Privacy Policy

Marra Hub is operated by Marra Community Hub Incorporated (ABN 79 178 583 024), an incorporated association and charity registered with the Australian Charities and Not-for-profits Commission (ACNC), of U 1/194 Sycamore Street, Caulfield South VIC 3162, Australia. We handle personal information in line with the Privacy Act 1988 (Cth) and the Australian Privacy Principles. You can contact us about privacy, access or deletion requests at hello@marrahub.com.au.

Organisations using Marra Hub manage their own volunteer and participant records in their own workspace. As between an organisation and the people it works with, the organisation is responsible for the information it collects through its forms and programs, and may have additional privacy notices of its own.

• Account details such as name, email address, phone number, password hash, email verification status and organisation membership.
• Organisation content such as names, descriptions, contact details, logos, workshops, food programs, form questions and team invitations.
• Volunteer applications and program registrations, including contact details, availability, interests, custom answers, attendance and queue or booking information.
• For volunteer forms embedded on another website, the bounded origin of that website as untrusted referral metadata. It is never used to identify an organisation or authorise access.
• Answers to custom questions an organisation adds to its application or registration forms. Those answers are stored with your record for that organisation.
• Volunteer details added or imported by organisation administrators (for example from a sign-up sheet or a previous system). The organisation is responsible for having permission to enter that information.
• Volunteer compliance records such as check type, reference number, expiry and verification evidence. An Owner/Admin may optionally retain a content-validated PDF, JPEG or PNG when recording and online verification are not sufficient.
• Support or sales messages and other information you choose to send us, along with technical context such as the page you wrote from and your browser type.
• Security and technical information such as session identifiers, IP address, request logs, device or browser information and human-check results.

You can browse public pages, including the Discover directory and organisation profiles, without creating an account or telling us who you are. Some things cannot be done anonymously — applying to volunteer or registering for a program needs contact details so the organisation can reach you.

An embedded form remains hosted by Marra Hub even though it appears within another organisation's website. That organisation is responsible for explaining why it asks for the information and for the privacy practices of its surrounding website. Marra Hub isolates the form in an iframe, does not give the host page access to form contents, and records only its origin (not the full page URL) for referral reporting and abuse response.

If you choose Google Sign-In, Marra Hub uses the Google account information made available by the sign-in scopes, limited to your stable Google account identifier, email address and name, where provided. We use it only to authenticate you, create or link your Marra Hub account, identify your account and protect account security.

We do not use Google user data for advertising, sell it, or allow people to read it for unrelated purposes. We do not access Gmail, Google Drive, Calendar or other Google product content unless a future feature clearly requests that additional permission and you consent to it. Our use and transfer of Google user data complies with the Google API Services User Data Policy, including its Limited Use requirements.

As a registered charity, Marra Community Hub Incorporated participates in the Google Ad Grants program, which provides in-kind Google advertising to eligible nonprofits. To meet the program's measurement requirements, our public pages may use Google Analytics and Google Ads conversion measurement — for example to count when an advertisement leads to an organisation signing up or a volunteer applying.

Where those tools are enabled, technical information about your visit (such as device information, approximate location and pages viewed) is shared with Google, which may process it outside Australia. We use these measurements only in aggregate, to understand and report on how our public pages perform. We do not use them to build advertising profiles of volunteers, and we do not sell personal information. Before any non-essential cookies or similar technologies are switched on, we will update the Cookie Notice and provide any consent controls required.

• Provide accounts, organisation workspaces, public registration forms, volunteer management, attendance, exports and related features.
• Send verification, password reset, invitation, service and support communications.
• Prevent abuse, investigate faults, maintain security and improve reliability.
• Report to funders and grant bodies on program participation and outcomes, normally using aggregated or de-identified statistics.
• Meet legal obligations, respond to lawful requests and enforce our terms.

We do not sell personal information or use it for behavioural advertising.

Volunteer and participant information is visible to authorised administrators of the organisation whose form or program you joined. We also use service providers only as needed to operate Marra Hub:

• Microsoft Azure for application hosting, PostgreSQL data storage, backups and operational monitoring.
• Microsoft Graph and Microsoft 365 for transactional email.
• Cloudflare Turnstile for abuse prevention on public forms, as described in Cloudflare's Turnstile Privacy Addendum. Cloudflare receives technical request details, including your IP address, when it checks a form submission.
• OpenStreetMap services for showing maps and converting workshop addresses and postcodes into map coordinates.
• Google Fonts for loading typefaces, and Google advertising and analytics tools as described in section 4. Google receives standard technical request information, such as your IP address, when these load.
• Google Sign-In, only if you choose it.

Compliance documents are limited to the organisation's Owner and Admin roles. Ordinary members cannot list or download them. Volunteers can see which structured records and file names an organisation holds about their linked account, but document access remains restricted while correction or deletion requests are verified.

Our own community programs are supported by funding bodies, including Glen Eira City Council. We may share volunteer and program information from programs run by Marra Community Hub Incorporated with those funders for grant reporting, acquittal and program evaluation. Wherever practical we share aggregated or de-identified statistics, such as volunteer numbers, attendance and program outcomes. We only share information that identifies you where this has been made clear to you at collection, you have consented, or the law otherwise permits it. Other organisations using Marra Hub are responsible for their own funding and reporting arrangements.

Providers may process information outside Australia under their own contractual and security arrangements. We may also disclose information where required by law, to protect safety or rights, or as part of a properly managed organisational transfer.

Marra Hub runs on Microsoft Azure. The application database, its backups and our operational logs are hosted in Azure's Australia East region, and geo-redundant backup is not enabled, so database backups also stay in that region. Web traffic is delivered through Microsoft's global edge network on its way to our Australian servers. The overseas processing described in sections 4 and 6 (Google, Cloudflare, OpenStreetMap and Microsoft services) is the exception to this Australian hosting.

We use access controls, encrypted connections, password hashing, server-side sessions and per-organisation tenancy isolation, so one organisation cannot see another's records. Sensitive volunteer documents are stored in a separate private blob container and are downloaded only through an authenticated, audited endpoint with no public storage URL. No internet service is completely secure, so users should protect their credentials and tell us promptly about suspected misuse. If a data breach occurs that is likely to result in serious harm, we will notify affected people and the Office of the Australian Information Commissioner as required by the Notifiable Data Breaches scheme.

Account and organisation information is kept while the workspace is active and afterwards only as reasonably needed for administration, security, dispute handling and legal obligations. Volunteer applications and registration records are retained according to the relevant organisation's program needs and should be reviewed or removed by its administrators when no longer required. Expired authentication records are removed through routine cleanup. Database backups are currently kept for around 7 days and operational logs for around 30 days before being overwritten.

Following a verified deletion request, we delete or de-identify information under our control within a reasonable period, normally within 30 days, unless law requires longer retention.

Every compliance document must have an explicit deletion date and is purged after that date. An authorised administrator can delete it sooner; deletion removes the private blob, not merely the database listing. Access events remain append-only evidence until the related volunteer or organisation data is itself lawfully erased.

Incident records can contain sensitive information and are restricted to the organisation owner and people the owner explicitly authorises. The starting retention review period is seven years from the incident, but claims, legal holds, child-safety duties, insurer requirements or other law may require a longer period. Reaching the review date does not itself authorise deletion. Automated deletion remains disabled until the operator's legal and insurance review approves its schedule; when approved, due private attachments are physically deleted and the action is audited.

You may ask to access, correct, export or delete personal information under our control. Contact hello@marrahub.com.au and identify the account or organisation involved. We may need to verify your identity, and we aim to respond within 30 days. Volunteers may also contact the organisation that collected their application or registration.

A request to delete Google-linked data removes or de-identifies the Google profile data and Google account link held by Marra Hub, subject to necessary legal retention. You can also revoke Marra Hub access from your Google Account permissions.

If you are concerned about how we have handled your personal information, contact us at hello@marrahub.com.au and tell us what happened. We will look into it and aim to respond within 30 days. If you are not satisfied with our response, you can complain to the Office of the Australian Information Commissioner (OAIC) at oaic.gov.au, by phone on 1300 363 992, or by mail to GPO Box 5288, Sydney NSW 2001.

People under 18 may use Marra Hub only with the involvement and permission of a parent or guardian where required. Organisations must apply their own child-safe, supervision and consent procedures. A parent or guardian may contact us to review or request deletion of a young person's data.

Our use of cookies and similar technologies is explained in the Cookie Notice. We may update this policy when services or legal requirements change. Material changes will be identified by a new version and, where required, presented for renewed consent.