← Back to RIFARE

LEGAL & COMPLIANCE HUB

RIFARE Pty Ltd (ACN 675 365 152) · ABN 71 675 365 152 · New South Wales 2505, Australia
Trading as RIFARE / Thar'Kaen · Document Version 2026-07-06-v2 · Effective 6 July 2026

This document comprises Part A (Terms & Conditions), Part B (Privacy Policy under the Privacy Act 1988 (Cth) and Australian Privacy Principles), and Part C (Schedules, workflows, and regulatory references). Export tools below produce a complete offline copy.

1. Introduction & Acceptance

BINDING These Terms and Conditions ("Terms") govern access to and use of the RIFARE website, digital platform, CRM portals, messaging, e-commerce, waivers, awards, attendance, bookings, and sports/recreation/education programs ("Services") operated by RIFARE Pty Ltd (ABN 71 675 365 152, ACN 675 365 152) ("RIFARE", "we", "us", "our").

By creating an account, ticking mandatory consent checkboxes at sign-up, booking a session, enrolling in a program, uploading a waiver, or otherwise using our Services, you agree to be bound by these Terms and our Privacy Policy (Part B). If you do not agree, you must not register or use the Services.

Where you accept on behalf of a minor, school, or organisation, you represent and warrant that you have authority to bind that person or entity and that all information provided is accurate.

1.1 Hierarchy of documents

In the event of inconsistency: (a) a signed government or school contract prevails over these Terms for that engagement; (b) program-specific safety briefings and session instructions prevail for on-site delivery; (c) these Terms and Part B prevail over marketing material.

1.2 Electronic acceptance

Consent records including version identifier, timestamp, user agent, and checkbox selections are stored in our systems and may be produced for regulators, insurers, schools, and tender audits.

1.2 Cooperation with regulators

We cooperate with ACCC, Fair Trading, OAIC, SafeWork, and education regulators within applicable law.

1.5 Record retention for litigation

Where litigation or insurance claim is reasonably anticipated, records may be retained beyond standard schedules.

1.8 No waiver

Failure to enforce a right is not a waiver of that right.

2. Definitions

In these Terms, unless context requires otherwise:

  • ACL — Australian Consumer Law (Schedule 2, Competition and Consumer Act 2010 (Cth)).
  • APPs — Australian Privacy Principles under the Privacy Act 1988 (Cth).
  • Participant / Student — a user enrolled in programs (Kids, Youth, or Adults categories).
  • Parent / Guardian — a user responsible for one or more linked child accounts.
  • Teacher / School Admin — an authorised representative of a registered school or training partner.
  • Super Admin — RIFARE personnel with platform-wide administration rights.
  • School — primary school, high school, sports academy, or approved educational partner.
  • Programs — boxing (including 8-week curriculum), surfing, breathwork/mindfulness, and related offerings.
  • WHS — work health and safety laws including the Work Health and Safety Act 2011 (NSW).
  • WWCC — Working With Children Check or equivalent clearance.
2.1 Interpretation

Headings are for convenience. Singular includes plural. References to legislation include amendments and successor laws.

2.1 Operational records

RIFARE maintains CRM records of attendance, consent version, waiver status, and communications to support schools, insurers, and regulatory enquiry.

2.4 Volunteers & contractors

Approved contractors must hold relevant clearances and follow RIFARE WHS induction before working with minors.

2.7 Severability

If a clause is invalid, remaining provisions continue to the fullest extent permitted.

2.10 Survival

Clauses relating to liability, privacy, IP, and dispute resolution survive termination.

3. Eligibility & Account Types

Accounts are tiered to reflect duty-of-care, data access, and regulatory obligations across schools, teachers, students, parents, and RIFARE administration.

Role
Who
Key obligations
Approval gate
Participant (Kids/Youth)
Under 18 students
Parent approval; WHS; waivers; teacher supervision
Parent link + school enrolment
Participant (Adults)
18+ individuals
WHS disclosure; waivers where required
Email verification
Parent / Guardian
Legal guardian
Child safety; accurate linking; consent on behalf of minor
Email verification
Teacher / School Admin
School staff
WWCC; attendance; photo approval; child-safe conduct
School + Super Admin approval
Super Admin
RIFARE staff
Privacy, security, moderation, tender integrity
Internal appointment
3.1 Minors

Kids and Youth accounts may remain in pending_parent status until a verified parent/guardian links the account. Minors cannot complete e-commerce checkout or program enrolment requiring payment until activated.

3.2 School registration

New schools and join-school applications are reviewed by RIFARE Super Admin. False or misleading school applications may be rejected and referred under procurement fraud policies.

3.3 Mandatory consents at signup

All accounts require affirmative consent to Terms, Privacy (APPs), WHS acknowledgements, and ACL disclosures. Role-specific consents apply for education, media, parental authority, and government tender terms.

3.3 School excursions & duty of care

Where programs occur on school grounds or excursions, school duty-of-care policies operate alongside RIFARE safety systems.

3.6 Translation & plain language

These Terms are in English. Translations may be provided for convenience; English prevails if inconsistent.

3.9 Assignment

RIFARE may assign rights under a restructure; users may not assign accounts without consent.

4. Australian Consumer Law (ACCC)

Complaints may be directed to RIFARE and, where appropriate, to ACCC or NSW Fair Trading.

Consumer right
Summary
RIFARE response
Regulator
Acceptable quality
Services reasonably fit for purpose
Program review, make-good sessions
ACCC / Fair Trading
Fit for disclosed purpose
Programs match descriptions
Curriculum alignment, coach briefing
ACCC
Timely supply
Sessions run as scheduled where safe
Reschedule, credit, or refund per ACL
Fair Trading
Misleading conduct
No false pricing or claims
Accurate shop, campaigns, signup
ACCC
Unfair contract terms
B2C terms must be fair
Plain-language Terms, no hidden fees
ACCC
4.1 Pricing & promotions

Discount codes, school pricing, and e-commerce displays show applicable conditions at checkout. We do not engage in bait advertising or drip pricing.

4.2 Remedies

Where a major failure occurs, you may be entitled to cancel and obtain a refund. For minor failures, we will rectify within a reasonable time.

4.2 Cooperation with regulators

We cooperate with ACCC, Fair Trading, OAIC, SafeWork, and education regulators within applicable law.

4.5 Record retention for litigation

Where litigation or insurance claim is reasonably anticipated, records may be retained beyond standard schedules.

4.8 No waiver

Failure to enforce a right is not a waiver of that right.

5. Work Health & Safety (WHS)

RIFARE delivers contact sports, ocean activities, and physical training subject to WHS legislation in NSW and other jurisdictions where programs operate. Safety is a shared responsibility.

Duty holder
Core duties
Platform features
RIFARE (PCBU)
Safe systems, instructor competency, incident response
Risk disclosures, waiver review, safety campaigns
School / Teacher
Supervision, attendance, hazard reporting
Attendance CRM, chat, session scheduling
Participant
Follow instructions, disclose conditions
Waiver upload, profile medical notes field
Parent
Ensure child suitability, transport safety
Parent portal, consent records
flowchart TD
  A[Incident or hazard identified] --> B{Immediate danger?}
  B -->|Yes| C[Cease activity / first aid / emergency services]
  B -->|No| D[Report to teacher on site]
  D --> E[Teacher logs in RIFARE CRM]
  E --> F[Super Admin notified if serious]
  F --> G[Investigation + corrective action]
  G --> H[Retain records for WHS / insurance]

Figure 1 — WHS incident reporting workflow

5.1 Participant health disclosure

You must disclose injuries, medical conditions, asthma, allergies, pregnancy, or other factors affecting safe participation. Concealment may affect insurance and liability assessments.

5.2 Equipment & environment

Boxing, surfing, and breathwork involve equipment and environmental risks (weather, surf, heat). Sessions may be modified or cancelled for safety.

5.3 Assumption of risk

You acknowledge inherent risks in sports and recreation while retaining all non-excludable statutory rights.

5.1 Operational records

RIFARE maintains CRM records of attendance, consent version, waiver status, and communications to support schools, insurers, and regulatory enquiry.

5.4 Volunteers & contractors

Approved contractors must hold relevant clearances and follow RIFARE WHS induction before working with minors.

5.7 Severability

If a clause is invalid, remaining provisions continue to the fullest extent permitted.

5.10 Survival

Clauses relating to liability, privacy, IP, and dispute resolution survive termination.

6. Education, Schools & Child Safety

RIFARE partners with primary schools, high schools, and community organisations to deliver structured boxing, surfing, and breathwork programs with CRM oversight, attendance, awards, and parent visibility.

CHILD SAFE Bullying, abuse, grooming, discrimination, or reportable conduct must be reported immediately to the school, RIFARE, and where required statutory authorities.
Principle 1

RIFARE aligns with National Principle 1 for child safe organisations. Schools and teachers must cooperate with reporting, supervision, and governance expectations under this principle.

Principle 2

RIFARE aligns with National Principle 2 for child safe organisations. Schools and teachers must cooperate with reporting, supervision, and governance expectations under this principle.

Principle 3

RIFARE aligns with National Principle 3 for child safe organisations. Schools and teachers must cooperate with reporting, supervision, and governance expectations under this principle.

Principle 4

RIFARE aligns with National Principle 4 for child safe organisations. Schools and teachers must cooperate with reporting, supervision, and governance expectations under this principle.

Principle 5

RIFARE aligns with National Principle 5 for child safe organisations. Schools and teachers must cooperate with reporting, supervision, and governance expectations under this principle.

Principle 6

RIFARE aligns with National Principle 6 for child safe organisations. Schools and teachers must cooperate with reporting, supervision, and governance expectations under this principle.

Principle 7

RIFARE aligns with National Principle 7 for child safe organisations. Schools and teachers must cooperate with reporting, supervision, and governance expectations under this principle.

Principle 8

RIFARE aligns with National Principle 8 for child safe organisations. Schools and teachers must cooperate with reporting, supervision, and governance expectations under this principle.

Principle 9

RIFARE aligns with National Principle 9 for child safe organisations. Schools and teachers must cooperate with reporting, supervision, and governance expectations under this principle.

Principle 10

RIFARE aligns with National Principle 10 for child safe organisations. Schools and teachers must cooperate with reporting, supervision, and governance expectations under this principle.

6.1 Attendance & awards

Teachers record Ready / Not Ready / Absent. Students absent or not ready may be ineligible for awards or progression until requirements are met.

6.2 School data access

Schools access student data only for enrolled students at their school. Export and reporting must comply with privacy and education sector policies.

6.3 School excursions & duty of care

Where programs occur on school grounds or excursions, school duty-of-care policies operate alongside RIFARE safety systems.

6.6 Translation & plain language

These Terms are in English. Translations may be provided for convenience; English prevails if inconsistent.

6.9 Assignment

RIFARE may assign rights under a restructure; users may not assign accounts without consent.

7. Government Tenders & Procurement

Where RIFARE contracts with government agencies, councils, or public schools through tender, standing offer, or selective procurement, the executed contract prevails over conflicting Terms.

Requirement
RIFARE commitment
School/Partner commitment
Accurate representations
Truthful capability, insurance, WHS systems
Authority to contract; accurate student numbers
Conflict of interest
Disclosure of related parties
Disclosure of gifts/benefits
Privacy & security
APP-compliant data handling
Lawful consent for student data
Child safety
National Principles alignment
WWCC; supervision ratios
Audit & records
Consent + attendance retention
Cooperation with audits
7.1 Modern slavery & ethical sourcing

RIFARE expects suppliers and partners to comply with applicable modern slavery reporting and ethical conduct expectations in public sector supply chains.

7.2 Cooperation with regulators

We cooperate with ACCC, Fair Trading, OAIC, SafeWork, and education regulators within applicable law.

7.5 Record retention for litigation

Where litigation or insurance claim is reasonably anticipated, records may be retained beyond standard schedules.

7.8 No waiver

Failure to enforce a right is not a waiver of that right.

8. Programs, Bookings & Attendance

Session schedules, capacities, locations, and content may change due to weather, WHS, facility access, or instructor availability. Bookings are subject to confirmation and attendance rules.

8.1 Boxing 8-week curriculum

The boxing program includes structured weekly progression, grading, and graduate pack eligibility. Teachers update CRM progress; students view status in their dashboard.

8.2 Flow programs (surf & breathwork)

Surfing and breathwork modules include session logging, goals, and journal features. Ocean conditions may require cancellation — rescheduling follows ACL and program policy.

8.3 Cancellations by participant

Cancellation notice requirements are communicated at booking. Repeated no-shows may affect future booking priority.

8.1 Operational records

RIFARE maintains CRM records of attendance, consent version, waiver status, and communications to support schools, insurers, and regulatory enquiry.

8.4 Volunteers & contractors

Approved contractors must hold relevant clearances and follow RIFARE WHS induction before working with minors.

8.7 Severability

If a clause is invalid, remaining provisions continue to the fullest extent permitted.

8.10 Survival

Clauses relating to liability, privacy, IP, and dispute resolution survive termination.

9. Fees, Payments & Refunds

Payments are processed via approved providers (e.g. Stripe). Prices are shown in AUD unless stated otherwise. GST treatment follows Australian tax law.

9.1 Refund assessment matrix

Refunds are assessed under ACL guarantees, session cancellation by RIFARE, medical withdrawal with evidence, and duplicate charges. Chargebacks should be raised with us first where practicable.

9.2 School invoicing

School partners may be invoiced under separate agreements. Platform shop purchases by individuals follow consumer Terms.

9.3 School excursions & duty of care

Where programs occur on school grounds or excursions, school duty-of-care policies operate alongside RIFARE safety systems.

9.6 Translation & plain language

These Terms are in English. Translations may be provided for convenience; English prevails if inconsistent.

9.9 Assignment

RIFARE may assign rights under a restructure; users may not assign accounts without consent.

10. Platform Conduct & Communications

Messaging, group chats, campaigns, and file attachments must be lawful, respectful, and relevant to RIFARE programs. We may moderate, remove content, and suspend accounts.

10.1 Prohibited conduct
  • Harassment, hate speech, or sexualised content — especially involving minors
  • Sharing passwords or impersonation
  • Spam, unrelated advertising, or malware
  • Circumventing blocks or parent controls
10.2 Campaigns vs direct messages

Campaign broadcasts are program announcements and may target role tiers. Direct messages are for individual or group coaching communication.

10.2 Cooperation with regulators

We cooperate with ACCC, Fair Trading, OAIC, SafeWork, and education regulators within applicable law.

10.5 Record retention for litigation

Where litigation or insurance claim is reasonably anticipated, records may be retained beyond standard schedules.

10.8 No waiver

Failure to enforce a right is not a waiver of that right.

11. Waivers, Insurance & Risk

Participants may submit participation waivers and insurance certificates. Waivers do not replace non-excludable ACL or WHS duties.

11.1 Insurance recommendations

We recommend personal accident, health, and where relevant water-sports insurance. Schools maintain their own duty-of-care and insurance arrangements.

11.1 Operational records

RIFARE maintains CRM records of attendance, consent version, waiver status, and communications to support schools, insurers, and regulatory enquiry.

11.4 Volunteers & contractors

Approved contractors must hold relevant clearances and follow RIFARE WHS induction before working with minors.

11.7 Severability

If a clause is invalid, remaining provisions continue to the fullest extent permitted.

11.10 Survival

Clauses relating to liability, privacy, IP, and dispute resolution survive termination.

12. Intellectual Property & Media

RIFARE branding, curriculum, platform code, award templates, and content are protected by IP laws. Unauthorised copying or scraping is prohibited.

12.1 Photography & media consent

Program photography may be used for education, school reporting, and promotion unless opt-out is exercised in writing. Minors require parent/guardian consent indicated at registration.

12.3 School excursions & duty of care

Where programs occur on school grounds or excursions, school duty-of-care policies operate alongside RIFARE safety systems.

12.6 Translation & plain language

These Terms are in English. Translations may be provided for convenience; English prevails if inconsistent.

12.9 Assignment

RIFARE may assign rights under a restructure; users may not assign accounts without consent.

13. Profile Images & Verification

Users may upload profile photos subject to teacher or RIFARE approval before public display. Images must be appropriate and accurately represent the account holder.

13.1 Approval workflow

Students: school teacher approves. Teachers: school lead or Super Admin. Parents/adults without school: Super Admin. Rejected images may be re-submitted.

13.2 Cooperation with regulators

We cooperate with ACCC, Fair Trading, OAIC, SafeWork, and education regulators within applicable law.

13.5 Record retention for litigation

Where litigation or insurance claim is reasonably anticipated, records may be retained beyond standard schedules.

13.8 No waiver

Failure to enforce a right is not a waiver of that right.

14. E-commerce

Shop purchases are subject to these Terms, ACL, and product-specific descriptions. Digital and physical fulfilment times are estimates.

14.1 Product images & descriptions

We endeavour to display accurate product metadata. Minor variations may occur. Defective goods remedies apply under ACL.

14.1 Operational records

RIFARE maintains CRM records of attendance, consent version, waiver status, and communications to support schools, insurers, and regulatory enquiry.

14.4 Volunteers & contractors

Approved contractors must hold relevant clearances and follow RIFARE WHS induction before working with minors.

14.7 Severability

If a clause is invalid, remaining provisions continue to the fullest extent permitted.

14.10 Survival

Clauses relating to liability, privacy, IP, and dispute resolution survive termination.

15. NSW Active & Creative Kids Vouchers

Where programs qualify, RIFARE may display NSW voucher guidance. Eligibility and redemption are governed by Service NSW rules.

15.1 Voucher logging

School admins log redemptions in CRM for reporting. False voucher claims may be referred to authorities.

15.3 School excursions & duty of care

Where programs occur on school grounds or excursions, school duty-of-care policies operate alongside RIFARE safety systems.

15.6 Translation & plain language

These Terms are in English. Translations may be provided for convenience; English prevails if inconsistent.

15.9 Assignment

RIFARE may assign rights under a restructure; users may not assign accounts without consent.

16. Limitation of Liability

To the maximum extent permitted by law, RIFARE is not liable for indirect or consequential loss. Aggregate liability for Services is limited to fees paid for the relevant program in the prior 12 months, except where liability cannot be limited.

16.2 Cooperation with regulators

We cooperate with ACCC, Fair Trading, OAIC, SafeWork, and education regulators within applicable law.

16.5 Record retention for litigation

Where litigation or insurance claim is reasonably anticipated, records may be retained beyond standard schedules.

16.8 No waiver

Failure to enforce a right is not a waiver of that right.

17. Dispute Resolution

Parties will attempt good-faith resolution before litigation. NSW courts have non-exclusive jurisdiction unless a contract specifies otherwise. Regulators (ACCC, Fair Trading, WHS, education authorities, OAIC) may be contacted at any time.

17.1 Operational records

RIFARE maintains CRM records of attendance, consent version, waiver status, and communications to support schools, insurers, and regulatory enquiry.

17.4 Volunteers & contractors

Approved contractors must hold relevant clearances and follow RIFARE WHS induction before working with minors.

17.7 Severability

If a clause is invalid, remaining provisions continue to the fullest extent permitted.

17.10 Survival

Clauses relating to liability, privacy, IP, and dispute resolution survive termination.

18. Changes, Termination & Governing Law

We may update Terms by publishing a new version. Material changes may require re-acceptance at next login. We may suspend accounts for breach or safety. Governed by laws of New South Wales, Australia.

18.3 School excursions & duty of care

Where programs occur on school grounds or excursions, school duty-of-care policies operate alongside RIFARE safety systems.

18.6 Translation & plain language

These Terms are in English. Translations may be provided for convenience; English prevails if inconsistent.

18.9 Assignment

RIFARE may assign rights under a restructure; users may not assign accounts without consent.

19. Force Majeure

RIFARE is not liable for delay or failure caused by events beyond reasonable control including severe weather, pandemic restrictions, facility closure, or government direction — session rescheduling or credits may apply.

19.2 Cooperation with regulators

We cooperate with ACCC, Fair Trading, OAIC, SafeWork, and education regulators within applicable law.

19.5 Record retention for litigation

Where litigation or insurance claim is reasonably anticipated, records may be retained beyond standard schedules.

19.8 No waiver

Failure to enforce a right is not a waiver of that right.

20. Anti-Bribery & Tender Integrity

RIFARE prohibits bribery, secret commissions, and misleading tender documentation. Partners must disclose conflicts of interest and gifts that could affect procurement decisions.

20.1 Operational records

RIFARE maintains CRM records of attendance, consent version, waiver status, and communications to support schools, insurers, and regulatory enquiry.

20.4 Volunteers & contractors

Approved contractors must hold relevant clearances and follow RIFARE WHS induction before working with minors.

20.7 Severability

If a clause is invalid, remaining provisions continue to the fullest extent permitted.

20.10 Survival

Clauses relating to liability, privacy, IP, and dispute resolution survive termination.

21. Accessibility

We aim to improve platform accessibility over time. Users requiring reasonable adjustments for program participation should contact their school teacher and RIFARE support.

21.3 School excursions & duty of care

Where programs occur on school grounds or excursions, school duty-of-care policies operate alongside RIFARE safety systems.

21.6 Translation & plain language

These Terms are in English. Translations may be provided for convenience; English prevails if inconsistent.

21.9 Assignment

RIFARE may assign rights under a restructure; users may not assign accounts without consent.

22. Contact

RIFARE Pty Ltd
ABN 71 675 365 152 · ACN 675 365 152
Email: hello@rifare.com.au

22.2 Cooperation with regulators

We cooperate with ACCC, Fair Trading, OAIC, SafeWork, and education regulators within applicable law.

22.5 Record retention for litigation

Where litigation or insurance claim is reasonably anticipated, records may be retained beyond standard schedules.

22.8 No waiver

Failure to enforce a right is not a waiver of that right.

P1. Privacy Overview

This Privacy Policy explains how RIFARE Pty Ltd collects, uses, stores, and discloses personal information under the Privacy Act 1988 (Cth) and APPs.

P2. What We Collect & Why

Category
Examples
Lawful basis
Retention
Account
Name, email, role, school
Consent; contract
Life of account + 7 yrs
Program
Attendance, progress, awards
Legitimate interest; education
7 yrs
Compliance
Signup consents, waivers
Legal obligation
7–10 yrs
Payment
Orders via Stripe
Contract
7 yrs tax
Communications
Chat, campaigns
Consent; legitimate interest
2 yrs
Media
Profile photos, uploads
Consent
Until deletion

P3. Australian Privacy Principles

Principle
Requirement
RIFARE practice
APP APP 1
Open & transparent management
Privacy policy published; consent at signup
APP APP 2
Anonymity & pseudonymity
Limited — accounts require identity for child safety
APP APP 3
Collection of solicited info
Signup forms; purpose disclosed
APP APP 4
Dealing with unsolicited info
Deleted if not required
APP APP 5
Notification of collection
Terms Part B; signup checkboxes
APP APP 6
Use & disclosure
Role-based CRM access matrix
APP APP 7
Direct marketing
Opt-out available; campaigns disclosed
APP APP 8
Cross-border disclosure
See P6 — Firebase/Google/Stripe
APP APP 9
Government identifiers
Not collected unless legally required
APP APP 10
Quality of PI
Users may update profile; schools verify enrolment
APP APP 11
Security
Firebase rules; HTTPS; access controls
APP APP 12
Access & correction
Privacy contact; OAIC rights
APP APP 13
Complaints
Internal process; OAIC escalation

P4. Children & Sensitive Information

We collect children's information only with parent/guardian involvement for minors, school authorisation where applicable, and strict role-based access. Sensitive information (health, waiver data) is collected only where reasonably necessary for safety and with consent.

P4.1 Parent access

Parents access linked children's bookings, attendance, awards, and vouchers through the Parent Portal.

P5. Disclosure & Third Parties

We use trusted providers including Google Firebase (hosting, database, authentication, storage), Stripe (payments), Google Maps (address autocomplete), and email delivery services. These providers process data under contractual safeguards.

P5.1 School disclosure

Student data is shared with the enrolled school and its approved teachers. No advertising resale of student data.

P6. Cross-Border Disclosure

Some providers may store or process data outside Australia (e.g. United States). We take reasonable steps to ensure overseas recipients comply with APP 8 requirements or comparable protections.

P7. Security

We implement role-based Firestore security rules, authentication, encrypted transport (HTTPS), and administrative access controls. No system is perfectly secure — report suspected breaches immediately.

Record type
Retention
Deletion trigger
Signup consents
7–10 years
Legal hold exception
Waivers & insurance
7 years post program
User deletion request assessed
Chat messages
2 years default
Moderation deletion
Attendance & awards
7 years
School archival policy
Payment records
7 years
Tax law requirement

P9. Access & Correction

Request access or correction via hello@rifare.com.au. We respond within reasonable timeframes per APP 12. Identity verification may be required.

P10. Complaints

Complaints are investigated internally. If unresolved, you may contact the Office of the Australian Information Commissioner (OAIC).

P11. Cookies & Analytics

We use essential cookies/session storage for authentication. Analytics may be used to improve the platform — where non-essential cookies are introduced, notice and consent mechanisms will be updated.

P12. Direct Marketing

Program campaigns and newsletters may be sent to users who opt in or have a reasonable expectation based on enrolment. Unsubscribe or opt-out instructions are provided.

flowchart LR
  A[Suspected breach] --> B[Contain & assess]
  B --> C{Serious harm likely?}
  C -->|Yes| D[Notify OAIC + affected individuals]
  C -->|No| E[Document & remediate]
  D --> F[Review security controls]
  E --> F

Figure 2 — Notifiable data breach assessment (Privacy Act Part IIIC)

P13. Data Breach Notification

We follow the Notifiable Data Breaches scheme under the Privacy Act. Affected users and OAIC are notified when eligible data breaches occur.

P14. Additional Privacy Disclosures

Law enforcement requests

We respond to valid legal process and may disclose information to protect life, safety, or rights.

De-identified analytics

Aggregated non-identifying statistics may be used for program improvement and tender reporting.

Employee & contractor privacy

Staff records are handled under separate employment privacy procedures.

Data minimisation

We collect only information reasonably necessary for program delivery and compliance.

Automated decision-making

RIFARE does not make solely automated decisions with legal effect without human review.

S1. Signup Consent Workflow

sequenceDiagram
  participant U as User
  participant W as Signup Wizard
  participant A as Auth
  participant F as Firestore
  U->>W: Step 1 identity
  U->>W: Step 2 role & school
  U->>W: Step 3 legal checkboxes
  W->>A: Create account
  A->>F: User profile
  W->>F: signupConsents record
  Note over F: version, timestamp, userAgent

Figure 3 — Signup consent capture sequence

S2. Parent–Child Linking

flowchart TD
  M[Minor signs up] --> P[pending_parent status]
  P --> G[Parent creates Parent account]
  G --> L[Links child email]
  L --> A[Child status = active]
  A --> E[Full program access]

Figure 4 — Parent approval activation

S3. Data Access by Role

Data type
Student
Parent
Teacher
Super Admin
Own profile
Child profile
Linked only
School students
Own school
Signup consents
Own
Own
Own
All
Waivers
Own
Linked child
School
All
Shop orders
Own
All
Chat
Contacts
Contacts
School + support
All
{faq_html}
{PROGRAM_APPENDIX}