Privacy Policy

​1. Our Commitment to Privacy and Sanctuary
​The Catholic Diocese of Bathurst (CDOB) and its associated parishes, ministries, and operational agencies are fundamentally committed to protecting the dignity, safety, and personal information of all individuals. In fulfilling our mission—encompassing pastoral care, sacramental administration, education support, youth programs, and community welfare—we recognize that trust is foundational.

​This Privacy Policy sets out how we handle personal and sensitive information in strict compliance with the Privacy Act 1988 (Cth), the Australian Privacy Principles (APPs), and contemporary regulatory standards (including the statutory duty of fairness, strict data minimisation, child safety frameworks, and modern surveillance/digital realities).

2. The Information We Collect
​We only collect personal information that is reasonably necessary to carry out our core functions, deliver pastoral care, administer church life, or comply with statutory requirements.
— ​General Personal Information:
Names, residential or postal addresses, telephone numbers, email addresses, and communication preferences.
​— Financial and Transactional Data:
Details regarding donations, bequests, event fees, and billing details processed securely via approved payment gateways (such as BPoint integrated into settings).
— ​Sensitive Information (Religious & Philosophical Beliefs):
Details regarding sacramental history (baptism, marriage, confirmation, and funerals) and memberships in church bodies or ministries.
— ​Health and Safety Data:
Medical conditions, dietary requirements, or emergency contact details collected specifically for camps, youth festivals (such as RISE/RISEN events), or specialized care ministries.
​— Background Screening & Safeguarding Data:
Information required for regulatory compliance under child safety laws, including professional conduct checks, working clearance validations, and safeguarding records. (Note: In compliance with strict data protection guidelines, government identifiers such as Working with Children Check numbers or tax details are handled with maximum security restrictions and are never exposed or stored insecurely).

3. Modern Digital Practices, Surveillance, and Cloud Security
​Because modern parish and diocesan operations rely heavily on digital platforms, electronic communications, and physical security measures, this policy explicitly covers:
— ​Cloud Infrastructure & Cross-Border Risks:
Third-party software providers, cloud databases, and digital form tools (such as Google Forms) used for parish registrations are bound by strict contractual data-processing obligations. Where backend backups involve overseas servers, we ensure compliance with APPs regarding cross-border data protection.
​— CCTV and Physical Surveillance:
Where closed-circuit television (CCTV) or electronic monitoring is deployed across diocesan, agency, or parish grounds for asset protection and physical safety, footage is stored securely, access-restricted, and automatically purged in line with statutory retention cycles.
— ​Electronic Communications and Tracking:
Website analytics and digital cookies track server addresses and connection data for administration, but personal browsing habits are never commercialised or traded.

​4. The "Fair and Reasonable" Standard & Data Minimisation
​In alignment with modern Australian privacy standards, all collection, use, and disclosure of personal data by the Diocese and its parishes must pass an objective Fair and Reasonable Test.
​— Proportionality:
We will never collect personal information indiscriminately or "just in case". Data handling must match our actual operational or pastoral needs.
— ​Minimisation:
We actively review our forms and databases to ensure we only capture the minimum volume of data required to achieve the intended purpose.
— ​Protection Against Harm:
No data processing activity will be undertaken if it imposes an unjustified risk of harm, distress, or unfair intrusion into an individual's private life.

​5. Handling of Sensitive Information and Consent
​Because our ministries routinely handle sensitive data (such as religious affiliations, health details, and safeguarding disclosures), we apply heightened security and strict consent controls:
— ​Unambiguous Consent:
Consent must be voluntary, informed, current, specific, and unambiguous. We strictly prohibit pre-ticked boxes, hidden terms, or "take-it-or-leave-it" bundled agreements (such as forcing media consent as a mandatory condition of event attendance).
— ​Children and Minors:
When collecting data from children and young people, our primary consideration is always the best interests of the child. For minors under the age of 15 (or those lacking independent capacity), privacy decisions, consents, and notices will be managed through their parents or legal guardians.

​6. How We Use and Disclose Information
​Personal information is used primarily for the purpose for which it was collected, or for directly related secondary purposes that a reasonable person would expect. This includes:
— ​Administering sacraments, maintaining parish rolls, and providing spiritual or pastoral care.
— Organizing youth events, parish gatherings, and community programs.
— Processing voluntary donations and issuing tax-deductible receipts.
— Fulfilling mandatory legal obligations, including child protection reporting (under NSW child safety laws), work health and safety rules, and canonical/civil governance.
No Data Trading:
We strictly prohibit the trading, bartering, selling, or unauthorised commercial sharing of personal information with external third parties.

​7. Data Retention, De-identification, and Destruction
​We do not retain personal information indefinitely.
​— Lifecycle Management:
Information is securely archived, destroyed, or irreversibly de-identified as soon as it is no longer required for its original purpose or needed to satisfy statutory, financial, or canonical record-keeping obligations.
— ​Safeguarding Records:
Safeguarding files, historical compliance records, and employee/volunteer screening logs are maintained strictly in accordance with statutory retention schedules and Diocesan record-keeping policies.

​8. Your Rights: Access, Correction, and Deletion
​You maintain fundamental control over your personal data:
— ​Access:
You may request access to the personal information we hold about you at any time by contacting our Privacy Officer. Parents or guardians may request access on behalf of minors where appropriate.
— ​Correction:
If you believe any information we hold is inaccurate, out-of-date, incomplete, or misleading, you may request its correction.
— ​Opt-Out:
You can opt out of direct marketing, newsletters, or promotional communications at any time by utilising the unsubscribe mechanism provided in those communications.

9. Enquiries, Privacy Complaints, and Dispute Resolution
​If you have any questions regarding this policy, or if you believe your privacy has been mishandled or breached, please contact our designated Privacy Officer in writing:

​Attn: Privacy Officer
Catholic Diocese of Bathurst
P.O. Box 246, Bathurst, NSW 2795
Email: privacy@bathurst.catholic.org.au

​We take all privacy concerns seriously and will investigate and respond to formal complaints within 21 business days. If you are unsatisfied with our internal resolution, you retain the right to escalate your query or formal complaint to the external regulator:

​Office of the Australian Information Commissioner (OAIC)
Phone: 1300 363 992 | Website: www.oaic.gov.au