Privacy Policy
This policy applies to STEPS Group Australia Limited (ABN 77 168 213 648) and STEPS Social Business (ABN 19 635 822 338) (“STEPS”, “we”, “us” or the “Company”). STEPS is committed to privacy protection. At STEPS we understand the importance of keeping personal information private and secure. This privacy policy (“Privacy Policy”) describes generally how we manage personal information and safeguard privacy. If you would like more information, please contact us.
1. The Australian privacy principles
This privacy policy explains how STEPS collects, uses, stores and shares personal information. We will treat all personal information in accordance with any and all obligations that are binding upon us under the Privacy Act 1988 (Cth) (“Privacy Act”). The Privacy Act lays down 13 key principles in relation to the collection and treatment of personal information, which are called the “Australian Privacy Principles”.
2. Our promise to you
We respect your privacy. We try to collect only the information we need. We handle personal information under the Privacy Act and the Australian Privacy Principles. We want this policy to be easy to read and easy to find. If you need help to understand it, please contact us and we will help.
We do not sell your personal information. We will only use or share your information when we need to provide our services, run our organisation, meet legal or funding requirements or where the law otherwise allows it.
3. What “personal information” means
Personal information is information about you. It can identify who you are or make you reasonably identifiable. This can include your name, contact details, date of birth, service records, payment details, training records, employment information and other information you give us or we need to enable us to provide services to you.
Some personal information is sensitive information. This needs extra care. It can include health information, disability information, NDIS information, support plans, criminal history checks, training assessments and information about carers, guardians, nominees or support needs.
4. The kinds of information we collect
Depending on your relationship with STEPS, we may collect information such as:
- your name, address, phone number and email
- date of birth and identity details
- payment or billing information
- service, support, training or employment records
- donation records
- information about your goals, support needs, education or work history
- health, disability, NDIS, screening or safety information where needed
- information from our websites, such as IP address, browser details and cookies.
We only collect sensitive information when you agree, when the law allows or requires it or when we need it to provide our services safely and properly.
5. How we collect your information
We usually collect personal information directly from you. We may collect it through forms, phone calls, emails, meetings, service delivery records, websites, online forms, referrals, recruitment processes, enrolment processes, donation forms or other communications with you.
Sometimes we collect information from someone else such as a referrer, guardian, nominee, advocate, doctor, employer, education provider, regulator or government agency. If we collect information this way, we will take reasonable steps to make sure you know about it, unless the law says otherwise.
6. Why we collect, hold and use your information
We collect, hold and use personal information so we can:
- provide disability, NDIS and community services
- provide training and education services
- support employment, recruitment and work opportunities
- process donations, invoices, refunds and payments
- communicate with you about services, supports or opportunities
- improve our services and systems
- protect health, safety and wellbeing
- meet legal, regulatory, funding, audit and reporting requirements.
We only use personal information for the reason it was collected, for a related reason you would expect, with your consent, or where the law otherwise allows or requires it.
7. When we share your information
We may share your personal information with:
- your authorised representative, guardian, nominee, carer or advocate
- service providers who help us run our systems or services
- government departments, funding bodies and regulators
- health professionals or partners involved in your care or support
- employers, work placement providers or referees where relevant
- our professional advisers, such as auditors or lawyers
- police, emergency services or other authorities where required by law or where needed to prevent serious harm.
This may include agencies such as the NDIS Quality and Safeguards Commission, the National Disability Insurance Agency (NDIA), the Australian Skills Quality Authority (ASQA) and other funding or regulatory bodies where required or authorised by law, contract or consent.
8. Overseas disclosure
Some of our technology or cloud service providers may store, back up or access information outside Australia. If this happens, we take reasonable steps to protect your information and to make sure overseas recipients handle it properly. In some cases, we remain accountable for how that information is handled overseas.
If you would like more information about overseas storage or access arrangements, you can contact us and ask.
9. Websites, cookies and online use
When you use our website or online services, we may collect technical information such as your IP address, browser type, device information and cookie information. We use this to keep our systems secure, improve our websites and services and understand how people use them.
You can usually change your browser settings to manage cookies. If you turn cookies off, some online features may not work properly.
10. Direct marketing
We may send you newsletters, updates, service information or information about STEPS programs and opportunities. You can tell us at any time if you do not want to receive this information and you can unsubscribe from marketing communications at any time.
11. How we protect your information
We store personal information in secure electronic systems and, sometimes, in paper files. We use passwords, access controls, monitoring, firewalls and other security measures. Only authorised workers can access the information they need for their role.
We also expect workers, volunteers and contractors to handle personal information carefully, including by limiting access, checking recipient details and following information security procedures.
12. Data breaches
A data breach happens when personal information is lost, accessed without permission or shared without permission. If a data breach is likely to result in serious harm, we will follow the law. This includes notifying affected individuals and the Office of the Australian Information Commissioner (OAIC) when required.
13. How long we keep your information
We keep records for as long as we need them to provide services and to meet legal, funding, taxation, regulatory, audit and recordkeeping requirements. When we no longer need the information, we will securely destroy it or de-identify it where appropriate.
14. Can you deal with us anonymously or with a different name?
In some situations, you can ask to deal with us anonymously or by using a pseudonym. This is not always possible. For example, we may need your real identity to provide funded services, meet legal requirements, verify eligibility, protect safety, or manage training, employment or billing records properly.
15. Accessing and correcting your information
You can ask for access to the personal information we hold about you. You can also ask us to correct information that is wrong, incomplete, out of date or misleading. We may ask you to confirm your identity before we release information to you.
Sometimes the law allows us to refuse access. If that happens, we will tell you why unless the law prevents us from doing so.
16. Privacy complaints
If you are worried about your privacy, please contact us. You can raise a privacy concern by email, phone, letter, website or through a worker, representative or advocate. If you need support, you can use an advocate, support person, nominee or interpreter where needed.
We aim to acknowledge written complaints quickly — usually within 24 hours — and we aim to resolve complaints within 10 business days where possible. If a matter takes longer, we will keep you informed.
If you are not happy with our response, you can complain to the Office of the Australian Information Commissioner (OAIC).
17. Contact us
Privacy Officer
Email: cso@stepsgroup.com.au
Phone: (07) 5458 3000
Post: PO Box 1139, Caloundra QLD 4558
Website: www.stepsgroup.com.au
18. Changes to this policy
We may update this Privacy Policy from time to time. The latest version will be available free of charge on our website and can be provided in another form on request.
This Policy was ratified by the Board on 30 July 2026.
Legal
Can’t find the information youre looking for? Contact STEPS Group Australia via phone or email today.