Privacy ›
A short, honest privacy notice.
What we collect, what we don’t, and what we do with it. Plain language first; the legal sections follow.
In one paragraph
We collect almost nothing.
If you fill in the contact form, we keep your email and your message until we’ve replied, then we archive them. If you become a member, we keep your name, email, and tier for as long as you’re a member, plus seven years for tax. If you donate, the same. We don’t run third-party tracking, advertising pixels, or behavioural analytics. We don’t sell anything to anyone. There’s no clever clause hiding under the next heading.
Last reviewed: May 2026. The OAIC privacy guide is the legal backbone.
-
What we collect.
From visitors: nothing automatic except standard server logs (IP, user-agent, the URL you requested) which our host rotates after fourteen days. From members and donors: name, email, address (donors only), and what you bought or gave. From contact-form senders: name, email, message, and which intent you picked.
-
What we don't collect.
We don’t run Google Analytics, Meta pixels, X tracking, TikTok pixels, or any other third-party behavioural script. We don’t fingerprint browsers. We don’t track scroll depth, dwell time, mouse movements, or page-to-page flow. We don’t share visitor IPs with third parties.
-
How long we keep things.
Server logs: fourteen days, rotated automatically. Contact-form messages: until we’ve replied, then archived in mailbox folders that auto-purge after twelve months. Member and donor records: while you’re active, plus seven years for tax (Australian Charities and Not-for-profits Commission requirement). Newsletter subscribers: until you unsubscribe — every newsletter has a one-click unsubscribe.
-
Who handles your data on our behalf.
A small set of trusted services: Brevo (Sendinblue SAS, France) for newsletter and transactional email — receives your email address, name, and the email content. Stripe Payments Australia Pty Ltd for membership and donation payments — receives your name, email, postcode, and tokenised card. Square AU Pty Ltd for shop checkout — receives your name, email, shipping address (if you order something posted), and tokenised card. Each is a separate entity with its own privacy policy.
-
Your rights and complaints.
You can ask us what we hold about you, ask us to correct it, or ask us to delete it. Email privacy@yarravalleywaterwheel.org and we will reply within a reasonable time. Members can self-edit most fields from the dashboard. If you are not happy with how we have handled a privacy matter, write to us first; if we cannot resolve it together, the Office of the Australian Information Commissioner (OAIC) takes complaints at oaic.gov.au.
Address
3409 Warburton Hwy
Warburton VIC 3799
Front desk
03 5966 ____
During open hours · voicemail otherwise