PRIVACY POLICY
1. We respect your privacy
1.1. Sunny Steps ABN 77 612 988 234 (hereafter referred to as “us”, “we”, “our”) respects your right to privacy and is committed to safeguarding the privacy of our customers and website visitors. This policy sets out how we collect and treat your personal information.
1.2. We adhere to the Australian Privacy Principles contained in the Privacy Act 1988 (Cth) and, to the extent applicable, the EU General Data Protection Regulation (GDPR).
1.3. “Personal information” is information we hold which is identifiable as being about you. This includes information such as your name, email address, identification number, or any other type of information that can reasonably identify an individual, either directly or indirectly.
1.4. You may contact us in writing at admin@sunnysteps.com.au for further information about this Privacy Policy.
2. What personal information is collected
2.1. We will, from time to time, receive and store personal information you submit to our website, provided to us directly or given to us in other forms.
2.2. You may provide basic information such as your name, phone number, address and email address to enable us to send you information, provide updates and process your product or service order.
2.3. We may collect additional information at other times, including but not limited to, when you provide feedback, when you provide information about your personal or business affairs, change your content or email preference, respond to surveys and/or promotions, provide financial or credit card information, or communicate with our customer support.
2.4. Additionally, we may also collect any other information you provide while interacting with us.
3. How we collect your personal information
3.1. We collect personal information from you in a variety of ways, including when you interact with us electronically or in person, when you access our website and when we engage in business activities with you. We may receive personal information from third parties. If we do, we will protect it as set out in this Privacy Policy.
3.2. By providing us with personal information, you consent to the supply of that information subject to the terms of this Privacy Policy.
4. How we use your personal information
4.1. We may use personal information collected from you to provide you with information about our products or services. We may also make you aware of new and additional products, services and opportunities available to you.
4.2. We will use personal information only for the purposes that you consent to. This may include to:
(a) provide you with products and services during the usual course of our business activities;
(b) administer our business activities;
(c) manage, research and develop our products and services;
(d) provide you with information about our products and services;
(e) communicate with you by a variety of measures including, but not limited to, by telephone, email, sms or mail; and
(f) investigate any complaints.
If you withhold your personal information, it may not be possible for us to provide you with our products and services or for you to fully access our website.
4.3. We may disclose your personal information to comply with a legal requirement, such as a law, regulation, court order, subpoena, warrant, legal proceedings or in response to a law enforcement agency request.
4.4. If there is a change of control in our business or a sale or transfer of business assets, we reserve the right to transfer to the extent permissible at law our user databases, together with any personal information and non-personal information contained in those databases.
5. Sensitive information and information about children
5.1. Because we provide family-focused disability supports, much of the information we collect is sensitive information under the Privacy Act 1988 (Cth). This includes health information and information about a person’s disability, such as NDIS numbers and plans, functional capacity and assessment information, care needs summaries, and related service records.
5.2. We only collect sensitive information where you consent and it is reasonably necessary for our functions or activities, or where the collection is otherwise permitted or required by law. We take additional steps to protect sensitive information and only use or disclose it for the purpose for which it was collected, for a directly related purpose you would reasonably expect, or as otherwise permitted under the Australian Privacy Principles.
5.3. Because our supports are often provided to children and young people, we routinely collect and hold personal and sensitive information about them. This information is generally provided by a parent, guardian, or authorised representative who consents to its collection on the child’s behalf. Where appropriate, we also seek the child’s views and agreement in a way suited to their age and capacity.
5.4. We handle all information about children with particular care and collect only what is reasonably necessary to provide supports and to meet our obligations under the NDIS and applicable law.
6. Disclosure of your personal information
6.1. We may disclose your personal information to any of our employees, officers, insurers, professional advisers, agents, suppliers or subcontractors insofar as reasonably necessary for the purposes set out in this Privacy Policy.
6.2. If we do disclose your personal information to a third party, we will protect it in accordance with this Privacy Policy.
7. General Data Protection Regulation (GDPR) for the European Union (EU)
7.1. This section applies only to individuals located in the European Union or European Economic Area. It sits alongside the rest of this Privacy Policy, which applies to everyone. Where this section and the general policy differ for EU/EEA individuals, this section applies.
7.2. We will comply with the principles of data protection set out in the GDPR for the purpose of fairness, transparency and lawful data collection and use.
7.3. We process your personal information as a Processor and/or to the extent that we are a Controller as defined in the GDPR.
7.4. We must establish a lawful basis for processing your personal information. The legal basis on which we collect your personal information depends on the data we collect and how we use it.
7.5. We will only collect your personal information with your consent for a specific purpose, and any data collected will be to the extent necessary and not excessive for its purpose. We will keep your data safe and secure.
7.6. We will also process your personal information where it is necessary for our legitimate interests, or to fulfil a contractual or legal obligation.
7.7. We may process your personal information where it is necessary to protect your vital interests or in a medical situation, where it is necessary to carry out a public function or a task in the public interest, or where the function has a clear basis in law.
7.8. Where we process special categories of personal data (such as health or disability information) for EU/EEA individuals, we do so on a lawful basis permitted under the GDPR, which will generally be your explicit consent or another condition set out in the GDPR. Our general handling of sensitive information and information about children is set out earlier in this Policy under “Sensitive information and information about children”.
7.9. You must not provide us with your personal information if you are under the age of 16 without the consent of a parent or person who has parental authority for you.
8. Your rights under the GDPR
8.1. If you are an individual residing in the EU, you have certain rights as to how your personal information is obtained and used. We comply with your rights under the GDPR as to how your personal information is used and controlled if you are an individual residing in the EU.
8.2. Except as otherwise provided in the GDPR, you have the following rights:
(a) to be informed how your personal information is being used;
(b) access your personal information (we will provide you with a free copy of it);
(c) to correct your personal information if it is inaccurate or incomplete;
(d) to delete your personal information (also known as “the right to be forgotten”);
(e) to restrict processing of your personal information;
(f) to retain and reuse your personal information for your own purposes;
(g) to object to your personal information being used; and
(h) to object against automated decision making and profiling.
8.3. Please contact us at any time to exercise your rights under the GDPR at the contact details in this Privacy Policy.
8.4. We may ask you to verify your identity before acting on any of your requests.
9. Hosting and international data transfers
9.1. The primary hosting facilities for our website are located in Australia.
9.2. Some of the software and AI-enabled tools we use to deliver and coordinate your supports are operated by reputable providers who may store or process information outside Australia, including in countries such as the United States. This may occur, for example, when we use workspace, design, or AI-assisted tools as part of preparing and managing your supports.
9.3. We also engage team members who may access information from outside Australia in the course of providing or supporting our services.
9.4. Where information is stored, processed, or accessed outside Australia, we take reasonable steps to ensure it is handled consistently with this Privacy Policy and the Australian Privacy Principles, and we only use providers who apply appropriate security and data-protection safeguards.
10. Security of your personal information
10.1. We are committed to ensuring that the information you provide to us is secure. In order to prevent unauthorised access or disclosure, we have put in place suitable physical, electronic and managerial procedures to safeguard and secure information and protect it from misuse, interference, loss and unauthorised access, modification and disclosure.
10.2. Where we employ data processors to process personal information on our behalf, we only do so on the basis that such data processors comply with the requirements under the GDPR and have adequate technical measures in place to protect personal information against unauthorised use, loss and theft.
10.3. The transmission and exchange of information is carried out at your own risk. We cannot guarantee the security of any information that you transmit to us, or receive from us. Although we take measures to safeguard against unauthorised disclosures of information, we cannot assure you that personal information that we collect will not be disclosed in a manner that is inconsistent with this Privacy Policy.
11. Access to your personal information
11.1 You may request details of personal information that we hold about you in accordance with the provisions of the Privacy Act 1988 (Cth), and to the extent applicable the EU GDPR. If you would like a copy of the information which we hold about you or believe that any information we hold on you is inaccurate, out of date, incomplete, irrelevant or misleading, please email us at admin@sunnysteps.com.au.
11.2. We reserve the right to refuse to provide you with information that we hold about you, in certain circumstances set out in the Privacy Act or any other applicable law.
12. Complains about privacy
9.1. If you have any complaints about our privacy practices, please feel free to send in details of your complaints to admin@sunnysteps.com.au. We take complaints very seriously and will respond shortly after receiving written notice of your complaint.
13. Changes to Privacy Policy
13.1. Please be aware that we may change this Privacy Policy in the future. We may modify this Policy at any time, in our sole discretion, and all modifications will be effective immediately upon our posting of the modifications on our website or notice board. Please check back from time to time to review our Privacy Policy.
14. Website
14.1 Visiting our webstie
When you come to our website (www.sunnysteps.com.au), we may collect certain information such as browser type, operating system, and the website visited immediately before coming to our site. This information is used in an aggregated manner to analyse how people use our site, so that we can improve our service.
14.2 Cookies
We may from time to time use cookies on our website. Cookies are very small files which a website uses to identify you when you come back to the site and to store details about your use of the site. Cookies are not malicious programs that access or damage your computer. Most web browsers automatically accept cookies but you can choose to reject cookies by changing your browser settings. However, this may prevent you from taking full advantage of our website. Our website may from time to time use cookies to analyse website traffic and help us provide a better website visitor experience. In addition, cookies may be used to serve relevant ads to website visitors through third party services such as Google AdWords. These ads may appear on this website or other websites you visit.
14.3 Third Party Sites
Our site may from time to time have links to other websites not owned or controlled by us. These links are meant for your convenience only. Links to third party websites do not constitute sponsorship, endorsement or approval of these websites. Please be aware that we are not responsible for the privacy practices of other such websites. We encourage our users to be aware, when they leave our website, to read the privacy statements of each and every website that collects personally identifiable information.
CONTACT
For any questions or notices, please contact us at:
Sunny Steps Family Support Services [ABN 77 612 988 234]
Email: admin@sunnysteps.com.au
Last updated: August 2026