DEC Housing logo
Ph: 1300 530 399     info@dechousing.org.au
DEC Housing
Contact Us
DEC Housing
Contact Us

Privacy Policy

Last updated: 5 October 2026
Effective date: 5 October 2026
Version 2.3 — replaces the version dated 31 July 2026.

DEC Housing Limited (ABN 13 647 822 099) is committed to protecting the privacy of an individual’s personal information. This policy sets out how we aim to protect the privacy of your personal information, your rights in relation to the personal information we manage, and the way we collect, use, disclose and store it.

This policy applies to our websites at dechousing.org.au, dechousing.com.au and dechousing.au, and to the Specialist Disability Accommodation (SDA) and related services we provide offline. We review this policy at least once every 12 months, and whenever we make a material change to how we handle personal information.

In handling your personal information we comply with the Privacy Act 1988 (Cth) (Privacy Act) and the thirteen Australian Privacy Principles (APPs), and with our obligations under the National Disability Insurance Scheme Act 2013 (Cth) and the NDIS Practice Standards.

We have policies and procedures in place to ensure that:

  • personal information is managed in an open and transparent way
  • the privacy of personal information of participants, tenants, staff and volunteers is protected
  • we collect and handle personal information fairly and lawfully
  • personal information we collect is used and disclosed for legally permitted purposes only
  • we regulate access to, and correction of, personal information
  • we maintain the confidentiality of personal information through appropriate storage and security.

Your privacy choices

You can change your cookie choice, or ask us not to sell or share your personal information, at any time from this page.

Change your cookie choiceDo Not Sell or Share My Personal Information

1. How to contact us about privacy

If you have a question about this policy, want to access or correct your information, want to opt out of something, or want to make a privacy complaint, contact our Privacy Officer:

If you need help to read this policy or to make a request, tell us and we will assist you, or you can ask a family member, carer, advocate or support coordinator to contact us on your behalf.

2. On this page

3. The kinds of information we collect

Information about participants, tenants and applicants. Personal information is collected so that we can provide accommodation, care and services. It could include your:

  • name, address, telephone number and email address
  • date of birth
  • gender
  • advocate, support coordinator or emergency contact’s name, telephone number and email
  • health information and disability support needs
  • NDIS participant number, SDA eligibility and approved SDA design category
  • housing preferences, including preferred suburb and whether you wish to live alone or share
  • diversity status (such as ethnicity, cultural background and lifestyle preferences).

Information you give us through our website. When you complete our contact form or our feedback and complaints form, we collect your name, email address, phone number, postcode or city, state, the suburb or town you want to live in, your role (for example participant, parent, carer or support coordinator), your SDA status and approved SDA category, your preferred contact method, and anything you write in the message field.

Technical information collected automatically. When you visit our websites we, our hosting provider and the third parties listed in section 7 may collect:

  • your IP address and the approximate location derived from it (city or region level)
  • your device type, operating system, browser type and screen size
  • the pages you view, the links you click, the date and time of your visit and how long you stay
  • the website or search engine that referred you to us
  • error and security logs generated by our hosting platform.

4. Sensitive and health information

Health information, disability information, and information about your ethnicity or cultural background are “sensitive information” under the Privacy Act and attract additional protection. We only collect sensitive information where:

  • you (or your authorised representative) have consented and the information is reasonably necessary for our services; or
  • the collection is required or authorised by law; or
  • a permitted general situation or permitted health situation under the Privacy Act applies (for example, to lessen a serious threat to life, health or safety).

You can withdraw your consent at any time by contacting us, although you should be aware that this may affect our capacity to provide services to you.

We do not collect sensitive information through our website forms, and we ask that you do not include health or other sensitive details in the free-text message fields. If you do, we will handle that information in accordance with this policy.

5. Dealing with us anonymously or by pseudonym

You have the option of dealing with us anonymously or under a pseudonym — for example, when making a general enquiry or providing feedback. In some cases this will not be practicable, such as when you apply for an SDA vacancy or when we need to verify your identity before giving you access to your records. We will tell you when this is the case.

6. How we collect personal information

Participant personal information may be collected from:

  • you, the participant or applicant
  • your family members or significant others
  • your advocate, guardian or support coordinator
  • your doctor, allied health professional, other service providers or facilities
  • the National Disability Insurance Agency (NDIA) and other government bodies, where authorised.

We will collect personal information directly from you unless:

  • we have your consent to collect the information from someone else
  • we are required or authorised by law to collect the information from someone else
  • it is unreasonable or impracticable to do so.

We also collect information through our website — from the forms you submit, and automatically through the cookies and tracking technologies described in the next section.

7. Cookies, analytics and tracking technologies

Cookies are small text files placed on your device by a website. We and our service providers also use related technologies such as JavaScript tags, pixels and browser local storage. We use them to make the site work, to keep it secure, and to understand how visitors use it.

The following tracking technologies are used on our websites:

  • Google Analytics 4 (measurement ID G-XGBJQ73DTP) — provided by Google LLC. This is an analytics tool that tells us how many people visit our site, which pages they view, how they found us and what device they use, so we can improve the site. It only runs if you choose “Accept cookies” on our cookie banner. Until you do, it is not loaded at all and no request is made to Google. If you accept, it sets cookies named _ga and _ga_XGBJQ73DTP in your browser and collects your IP address, device and browser details, and the pages you view. We use it for statistical analysis only. We have not enabled Google Analytics advertising features, audience remarketing or Google Signals, and we do not use Google Analytics data to target advertising to you. See Google’s Privacy Policy and How Google uses information from sites that use its services.
  • Google reCAPTCHA — provided by Google LLC and used on our contact form and our feedback and complaints form to tell humans and automated spam bots apart. reCAPTCHA collects hardware and software information (including your IP address, device and browser data, and mouse and touch behaviour) and sends it to Google for analysis. It is subject to Google’s Privacy Policy and Terms of Service. We consider this a necessary security measure and cannot accept form submissions without it.
  • OpenStreetMap — our SDA Vacancies Map page loads map tiles from tile.openstreetmap.org, operated by the OpenStreetMap Foundation. When those tiles load, your IP address and the map area you are viewing are disclosed to the OpenStreetMap Foundation. See the OpenStreetMap Foundation Privacy Policy. No cookies are set by this service.
  • Accessibility widget — our website accessibility toolbar is provided by Elementor Ltd. and loaded from cdn.elementor.com. It stores your chosen accessibility settings (such as larger text or increased contrast) in your browser’s local storage so your preferences persist between visits.
  • Essential website and security cookies — our website platform (WordPress), our hosting provider and our performance and caching tools set strictly necessary cookies to keep the site working, to serve the correct cached version of a page, to protect against brute-force login attempts and spam, and to keep logged-in administrators signed in. These cookies do not track you across other websites.

We do not use advertising cookies, social media tracking pixels, marketing pixels, session-recording or heat-mapping tools, or cross-site behavioural advertising technologies on our websites. Our social media icons are ordinary links — they do not load tracking code from Facebook or LinkedIn.

If we add a new tracking technology to our websites, we will update this section and change the “Last updated” date at the top of this page.

8. Managing cookies and tracking — your choices

Analytics is off until you turn it on. When you first visit, a banner asks whether you are happy for us to use Google Analytics. Nothing is loaded and no analytics cookies are set unless you choose “Accept cookies”. Choosing “Reject cookies” — or pressing Escape — leaves analytics off, and we will not ask again on that device. Essential cookies that make the site work are always used, as they are necessary to provide the service you have asked for.

You can change your mind at any time:

  • Change your cookie choice — use the Change your cookie choice button at the top of this policy or below to bring the banner back and change your answer. Your choice is stored in your browser’s local storage rather than in a cookie, so clearing your browsing data will reset it and the banner will appear again.
  • Opt out of Google Analytics on all websites — install the Google Analytics Opt-out Browser Add-on.
  • Block or delete cookies in your browser — every major browser lets you block third-party cookies, block all cookies for a specific site, or delete cookies already stored. See the privacy or security settings in Chrome, Safari, Edge or Firefox. Blocking strictly necessary cookies may stop parts of the site working.
  • Use your browser’s built-in tracking protection — features such as Safari’s Intelligent Tracking Prevention, Firefox’s Enhanced Tracking Protection and Brave’s Shields will block or limit our analytics cookies.
  • Ask us — email info@dechousing.org.au and we will tell you what we hold and delete any analytics record we can identify as yours.

Change your cookie choice

Global Privacy Control (GPC). Some browsers and browser extensions can send a Global Privacy Control signal telling websites you do not want to be tracked, or do not want your information sold or shared. Our website recognises this signal automatically. If your browser sends it, we do not load Google Analytics at all for your visit and no analytics cookies are set — you do not need to do anything else. We also do not sell or share personal information for advertising, so there is nothing further to opt out of on that basis. The opt-out methods listed above remain available regardless of any browser signal.

9. Do Not Sell or Share My Personal Information

DEC Housing does not sell your personal information, and never has. We do not:

  • sell, rent, trade or licence personal information to anyone, for money or for anything else of value
  • share personal information for cross-context behavioural advertising or targeted advertising
  • disclose personal information to data brokers, advertising networks or list-rental services
  • use sensitive personal information for any purpose other than providing and improving our services and meeting our legal obligations.

Because we do not sell or share personal information, there is no sale or sharing for you to opt out of. If you would still like us to record an opt-out preference against your details, or if you would like us to stop using analytics that identify your visit, email info@dechousing.org.au with the subject line “Do Not Sell or Share”, or call 1300 530 399. We will action your request within 30 days at no cost to you, and we will not discriminate against you or reduce the services you receive because you made the request. An authorised agent may make this request on your behalf.

To stop analytics on this device straight away, use Change your cookie choice and choose “Reject cookies”.

Email a Do Not Sell or Share requestChange your cookie choice

10. Why we collect personal information

Personal information is collected for the purposes of providing accommodation, care and services. The information may be used to:

  • assess your eligibility and suitability for an SDA vacancy and match you with appropriate housing
  • provide and administer support services and tenancies
  • enable service providers and medical practitioners to provide care and services
  • respond to your enquiries, feedback and complaints
  • meet our reporting, funding, audit and compliance obligations to the NDIA, the NDIS Quality and Safeguards Commission, the ACNC and other regulators
  • operate, secure, maintain and improve our websites and services
  • keep you informed about our services, where you have asked us to.

11. Disclosure of personal information

We may disclose your personal and health information, for the purpose of your care and services, to:

  • service providers who assist us in providing care and services, medical practitioners, external health agencies such as the ambulance service, hospitals, the National Disability Insurance Scheme, and other relevant government organisations
  • a person you have nominated as being your advocate — for example a parent, child or sibling, spouse, a relative, a member of your household, a guardian, an enduring power of attorney, or a person you have nominated to be contacted in case of emergency, provided they are at least 18 years of age
  • our professional advisers, including lawyers, accountants and auditors, who are bound by confidentiality obligations
  • our technology suppliers, who host our website, deliver our email and store our records under contract, and who may only handle personal information on our instructions.

We may not use or disclose personal information for a purpose other than providing care and services, unless:

  • you have consented
  • the purpose is related to providing care and services, and you would reasonably expect disclosure of the information for that purpose
  • we believe on reasonable grounds that the disclosure is necessary to prevent or lessen a serious and imminent threat to your life, health or safety, or a serious threat to public health or public safety
  • we have reason to suspect unlawful activity, or the disclosure is required or authorised by or under law or a court or tribunal order.

12. Overseas disclosure

We do not disclose participant, tenant or applicant records to overseas recipients. Those records are held in Australia.

However, some of the website technologies described in section 7 are provided by companies based outside Australia, and using them means limited technical information about your visit may be sent overseas:

  • Google LLC (Google Analytics and reCAPTCHA) — the United States and other countries in which Google maintains data centres. Google Analytics only receives any information if you have accepted analytics; reCAPTCHA operates on our forms as a necessary security measure.
  • OpenStreetMap Foundation (map tiles) — the United Kingdom and the European Union.
  • Elementor Ltd. (accessibility widget) — Israel and the European Union.

The information disclosed to these providers is limited to technical and usage information such as your IP address, device and browser details, and the pages you view. It does not include your NDIS information, your health information or the contents of your enquiry, other than where reCAPTCHA assesses a form submission. Before disclosing information to an overseas recipient we take reasonable steps to ensure the recipient does not breach the Australian Privacy Principles, as required by APP 8. If you would prefer that no information about your visit is sent overseas, use the opt-out options in section 8 and contact us by phone rather than through our web forms.

13. Direct marketing

We do not sell or rent our contact lists, and we do not use your information for third-party marketing. If we send you information about our services, we will only do so where you have asked us to or would reasonably expect it, and every message will include a simple way to opt out. You can also opt out at any time by emailing info@dechousing.org.au or calling 1300 530 399, and you can ask us to tell you where we obtained your information.

14. Government related identifiers

We collect NDIS participant numbers and may receive other government related identifiers where this is necessary to deliver services, claim payments or meet our legal obligations. We do not adopt a government related identifier as our own identifier for you, and we do not use or disclose one except as permitted by APP 9.

15. Children’s and young people’s privacy

Our websites are designed for adults — for people seeking accommodation, their families and carers, support coordinators and industry partners. They are not directed at children, and we do not knowingly collect personal information directly from a child under 16 through our websites, nor do we knowingly allow children under 16 to submit our online forms.

We ask that children under 16 do not submit personal information through our website. If you are under 16, please ask a parent, guardian or carer to contact us on your behalf.

If we become aware that we have collected personal information directly from a child under 16 through our website without the consent of a parent or guardian, we will delete that information promptly. If you believe a child has provided personal information to us, contact our Privacy Officer at info@dechousing.org.au or on 1300 530 399 and we will investigate and delete it.

We do not knowingly serve advertising to children, we do not build profiles of children, and we do not sell or share the personal information of anyone under 18.

Children and young people we support. Separately from our websites, we may hold personal and health information about children and young people who are, or may become, residents in the accommodation we provide. That information is collected from, and disclosed to, a parent, guardian or authorised representative, and is handled in accordance with this policy, the Privacy Act and the NDIS Practice Standards. Where a young person has the capacity to make their own decisions about their personal information, we will deal with them directly and respect their choices.

16. Security of personal information

We take all reasonable steps to ensure that the personal information we hold is protected against misuse, interference, loss, and unauthorised access, modification or disclosure. We hold personal information in both hard copy and electronic forms in secure databases on secure premises and on secure, cloud-based technology, accessible only by our authorised staff. Our measures include encryption of our website traffic (HTTPS), access controls and role-based permissions, multi-factor authentication on key systems, monitoring and login protection on our website, staff training and confidentiality obligations, and contractual protections with the suppliers who handle information on our behalf.

No method of transmission over the internet is completely secure. If you are sending us sensitive or health information, please contact us by phone rather than through our website forms or by unencrypted email.

17. Data breaches

In the event that your personal information is lost, stolen or subject to unauthorised access or disclosure, we will implement our Management of Data Breach Policy and Procedure. We will assess any suspected breach within 30 days.

Where a data breach is likely to result in serious harm to any individual whose information is involved, we will notify the affected individuals and the Office of the Australian Information Commissioner (OAIC) as soon as practicable, in accordance with the Notifiable Data Breaches scheme in Part IIIC of the Privacy Act. Where the breach involves NDIS participants, we will also notify the NDIS Quality and Safeguards Commission as required.

18. How long we keep personal information

We keep personal information only for as long as we need it for the purposes described in this policy, or for as long as we are required to keep it by law — including the record-keeping obligations in the NDIS Practice Standards, residential tenancy laws, workplace laws and the Corporations Act 2001 (Cth). Records relating to the provision of supports to an NDIS participant are generally retained for at least seven years.

When personal information is no longer needed and we are not required to retain it, we destroy it securely or de-identify it. Website analytics information is retained only for the limited period configured in our Google Analytics account, after which Google deletes it. Website server and security logs are retained for a short period for troubleshooting and security purposes.

19. Accessing and correcting the information we hold about you

Under the Privacy Act, you have a right to access the personal information we collect and hold about you, and to ask us to correct it if it is inaccurate, out of date, incomplete, irrelevant or misleading. If at any time you would like to access or change the personal information that we hold about you, or you would like more information on our approach to privacy, please contact our Privacy Officer.

To obtain access to your personal information, you will have to provide us with proof of identity. We will take all reasonable steps to provide access to your personal information within seven (7) days of your request, and in any case within 30 days. We do not charge a fee for making a request, and we will not charge for correcting your information. If we refuse access, or refuse to make a correction, we will tell you in writing why, and how you can complain about that decision.

20. Your privacy rights — summary

You have the right to:

  • be told what personal information we collect, why we collect it, and who we disclose it to — this policy is how we do that
  • deal with us anonymously or under a pseudonym where practicable
  • access the personal information we hold about you
  • ask us to correct information that is wrong, out of date or incomplete
  • ask us to delete or de-identify information we no longer need to keep
  • withdraw your consent to our collection, use or disclosure of your information at any time
  • opt out of analytics tracking and of any direct marketing
  • confirm that we do not sell or share your personal information
  • have someone — a family member, carer, advocate, support coordinator or authorised agent — exercise these rights for you
  • complain to us, and to escalate your complaint to a regulator, without it affecting the services you receive.

To exercise any of these rights, contact our Privacy Officer using the details in section 1. We will not discriminate against you, refuse you services, or treat you differently because you exercised a privacy right.

21. Visitors from outside Australia

Our services are provided in Australia and this policy is written to comply with Australian law. If you access our websites from outside Australia, additional rights may apply to you under your local law:

  • European Economic Area and United Kingdom. Where the GDPR or UK GDPR applies, our lawful bases for processing are your consent (analytics), performance of a contract or steps taken at your request (enquiries and tenancies), compliance with a legal obligation (regulatory reporting), and our legitimate interests (website security and improvement). You may have rights of access, rectification, erasure, restriction, objection and data portability, and a right to lodge a complaint with your local supervisory authority.
  • California and other United States jurisdictions. We do not sell or share personal information as those terms are defined in the California Consumer Privacy Act as amended by the CPRA, and we do not use or disclose sensitive personal information for purposes that would require a right to limit. You have rights to know, delete, correct and opt out as described in sections 8, 9 and 19, and a right not to be discriminated against for exercising them.

To exercise any of these rights, contact our Privacy Officer using the details in section 1.

22. Automated decision-making

We do not use automated decision-making or profiling to make decisions that have a legal or similarly significant effect on you. Decisions about SDA eligibility, vacancy matching and tenancies are made by our staff. If this changes, we will update this policy and explain what information is used and how the decision is made.

23. Employee and volunteer records

Records of current and past employees which are related to the employment relationship are managed in accordance with workplace laws. Privacy laws may apply to employee personal information if the information is used for something that is not related to the employment relationship between our organisation and the employee.

Personal information collected and held by us in relation to our volunteers will be managed in accordance with the Privacy Act. Information collected during recruitment, including from applicants who are not successful, is handled in accordance with this policy and destroyed when it is no longer needed.

Our websites contain links to other sites, including the NDIS, the NDIS Quality and Safeguards Commission, the ACNC, National Disability Services and our social media pages. We are not responsible for the privacy practices or the content of those websites. We encourage you to read the privacy policy of any website you visit from a link on our site.

25. Privacy complaints

All complaints regarding privacy can be lodged with our Privacy Officer using the contact details in section 1, or through our feedback and complaints process.

At all times, privacy complaints will:

  • be treated seriously
  • be dealt with as promptly as possible
  • be dealt with in a confidential manner
  • not affect your existing entitlements or the commercial arrangements between you and us.

We will acknowledge your complaint promptly, tell you when you can expect a response, and inform you of the outcome following completion of our investigation. You are welcome to have a support person, family member or advocate assist you.

If you are not satisfied with our response, you can escalate your complaint to:

  • Office of the Australian Information Commissioner (OAIC) — phone 1300 363 992, or visit oaic.gov.au. Generally the OAIC will ask that you complain to us first and allow us 30 days to respond.
  • NDIS Quality and Safeguards Commission (for NDIS participants) — phone 1800 035 544, or visit ndiscommission.gov.au.

26. Changes to this policy

We review this Privacy Policy at least annually, and update it whenever there is a material change to how we collect, use, disclose or protect personal information — including whenever we add or remove a tracking technology on our websites. When we update it, we change the “Last updated” date and version number at the top of this page. Where a change is significant, we will take reasonable steps to bring it to your attention. We encourage you to review this page from time to time. This version replaces all earlier versions of our Privacy Policy.