Privacy Policy
Sunshine Sports - Privacy Policy
Last updated: 28 September 2026
Sunshine Learning Hub Pty Ltd (ABN 97 689 012 575), trading as Sunshine Sports ("we", "us", "our") runs junior sports programs in Western Sydney. We take your family's privacy seriously and handle personal information in line with the Australian Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs). This policy explains what we collect, why, and your rights.
1. Who we are
Sunshine Learning Hub Pty Ltd, ABN 97 689 012 575, trading as Sunshine Sports, of Western Sydney, New South Wales. Contact: info@sunshinesports.au.
2. What we collect
- Parent/guardian details: name, email, phone, suburb/address. - Child details: name, date of birth and school year. We also ask for medical and allergy information, or confirmation that there are no known conditions or allergies, and emergency-contact details. These safety answers are required before you can add a child to the portal. - Enrolment and attendance history. - Payment records. Card numbers are entered directly with our payment processor (Stripe) and are never stored on our systems. - Communications you send us (messages, enquiries, feedback). - Basic technical data needed to run the portal (see our Cookie Notice).
3. Why we collect it
- To enrol children and run our programs safely (including responding to medical/emergency situations). - To take payment and keep financial records. - To contact you about sessions, cancellations, reminders and account matters. - With your consent, to send you news and marketing. You can opt out at any time. - To meet our legal obligations (e.g. child-safety and tax record-keeping).
4. Consent for children's information
Because our participants are children, a parent or guardian provides their information and consents on their behalf. We sometimes photograph sessions for team photos, our website and our social media, as our enrolment terms explain. If you would rather we did not photograph your child, tell us at any time, on your child's page in the portal or by contacting us.
5. Who we share it with
We do not sell your personal information. We share it only with service providers who help us run the business, under contract and only as needed: - Stripe (payments), our email and SMS providers (notifications), our hosting provider, our encrypted off-site backup storage, and accounting software (invoicing). - Google, if you choose to sign in with Google. Google confirms who you are and gives us your name and email address; we do not receive your Google password. - Google Fonts, which serves the typeface our pages are set in. It receives your IP address when your browser requests the font, and nothing else about you or your family. - Coaches, limited to the roster and safety information for the sessions they run. - Authorities where we are required to by law or to protect a child's safety.
6. Storage, security & overseas transfer
Information is stored in secured, access-controlled systems. Authorised office staff can access household information needed to administer our programs. Financial access is restricted by staff roles and permissions. Coaches are limited to roster, attendance and safety information for their assigned programs. Our payment processor, Stripe, processes payment information in the United States. Other providers, including our email delivery provider and our encrypted off-site backup storage, may also process or store data outside Australia, including in the United States; where they do, we take reasonable steps to ensure comparable protection, as the Australian Privacy Principles require.
7. How long we keep it
We keep each kind of information only as long as we actually need it, and no longer. These are the periods we work to:
- Enrolment, attendance and account records: 7 years after your last enrolment ends. The ATO requires business records to be kept for at least 5 years. We hold them for 7, which is our choice rather than the tax office's requirement, so that a record still exists for the ordinary limitation period on a contract dispute. - Payment and financial records (amounts, dates, invoice numbers): 7 years from the date of the transaction, as required for tax and accounting. Your name is removed from these if you ask us to delete your information, but the financial record itself must stay. - Medical conditions, allergies and emergency contacts: deleted 12 months after your child's last session (including any make-up session), or 12 months after you last updated your child's details if that is later. We keep them for that year in case your child returns the following term and so that we can respond to any question about an incident; after that they serve no purpose and they go. - Messages and enquiries: 2 years from the last message in the conversation. - Enquiries from families who never enrolled: 2 years from your last contact with us, then deleted. - Photographs and video: kept while in use, and removed from anywhere we control within 30 days of you telling us you no longer want your child photographed. Material already published by a third party (for example, shared onward from social media) is outside our control, so please tell us as early as you can. - Records relating to a child-safety incident, allegation or complaint: 45 years. This follows the recommendation of the Royal Commission into Institutional Responses to Child Sexual Abuse, which exists so that a person who was a child at the time can still obtain the record as an adult. This period applies even if you ask us to delete everything else. - Portal server and access logs: 90 days.
When a period ends, information is deleted or de-identified. Medical and emergency details are cleared automatically once a month for every child past their 12 months; other information is removed as part of a regular review rather than on the day itself. If you would like your family's information removed sooner, email info@sunshinesports.au and we will act on it.
8. Your rights (APPs)
You can ask to access or correct your information, opt out of marketing, or ask us to delete it. Email info@sunshinesports.au and we will respond within a reasonable time (usually 30 days).
When we delete a family's information we remove everything that identifies you or describes your child - names, contact details, dates of birth, allergies, medical notes, emergency contacts, messages and enrolment history. Two exceptions, both of them legal obligations rather than choices: financial records stay for 7 years with your details removed from them, and any record relating to a child-safety incident is retained for the period in section 7.
9. Data breaches
If personal information we hold is lost, or accessed or disclosed without authorisation, we assess it promptly, and within 30 days at the outside. Where we decide a breach is likely to result in serious harm, we notify you and the Office of the Australian Information Commissioner as soon as practicable after that, which is what the Notifiable Data Breaches scheme requires. We do not wait out the assessment period once we know. We hold a written breach response plan and follow it.
10. Complaints
If you're concerned about how we've handled your information, contact us first at info@sunshinesports.au. If unresolved, you can contact the Office of the Australian Information Commissioner (OAIC) at oaic.gov.au.
11. Overseas / EU visitors (GDPR)
If you are located in the EU/UK, the GDPR may also apply. In that case our lawful bases are: performance of a contract (enrolment), your consent (marketing), and our legitimate interests (running the business safely). You have additional rights to portability and erasure - contact info@sunshinesports.au.
12. Changes
We may update this policy; the "last updated" date shows the current version. Material changes will be notified through the portal or by email.