Privacy policy
How Green and Gold Community Services collects, uses, stores and protects your personal information, in plain language, under the Privacy Act 1988 (Cth) and the Australian Privacy Principles. Last updated 28 September 2026.
The business behind this site
Green and Gold Community Services Pty Ltd (ABN 71 702 676 337, ACN 702 676 337) is a company based in O'Halloran Hill, South Australia. Until Sunday 11 October 2026 your supports are provided by Lachlan Smith trading as Southern Allied Care (ABN 11 581 041 829); from Monday 12 October 2026 the company provides them and holds your records. Same team, same phone number. Because we provide a health and disability service, the Privacy Act applies to us whatever our size. Our Privacy Officer is Lachlan Smith.
Only what we need to support you
For participants: your name, contact details, date of birth, address, NDIS number, plan details and dates, plan-manager details, your goals, and the health and support information we need to deliver your supports safely. For workers: name, contact and emergency contact, date of birth and ID, pay, tax and super details, rosters and timesheets (including odometer readings for work travel), qualifications and screening checks, and any work injury or incident records. For anyone who contacts us: your name, how to reach you and your message.
We collect it to deliver and coordinate your supports, keep proper records, invoice and claim correctly, and meet our legal and NDIS obligations. Nothing else. We collect it from you, or from your plan manager or support coordinator with your consent. We collect health information only with your consent, or where the law allows or requires it. You can ask a general question or give feedback without giving your name.
Website forms: when you send an enquiry, referral, meet and greet request, feedback or job interest through this site, we save what you type in our business database and email a copy to our business inbox so we can reply. If our database can't be reached, the form opens your own email app instead. We use it only to respond to you and, if you go on to receive supports or work with us, to set up your file. We don't use it for marketing and we never sell it.
The services we use
Our database
Supabase, hosted in Sydney, Australia. It holds our staff app (rosters, notes, invoices and uploaded documents) and website enquiries.
Email, calendar and maps
Google: Gmail and Google Calendar. For directions to visits, Google Maps or Apple Maps.
Records and backups
Microsoft OneDrive, for our filed records (progress notes, invoices and signed documents) and nightly backups.
Website and app delivery
Cloudflare delivers this website and our staff app.
Office assistant
We use Anthropic's Claude, an AI assistant, to help run our office, for example drafting emails and checking records. It can see the records it helps with, including health information.
Pay and invoices
For workers: e-PayDay runs our payroll, sends your tax and super reports to the ATO and pays your super to your fund, as the law requires. For participants: invoices go to your plan manager, or to you if you self-manage.
Shared only when needed: only to deliver your supports and meet our obligations, for example with your plan manager for invoicing, with a family member only if you ask us to, with the NDIS Commission where the law requires it, and for workers with ReturnToWorkSA, the NDIS Worker Screening Unit, our insurer and our accountant.
Google, Apple, Microsoft, Cloudflare and Anthropic may store or process information outside Australia, most likely in the United States (Cloudflare can handle a visit in any country in its network). We take reasonable steps to make sure they protect it in line with the Australian Privacy Principles, and we stay responsible for it.
No cookies, no advertising trackers
This site uses no cookies and no advertising or tracking pixels. Cloudflare, which delivers the site, counts visits with its cookie-free Web Analytics (the page viewed, browser type and rough location), which doesn't identify you. If you use the text-size or contrast buttons, that choice is saved only on your own device. Our fonts load from Google Fonts and some page code loads from jsDelivr, so those services see your device's internet address, as happens with most websites.
Kept safely, then destroyed
Records are kept behind individual logins. Each worker sees only their own shifts and the notes they need, and our devices are locked.
Participant and worker records: at least 7 years after our last service to you or your last shift with us (for a participant who was under 18, until they turn 25 if that is later), and never while a complaint or audit about them is open. Then we destroy them securely. Website enquiries that don't go any further: we delete them, including the email copy, when you ask, and otherwise aim to delete them within 12 months. Backup copies are replaced within a few weeks.
See it, correct it, question it
You can ask to see the information we hold about you, ask us to correct it, or ask us to delete it. We check who you are first, then aim to reply within 30 days. If the law requires us to keep something (for example invoices or incident records), we'll tell you why. Contact our Privacy Officer, Lachlan Smith: call 0424 339 811 or email lachlan@greenandgoldcommunityservices.com.au.
Privacy complaints: tell us first if you can. We acknowledge within 2 business days, aim to give you an outcome within 21 days, and update you at least every 7 days if it takes longer. Not satisfied? You can go to the Office of the Australian Information Commissioner (oaic.gov.au), or to the NDIS Commission for NDIS matters. See our feedback and complaints page for every option.
Data breaches: if a breach is likely to cause you serious harm, we will tell you and the OAIC, as the Notifiable Data Breaches scheme requires.
This is our public privacy policy, last updated 28 September 2026. It sits alongside our internal Privacy, Information Management, Consent, Complaints Management and Data Breach Response policies, which you can ask us for, free. We review it at least once a year.