Privacy Policy

Part A — Privacy Policy

A.1 About this policy

This Privacy Policy explains how RFA collects, holds, uses and discloses Personal Information in connection with the Website and the Platform, in accordance with the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs). It applies to visitors to the Website, enquirers, Course purchasers and Organisational Purchasers.

A.2 Information we collect

We may collect the following categories of Personal Information:

  • Contact and account information — name, email address, phone number, billing address, and account credentials created on the Platform.

  • Payment information — processed by our payment processor, Stripe; we do not directly store full card details.

  • Enquiry information — details you provide through the Website's contact/enquiry form, including your role, organisation and any information you choose to share about your interest in a Course. Given the subject matter of the Courses, an enquiry may contain health-related information; if so, we handle it as sensitive information in accordance with this policy.

  • Course engagement information — progress through Course modules, completion status, and, where you choose to complete them, your responses to Reflection Exercises.

  • Course Assessment information — your responses to the pre-course and post-course quiz included in each Course, which ask about your knowledge of trauma-related content and your confidence applying particular skills.

  • Technical and usage information — IP address, device and browser type, pages visited and referral source, collected automatically via cookies and similar technologies, Google Analytics and Meta Pixel.

A.2.1 Sensitive information in Reflection Exercises

Reflection Exercises are provided as downloadable PDF worksheets. You complete these offline, on your own device — RFA does not receive, collect or store your responses, and cannot access them. If you choose to send a completed worksheet to us directly (for example, by email when requesting support), any sensitive information it contains will only be handled in accordance with this policy from the point we receive it.

A.2.2 Course Assessments (pre- and post-course quizzes)

Unlike Reflection Exercises, Course Assessment responses are submitted through the Platform and are stored by RFA. Because they touch on self-reported knowledge and confidence relating to trauma, they may include information that constitutes sensitive information under the Privacy Act. We use Course Assessment data primarily in de-identified or aggregate form to measure and improve our Courses, and to demonstrate course efficacy in sales pitches and proposals to prospective Organisational Purchasers. We do not use this data in public advertising or marketing to individuals. Where we wish to use an identifiable individual result, such as in a testimonial, we will seek your separate, explicit consent first.

A.3 How we use your information

We use Personal Information to:

  • provide, personalise and improve the Courses and Website;

  • process purchases and manage your Platform account;

  • respond to enquiries and provide customer support;

  • send transactional communications, such as purchase confirmations and access details;

  • with your consent, send marketing communications about new Courses or content;

  • measure and demonstrate the efficacy of our Courses using Course Assessment data, in de-identified or aggregate form, in sales pitches and proposals to prospective Organisational Purchasers (not in public advertising or marketing to individuals), unless you have provided your express consent to the use or disclosure of identifiable information;

  • run and measure the effectiveness of advertising via Google Analytics and Meta Pixel;

  • comply with our legal obligations, including under the Australian Consumer Law and tax law.

A.4 Payment processing — Stripe

Payments are processed by Stripe, Inc. Stripe collects and processes your payment information directly in accordance with its own privacy policy. RFA does not store your full card number, expiry date or CVV, and does not accept payment card details by email, phone, invoice or any other channel outside Stripe's checkout.

A.5 Analytics and advertising — Google Analytics and Meta Pixel

We use Google Analytics to understand how visitors use the Website, and Meta Pixel to measure and improve the effectiveness of our advertising on Facebook and Instagram. These tools use cookies and similar technologies and may collect information about your device, browsing behaviour and interactions with our advertising. Data collected through these tools is handled in accordance with the privacy policies of Google LLC and Meta Platforms, Inc. respectively.

You can limit this tracking through your browser or device settings, or by opting out directly through Google's Ads Settings or Meta's Ad Preferences. See also clause A.8 (Cookies).

A.6 Disclosure of information

We may disclose Personal Information to:

  • our service providers, including Kajabi, Stripe, Squarespace, and email/marketing platforms;

  • Google and Meta, for the analytics and advertising purposes described above;

  • professional advisers, such as accountants and lawyers, where necessary;

  • regulatory or law enforcement bodies where required by law;

  • an Organisational Purchaser, but only to the extent necessary to confirm licence usage, and not the content of an individual User's Reflection Exercise responses;

  • prospective Organisational Purchasers, in the form of aggregated and de-identified Course Assessment data that does not reasonably identify individual users, for the purpose of evaluating and demonstrating course effectiveness as part of a sales pitch or proposal.

We do not sell Personal Information to third parties.

A.7 Overseas disclosure

Some of our service providers, including Kajabi, Stripe, Google and Meta, store or process data on servers located outside Australia, including in the United States. Your Personal Information may be stored, processed or accessed outside of Australia by these third-party service providers. While we take reasonable steps to ensure those providers handle Personal Information appropriately, privacy protections in overseas jurisdictions may differ from those available under Australian law. By using the Website or Platform, you acknowledge that your Personal Information may be disclosed overseas.

A.8 Cookies

The Website and Platform use cookies and similar technologies to operate core functionality, remember preferences, and support the analytics and advertising described above. You can control or disable cookies through your browser settings; disabling cookies may affect the functionality of the Website or Platform. Some cookies and similar technologies are provided by third-party services, including Google Analytics and Meta Pixel, for analytics and advertising purposes.

Our solicitors have advised that a cookie banner is not currently a strict legal requirement in Australia, but recommend having one as good practice.

A.9 Data storage and security

We take reasonable steps to protect Personal Information from misuse, interference, loss and unauthorised access, modification or disclosure, including administrative, technical and organisational safeguards together with the security measures implemented by Kajabi, Squarespace and Stripe. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

A.10 Retention

We retain Personal Information for as long as reasonably necessary to fulfil the purposes described in this policy, including ongoing access to purchased Courses given the lifetime-access model, and to comply with our legal, accounting and reporting obligations.

A.11 Access and correction

You may request access to, or correction of, the Personal Information we hold about you by contacting us using the details in clause A.14. We will respond within a reasonable time and in accordance with the APPs. We may need to verify your identity before providing access.

A.12 Children's privacy

The Website and Courses are intended for adult first responders and are not directed at, or intended for use by, children. We do not knowingly collect Personal Information from anyone under 18. If you believe a child has provided us with Personal Information, please contact us so we can remove it.

A.13 Changes to this policy

We may update this Privacy Policy from time to time. The updated version will be posted on the Website with a revised "last updated" date. Continued use of the Website or Platform after an update constitutes acceptance of the revised policy.

A.14 Contact us and complaints

If you have a question, wish to exercise a privacy right, or wish to make a complaint about how we have handled your Personal Information, please contact us at hello@respondersfirstaustralia.com.au. We will investigate and aim to respond to complaints within 30 days. If you are not satisfied with our response, you may contact the Office of the Australian Information Commissioner (OAIC) at www.oaic.gov.au.