Work with us
Back to Model policies
Policy 3.1 Integrity, privacy and security How we keep people and information safe

Privacy (internal and external)

How Just Gold collects, stores, uses and deletes personal, cultural and sensitive information, and how breaches are handled.

Easy Read

This policy is about keeping information private.

We only collect information we need.

We always explain why we need it.

We store information securely.

Only the right people can see it.

We ask for clear consent before we collect or use it.

We delete or return information when we no longer need it.

Report a possible breach to the CEO within 24 hours.

A breach is when private information gets out.

We tell people promptly if a breach affects them.

In plain language

Just Gold only collects the information it needs and explains why. Information is stored securely, and only the right people can see it. We ask for clear consent and remove names where we can. Suspected breaches must be reported to the CEO within 24 hours. People affected by a breach are told promptly.

Full policy

Section 3: Integrity, privacy and security

Trust is essential to our work. This section governs how we manage information, declare interests, and use resources. It sets out the ethical boundaries for professional integrity, including how we protect private data and public confidence in Just Gold's brand.

Policy statement

Privacy is not just a compliance issue; it’s a matter of dignity. Just Gold protects the personal, cultural, and sensitive information of staff, clients, partners, and communities. We align with Australian privacy law, but our standards often exceed legal minimums.

Our commitments

  • Collect only what we need, and explain why.
  • Store information securely, with access limited to authorised personnel.
  • Seek informed, specific consent for data collection, storage, and use.
  • Anonymise or deidentify personal data wherever possible.
  • Delete or return data once no longer required.

Types of information covered

  • Staff and contractor records
  • Client and community data
  • Research or impact evaluation responses
  • Media assets (photos, interviews, transcripts)
  • Cultural or community knowledge shared in confidence

Digital platforms

  • We use encrypted platforms and secure project management tools.
  • Access levels are role based, reviewed quarterly, and revoked upon exit.
  • Personal or confidential information is not to be stored on unapproved devices or personal accounts.

Breach response

  • Suspected breaches must be reported to the CEO within 24 hours.
  • A preliminary review will determine severity, impact, and any external reporting obligations.
  • Individuals affected by the breach will be notified promptly and respectfully.

Application

This policy applies to all projects, platforms, and interactions involving data. It also guides procurement of any digital tools or software with access to sensitive information.

Status
Under review
Version
2.0
Last updated
14 May 2025
Effective date
14 May 2025
Review date
March 2027
Owner
CEO, Just Gold