Privacy Statement

1. Who we are

The Mangrove Emergency Planning & Communications Committee Inc. (MEPCC) is a volunteer incorporated association (Y2398401, ABN 57 950 364 981). We run a UHF CB emergency radio network across isolated Central Coast communities, funded under the Commonwealth Black Summer Bushfire Recovery program.

This website is the register for that network: who holds which call sign, what equipment is at which property, who reached whom on a testing night, and the notices and documents the committee sends out.

For anything about your information, write to [email protected]. It goes to the committee.

We are committed to handling personal information in accordance with the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs), the rules the Act sets for how personal information is collected, used, kept and shared.

2. What we hold about you

If you are a participant on the network, the register holds:

• Your name, email address and phone number
• The property your radio is at: its street address, and where it is on the map
• Your call sign, and when it was issued to you
• The date you signed the participant agreement
• The radio, antenna and other equipment at your property, including serial numbers. The equipment belongs to MEPCC; the register records that it is in your care
• Your training: sessions you attended and the result, and when a refresher is due
• Which guides and documents you have said you have read
• Whether you have chosen to show your name to other participants on the map (off unless you turn it on)
• Who lived at the property before you, and who holds the call sign after you leave. The register keeps the history of a call sign and a property. It does not delete it when a person leaves

If you have an account, we also hold a password (stored as a hash that cannot be turned back into the password), when you last signed in, and the emailed links we sent you to set it up, reset it or confirm a new email address. While you are changing your email address, the new address is held with the link we send to it, for up to a day.

If you set up a second step at sign-in, we hold what checks it: for an authenticator app, its secret, encrypted; for a passkey, the public half only, which cannot be used to sign in; and your recovery codes, stored as hashes. For each browser you have confirmed, we hold a code that recognises it and the browser's own description of itself (for example, which browser on which kind of phone), so we don't ask again on it.

Things you write on the site:

• Testing sheets and contacts you log: the date, the call signs you heard, how well you heard them, and where you were transmitting from
• Replies and notes on the forms you fill in

If you write to us through the public site and are not yet a participant:

• Register interest: your name, email address, phone number, address and message
• Report a fault: whatever you choose to tell us, which may include your name, contact details, call sign and location

The committee's own record of changes. Every change to the register records who made it, when, and what it was before. If a committee member corrects your phone number, the register keeps both numbers and the name of the committee member.

Technical information. Your address on the internet (IP address) is used to limit repeated sign-in attempts and repeated form submissions, and appears in our web server logs. The public and participant pages send the page path, and nothing after the question mark, to Google Analytics so we can see which pages are used. The committee's screens do not.

What we do not hold. No bank or card details: nothing on this site takes a payment. No health information, no information about mobility or who needs help to evacuate. If the committee ever decides the register should hold information like that, section 12 says what has to be true first.

3. Where it comes from

• From you, when you update My details, log a contact, or fill in a form
• From the committee, when a committee member sets you up on the network, records your training, or records that you have left a property
• From the committee's earlier records. The network ran on a spreadsheet before this site. When the site was set up, the spreadsheet's rows were read into the register. Your entry may have come from there
• From Google, when a committee member places your property on the map from its address. Google returns a position; we store it against the property
• From other participants, when they log that they heard your call sign on a testing night

4. Why we hold it

• To run the network. A radio network is a list of who is on it, where they are, and whether their radio works. That is the register
• To hand over a call sign properly. When a participant leaves, the antenna stays, the call sign goes vacant, and the next resident needs to be found and set up. That needs the history
• To know who can reach whom. The testing nights exist to find out which stations can hear each other. Your logged contacts feed the map and the results the committee sends out after a test
• To keep in touch. Notices about testing nights, meetings and results are sent to participants by email
• To look after publicly funded equipment. The radios and antennas were bought with a Commonwealth grant. The register is the record of where each one is
• To keep the site safe. Sign-in, emailed links, limits on repeated attempts, and the log of changes

We do not sell personal information. We do not show advertising. We send you nothing that is not about the network.

5. Who can see it

Other participants can see, when signed in: your call sign, your locality, and a marker for your property on the Who can I reach? map. Your name is shown beside it only if you have turned that on in My details. Other participants never see your street address, phone number, email address or equipment.

A marker on a map is a position. Somebody could read a street off it. We think this is appropriate for a network whose purpose is that neighbours can reach each other, and it is within what was agreed at the information sessions when you joined.

The committee can see everything in section 2, because setting people up, recording training, handing over call signs and looking after equipment is their job. Committee members sign in with their own accounts, and the register records what each of them changes.

Nobody signed out can see anything in the register. The public coverage map shows localities as an area, with no markers, no call signs and no properties.

6. Who we share it with

We do not give personal information to anybody outside MEPCC except the service providers below, who process it on our behalf, and except where the law requires.

Where a provider is outside Australia, MEPCC takes reasonable steps to ensure it handles personal information in a manner consistent with the Australian Privacy Principles, including through the provider's contractual protections, its security controls, and the checks we make when choosing it.

7. Where it is stored

The live register is in Sydney.

Backups. Every night an encrypted copy of the register is made and stored with Wasabi, a cloud storage provider, in Sydney. It is encrypted before it leaves the live server, with a key that neither the live server nor Wasabi holds. A short-lived copy is also taken before each software update and kept on the live server for seven days, so an update that goes wrong can be undone.

8. How we protect it

• Every connection to the site is encrypted (HTTPS)
• Passwords are stored as hashes, never as the password
• Every page of the register requires a signed-in account, and every request checks whether that account is allowed to see what it asked for
• Repeated wrong passwords and repeated form submissions are slowed down
• Every change to the register records who made it and what it was before
• Documents are stored outside the website's files and served only to people allowed to see them
• The committee's screens require a second step at sign-in, an authenticator app or a passkey, because they show everybody's details. Participants can add a passkey too, so a fingerprint or face confirms it is them
• A sign-in from a browser your account has not used before is confirmed by a code sent to your email address, or by your second step if you have one
• Backups are encrypted before they leave the live server, and the key that opens them is kept neither there nor with the storage provider

No system is perfectly secure. If a breach happens that is likely to result in serious harm to you, we will tell you and the Office of the Australian Information Commissioner (OAIC) as soon as practicable, in accordance with the Notifiable Data Breaches scheme.

9. How long we keep it

We may keep information longer where reasonably necessary to comply with a legal obligation, resolve a dispute, investigate misuse of the site, or protect the rights, property or safety of people on the network. The full retention schedule, with the reason for each period, is available from [email protected].

10. Your choices

• See and correct your details. My details shows what the register holds about you. You can change your name, phone number and email address there; a new email address takes effect when you follow the link we send to it, and we tell your old address too. For anything else, write to us; it is done by a committee member so the change is recorded
• Your name on the map. My details has the switch. It is off unless you turn it on, and you can turn it off again at any time
• Ask for a copy. Write to [email protected] and we will send you what the register holds about you within 30 days
• Leave the network. Tell the committee. Your account is closed, your call sign becomes vacant for the next resident, and the equipment stays with the property, because it belongs to MEPCC. Your name stays in the history of the call sign and the property, as section 9 says, and nowhere else
• Email. Notices are sent to every participant with an account. If you would rather not receive them, tell the committee; you will still see them on the site

11. Cookies

The site sets three small files in your browser (cookies), and uses them for nothing else:

• one that keeps you signed in, for up to thirty days
• one that remembers a browser you have confirmed, so you are not sent a code again, for up to a year. Signing out does not remove it
• one that holds a sign-in while you enter the code we sent you, for ten minutes

Google Analytics sets its own cookies on the public and participant pages; it does not run on the committee's screens.

12. Sensitive information

The register holds none. Health, mobility, and who might need help to evacuate are sensitive information under the Privacy Act, and the site will never hold such information unless every one of these is in place first: your express consent, recorded; encryption of the information itself; a log of every person who reads it; a stated retention period; this statement updated to say so; and a second sign-in step for everybody who can see it.

13. Complaints

Write to [email protected] first and we will work to put it right. If you are not satisfied, you may complain to the Office of the Australian Information Commissioner at oaic.gov.au.

14. Changes to this statement

Changes are posted here with a new effective date, and participants are told of material changes by a notice. Earlier versions are kept and available on request.