Last updated: 15 April 2026

Purpose

Endeavour Foundation, including Community Solutions Group (Endeavour Foundation), is committed to providing quality services and supports to the people who access our services, to our employees and to our supporters. This policy outlines how we collect, use, protect and share personal information for that purpose.

Endeavour Foundation has obligations under the Privacy Act 1988 (Cth), and various state and territory legislation. Our privacy framework is based on the Australian Privacy Principles (APPs). The APPs govern the way in which we collect, use, protect and share personal and sensitive information.

A copy of the APPs may be obtained from the website of the Office of the Australian Information Commissioner at www.oaic.gov.au.

Scope

This policy applies to all Endeavour Foundation officers, executives, employees, volunteers, Advisory Group members, consultants, and contractors.

Policy

Endeavour Foundation will:

• explain to people what personal and sensitive information we are collecting, why we are collecting the information, and how we plan to use it
• obtain consent to collect, use or disclose personal information, unless required by law
• • only use sensitive information:
• • for the primary purpose for which it was obtained
• • for a secondary purpose that is directly related to the primary purpose, AND
• with consent, or where required by law
• take reasonable steps to ensure that people accessing our services are made aware of any information about them shared with or provided to us by a third party
• ensure personal information is stored and managed in a way that reasonably protects it from misuse or loss, and/or unauthorised access, modification of disclosure
• ensure individuals, or their appointed guardian or supportive decision-maker, have access to their personal information as outlined below, and in accordance with the APPs
• take reasonable steps to ensure that personal information is accurate, complete, and current.

Policy Elements

What is personal information?

Personal information is information or an opinion that identifies an individual. It includes name, address, date of birth, photographs, and bank account details, among other things.

Endeavour Foundation collects a range of personal information. Some examples include:

• name, date of birth, address, email, and phone number
• personal history
• photographs
• work experience.

We may also collect the following information when you visit our websites:

• your IP address
• the date and time of your visit
• the pages you accessed and the documents you downloaded from our website
• the search terms you used
• your top-level domain name (e.g. .com, .gov, .au)
• your email address if you provide it
• any cookies your browser has presented to our server. This information is used to improve our website and services and may also be used to secure our network or prevent security incidents.

What is sensitive information?

Sensitive information is information or opinion about such things as an individual’s racial or ethnic background, political opinion, religious or philosophical beliefs, criminal record or sexual identity and preferences.

A subset of sensitive information is health information. This is information relating an individual’s current and past medical history. It also includes information about disabilities.
Some examples of sensitive information which may be collected by Endeavour Foundation include:

• disability information
• health information
• religious beliefs
• immigration status.

Why do we collect personal and sensitive information?

Endeavour Foundation collects personal and sensitive information from the people who access our services, our employees, contractors, consultants and supporters to deliver supports and services, administer and manage our relationship, to send newsletters, information and marketing communications, to facilitate fundraising and lotteries activities and carry out Endeavour Foundation business activities. We will only collect personal information that is necessary to carry out these activities.

How do we collect personal and sensitive information?

We collect personal and sensitive information by asking an individual or their representative to provide it. In some instances, personal information must be provided before we’re able to provide a service or support.

We also collect personal information while providing supports or services. For example, a support worker will record personal information about a person we support to complete daily progress notes, our fundraising and lotteries teams will record personal information to facilitate donations or ticket purchases; or personal information may be collected about a trainee in the process of evaluating their progress in their traineeship.

We may collect information about an individual from a third party, but we will obtain the individual’s consent when doing so. For example, we will obtain consent from a job applicant before contacting their former employer for a referee report, our we may collect information from a health care provider about a person we support.

What is the primary purpose of collection?

The primary purpose of collection refers to the reason we ask an individual to provide us with personal or sensitive information. We will only collect and use information that is reasonably necessary to perform one or more of our functions or activities (out primary purpose). Functions or activities for which we collect personal information include:

• assessing whether, and how, we will support a potential client
• providing support services
• providing NDIS support coordination, behaviour support or allied health services
• providing employment opportunities and services
• complying with our legal and contractual obligations with government agencies
• to send newsletters, information and marketing communications
• fundraising
• sale of lotteries tickets
• administrative functions.

What is a secondary purpose?

We may also use and disclosure personal or sensitive information for a purpose other than the primary purpose if an individual has given their consent OR it would be reasonably expected that we would use or disclose information for a purpose directly related to the primary purpose. This is the secondary purpose.

Secondary purposes for which we may use or disclose personal or sensitive information include:

• sharing information with the NDIS Quality and Safeguards Commission to ensure we are providing are receiving quality supports
• sharing information with other providers of supports and services, such as:
• • a client’s behaviour support practitioner o a client’s NDIS support coordinator
• • health specialists to provide medical or health-related supports
• with auditors or regulatory bodies to ensure we meet our compliance obligations
• when requested by a law enforcement agency.

When sharing information with other organisations we will ensure that the organisation has a right to the information and genuinely needs it to provide supports or services, or to assist Endeavour Foundation in its operations.

For NDIS purposes, do Endeavour Foundation and Community Solutions share personal and sensitive information?

For NDIS purposes, Endeavour Foundation and Community Solutions are separate entities. Although we do share some clients, in many cases the two entities do not, and thus it is important to ensure their client information is kept separated.

When the two entities share a client, requests to disclose information between the two must be managed as a third-party request through the Privacy Team.

Security of personal information

Personal and sensitive information is stored in a range of hard copy and electronic forms in a manner that reasonably protects it from misuse or loss, and from unauthorised access, modification, or disclosure. All hard copy records are held in Australia. Digital records are primarily stored in Australia but may be stored on server in countries with equivalent or stronger privacy protections than Australia.

When your personal information is no longer needed for any purpose, we will take reasonable steps to destroy or permanently de-identify the records.

Accessing personal information

Individuals may request to access the personal information we hold, including to update or correct it. Individuals wishing to access their personal information, should contact us in writing at the below mail or email address.

If a guardian, family member or supportive decision-maker for a child or adult we support wishes to access personal information about the person we support, they may be required to demonstrate right to access the person’s information. This is done via completion of our Application for Access to Information form, which can be provided by the Privacy Officer or any Endeavour Foundation or Community Solutions employee.

Due to the nature of Endeavour Foundation’s business, records containing personal information about an individual may also contain personal information about other individuals, such as other people we support or our employees. Unless we have consent from those individuals to share their information, we will remove it prior to providing the records.

How to request Endeavour Foundation to stop sending communications

An individual wishing to cease receiving communications from us may do so by either clicking the ‘Unsubscribe’ link on an email, or by contacting the Privacy Team using the details below. However, if we need to continue to send you factual non-marketing communications, such as for financial matters, we will not be able to stop this.

Privacy Complaints

An individual who thinks Endeavour Foundation may have breached our privacy obligations in relation to the handling of personal information may make a complaint by contacting us using the contact details set out below.

The complaint should be made in writing and include contact details for a response, and all relevant details to enable us to understand, investigate and assess the matter.

We will respond to the complaint within a reasonable timeframe. We are committed to quick and fair resolution of any complaints and will ensure every complaint is taken seriously.

An individual that is not satisfied with the outcome of the complaint or the way it was handled by us, can lodge a complaint with the Office of the Australian Information Commissioner at www.oaic.gov.au.

Contact Us

If you have any questions or complaints about our privacy practices, or you wish to access your personal information, please contact:

Endeavour Foundation Privacy Officer
PO Box 355
Tingalpa QLD 4173

OR
1800 112 112

OR
[email protected]

You may also report complaints about how we collect, use, store or disclose your personal
information with the Office of the Australian Information Commissioner via: www.oaic.gov.au.

OR
1300 363 992