Data Handling
Sunshine Sports - Data Handling & Protection Statement
Last updated: 28 September 2026
This statement summarises, in plain terms, how Sunshine Learning Hub Pty Ltd (ABN 97 689 012 575), trading as Sunshine Sports handles the personal and children's data in the parent portal and CRM. It complements our Privacy Policy and is intended for parents, staff and partners who want the operational detail.
1. Data we hold
Family accounts, children's profiles (including date of birth and any medical/allergy notes), enrolments, attendance, messages, and payment records. Card data is handled by Stripe and never stored by us.
2. Lawful basis & minimisation
We collect only what we need to run programs safely and take payment. To add a child, you must provide emergency-contact details and answer the medical and allergy questions, including confirming when there are no known conditions or allergies. We use this information to keep your child safe.
3. Access control
- Authorised office staff can access household information needed to administer our programs. Financial information and administration tools are restricted by each staff member's role and permissions. Coaches are limited to roster, attendance and safety information for their assigned programs. - Admin access requires a username and password; sessions are token-based and expire. - Parents can only ever see their own household.
4. Storage & encryption
Data is held in an access-controlled database. Traffic is served over HTTPS in production. Secrets (API keys, database credentials) are kept in access-restricted server configuration, never in the code or the browser.
5. Processors we use
Stripe (payments), email/SMS notification providers, hosting provider, and accounting software (invoicing). Each is used under its terms and only for the stated purpose.
6. Retention & deletion
Each category of information has a stated retention period, set out in section 7 of our Privacy Policy. In summary: enrolment and financial records 7 years, medical and emergency details 12 months after a child's last session or the last update to them (whichever is later), messages 2 years, server logs 90 days, and records relating to a child-safety incident 45 years. Families can request access, correction or deletion by emailing info@sunshinesports.au.
7. Breach response
We maintain a written data breach response plan. If a breach occurs, the owner contains it first, then assesses it within 30 days, and where serious harm is likely notifies affected families and the OAIC as soon as practicable, as the Notifiable Data Breaches scheme requires.
8. Child safety
Children's data is treated as sensitive information. A family's choice about photographs is recorded per child; tell us at any time if you do not want your child photographed.
Contact for any data question: info@sunshinesports.au.