Data Handling

Sunshine Sports - Data Handling & Protection Statement Last updated: [CONFIRM date] This statement summarises, in plain terms, how Sunshine Sports handles the personal and children's data in the parent portal and CRM. It complements our Privacy Policy and is intended for parents, staff and partners who want the operational detail. 1. Data we hold Family accounts, children's profiles (including date of birth and any medical/allergy notes), enrolments, attendance, messages, and payment records. Card data is handled by Stripe and never stored by us. 2. Lawful basis & minimisation We collect only what we need to run programs safely and take payment. Medical and emergency fields are optional and used solely for child safety. 3. Access control - Role-based access: "owner" sees everything; "staff/coach" accounts are limited to the rosters, attendance and safety information for their assigned programs, and cannot access financial records, exports, settings or the full family database. - Admin access requires a username and password; sessions are token-based and expire. - Parents can only ever see their own household. 4. Storage & encryption Data is held in an access-controlled database. Traffic is served over HTTPS in production. Secrets (API keys, database credentials) are stored in the host's secret manager, never in the code or the browser. 5. Processors we use Stripe (payments), email/SMS notification providers, hosting provider, and accounting software (invoicing). Each is used under its terms and only for the stated purpose. 6. Retention & deletion Information is retained only as long as needed and to meet legal obligations (e.g. 7-year financial records [CONFIRM]). Families can request access, correction or deletion by emailing info@sunshinesports.au. 7. Breach response If a data breach occurs that is likely to result in serious harm, we will act promptly to contain it and will notify affected families and the OAIC as required under the Notifiable Data Breaches scheme. 8. Child safety Children's data is treated as sensitive information. Photography/marketing consent is optional and recorded per child, and can be withdrawn at any time. Contact for any data question: info@sunshinesports.au. (Edit this statement in Admin → Policies → Data handling.)