This Privacy Policy explains how D.E Castelli and T.A Cusack, in partnership, trading as Thera H-Art Workshops, ABN 67 129 140 375 ("Thera H-Art", "we", "us" or "our"), collect, use, disclose, store and protect personal information.
It should be read together with our Terms and Conditions and any specific privacy or collection notice provided when you book or participate in a Thera H-Art offering.
We handle personal information in accordance with the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs) where they apply. We have also chosen to use those principles as the baseline for our privacy practices because participants may share personal, health and other sensitive information with us.
1. What Personal Information We Collect
We collect only the personal information we reasonably need to operate Thera H-Art, provide our products and services, communicate with you and support safe participation.
Depending on how you interact with us, this may include:
- Contact information: your name, email address, telephone number and billing or delivery address.
- Booking and purchase information: what you book or purchase, payment status, transaction information and communications with us. Payment-card details are processed by our payment provider and are not stored by Thera H-Art.
- Participant information: emergency contact details, dietary requirements, accessibility requirements and other information relevant to participation.
- Health and wellbeing information: where you choose to provide it or where it is reasonably required for a particular activity. This may include injuries, health conditions, medications, accessibility considerations or other information relevant to safe participation.
- Information about children or young people: where an offering is designed for them, such as their name, age, relevant participation information and parent or guardian details.
- Travel information: where reasonably necessary to organise a retreat or journey. Wherever practicable, passport, visa and other identity-document information should be given directly to the relevant travel provider rather than to Thera H-Art.
- Photographs, video and audio recordings: where you have agreed to photography or recording.
- Images or scans for personalised products: photographs, scans or other visual information you provide so that we can create a personalised product, such as a Mini Me.
- Participant-created material: artwork, writing, stories or reflections you choose to share with us.
- Correspondence and feedback: enquiries, complaints, surveys and other communications.
- Marketing preferences: whether you have subscribed to receive Thera H-Art news and updates.
- Website and device information: IP address, browser or device information, pages viewed and similar information collected through website technologies or analytics.
Some of this information is sensitive information, including health information. Photographs and scans are personal information, and may also be sensitive information where they contain health information or are used to create biometric information for automated identification or verification.
Where consent is required to collect sensitive information, we will ask for it, and we will collect only what is reasonably necessary for the relevant purpose or otherwise permitted by law.
2. How We Collect Personal Information
We generally collect personal information directly from you when you:
- make a booking or purchase
- register for a workshop, program, retreat or journey
- complete a participant form, consent form, health declaration or risk acknowledgement
- sign up for our mailing list or a resource
- contact us or give us feedback
- supply photographs or scans for a personalised product
- agree to photography or recording
- use our website.
Sometimes information is provided by another person or organisation. For example, a parent or guardian may provide information about a child, one person may make a booking for another participant, or a booking platform, venue or travel provider may provide information needed to administer an experience.
If you give us personal information about another person, you should have their authority to do so where appropriate and make them aware that we will handle their information in accordance with this Privacy Policy.
When we collect sensitive or health information, we may also provide a separate collection notice or consent statement explaining what is being collected, why it is needed, who may receive it and what may happen if it is not provided.
3. Why We Collect and Use Personal Information
We may use personal information to:
- process bookings, purchases, payments and deliveries
- administer workshops, programs, retreats and journeys
- send booking confirmations, reminders, changes and practical information
- support participant health, safety and accessibility, and make reasonable adjustments
- respond appropriately in an emergency
- create personalised products you have requested
- provide customer support and respond to enquiries, feedback or complaints
- manage cancellations, refunds and other transactions
- improve our offerings, participant experience and website
- send marketing communications where you have consented or where otherwise permitted by law
- use photographs, recordings or participant-created work where you have given permission
- keep records required for business, tax, legal, insurance or regulatory purposes
- establish, exercise or defend legal claims and comply with applicable law.
We use health and other sensitive information primarily for the purpose for which it was collected, such as supporting safe and appropriate participation, unless you agree to another use or the law permits or requires it.
We do not sell, rent or trade personal information.
4. Images and Scans Used for Personalised Products
Where you give us photographs, scans or other images so that we can create a personalised item, including a Mini Me, we ask for your consent before we collect them. We use them to create, check and deliver the product you requested.
We produce these items on our own equipment. Access is limited, as far as reasonably practicable, to Thera H-Art personnel who need the material to complete the product. If we ever need an external production or fulfilment provider, we will tell you first and disclose only what is reasonably necessary.
We will not use source photographs or scans for marketing, promotional or unrelated purposes without your separate permission.
Source images, scans and associated production files are kept only for as long as reasonably necessary for production, quality control, customer support, record-keeping or legal purposes, and are then securely deleted or de-identified.
5. Who We May Share Personal Information With
We disclose personal information only where reasonably necessary for our activities, with your consent where required, or where authorised or required by law.
Recipients may include:
- Thera H-Art founders, facilitators and authorised team members who need the information to perform their role
- website, hosting, email and technology providers
- cloud storage, document and productivity providers
- payment processors
- booking and scheduling providers
- accounting and business-administration providers
- venues and activity providers
- accommodation, travel and transport providers involved in a retreat or journey
- professional advisers, including accountants, solicitors and insurers
- medical professionals or emergency services where reasonably necessary in an emergency
- government bodies, regulators, courts or law-enforcement authorities where disclosure is authorised or required by law.
We may also disclose information where it is reasonably necessary to prevent or lessen a serious threat to the life, health or safety of a person, or to meet our child-safety obligations.
Health, accessibility and emergency information is shared with facilitators or providers only where it is reasonably necessary for participant safety, accessibility or delivery of the experience.
Third-party providers operate under their own privacy policies and legal obligations. Where reasonably practicable, we choose reputable providers and disclose only the information required for the relevant service.
In a group experience, other participants may hear information that you choose to share. We set expectations around participant privacy and confidentiality, but we cannot guarantee another participant's behaviour. Our Terms and Conditions explain this further.
6. Overseas Storage and Disclosure
Some technology, website, payment, cloud, communication, booking or other service providers may store or process information outside Australia. Depending on the providers used at a particular time, personal information may be processed in countries including the United States and other countries in which those providers or their service partners operate.
Where an overseas disclosure is subject to the Australian Privacy Principles, we take the reasonable steps required by applicable privacy law. We also try, where reasonably practicable, to use established providers with appropriate privacy and security practices.
Where it is practicable to identify particular overseas recipients or countries when we collect information, we may do so in the relevant collection notice.
If you are outside Australia, your information may be transferred to or processed in Australia or other countries. You may also have rights under the privacy laws of your location, and you can contact us about them.
7. Cookies, Website Data and Analytics
Our website may use cookies and similar technologies to:
- operate essential website functions
- remember settings or preferences
- support booking or purchasing functionality
- understand how visitors use the website
- improve website performance and user experience.
We may use analytics or similar services for these purposes.
You can usually control or block cookies through your browser settings. Disabling some cookies may affect website functionality. Where applicable, we will provide additional cookie information or consent controls required by law.
Our website may link to third-party websites, social-media platforms and services. Those services have their own privacy practices, which we do not control.
8. Marketing Communications
We send electronic marketing where you have consented or where otherwise permitted by law.
Marketing communications identify Thera H-Art and include a functioning way to unsubscribe. You can unsubscribe at any time using the unsubscribe facility in the message or by contacting us. We will action an unsubscribe request within 5 business days.
Unsubscribing from marketing does not stop us sending communications that are necessary to administer a booking, purchase or existing relationship with you.
We will seek permission before using identifiable photographs, recordings or participant-created material for promotional purposes.
9. Storage, Security and Retention
We take reasonable steps to protect personal information from misuse, interference, loss, unauthorised access, modification and disclosure.
Our safeguards may include:
- password-protected systems and account security measures
- access controls that limit information to people who need it
- reputable technology and cloud-service providers
- appropriate restrictions on sensitive participant information
- secure deletion or de-identification when information is no longer required.
No electronic or physical storage system can be guaranteed to be completely secure.
We keep different categories of personal information for different periods, depending on why we hold them. For example:
- transaction and financial records are kept for the periods required by tax, accounting or other law
- booking and participant records are kept where reasonably necessary for administration, insurance, legal or risk-management purposes
- health, accessibility and emergency information is kept only for as long as reasonably necessary for the relevant participation, safety, legal, insurance or record-keeping purpose
- marketing information is kept while you remain subscribed or while otherwise lawfully required
- photographs, scans and production files for personalised products are kept as described in section 4
- photographs or media for which ongoing promotional permission has been given may be kept for that purpose unless the permission or circumstances change.
When personal information is no longer reasonably required and we are not legally required to keep it, we take reasonable steps to securely destroy or de-identify it.
10. Data Breaches
If we become aware of a suspected data breach, we will assess it and take reasonable steps to contain and respond to it.
Where the Notifiable Data Breaches scheme applies and a breach is likely to result in serious harm, we will notify affected individuals and the Office of the Australian Information Commissioner as required by law.
11. Access, Correction and Deletion Requests
You may contact us to request:
- access to personal information we hold about you
- correction of information that is inaccurate, incomplete or out of date
- deletion of information where it is no longer required and we are legally able to delete it
- withdrawal of a consent where the relevant processing relies on that consent
- an end to marketing communications.
We may need to verify your identity before responding. We aim to respond to privacy requests within 30 days.
There may be circumstances in which we cannot give access, make a requested change or immediately delete information, for example where we are legally required or reasonably entitled to keep it. If we refuse an access or correction request, we will explain our reasons in writing where the law requires.
Where it is lawful and practicable, you may also deal with us anonymously or under a pseudonym, for example when making a general enquiry. This is not possible where we need your identity to provide a booking, purchase or safety-related service.
12. Children and Young People
Our general website is not directed specifically to children.
Some Thera H-Art offerings may be designed for children or young people. Where appropriate, a parent or guardian may be required to make the booking, give consent and provide relevant participation, health or safety information.
We do not intentionally seek sensitive information directly from a child without appropriate involvement of a parent or guardian where that involvement is required or appropriate.
If you believe we have collected information about a child inappropriately, please contact us. We will review the circumstances and take appropriate action, which may include deleting information where it is not required or permitted to be kept.
13. Participant Choice and Sensitive Information
You are generally free to decide how much personal information you disclose during a reflective or group experience. You should not feel required to disclose personal experiences merely because an activity invites reflection.
Some information may, however, be necessary to provide a particular service or enable safe participation. Where it is, we will explain this where appropriate. If you choose not to provide information that is reasonably necessary for safety or delivery of an offering, we may not be able to provide that particular activity or service.
14. Photography, Recordings and Participant-Created Material
Where Thera H-Art intends to photograph or record identifiable participants for promotional or other non-essential purposes, we will seek your permission. Where practicable, promotional photography consent will be separate from agreement to take part in the underlying experience.
Declining promotional photography will not ordinarily prevent participation unless recording is an essential and clearly disclosed feature of the offering.
Participants keep ownership of their own original artwork, writing, stories and reflections, subject to the intellectual-property provisions in our Terms and Conditions. We will seek permission before using identifiable participant-created material for marketing, promotional, educational or commercial purposes.
15. Complaints About Privacy
If you have a concern about how we have handled your personal information, please contact us first.
We aim to acknowledge a privacy complaint within 5 business days and provide a substantive response within 20 business days, depending on the complexity of the matter.
If you are not satisfied with our response, you may complain to the Office of the Australian Information Commissioner (OAIC) at oaic.gov.au or on 1300 363 992.
16. Changes to This Privacy Policy
We may update this Privacy Policy as our activities, systems, service providers or legal obligations change. The current version will be published on our website with its effective date. We keep earlier versions.
If we make a material change to how we use personal information already provided to us, we will take reasonable steps to notify affected individuals where appropriate.
17. Contact Us
Thera H-Art Workshops
ABN 67 129 140 375
Email: connect@therahart.com.au
Website: therahart.com.au
Queensland, Australia