Privacy Policy

1. Who we are

Towershift ("we", "us", "our") is a volunteer management platform operated in Australia. We help organisations coordinate their volunteers for events and programmes.

2. What data we collect

We collect the following personal information when you use our service:

• Account data — name, email address, and password (hashed)
• Organisation membership data — phone number (optional), role within the organisation, and membership status
• Event participation data — event signups, slot assignments, attendance records, and duty swap requests
• Skills and qualifications — skill names, approval status, and uploaded proof documents
• Emergency contacts — name and phone number of contacts provided by volunteers to their organisation
• Communications — SMS messages, email notifications, and broadcast messages sent through the platform
• Technical data — IP address, browser type, and session cookies (used for authentication only)

The Service is not designed to collect or store health, medical, or other sensitive information as defined under the Privacy Act 1988. Organisations must not use the platform to collect such data.

3. How we use your data

We use your personal data to:

• Provide and maintain the volunteer management service
• Send event reminders and notifications you have opted into
• Allow organisation administrators to coordinate volunteers
• Generate attendance reports and analytics for your organisations
• Process payments for organisation subscriptions and SMS credits

4. Data sharing

Your data is shared only with the organisations you join. Organisation administrators can see your name, email, phone number, skills, and participation history within their organisation.

We use third-party service providers (sub-processors) for the purposes listed below. A full list with names, data processed, and locations is available at /dpa/sub-processors.

• Payment processing (billing data only)
• SMS delivery (phone numbers and message content)
• Transactional email delivery (email address and message content)
• Hosting infrastructure (all data, stored in Australia)
• Object storage for file uploads (uploaded files, stored in Australia)
• CAPTCHA verification (IP address and browser metadata during registration)

We do not sell your personal data to third parties. Our staff will not access volunteer data except to provide the Service, resolve technical issues, or comply with legal obligations.

Organisations determine what information they collect from volunteers through the platform. We do not control or monitor the scope of data an organisation requests from its volunteers.

5. Data retention

We retain your account data for as long as your account is active. Notifications and SMS message logs are automatically deleted after 90 days. Event participation data is retained for the lifetime of the organisation to support reporting and volunteer recognition.

6. Your rights

You have the right to:

• Access your data — use the data export feature at /account/export to download all your personal data
• Correct your data — update your profile from your account settings
• Delete your account — contact us and we will delete your account and associated data
• Withdraw consent — manage your notification preferences per organisation

7. Cookies

We use only essential session cookies required for authentication.

8. Security

We protect your data using industry-standard measures including encrypted connections, hashed passwords, and role-based access controls. All data is stored on servers located in Australia.

9. Data breach notification

In the event of a data breach that is likely to result in serious harm, we will notify affected individuals and the Office of the Australian Information Commissioner (OAIC) as soon as practicable, in accordance with the Notifiable Data Breaches scheme under the Privacy Act 1988.

10. Contact

For privacy inquiries, data access requests, or complaints, contact us at privacy@towershift.app.

If you are not satisfied with our response, you may lodge a complaint with the Office of the Australian Information Commissioner (OAIC) at www.oaic.gov.au.