Privacy Policy

Incorporating amendments to comply with the Privacy Act (1988) and relevant amendments.

Part 1 – Personal Information Handling Practices explains our general information handling practices across Sydney Missionary & Bible College (“SMBC” or “the College”) including The Bridge gap year program. We have included information about how we collect, use, disclose and store your personal information, in accordance with the legal requirements.

Part 2 – Files explains our personal information and physical file handling practices.

Part 3 – Online explains our personal information handling practices when you visit our websites.

How to contact us:

For further information about this policy please contact us as follows:

Call: +61 2 9747 4780
Email: SMBC Administrative Staff: admin@smbc.edu.au
Chief Operating Officer: coo@smbc.edu.au
Address: PO Box 83
CROYDON NSW 2132

 

Part 1 – Our Personal Information Handling Practices

This privacy policy sets out how we take steps to comply with our obligations under the Privacy Act 1988 (Privacy Act) as amended from time to time, and the Australian Privacy Principles contained in the Privacy Act. The policy is regularly reviewed to provide for new and revised legislation, changes in technology, and changes in systems, procedures and processes within SMBC driven by changes in the environment in which SMBC operates. SMBC is committed to ensuring personal information is managed in an open and transparent way in accordance with the Australian Privacy Principles. SMBC will take reasonable steps in the circumstances to implement practices, procedures and systems relating to our activities that comply with the Australian Privacy Principles.

A copy of this policy is available on our website here or is available upon reasonable request in an alternative form.

A. Collecting Information

SMBC collects personal information, possibly including sensitive information, from the following groups of people who interact with SMBC in different ways:

  • Students (at all stages of enrolment, including after they graduate)
  • People attending internal SMBC conferences, functions and events
  • Donors, supporters and customers who purchase goods and/or services from the College
  • Job applicants, current employees, contractors, suppliers and volunteers, in the course of their employment or engagement with the College.

Personal information means information or an opinion about an identified individual, or an individual who is reasonably identifiable. SMBC’s primary purpose for collecting personal information is to enable the provision of education, activities and support to students, and provide other services to our students and alumni.

EXCEPTION: Under the Privacy Act and the Health Records and Information Privacy Act 2002 (NSW) (HRIP), the Australian Privacy Principles and the Health Privacy Principles do not apply to an employee’s record. Therefore, this policy does not apply to SMBC’s treatment of an employee record, where it relates to a current or former employment relationship between SMBC and an employee.

Some of the information we collect is to satisfy SMBC’s legal obligations, particularly to enable the College to discharge its duty of care. In the event of a pandemic (or other illness, injury or misadventure), SMBC may collect personal health information from visitors to its campuses, including in accordance with public health orders. Health information is sensitive information in accordance with Privacy Principles under the Privacy Act.

Sensitive information also includes information about racial or ethnic origin, religion or ideology, political affiliation and criminal records. Sensitive information is usually collected with consent (which may be express or implied), except for in an emergency health situation.

Certain laws governing or relating to the operation of SMBC require that certain personal information is collected, used and disclosed. These may include public health laws from time to time.

Personal information (including in some cases, sensitive information) may be collected by SMBC by way of telephone calls, emails, letters, hard copy forms, advertising requests, online forms, third party booking facilities and software applications (such as Humanitix), surveillance activities (including through CCTV), purchase orders, face to face meetings, and interviews. SMBC may also use AI technologies such as chatbots to gather personal information or other student data via our websites. SMBC collects personal information directly when it is reasonable and practical to do so.

Please also note:
We may ask potential or current students, and potential or current employees, to provide medical reports, allergy information and/or dietary requirements about themselves from time to time. Where SMBC collects health information to provide a health service to students, it will also be bound by the Health Privacy Principles which are contained in the HRIP Act.

If you provide SMBC with the personal information of others, such as doctors or emergency contacts, we encourage you to inform them that you are disclosing information to SMBC and why, that they can access that information if they wish and that SMBC does not disclose the information to third parties, other than when permitted to do so in accordance with the Australian Privacy Principles and/or Health Privacy Principles (such as in an emergency health situation).

If we do not obtain the information referred to above, we may not be able to enrol or continue with your enrolment, staff position or other engagement with SMBC.

SMBC generally collects the following kinds of personal information:
Names, postal and email addresses, phone numbers, nationality, racial or ethnic origin, religion or ideology, location, languages, date of birth, gender, marital status, education and training, details about next of kin, occupation and employment history, attendance and history of involvement in SMBC activities, financial details (bank and credit card numbers), donor history, medical reports and support services, accommodation history, photographic images, videoclips and sound recordings. SMBC may also collect records linked to a third party (e.g. Child Protection & WWCC, Police & Criminal records).

SMBC will not collect personal information unless the information is reasonably necessary for one or more of its activities or functions, and will use and disclose information for the purpose it was collected (unless an exception applies).

B. Holding and Use of Information

Information collected is stored in a variety of ways. Sensitive credit card or bank account information required for the completion of purchase transactions is not held by SMBC but passes directly through payment gateways to our bank (Westpac) to enable the purchase transaction to be processed. SMBC may use AI or other computer programs in the decision-making processes regarding student engagement with SMBC. Other student, employee, and third-party information is held in our electronic databases which are hosted on our secure servers, or if physical records are held, within our locked cabinets and/or locked premises.

Please Note:
SMBC uses various third-party services for event booking, financial operations, relationship management, communication, and academic integrity. By interacting with SMBC in specific roles or contexts and using these online platforms, you are deemed to have read and consented to the respective service’s privacy policy. These platforms include (but are not limited to):

SMBC collects, uses and discloses student information for purposes such as communication, enrolment assessment, academic reporting, and the provision of services to students and alumni. Some of this personal information may occasionally be published in SMBC materials or online platforms, including academic achievements and photos, if individuals have consented via the opt-in checkbox to their photos being used in promotional material. Otherwise, personal data is generally used internally and only disclosed to third parties when legally required or permitted, such as when consent is given, or when it may be reasonably expected by the individual. Overseas disclosures (other than to ‘cloud’ service providers) are rare and typically relate to references or health needs. SMBC may also use personal information for fundraising and marketing purposes, without sharing it externally unless required or authorised by law or to resolve donation issues.

Additionally, SMBC may collect or share information with third parties for enrolment, accommodation, employment references, working with children checks, event participation, and financial transactions. If accounts remain unpaid, information may be shared with legal or collection services. Student, staff, and faculty photos may also be used in directories or in social media posts if they have opted in to allow SMBC to use those photos in promoting the College.

Disclosure of information overseas
SMBC employs a cloud-based database and other data management systems, where personal and sensitive information is generally held in Japan and the United States of America. SMBC takes all reasonable steps to ensure that third parties comply with the Australian Privacy Principles or substantially similar laws, and that the privacy of individuals is protected by overseas providers in a way that is, overall, substantially similar to Australia.

Recording Online “Meetings”
Zoom (and other AVL platforms) has a function for recording online meetings held on their platform. Meeting hosts are responsible for obtaining consent from those attending the meetings. Recordings will be stored on servers at SMBC and/or the host’s computer. Most class and event recordings are also stored in the cloud (Zoom Cloud and Vimeo).

If you don’t want to be recorded, then it is your responsibility to inform the meeting host/lecturer for the meeting/lecture class well before the activity commences. If you do not notify the meeting host that you do not consent to be recorded and remain in the online meeting, this will be taken as consent to the recording.

C. Access and Correction of Information

Individuals can request access to their personal data by contacting SMBC’s Chief Operating Officer. Students may also review and update their contact details via the student portal. SMBC supports your right to access and correct your personal data under the Privacy Act.

Access may be denied where an exception under the Privacy Act applies, such as where it:

  • risks safety or public health
  • impacts privacy of others
  • is frivolous or vexatious
  • is an unlawful disclosure, relates to legal proceedings or is restricted by a court/tribunal
  • is commercially sensitive or relates to ongoing negotiations
  • relates to unlawful activity or misconduct, and giving access would prejudice the taking of appropriate action or enforcement related activities.

SMBC Commitments:

  • Respond within a reasonable period to requests
  • Provide access in the requested format, if practical
  • If access is fully or partly denied, offer alternative ways (like an intermediary or by redaction)

Charges and other access arrangements:
Requesting access is free, but a reasonable fee may apply for actual access provision. SMBC may require verification of identity and specific details about what information is required.

Refusals:
If access is denied in full or in part, SMBC will provide written reasons (unless it is unreasonable to do so), explain complaint mechanisms, and outline any relevant regulations. You can also make a complaint about how SMBC has handled personal information or responded to an access request by contacting SMBC’s Chief Operating Officer. If an individual is not satisfied with SMBC’s response to a complaint, they may seek redress through OAIC or the Courts (as applicable), including for a serious invasion of privacy (other than where this is outweighed by a countervailing public interest).

Part 2 – Files

Student Files

Purpose
Student files (both electronic and physical) are maintained to support SMBC’s educational and administrative functions. These files store information such as application details, enrolment records, academic progress, graduation documentation, and correspondence with accrediting bodies. They also include data related to student services like accommodation, catering, financial transactions, emergency contacts, and guidance provided to both prospective and current students.

Collection
Information is generally collected directly from individuals, when this is reasonably practicable, and in a manner that is lawful and fair. Information may also be collected from an individual’s referees, or publicly available sources like websites and directories.

Use and Disclosure
Student files are used principally for managing student education, welfare, and for past students, alumni relations. Disclosure to third parties only occurs with consent, where reasonably expected, or when required or authorised by law.

Data Quality
SMBC updates records as needed or when notified by individuals. Manual updates are made if no self-service option is available.

Data Security
Files are stored securely—electronically with password protection or physically in locked areas. When no longer needed, personal data is securely destroyed. Access is limited to staff with a legitimate need, including senior leadership, faculty, student care, IT, and records staff.

Contact Lists

Purpose
Contact lists include individuals, churches, organisations, and suppliers. They are used to share information about SMBC’s activities and manage stakeholder relationships.

Collection
We collect information for contact lists directly, whenever it is reasonable and practical to do so.

Use and Disclosure
The contact lists are used only for stakeholder communication, including for marketing purposes. They are not shared externally without consent unless this is a legal requirement or authorised by law.

Data Quality
We regularly update and audit our contact lists. Individuals can request updates to their contact details to correct them, or removal from contact lists.

Data Security
The contact lists are stored securely in password-protected systems. Access is limited to database administrators and relevant staff on a need-to-know basis.

Administrative Files

Purpose
Personnel and applicant files are kept for employment and business purposes. These include employment applications, contracts, salary and tax details, qualifications, health information, and professional development records. Applicant files help assess future employment suitability.

Collection
Collected directly from employees and applicants, or from third parties like recruitment agents and public sources.

Use and Disclosure
Used only for employment-related purposes. Disclosure occurs only with consent, where reasonably expected, or if legally required or authorised.

Data Quality
Information is updated as needed or when individuals notify SMBC of changes.

Data Security
Files are stored securely—electronically with passwords or physically in locked cabinets. Payroll data may also be stored in Xero (see Xero’s Privacy Policy). Applicant files are retained for seven years before being securely destroyed. Access is restricted to relevant administrative and finance staff.

Part 3 – Online

Collection
SMBC routinely collects information from visitors to its online platforms, including IP addresses, visit duration, pages accessed, and browser type, primarily for statistical and service improvement purposes. This data is collected using tools like Google Analytics, and individuals are generally not identifiable from this data. Users can opt out of tracking via browser settings or add-ons. When users create accounts or make transactions you will be identifiable, and SMBC collects names, emails, hashed passwords, and any additional contact or personal information provided. Sensitive payment details are not stored by SMBC.

Third-Party Platforms
Some services (e.g. library tools, social media, payment gateways) are hosted by third parties. Users should review those platforms’ privacy policies before engaging with them, as SMBC cannot control how those platforms handle data.

Cookies
Most SMBC platforms use cookies and sessions. A “cookie” is a small file stored on your computer’s browser, which assists in managing customised settings of the website and delivering content. Disabling cookies may limit access to some features but won’t affect core functionality.

Use and Disclosure
Personal information collected online is not shared without consent unless expected or legally required.

Data Quality
Users can request corrections or deletions of their data. Email subscribers can opt out via unsubscribe links.

Data Security
SMBC uses HTTPS encryption and implements strong server security measures, including physical protections, password security, and monitoring. However, there are inherent risks in internet data transmission, and SMBC cannot guarantee the security of data on third-party platforms.

 

Version: 2.0

Effective 24 September 2026

Results (0)