Privacy Policy

1. Who we are

Manyang Disability Foundation ("MDF", "we", "us", "our") is the data controller for personal data collected through this website. We are an ACNC-registered charity based in Australia (ABN 75 986 228 179) supporting people with disabilities. We receive enquiries and support from visitors located in the European Union, the United Kingdom, Australia and elsewhere.

You can reach our privacy contact at [email protected] or via our contact form.

2. Data we collect

We only collect what we need to run our programs and services:

• Contact form: your name, email address, and the message you send.
• Donations: your name, email address, donation amount, and — if you request a tax receipt — postal address. Payment card details are handled directly by our payment processor and never touch our servers.
• Event RSVPs: your name, email address, and any requirements you share (dietary, accessibility).
• Volunteer, coordinator, fundraiser and aid-request submissions: the fields you complete on each form (contact details, location, availability, and — for aid requests — the information you provide about your need).
• Staff / partner accounts: email address, full name, hashed password, role assignments, sign-in timestamps.
• Technical logs: IP address and basic request metadata are temporarily processed for security (rate limiting, abuse prevention) and error monitoring.

3. Legal bases for processing (GDPR)

• Consent (Art. 6(1)(a)) — when you submit a form or RSVP, you consent to us using that data to respond.
• Contract / steps prior to contract (Art. 6(1)(b)) — processing donations, running your account, sending transactional confirmations.
• Legal obligation (Art. 6(1)(c)) — retaining donation records to meet Australian tax and charity-reporting requirements.
• Legitimate interests (Art. 6(1)(f)) — securing the site (rate-limiting, spam prevention), keeping short-lived server logs.

4. How we use your data

• To reply to your enquiries and requests.
• To process donations and issue receipts.
• To coordinate volunteering, events, partnerships and aid programs.
• To send transactional and authentication emails only — we do not send marketing emails or newsletters.
• To secure the service and prevent abuse.
• To meet our legal and regulatory obligations as an Australian charity.

5. Emails and communications

We send only authentication emails (for staff accounts) and transactional emails (receipts, confirmations, deletion notices). For a detailed breakdown of what we send, how it is delivered, retention, and how to opt out, see our Email Communications Addendum.

6. Sharing & subprocessors

We do not sell personal data. We share limited data with service providers that help us run the site:

• Hosting, database and email delivery — provided by our application platform, which stores your data and sends transactional and auth emails on our behalf.
• Payment processor — handles donation payments directly; payment card details are collected by the processor, not by us.
• Australian Charities and Not-for-profits Commission (ACNC) — as required by our regulatory reporting obligations.

7. International transfers

MDF is based in Australia and our service providers may process data in the European Union, the United Kingdom, the United States or other jurisdictions. Where personal data of EU/UK residents is transferred outside those regions, we rely on the safeguards our providers make available (such as Standard Contractual Clauses) and on the adequacy status of Australian charities under applicable law. Contact us for details of the safeguards in place.

8. Retention

• Contact form messages and general communications: retained for one month after the matter is resolved, then deleted.
• Donation records: retained for the period required by Australian tax and charity law.
• Staff / partner accounts: retained until you delete your account via Delete account. Deletion is subject to a 30-day grace period during which you can cancel; after that, the account and its data are permanently removed.
• Technical logs: retained for a short operational window and then deleted.

9. Your rights

Depending on where you live, you have some or all of the following rights over your personal data:

• Access — request a copy of the personal data we hold about you.
• Rectification — ask us to correct inaccurate or incomplete data.
• Erasure — ask us to delete your data (subject to legal retention duties).
• Restriction & objection — ask us to pause or stop processing based on legitimate interests.
• Portability — receive your data in a portable format.
• Withdraw consent — where processing is based on consent, you can withdraw it at any time.
• Lodge a complaint — with your local supervisory authority.

Supervisory authorities: Australian residents may contact the Office of the Australian Information Commissioner (OAIC). EU residents may contact their national data protection authority. UK residents may contact the Information Commissioner's Office (ICO).

10. How to exercise your rights

• Email [email protected] with your request. We aim to respond within 30 days.
• Account holders can download all data associated with their account and schedule permanent deletion from the Delete account page — no email required.
• We may ask for reasonable proof of identity before releasing or deleting data.

11. Cookies

We use only strictly-necessary cookies and local storage entries required to keep you signed in and to protect the site from abuse. We do not use advertising cookies or third-party analytics that profile visitors.

12. Children

This site is not directed at children under 16. We do not knowingly collect personal data from children. If you believe a child has provided personal data, contact us and we will delete it.

13. Security

Access to personal data is restricted to authorised staff and enforced by row-level authorisation in our database. Passwords are hashed. We use HTTPS in transit. No online service can be guaranteed 100% secure — security is a shared responsibility between us and the platform providers we rely on.

14. Changes to this policy

We may update this policy from time to time. Material changes will be flagged on this page and the "Last updated" date above will be revised. Continued use of the site after changes take effect constitutes acceptance of the updated policy.

15. Contact us