, donors, supporters, subscribers, suppliers, landholders, project partners, event participants, website users and other people who interact with ARRC.
ARRC manages personal information consistently with applicable Australian privacy, charity, corporations, communications, employment, taxation and record-keeping obligations, including where relevant the Privacy Act 1988 (Commonwealth), the Australian Privacy Principles, the Australian Charities and Not-for-profit Commission Governance Standards, the Spam Act 2003 (Commonwealth), and Australian Securities and Investments Commission-related corporate record obligations.
3. Information we collect
ARRC only collects personal information that is reasonably necessary for our work. This may include names, contact details, role or organisation, project or property details, payment information, employment, contractor and volunteer records, event attendance, communications, website and analytics data, photos, video, stories, testimonials, project content, and records needed for finance, governance, compliance, reporting or safety.
ARRC may also collect sensitive information only where lawful, such as health or safety information for fieldwork, events, insurance, employment, incident response or legal compliance.
4. How we collect information
ARRC collects information directly from people using forms, emails, meetings, phone calls, websites, events, project agreements, donations, contractor records, employment processes, surveys and subscriptions.
ARRC may also collect information from project partners, public sources, funders, government agencies, digital platforms, social media platforms, analytics tools, service providers or authorised representatives where this is reasonably necessary for ARRC’s work.
Where ARRC collects personal information about children or young people, ARRC will take reasonable steps to collect only what is needed and, where appropriate, seek consent from a parent or guardian before collecting or publishing identifying information, photos, video or stories.
5. How we use information
ARRC uses personal information to carry out its work, deliver projects, manage relationships, communicate with supporters, meet legal and funder obligations, manage risk and keep records. ARRC may use photos, video, stories, testimonials or project content where permitted by law and with appropriate consent.
6. Websites, cookies and analytics
ARRC websites and digital services may use cookies, tags, logs and analytics tools to understand how people use our sites and campaigns. This may include website, search, social media and campaign analytics tools. These tools may collect information such as IP address, browser type, device information, referring pages, pages visited, campaign interactions and interactions with our content.
7. Microsoft 365, Copilot and AI-enabled tools
ARRC uses Microsoft 365 and Microsoft 365 Copilot and other approved AI-enabled tools to assist with drafting, summarising, searching, analysing and managing organisational information. These tools are used within approved business systems and subject to ARRC’s access controls, confidentiality obligations and security settings. Staff must not enter personal, confidential or sensitive information into unapproved public AI tools.
8. Finance, accounting and business systems
ARRC uses approved business systems to manage finance, accounting, records, communications, websites, campaigns, governance and operations. This may include cloud productivity, finance and accounting, document management, email marketing, website hosting, content management, analytics, IT support, security and professional advisory systems. These systems may store or process personal information for ARRC’s legitimate organisational purposes.
9. Email marketing and communications
ARRC sends newsletters, updates, event invitations, fundraising information or campaign communications where permitted by law. ARRC sends commercial electronic messages with appropriate consent, identifies ARRC as the sender and provides a simple unsubscribe option. ARRC uses approved email marketing systems to manage subscription lists and unsubscribe requests.
10. Social media
ARRC uses social media platforms such as LinkedIn, Facebook and Instagram to share updates, promote events, engage with the community and understand the reach of our communications. If you interact with us on these platforms, we may see information you make available through your account or interaction, such as your name, profile details, comments, messages, reactions, shares and public activity. These platforms are operated by third parties and are also governed by their own privacy policies, settings and terms. ARRC may use platform insights, advertising tools or campaign analytics to understand engagement and improve our communications.
11. Disclosure and service providers
ARRC may disclose personal information to employees, contractors, directors, professional advisers, auditors, insurers, funders, project partners, payment processors, IT providers, website and hosting providers, analytics services, email marketing services, social media platforms, government agencies, regulators, law enforcement bodies or other parties where this is needed for ARRC’s work, required by law, or authorised by the person concerned.
12. Overseas processing and cloud services
Some of the services ARRC uses may store, access or process information outside Australia. Where required, we take reasonable steps to consider the privacy and security practices of relevant service providers and to manage the risks associated with cross-border disclosure or overseas processing.
13. Security
ARRC takes reasonable steps to protect personal information from misuse, interference, loss, unauthorised access, modification or disclosure. These steps may include access controls, multi-factor authentication, passkeys or other phishing-resistant sign-in methods, secure cloud systems, staff guidance, record controls, backups, security reviews and access restrictions so that information is available only to people who need it for their work.
14. Retention and deletion
ARRC keeps personal information only for as long as needed for the purpose for which it was collected, or where retention is required for legal, financial, employment, insurance, grant, governance, archival or operational reasons. When information is no longer needed, ARRC takes reasonable steps to delete, de-identify or securely archive it.
15. Data breaches
If a data breach occurs or is suspected, ARRC will take reasonable steps to contain it, assess the risk, reduce harm and meet any notification obligations that apply. Where the Notifiable Data Breaches scheme applies and a breach is likely to result in serious harm, ARRC will notify affected individuals and the Office of the Australian Information Commissioner as required.
16. Access and correction
You may ask to access or correct personal information we hold about you. ARRC will respond within a reasonable time and may need to confirm your identity before providing access or making changes.
17. Complaints
If you are concerned about how the ARRC has handled your personal information, please contact us first please contact ARRC first so the matter can be considered and, where possible, resolved. If the Privacy Act applies and you are not satisfied with our response, you may be able to contact the Office of the Australian Information Commissioner.
18. Changes to this policy
We may update this policy from time to time. The current version will be available on our website or from ARRC on request.
19. Contact
For privacy questions, access or correction requests, unsubscribe issues or complaints, contact ARRC at enquiries@arrc.com.au.
Australian River Restoration Centre Limited (ARRC)
ABN: 62 129 024 997
Stay connected to the rivers you love
Sign up to our monthly email newsletter and be the first to see inspiring stories, practical resources, and ways to make a real difference for our waterways and the native species that depend on them.
Be a part of our community 💚
The ARRC acknowledges the Country we live on
We acknowledge and respect Aboriginal and Torres Strait Islander Peoples as the Traditional and Continuing Custodians of Country. We respect and learn from Elders past, present and emerging, valuing their knowledge, insights, cultures and connections to the waterways we love and care for.
Our Reflect Reconciliation Action Plan promotes a reconciled Australia by supporting and empowering Aboriginal and Torres Strait Islander voices and experience in the work we do to restore and protect our waterways. We make every effort to involve First Nations collaboration and partnerships in all our on-ground projects.
Support our work
There are multiple ways to show your support for what we do.
Choose your own adventure.
Every donation makes an impact.
100% of proceeds go directly towards our work restoring rivers.
Join us at an upcoming planting day or community event.
Collaborate with us on a range of projects, working to restore our rivers together.
Work with us to achieve sustainability goals and make a positive environmental impact.