Privacy Policy

Our Privacy Commitment

The Disability Services Exchange (DSX) is committed to protecting your privacy in accordance with the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs). This policy explains how we collect, use, disclose, and protect your personal information.

Effective Date: 30 October 2026 | Version: 2.3 | Review Cycle: Annual

Data Minimization

We only collect information necessary for service delivery, with explicit consent and clear purpose statements.

Secure Storage

Personal data is encrypted in transit. Our website, database and files are hosted in Sydney, Australia.

Transparency

Clear visibility into what data we collect, why we need it, and how it's used to improve services.

Your Control

Access, correct, or delete your information at any time through your account or by contacting us.

1. Information We Collect

Personal Information (APP 3: Collection)

Identity & Contact Information

Full name
Email address, phone number, postal address
Government identifiers (ABN, NDIS registration) for providers
Professional qualifications and certifications

Service-Related Information

NDIS participant or provider status
Service preferences and requirements
Support needs and accessibility requirements
Feedback and survey responses

Technical Information

IP address and device information
Browser type and operating system
Usage patterns and interaction data
Essential cookies and browser storage (see our Cookie Policy)

Sensitive Information (APP 3.3)

Health information (only with explicit consent for service matching)
Disability-related information (for appropriate support provision)
Cultural and linguistic background (for culturally appropriate services)

Note: Sensitive information is only collected with your explicit consent and where necessary for service provision.

2. How We Collect Information

Directly from you: Through forms, account registration, surveys, and communications
Automatically: Via essential cookies and the technical information your browser sends
From third parties: NDIS verification systems (with authorization)
Public sources: NDIS provider registers and professional directories

3. How We Use Your Information (APP 6)

Primary Purposes

Service Delivery: Connecting participants with appropriate providers
Account Management: Creating and maintaining your DSX account
Communication: Sending service updates, newsletters (with consent)
Quality Assurance: Monitoring and improving service quality
Compliance: Meeting NDIS Quality and Safeguards requirements
Safety: Protecting users and preventing fraud or abuse

DSX uses AI (Google Gemini) to answer questions in the Avatar chat, to help our team review provider profiles, to draft news and social media posts, and to rewrite pages in Easy Read.

Secondary Purposes (with consent)

Research and analytics (de-identified data)
Sector improvement initiatives
Marketing communications (opt-in only)
Testimonials and case studies (with explicit permission)

4. Information Sharing & Disclosure (APP 6 & 8)

We May Share Information With:

Service Providers: Amazon Web Services (website, database and file hosting in Sydney), Google (Gemini AI, Gmail for sending email, Google Maps) and Cloudflare (Turnstile spam protection). See section 9
NDIS Commission: For compliance and quality assurance
Law Enforcement: When legally required or to prevent serious harm
Professional Advisors: Lawyers, auditors (under confidentiality)
With Your Consent: Other parties you explicitly authorize

We Never:

Sell or rent your personal information
Use your data for purposes other than those disclosed
Allow unauthorized access to your information

5. Data Security & Retention (APP 11)

Security Measures

Encryption: TLS 1.2 or later in transit
Access Controls: Role-based permissions for staff accounts

Data Retention

Active Accounts: Retained while account is active
Inactive Accounts: Archived after 2 years, deleted after 7 years
Financial Records: 7 years (tax requirements)
NDIS Compliance: As per NDIS Commission requirements
Marketing Lists: Until consent withdrawn
Cookies: Login cookies expire after 8 hours, security cookies after 24 hours, and the cookie-choice cookie after 12 months

6. Your Privacy Rights (APP 12 & 13)

You Have the Right To:

Access (APP 12)

Request a copy of your personal information
Know what information we hold about you
Understand how we use your data
Receive data in a portable format

Correction (APP 13)

Update incorrect information
Complete incomplete records
Add explanatory notes
Request third-party corrections

Control

Opt-out of marketing
Withdraw consent
Restrict processing
Data portability

Deletion

Request account deletion
Remove unnecessary data
Be forgotten (where legally permitted)
Anonymization of records

To exercise any of these rights, contact our Privacy Officer at info@dsx.org.au. We will respond within 30 days.

7. Cookies & Tracking Technologies

We Use Cookies For:

Essential Functions: Authentication, security, and remembering your cookie choice
Preferences: Your settings (such as Easy Read and language) are kept in your browser's local storage
Analytics: We do not use third-party analytics or error tracking. The site automatically reports its own errors to DSX (the page address, the item clicked and your browser type)

Managing Cookies:

You can control cookies through your browser settings. Note that disabling certain cookies may affect site functionality.

8. Children's Privacy

Our services are not directed to children under 16. We do not knowingly collect personal information from children without parental consent. If you believe we have inadvertently collected such information, please contact us immediately for removal.

9. Cross-Border Data Transfers (APP 8)

Where Your Information Is Held

Our website, database and files are hosted in Sydney, Australia, by Amazon Web Services. Backups are kept in Sydney and on a computer in Australia.

Some services we use are provided by overseas companies. They may process information outside Australia:

Google Gemini (AI): Your Avatar chat messages, the last few messages of the conversation, and the page you are on (including the provider you are viewing and your search and location filter); the content of provider profiles sent for AI review, including the names of contact people, CEOs and owners; and text our team sends for drafting news, social media posts and Easy Read
Google (Gmail and Google Workspace): The emails we send you, such as account verification, password reset and notifications, including your email address; and the messages you send us through the contact form or by email to DSX
Google Maps: Loads in your browser on provider profile pages and in address fields, and receives your IP address and browser information
Cloudflare Turnstile (spam protection): Loads in your browser on the contact, join-us and bug report forms and the Avatar chat, and receives your IP address and browser information

If you use voice input in the Avatar chat, your browser's speech recognition may send the audio to your browser's provider (for example, Google for Chrome).

10. Changes to This Policy

We may update this policy to reflect changes in law or our practices. Significant changes will be notified via email or website announcement at least 30 days before taking effect. Continued use of our services after changes indicates acceptance of the updated policy.

11. Making a Complaint

Complaint Process

Step 1: Contact DSX

Email: info@dsx.org.au | Phone: 0466 106 150
We aim to resolve complaints within 30 days.

Step 2: External Review

Lodge a complaint with the Office of the Australian Information Commissioner (OAIC):
Web: www.oaic.gov.au | Phone: 1300 363 992