Privacy Policy

Updated 12 March 2026

Introduction

Regional Arts NSW (RANSW) collects information from individuals and organisations in order to administer and deliver its programs, and to communicate with its stakeholders, associates and customers. RANSW is committed to the protection of their privacy and personal information.

RANSW aims to comply with the National Privacy Principles (NPPs) detailed in the federal Privacy Act 1988 (Cth) (Privacy Act) and any other applicable current or future laws relating to privacy, data collection, the access to, the collection of and the use and disclosure of personal information.

Purpose

The purpose of the Privacy and Security Policy is to provide guidance and information on the management and use of information provided to RANSW and the way in which privacy and security issues will be addressed. This Policy is not intended to create a legally binding agreement between RANSW and an individual. The Policy has been created as a guide to RANSW privacy principles and is not a contractual document. RANSW will act in the interests of compliance with the principles contained in this Policy.

Collection and Storage of Information

In order for RANSW to provide its products and services, it may receive and store information that has been provided. Such products and services include:

  • maintaining accurate records of grant applications and acquittals;
  • distributing email newsletters and other material;
  • providing up-to-date information regarding artists, events and venues; and
  • gathering information for statistical, research and reporting purposes.

Information that identifies an individual is “personal information”. Any personal information given to RANSW will be used and disclosed only in accordance with this Policy. There is potentially a wide range of personal information that may be collected which may include, for example, names, addresses, phone numbers, age, email addresses and any information or opinions about an individual’s preferences, habits or activities.

RANSW will only record e-mail address if provided. It will only be used for sending information requested about RANSW products and services, or for another use provided. It will not be added to a mailing list, used for any unauthorised purpose or disclosed without that person’s consent.

RANSW will only collect personal information with the consent of and as provided by the individual to whom the personal information relates. By accessing the RANSW website, using its products or services or subscribing for materials, alerts or other information issued by RANSW, consent to collection of personal information is deemed to have been given.

In some cases, personal information may be provided to RANSW by a third party, such as a colleague or friend. RANSW will take reasonable steps to let the individual know that RANSW has personal information, which may include asking the party that provided the information to let the person know that RANSW has it.

The specific types of information collected from time to time and the reasons for collecting it may vary depending upon the particular circumstances. Where practicable, the purpose for which RANSW collects the personal information will be made clear at the time of collection. Further, where lawful and practicable, RANSW will endeavour to do business without requiring an individual to provide personal information. For example, RANSW will not require a person visiting the website to provide personal information unless and until they make a request which requires personal information in order to meet their request. If an individual does not provide RANSW with certain requested information, RANSW may not be able to provide its products or services to that individual.

RANSW may also store and/or collect “cookies” and “clickstream” information automatically from an individual accessing the RANSW website. The website may make use of a feature of Internet web browsers called “cookies”, which are small pieces of information stored by a browser on the individual’s computer hard drive or mobile phone. Cookies are used to maintain session information between a browser and the RANSW website. They enable the RANSW system to recognise an individual’s browser and to provide features. Most browsers notify the individual when a new cookie is received or turn off cookies altogether. However, if cookies are turned off, some features may no longer be available. For this reason, it is recommended that the cookies be left on.

RANSW will only use information obtained via cookies in order to learn about preferences in relation to RANSW facilities so that websites and the services offered through them can be improved.

RANSW may from time to time receive and store certain information relating to the use of, and behaviour on, the RANSW website. This information is commonly referred to as “clickstream” information. For example, RANSW may record information such as the areas of the website accessed, the time, date and URL of the pages requested, a user’s IP address and browser software. The recording of such information enables RANSW to monitor the areas of the website that are most popular and to improve sections accordingly.

We securely store personal information in cloud-based systems provided by trusted third parties, including Salesforce Non-profit Cloud and Pardot, hosted in Australian data centres via Salesforce’s Hyperforce architecture. Salesforce acts as our data processor under a Data Processing Addendum, with full details of their security practices available at trust.salesforce.com. We limit data shared with processors to what is necessary for our operations, such as managing supporter contacts, event registrations, and grant applications.

RANSW securely hosts and manages personal information for our partner organisations (RADOs) within our shared Salesforce Non-profit Cloud CRM environment. Partner data is segregated via dedicated portals with role-based access controls, stored in Australian data centres, and protected by encryption and Australian Privacy Principles (APPs) compliance. RANSW will not use or share partner data without the respective organisation’s prior written permission, as detailed in our Data Governance Policy.

Use and Disclosure

RANSW will not use or disclose personal information for any purpose other than the primary purpose of collection, unless it is required or authorised by law, or it is reasonably necessary for law enforcement.

RANSW may make personal information available to agencies in circumstances where required to do so by law, and in a manner that complies with that law. RANSW also reserves the right to disclose an individual’s information to law enforcement agencies in circumstances described in the NPPs and other applicable laws and regulations, including for the purpose of investigating alleged contraventions of law or in emergency situations.

RANSW may also share ‘aggregated’ information (at minimum identifier levels of a Census Collection District) with others provided no individual is identifiable from the aggregated information.

From time to time RANSW may engage or employ other companies and individuals to perform functions on our behalf to assist RANSW to comply with this Policy and perform its functions and services.

Access and Correction

RANSW will maintain procedures designed to keep its records accurate. If personal information that is out of date or inaccurate at any time needs to be changed, RANSW needs to be contacted at admin@regionalartsnsw.com.au or 02 9270 2500. After notice to change personal information, RANSW will take reasonable steps to correct any personal information. Similarly personal information is to be deleted, RANSW needs to be contacted. RANSW may be unable to supply services to you without certain information.

An individual has the right of access to their personal information, unless there is a threat to life or health or other people’s privacy, the request is frivolous or vexatious, there are legal proceedings in train, negotiations would be prejudiced, access is unlawful, denying access is required or authorised by law, it would prejudice investigation of an unlawful activity or law enforcement or for national security reasons. If access is denied a reason will be given.

Security

RANSW will take reasonable steps to protect personal information from misuse, loss or unauthorised access, modification or disclosure. Personal Information will be disposed of securely when it is no longer of use. Security measures used by RANSW include:

  • Educating staff as to their obligations with regards to personal information.
  • Security measures to systems access.
  • Only allowing access to personal information to an individual where that individual seeking access has satisfied our identification requirements.
  • Encrypting data during Internet transactions.
  • Employing firewalls, intrusion detection systems and virus scanning tools to protect against unauthorised persons and viruses from entering RANSW system.
  • Monitoring email traffic.
  • Seeking and acting upon external specialist advice in relation to information security measures.
  • Documenting and approving changes to RANSW systems.

RANSW implements appropriate technical and organisational measures to protect personal information from misuse, interference, loss, unauthorised access, modification, or disclosure, including encryption, access controls, and regular audits in our Salesforce environment. Where data is held by processors like Salesforce, we require equivalent protections and conduct due diligence on their compliance with current Australian standards (e.g., ISO 27001). You can learn more about Salesforce’s security approach and certifications on their compliance site.

In the event of a suspected or confirmed data breach, RANSW will promptly investigate, contain risks, and assess harm under the Notifiable Data Breaches scheme. If likely to cause serious harm, we will notify affected individuals and the Office of the Australian Information Commissioner (OAIC) as required by law, providing mitigation advice. Salesforce notifies us rapidly of processor-side incidents, enabling our response.

While RANSW will take all reasonable steps to keep records of personal information on its server and transmissions to and from its server secure, no organisation can absolutely guarantee security. There might be a risk of unauthorised access to an individual’s information and RANSW cannot be held responsible for events arising from unauthorised access to such information. RANSW is to be contacted if there is any reason to believe that there has been any unauthorised access to or use of personal information provided to RANSW.

Changes to this Policy

From time to time RANSW may review and update this Policy. Revised versions will be updated on the RANSW website

Resolving privacy issues

More information about the NPPs and privacy rights can be found at the Privacy Commissioner’s website: www.privacy.gov.au