Privacy Policy

Evoke Performing Arts Academy (ABN 55 936 767 411) has prepared this Privacy Policy to explain how we treat your personal information. We are committed to handling your family's information, and especially your child's, with care, and to meeting our obligations under the Australian Privacy Act 1988 and the Australian Privacy Principles.

Personal information means any information that may be used to identify an individual, including but not limited to a first and family name, a home or other physical address, an email address or other contact information, whether at work or at home.

If you choose to provide us with your personal information, we may use it to deliver our classes and services, and we may share limited information with the service providers described below.

The information we collect

We collect only what we need to run our classes safely and to manage your enrolment:

• parent or guardian name, email, mobile and relationship to the student
• student name, date of birth, pronouns (optional), school year and performing experience
• emergency contact details
• health, allergy and support-needs information (see below)
• enrolment, attendance, invoice and payment records
• how you heard about us, and your marketing preferences
• messages and enquiries you send us, including through the parent portal

We generally collect this information directly from you, through enrolment forms, trial registrations, the parent portal, email communications and other interactions with us. When you contact us through the portal, we keep your messages so we can respond and maintain a record of our communication with you.

How we use photographs and videos of your child is covered separately in our Image Consent and Release. Choosing "No Consent" there affects promotional use only; it does not affect your child's participation in classes, rehearsals or performances.

Your choice

You may choose whether or not to provide personal information to Evoke Performing Arts Academy. If you choose to have a relationship with us, such as enrolling your child, we will continue to contact you in connection with that enrolment. You may opt out of marketing emails at any time by using the unsubscribe link, or by emailing admin@evokeperformingarts.com.au with 'Unsubscribe' in the subject line. Opting out of marketing does not affect the essential emails we need to send you about your child's classes, invoices or safety. If you choose not to provide information that is required for safety or enrolment purposes, we may be unable to enrol your child or safely provide our services.

Health and medical information

Health, allergy and support-needs information is sensitive information, and we treat it with extra care. We collect it only so we can keep your child safe and support them in class (our duty of care). We use structured questions (for example yes or no, and short lists) so you do not need to share more than is necessary.

• We collect and store this information with your express consent, which you give by ticking the health consent option when you provide the details. We also rely on our duty of care and our legal obligations as a basis for handling it. You can withdraw consent at any time, although this may affect whether we can safely have your child in class, and some records (such as incident or injury records) may be kept as required even if consent is later withdrawn.
• Only teaching staff see medical and support notes, and only when they need them. Access to these notes is logged.
• Your child's health and medical information is stored in Australia (in our database, hosted in Sydney). We do not disclose it to our invoicing, email or payment providers, and we only disclose it where reasonably necessary for safety, legal compliance, or as otherwise authorised by you.
• In a genuine emergency, we may share relevant health information with medical or emergency personnel to prevent serious harm to the life, health, or safety of the student or another individual, in accordance with our duty of care and the permitted general situations under the Privacy Act.

We will ask you to re-confirm your consent to hold your child's health information from time to time (for example each term or year), so it stays current.

Parents and guardians are responsible for ensuring that the information they provide, including emergency contacts, health information and medical management plans, remains accurate and up to date.

Security of your information

Wherever your personal information is held by us or on our behalf, we take reasonable steps to protect it from unauthorised access, loss or disclosure. These include encryption in transit and at rest, access controls so each person sees only what their role allows, and two-factor sign-in for staff.

How long we keep your information

We keep personal information only for as long as we need it, then securely destroy or de-identify it:

• General enrolment and contact records: 7 years after your family's last active enrolment.
• Financial records (invoices and payments): 7 years.
• Children's health, allergy and incident or injury records: until the child turns 25, or 7 years after their last enrolment, whichever is later, or for such longer period as may be required to defend or manage potential legal claims under Western Australian limitation laws.
• Inactive trial records (where a trial did not lead to enrolment): 12 months.

Inactive or archived data is securely isolated, and once any statutory retention period expires, it is permanently destroyed by secure deletion or completely de-identified so that it can no longer be linked to any individual.

Your portal account (your login) is separate from your records. We archive your account once your family is inactive and you have told us your child is not returning, and we remove the login after a further 12 months. Your information is still kept for the retention periods above regardless of the account, and then securely destroyed.

Access and accuracy

You can view and update much of your information yourself in the parent portal. If you wish to review, access or correct any information you cannot change in the portal, email us at admin@evokeperformingarts.com.au and we will respond within a reasonable period, generally within 30 days.

Third-party services and overseas service providers

We use a small number of trusted service providers to deliver our services. We give each of them only the minimum information they need, and we take reasonable steps to ensure they protect it.

• Our database and file storage (all family, student and health information) is hosted in Australia, in Sydney.
• Our invoicing (names, amounts and email addresses only) is processed by Zoho Books on its Australian data centre.
• Payments are processed securely by Stripe. No card details are entered into or stored by our system. Stripe processes payment information in the United States and India.
• Our email and class mailing lists (parent names and email addresses only) are run through Brevo, which processes data in the European Union.
• Our enrolment, trial and contact forms are protected from spam and automated abuse by Cloudflare Turnstile. To tell a genuine visitor apart from a bot, it checks limited technical information about your device and browser. It is built to be privacy-friendly: it does not track you across other websites and is not used for advertising. Cloudflare may process this information on servers located overseas, including in the United States.

This means some limited, non-health personal information (names and email addresses for email, and payment information for payments), along with limited technical information used to keep our forms free of spam, may be processed overseas. Your child's health and medical information is stored in Australia and is not intentionally disclosed to our overseas service providers. By providing your information and using our portal, you acknowledge and agree to this cross-border transfer. While we take reasonable steps to select reputable providers and require appropriate privacy protections, we cannot directly control the acts or omissions of independent third-party service providers.

When we may disclose your information

We may disclose personal information where reasonably necessary, including where required or authorised by law, a court order, or a government authority; to our insurer or legal adviser; to medical or emergency personnel to protect the safety of a person; or where you have authorised the disclosure.

Website analytics

To understand how people find and use our website, we run our own simple analytics. This is first-party, which means the information stays on our own server. We do not use tracking cookies, we do not store your IP address, and we do not sell your data. When you view a page we record a few basic, anonymous details: the page you visited, the website or search that sent you to us, and your device type and browser. To count visits without identifying anyone, we use a temporary daily tag that cannot be traced back to you and resets every day. These analytics are used only for aggregate website statistics and not to identify individual visitors. If you have any questions, email admin@evokeperformingarts.com.au.

Children's privacy

Our classes are for children aged 6 to 16, but our website, portal and forms are intended to be completed by a parent or guardian. We do not knowingly collect personal information directly from a child. If you believe a child has submitted their details to us without a parent's involvement, contact us at admin@evokeperformingarts.com.au and we will delete it. The personal and health information we do hold about a child is provided to us by their parent or guardian as part of enrolment.

If something goes wrong

If we suspect or become aware of a data breach involving personal or sensitive information, we will assess it promptly, within the 30-day statutory assessment window. Where the Notifiable Data Breaches scheme requires (because the breach is likely to result in serious harm), we will notify the Office of the Australian Information Commissioner and any affected families as soon as practicable, along with the steps they can take to reduce the risk.

Your consent

By using our website and portal, you consent to this Privacy Policy and to our handling of personal information for the purposes described above. If this policy changes, we will post the updated version here. Material changes to this Privacy Policy will be notified through the parent portal, by email, or on our website. Continued use of the site following any change means you accept the change.

Questions and complaints

If you have any questions about our privacy practices, or wish to make a complaint, contact us at admin@evokeperformingarts.com.au. We will acknowledge privacy complaints within 14 days and aim to resolve them within 30 days. If you are not satisfied with our response, you may contact the Office of the Australian Information Commissioner.

Evoke Performing Arts Academy. ABN 55 936 767 411. PO Box 572, Kwinana WA 6966. admin@evokeperformingarts.com.au