Castlemaine Art Museum (CAM, we, us, our) is committed to protecting the privacy of our visitors, members, donors, volunteers, customers and anyone else who interacts with us. This policy explains what personal information we collect, how we use and protect it, and the rights you have in relation to that information.
CAM handles personal information in accordance with the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs). Where state-based privacy obligations apply, we also comply with the Privacy and Data Protection Act 2014 (Vic).
1. What this policy covers
This policy applies to information collected through:
our website at castlemaineartmuseum.org.au and any subdomains;
our mailing list and newsletter sign-ups;
online and in-person donations;
membership applications, including Friends of CAM (FOCAM);
ticketing and event bookings;
our online shop and in-person retail at the museum;
volunteer applications and onboarding;
social media pages we operate; and
in-person interactions at the museum, including correspondence and phone calls.
2. The information we collect
The personal information we collect depends on how you interact with us. In broad terms, this may include:
identity and contact information — name, postal address, email address, phone number;
donation and payment information — donation history, gift aid / tax receipt details, and limited transaction information (we do not store full credit card numbers; payments are processed by third-party payment providers);
membership information — membership tier, renewal dates, communication preferences;
ticketing information — events booked, dietary or access requirements provided when booking;
shop information — orders placed, delivery address, returns and exchanges;
volunteer information — referee details, availability, skills and interests, and where required for child-related roles, Working with Children Check details;
communications — emails, letters and notes of conversations you have with our staff or volunteers;
technical information — IP address, browser type, device information, pages viewed, referring site and similar information, collected automatically when you visit our website (see section 6 on cookies and analytics);
images and recordings — photographs and video recordings taken at exhibitions, events and on the museum premises, in accordance with section 8 below.
We do not knowingly collect sensitive information (as defined in the Privacy Act) unless it is necessary for a specific purpose — for example, accessibility requirements provided when you book tickets, or Working with Children Check details for volunteers in child-related roles. Where we collect sensitive information, we do so only with your consent.
3. How we collect personal information
We collect personal information directly from you whenever possible — for example, when you fill in a form on our website, make a donation, buy a membership or ticket, place an order in our online shop, apply to volunteer, or write or speak to us. Some information is collected automatically when you use our website (see section 6).
Occasionally we may receive information about you from third parties — for example, from a person who refers you as a potential donor or volunteer, from a payment or ticketing provider, or from publicly available sources. Where this happens, we will let you know at the earliest reasonable opportunity.
4. How we use your personal information
We use personal information to:
process donations, memberships, ticket bookings and shop orders, and to issue receipts (including tax-deductible receipts);
manage our relationships with members, donors, supporters and volunteers, including stewardship communications;
send you newsletters, programs information, invitations and other marketing material where you have opted in to receive them;
process volunteer applications, references and onboarding;
respond to your enquiries and complaints;
improve our exhibitions, programs, website and services;
comply with our legal, accounting, regulatory and audit obligations; and
where lawful, conduct fundraising research and analysis to support our mission.
We will only use your personal information for purposes you would reasonably expect, or for purposes you have consented to. You can opt out of marketing communications at any time using the unsubscribe link in our emails or by contacting us at the address in section 11.
5. Disclosure to third parties
We do not sell, rent or trade personal information. We disclose personal information only where it is necessary to deliver our services, where you have consented, or where we are required or permitted by law. The categories of third parties we may share information with include:
service providers who help us operate the museum and the website — including our website host, email and CRM provider (Supporterhub), donation and payment processors, ticketing platform, online shop platform and IT support providers;
professional advisers, including auditors, accountants and lawyers;
government agencies and regulators where required by law (for example, the Australian Taxation Office in relation to deductible gift recipient receipting);
law enforcement agencies where lawfully required; and
other parties with your express consent.
Some of our service providers store information outside Australia. Where personal information is disclosed overseas, we take reasonable steps to ensure the recipient handles it in accordance with the Australian Privacy Principles.
6. Cookies, analytics and online tracking
Our website uses cookies and similar technologies to make the site work, to understand how it is used and to improve your experience.
We use the following tools:
Google Analytics — to collect aggregated, anonymised information about how visitors use our website (pages visited, time on site, referring source, device and browser type);
SupporterHub — to manage our mailing list and to record whether subscribers open our emails or click on links;
Meta (Facebook/Instagram) pixel — to measure the effectiveness of any social media campaigns we run and to show CAM content to relevant audiences on Meta platforms.
You can manage cookies through your browser settings, and you can opt out of Google Analytics by installing the Google Analytics opt-out browser add-on. Disabling cookies may affect how parts of the website work.
7. Children's privacy
We welcome children and families to the museum and offer programs designed for young people. Where we collect information about a child (for example, in relation to a school program or a children's workshop booking), we do so through a parent, guardian or teacher and only collect what is necessary for the activity. We do not knowingly direct marketing communications to children.
8. Photography and recording on site
Photography and video recording of exhibitions, openings, public programs and events is part of how we document and promote the museum. Where reasonably practicable, we will let you know when photography or recording is taking place and provide a way for you to be excluded from images.
If you appear in a photograph or recording taken at the museum and would prefer it not to be used in our promotional material, please contact us at the address in section 11 and we will take reasonable steps to remove or replace the image in our active materials.
9. Storage, security and retention
We take reasonable steps to protect personal information from loss, misuse, interference, unauthorised access, modification or disclosure. These steps include physical, electronic and administrative safeguards such as restricted access, secure storage and the use of reputable service providers.
We retain personal information only for as long as it is needed for the purposes described in this policy or as required by law (including donation and tax records, which are retained for the period required by the Australian Taxation Office). When personal information is no longer required, we take reasonable steps to securely destroy or de-identify it.
10. Accessing and correcting your information
You have the right to ask us what personal information we hold about you and to ask us to correct it if it is inaccurate, out of date, incomplete or misleading. To make a request, contact us using the details in section 11. We will respond within a reasonable time and there is generally no charge for making a request.
11. Contact and complaints
If you have any questions, concerns or complaints about how we handle your personal information — or if you would like to access, update or delete your information — please contact us:
info@castlemaineartmuseum.org.au
12. Changes to this policy
We may update this policy from time to time to reflect changes in our practices or in the law. The current version is always available on our website, and the date of the most recent update is shown at the top of this document.
