Madalah is committed to managing personal information to ensure that your privacy is protected and will endeavor to handle your personal information in accordance with this Privacy Policy and the Australian Privacy Principles. This Policy outlines the kinds of personal information we collect and hold, how and why we collect, use and disclose it, how we protect information that you provide and how individuals may access or correct their information or make a complaint. Madalah may change this Policy from time to time by updating this page.
Scope and key terms
This Privacy Policy sets out how we comply with our obligations under the Privacy Act 1988 (Privacy Act), the Australian Privacy Principles (APPs), and any applicable industry privacy codes.
This Policy applies to personal information handled by Madalah in connection with its scholarships, educational support, wellbeing services, fundraising, partnerships, events, website, employment and other operations.
In this Privacy Policy, ‘personal information’ and ‘information’ are used interchangeably and means information or an opinion about an identified individual, or an individual who is reasonably identifiable, whether true or not and whether recorded in a material form or not.
Sensitive information includes health information and information about racial or ethnic origin, religious beliefs and other categories specified in the Privacy Act.
What personal information we collect and hold
Depending on our relationship with you, we may collect and hold personal information such as your name,
contact details, dates of birth, identity and eligibility information, education and scholarship information, family or guardian details, emergency contacts, financial and payment information, photographs or recordings, correspondence, feedback and complaints, and employment or volunteer information and any other details you voluntarily provide through our website forms.
In some cases, we may collect sensitive information such as cultural background or health-related details when it is relevant to providing scholarships or wellbeing support. We will obtain consent where the Privacy Act requires it, unless another lawful exception applies.
When you use our website or digital services we also collect technical information such as IP address, device details, browser type, and cookies to improve your website experience.
Purposes for which we collect, hold, use and disclose personal information
We may collect, hold, use and disclose your personal information for the following purposes:
- provide and manage scholarships;
- provide education, mentoring, wellbeing and related support;
- communicate with students, families, schools, partners, donors and service providers;
- manage events, fundraising and relationships;
- process payments;
- monitor and improve programs and digital services;
- meet safety, reporting, governance and legal obligations;
- manage staff, volunteers and contractors; and
- to customise users experiences, measure interest in our services, improve our services and inform users about services and updates.
Where we collect your personal information for a specific purpose not outlined above, we will provide you with a collection notice which explains the primary purpose and any related secondary purposes for which we are collecting your personal information, whether the provision of personal information is required or optional and how it will be used.
How we collect and hold personal information
Where reasonable and practical, we collect personal information directly from you including through applications, forms, interviews, telephone calls, emails, our website, events and delivery of our programs. We may also collect information from a parent or guardian, school, referee, service provider, funding body, government agency, partner organisation or publicly available source where permitted by law.
Where lawful and practicable, individuals may interact with Madalah anonymously or using a pseudonym. However, this may not be possible where identification is reasonably necessary for scholarship administration, wellbeing support, employment, fundraising or legal compliance purposes.
If we receive unsolicited personal information, we will determine whether we could have collected it under the APPs. If not, and if lawful and reasonable to do so, we will destroy or de-identify it.
Where required, we will provide a collection notice explaining relevant matters, including why information is collected, the consequences if it is not provided, usual disclosures, and how to access or correct information or make a complaint.
Disclosure
We do not sell or rent personal information to third parties for marketing purposes without your explicit consent. Direct marketing communications will only be sent as permitted by law and will include a simple way to opt out. We will action opt-out requests within a reasonable period
We may disclose personal information where reasonably necessary to partner schools, education providers, funding bodies, government agencies, partner organisations, professional advisers, auditors, insurers, payment providers, technology and cloud service providers, and health or wellbeing professionals. We limit disclosures to what is reasonably necessary and require service providers to protect information appropriately.
Security
We are committed to the protection of personal data. We take reasonable steps to protect personal information from misuse, interference, loss, and unauthorised access, modification or disclosure. Measures may include access controls, multi-factor authentication, encryption, secure networks, managed devices, staff training, physical security, vendor oversight and periodic review of security controls.
We retain personal information only for as long as reasonably necessary for our functions, activities and legal obligations. When information is no longer required and we are not legally required to retain it, we take reasonable steps to securely destroy or de-identify it.
We store information securely using systems such as Microsoft 365 and Salesforce with restricted access, encryption, and two-factor authentication. Only authorised staff can access personal information. We regularly review and update security controls to reflect best practice.
We will not knowingly share any of your personal information with any third party other than our services providers who assist us in providing the information and/or services we are providing to you. To the extent that we do share your personal information with a services provider, we would only do so if that party is under a similar obligation to comply with privacy standards as described in this Privacy Policy.
However, no information transmitted over the internet can be guaranteed to be secure. We cannot guarantee the security of any information you transmit to us or receive from us. The transmission and exchange of information is carried out at your own risk. Although we take measures as described in this Privacy Policy to safeguard against unauthorised disclosures of information, we cannot assure you that personal information that we collect will not be disclosed in a manner that is inconsistent with this Privacy Policy.
Overseas disclosure
Madalah may engage technology, cloud hosting and software service providers that store or process personal information outside Australia. Where personal information is disclosed to an overseas recipient, Madalah will take reasonable steps to ensure the recipient handles the information in accordance with the Australian Privacy Principles unless an exception under APP 8 applies.
Children and Young People
As Madalah provides services to children and young people, we take particular care to ensure privacy communications are clear and age appropriate, collect only information reasonably necessary for our functions or activities, and consider whether the individual has capacity to consent their personal information. Where appropriate, we will seek consent from a parent or guardian where required.
Madalah will monitor and implement applicable requirements arising from the Children’s Online Privacy Code when it commences and applies to our activities.
Data breach response
Madalah maintains procedures to identify, contain, assess and respond to suspected or actual data breaches. Where an eligible data breach is likely to result in serious harm and remedial action does not prevent that likely harm, we will notify affected individuals and the Office of the Australian Information Commissioner (OAIC) in accordance with the Notifiable Data Breaches Scheme.
Access and correction of personal information
You have the right to request access to personal information that Madalah holds about you and request correction of personal information that is inaccurate, out of date, incomplete, irrelevant or misleading. We may need to verify your identity before providing access to or amending personal information.
We will respond to requests within a reasonable period. Where we refuse a request for access or correction, we will provide written reasons for the refusal and information about available complaint mechanisms, unless it would be unreasonable or unlawful to do so.
Madalah will not charge an application fee for access requests. Where a charge is permitted by law for providing access, any fee will not be excessive and will be communicated before access is provided.
If you no longer wish to receive direct marketing communications from Madalah, you may opt out at any time by using the unsubscribe function provided in the communication or by contacting us at info@madalah.com.au.
Madalah will securely destroy or de-identify personal information when it is no longer required for the purpose for which it was collected and there is no legal or operational requirement to retain it.
Cookies and Analytics
Our website may use cookies and analytics tools to support functionality and understand how visitors use our site. You can adjust your browser settings to block or delete cookies, although this may affect website functionality. Where third-party tools collect personal information, their handling practices may also be governed by their privacy policies.
Automated decision-making
Madalah does not currently use computer programs to make decisions or do things substantially and directly related to decisions that significantly affect an individual’s rights or interests. If this changes, Madalah will update this Privacy Policy to explain the kinds of decisions and personal information used, as required by the Privacy Act.
Complaints
If you have any concerns or complaints about how we handle your personal information, please contact us using the details below and provide sufficient information for us to investigate. We take all privacy concerns seriously and will respond promptly, aiming to resolve any issues within a reasonable timeframe. If you are not satisfied with our response, you may lodge a complaint with the Office of the Australian Information Commissioner (OAIC) at www.oaic.gov.au.
Contact us
If you have any questions or would like further information about our privacy information handling practices and policies, or a hard copy of this policy, or you wish to exercise your right to make a correction, complaint, request access to, or deletion of, any information which we have collected about you, please contact us at:
Madalah Ltd
Suite 4, 16 Brodie Hall Drive, Bentley, WA, 6102
Phone: (08) 6153 0753
Email: info@madalah.com.au
Changes to this policy
This policy will be reviewed annually or earlier where there are material changes to applicable law, OAIC guidance, technology, service delivery or Madalah’s information-handling practices. The current version will be published on our website and will state its approval or effective date.
BOARD APPROVED: 14 September 2026