Who this policy applies to

This policy applies to all personal information collected by The Learning Garden about children, families, staff and visitors. As an early childhood education and care service, we are classified as a health service provider under Australian law — meaning we are bound by the Privacy Act 1988 and must comply with the Australian Privacy Principles (APPs).

What information we collect and why

We collect personal information only where it is necessary for providing education and care or for employment purposes. This may include:

• Children's names, dates of birth, medical records and health information

• Family contact details, home addresses and emergency contacts

• Court orders or custody arrangements relevant to a child's care

• Information required to process Child Care Subsidy (CCS) through Services Australia

• Health information such as allergies or medical conditions — displayed with your permission to keep your child safe

• Employment information for team members

All information is collected lawfully, with your knowledge and consent.

Child Care Subsidy and information sharing

To process your Child Care Subsidy entitlement, we are required to share relevant personal information with Services Australia and the Australian Government Department of Education. This is authorised under Family Assistance Law.

At enrolment, families are advised in writing that this information sharing occurs. Your consent is required — and without it, we are unable to process CCS on your behalf.

How we store and protect your information

Personal and confidential information is stored securely using locked devices, password-protected systems and access controls. We take the following steps to protect your information:

• Access to personal information is restricted to those who need it to fulfil their role

• Unique login credentials are required for all platforms holding personal data

• Passwords are never shared or stored in an accessible way

• Confidential conversations are conducted privately and away from children where possible

• Physical documents containing personal information are disposed of by shredding

• CCTV is in operation at the centre — families are notified of this at enrolment

Photography and digital images

Our service follows the National Model Code for taking, using and publishing digital images of children. We do not share identifiable images of children's faces on any digital platform or social media. Photography at The Learning Garden is used to document learning — not for promotional or social purposes without explicit consent.

Permission for use of photographs is sought at enrolment through your Enrolment and Agreement Form.

Who we may share your information with

We only disclose personal information where required for the provision of education and care, for child protection or where required by law. This may include:

• Services Australia — for processing Child Care Subsidy

• The regulatory authority — as required under the National Law and Regulations

• Government child safety agencies — where required for child protection

• Medical professionals — where necessary for a child's medical treatment

• A parent or guardian — in relation to their own child

We do not share your personal information with any other third parties without your written consent.

Your rights

You have the right to:

• Know what personal information we hold about you and your child

• Request access to your records at any time (except where documents are protected by a court order)

• Request corrections to inaccurate or outdated information

• Ask why your information is collected, how it is stored and who has access to it

• Make a complaint if you believe your privacy has been breached

Data breaches

We are required to comply with the Notifiable Data Breaches (NDB) scheme under the Privacy Act. If a data breach occurs that is likely to result in serious harm, we will promptly notify affected individuals and the Office of the Australian Information Commissioner (OAIC). Our response process follows four steps: Contain, Assess, Notify and Review.

Legislation and compliance

This policy is aligned with:

• Privacy Act 1988 (Cth) and the Australian Privacy Principles

• Education and Care Services National Law Act 2010

• Education and Care Services National Regulations (Regulations 168, 181, 183)

• National Quality Standards (QA6, QA7)

• Family Assistance Law — Child Care Subsidy provisions

• National Model Code for digital images of children