Privacy Policy
1. Who we are
This policy applies to Trail to Triumph Inc, ABN 53 199 644 694 (“Trail to Triumph”, “we”, “us”), which runs the Trail to Triumph events and the website at trailtotriumph.com.au to raise awareness and funds for mesothelioma.
Privacy contact: Trail to Triumph event team
Email: dan.c@trailtotriumph.com.au
Phone: 0488 688 839
Post: PO Box 4467, Springfield Central QLD 4300
2. The laws we follow
We are a small organisation and may not be legally required to follow the Privacy Act 1988 (Cth). Because we collect health-related information at some events, we choose to follow the Act and the Australian Privacy Principles in full. We also follow the notifiable data breaches scheme in that Act. If another law, such as a state health records law, applies to you, we handle your health information to the same standard.
3. What we collect
| When | What we collect |
|---|---|
| You browse this website | Technical data such as your IP address, device and browser type, pages viewed and the time of your visit. This is collected by our hosting provider and by Google Analytics (see section 7). |
| You send us a message through the contact form | Your name, phone number, email address, location and message. |
| You register for an event | Your name, date of birth, email, phone, postal address, shirt size, registration type and event, and an emergency contact (name, phone and optional email). |
| You tell us about dietary needs or allergies | Dietary requirements and any allergy or other notes you type. This can be health information, which is a type of sensitive information. |
| You enter an event that needs medical clearance (for example the Ultra Marathon) | The completed doctor clearance form you email to us. This is health information. |
| You pay | Payment is made on a page run by Stripe. We receive confirmation of your payment, your name and email. We never see or store your full card number. |
| You contact us by email, phone or social media | Whatever you choose to tell us. |
You do not have to give us this information. If you leave out required details we may not be able to process your registration. Where it is practical you can use a pseudonym or contact us without identifying yourself, but we need real details to register you for an event and keep you safe.
If you give us someone else’s details, for example an emergency contact, please make sure they know and are happy for you to do so.
4. How we collect it
Directly from you, through our contact and registration forms, by email or phone, and at our events. Our website and its providers also collect technical data automatically.
5. Why we collect it and how we use it
- To process your registration and payment, and send you event information and updates.
- To keep participants safe: your emergency contact, dietary and allergy details and medical clearance are used for event safety and, in an emergency, to contact your emergency contact or pass details to paramedics and medical staff.
- To answer your enquiries.
- To run and improve the website and events, and to meet our legal, insurance and reporting obligations.
We use health information only for these purposes, and only with your consent, which we ask for on the registration form. We will not use or disclose your information for another purpose unless it is related and you would reasonably expect it, you consent, or the law allows or requires it (for example to prevent a serious threat to someone’s life or health).
6. Marketing
We do not currently send marketing emails or texts. If we start, we will ask for your consent first and every message will have an unsubscribe option, as the Spam Act 2001 (Cth) requires. Emails about an event you registered for are not marketing.
7. Who we share it with
We do not sell your personal information. We share it only with the providers that help us run the website and events, and only as needed:
- Netlify hosts this website and stores form submissions (contact and registration). netlify.com/privacy
- Stripe processes event payments. stripe.com/au/privacy
- Google Analytics measures how the website is used. We use it to see which pages are visited, not to identify you. policies.google.com/privacy
- Our email provider carries the messages you send us and we send you.
- Event partners and medical or emergency services, only where needed to run an event safely or in an emergency.
- Our professional advisers, insurers, and government bodies, where the law requires.
8. Overseas disclosure
Some of these providers store or process data outside Australia, most likely in the United States and possibly other countries where they operate. Before we use a provider, we take reasonable steps to make sure it handles your information in line with the Australian Privacy Principles. By registering or contacting us you understand your information may be handled overseas in this way.
9. Cookies and links to other sites
Google Analytics uses cookies or similar technology to collect usage data. You can block cookies in your browser settings or install Google’s opt-out add-on and the site will still work. Our site links to Facebook, Instagram, Stripe and other sites. Those sites have their own privacy policies and we are not responsible for them.
10. Security
This site uses HTTPS. Form submissions are held in access-controlled accounts and only the people who run the events can see them. No system is perfectly secure, but we take reasonable steps to protect your information from misuse, loss and unauthorised access.
11. How long we keep it
- Contact enquiries: up to 12 months.
- Registration details, emergency contacts, dietary and medical clearance information: up to 7 years after the event, then securely deleted or de-identified.
- Payment and financial records: 7 years, as tax and record-keeping law requires.
12. Data breaches
If a data breach is likely to cause you serious harm, we will tell you and the Office of the Australian Information Commissioner (OAIC) as the law requires, and explain what you can do to protect yourself.
13. Seeing and correcting your information
You can ask for a copy of the personal information we hold about you, or ask us to correct it, by contacting us using the details in section 1. We will confirm who you are first and aim to reply within 30 days. If we refuse, we will tell you why in writing. We will not charge for making a request.
14. Complaints
If you think we have breached the Australian Privacy Principles, contact us first. We will acknowledge your complaint, look into it and reply in writing. If you are not satisfied, you can complain to the OAIC at oaic.gov.au/privacy/privacy-complaints or on 1300 363 992.
15. Visitors from outside Australia
Our website and events are aimed at people in Australia. If you contact us from elsewhere, including the European Union or the United Kingdom, we will still respond to requests to access, correct or delete your information.
16. Children
Our forms are written for adults. If you are registering a child, you must be their parent or guardian and the details you give are about them. If you are under 18, please ask a parent or guardian to contact us before you register.
17. Automated decisions
We do not use automated decision making to make decisions about you.
18. Changes to this policy
We may update this policy from time to time. The current version is always on this page with its date at the top.