Wonsie Pty Ltd
NDIS Provider Number: 4050130800
ABN: 49 672 305 672
Effective Date: September 2026
Review Date: September 2027
Policy Owner: Director, Wonsie Pty Ltd
1. Purpose
Wonsie Pty Ltd is committed to respecting and protecting the privacy, dignity and confidentiality of all customers and National Disability Insurance Scheme (NDIS) participants.
This policy explains how Wonsie collects, uses, stores, protects and discloses personal information and how individuals may access or correct information held about them.
Wonsie recognises that privacy is an important right of people with disability and is committed to handling participant information respectfully, securely and only for legitimate business, service-delivery and regulatory purposes.
2. Scope
This policy applies to Wonsie Pty Ltd, its Director, workers and any contractors who may have authorised access to personal or confidential information.
Wonsie supplies adaptive clothing and related products to children and adults, including NDIS participants. Wonsie does not provide direct personal care or in-person participant support.
Because of the nature of NDIS ordering and invoicing, Wonsie may nevertheless receive personal and sensitive information about participants.
3. Our Commitment
Wonsie will:
• respect the privacy, dignity and confidentiality of NDIS participants and customers;
• collect only information reasonably necessary to process orders, provide products, communicate with customers and representatives, receive payment, make NDIS claims where applicable, and meet legal or regulatory requirements;
• explain, where appropriate, why information is being collected and how it will be used;
• obtain consent where required for the collection, use or disclosure of personal information;
• take reasonable steps to ensure personal information is accurate, current and protected from unauthorised access, loss, misuse or disclosure;
• limit access to personal information to people who require it to perform their role;
• allow individuals to request access to or correction of their personal information; and
• respond appropriately to suspected privacy or data breaches.
4. Information Wonsie May Collect
Depending on the type of order or enquiry, Wonsie may collect information including:
• participant or customer name;
• NDIS participant number;
• date of birth, where required for NDIS processing;
• delivery and billing address;
• telephone number and email address;
• parent, guardian, nominee or representative details;
• plan management arrangements;
• plan manager contact and invoicing details;
• information contained in NDIS order forms, quotes and invoices;
• order, product, payment and delivery information;
• communications relating to an order or account; and
• limited information about a participant's disability, personal care or support needs where voluntarily provided and relevant to selecting or supplying an appropriate adaptive product.
Wonsie does not seek to collect unnecessary medical, disability or personal information.
5. How Information is Collected
Information may be collected through:
• the Wonsie website and online store;
• NDIS order or quote forms;
• email and telephone communication;
• invoices and payment records;
• communication with participants, parents, guardians or authorised representatives;
• plan managers;
• the NDIA or NDIS systems where Wonsie is authorised to access or submit information; and
• other information voluntarily provided to Wonsie.
Where reasonably practicable, information is collected directly from the individual concerned or their authorised representative.
6. How Personal Information is Used
Wonsie may use personal information to:
• process and fulfil orders;
• prepare quotes and invoices;
• process NDIS-funded orders and payment requests;
• communicate with participants, customers, representatives and plan managers;
• confirm NDIS or payment information where necessary;
• arrange delivery and returns;
• provide customer service;
• maintain appropriate financial and business records;
• respond to complaints or incidents; and
• meet legal, regulatory, taxation, NDIS registration and audit requirements.
Personal information will not be used for an unrelated purpose unless the individual has consented or the use is otherwise permitted or required by law.
7. Disclosure of Information
Wonsie will only disclose personal information where reasonably necessary for the purpose for which it was collected, where consent has been provided, or where disclosure is authorised or required by law.
This may include disclosure to:
• the National Disability Insurance Agency (NDIA);
• the NDIS Quality and Safeguards Commission;
• an authorised plan manager;
• a participant's authorised nominee, representative, parent or guardian;
• payment providers;
• accountants or professional advisers where necessary;
• delivery and postal providers, to the extent necessary to deliver an order;
• technology and business service providers used to operate Wonsie's systems; or
• government, regulatory or law-enforcement bodies where legally required.
Wonsie will not sell participant personal information.
Information may be disclosed without consent where Wonsie is legally required or authorised to do so, including where necessary to comply with NDIS reporting or other legal obligations.
8. Consent
Where consent is required, Wonsie will seek consent from the participant or, where appropriate, their authorised representative.
Participants and representatives will be provided with sufficient information to understand what information is being collected and why.
Consent may be withdrawn or amended, subject to any legal, financial or regulatory requirement for Wonsie to retain or use particular information.
Wonsie does not ordinarily make audio or visual recordings of NDIS participants as part of providing its products. If Wonsie proposes to collect such material for an NDIS-related purpose, informed consent will be obtained beforehand.
9. Storage and Security of Information
Wonsie takes reasonable steps to protect personal and confidential information against loss, misuse, interference, unauthorised access, modification or disclosure.
Information may be stored electronically within password-protected business systems and, where necessary, in physical business records.
Access to participant information is limited to Wonsie personnel who require access to carry out their duties.
Workers are expected to maintain confidentiality and must not access, discuss, copy or disclose participant information unless required for their work.
Paper records containing personal information are kept securely and disposed of securely when no longer required.
10. Accuracy of Information
Wonsie will take reasonable steps to ensure that personal information is accurate, complete and current.
Where Wonsie becomes aware that information may be incorrect or outdated, it will take reasonable steps to update it.
Participants, customers and representatives are encouraged to advise Wonsie if their contact, delivery, plan management or other relevant information changes.
11. Access and Correction
Individuals may request access to personal information Wonsie holds about them or request that inaccurate or outdated information be corrected.
Requests should be made directly to Wonsie. Wonsie will respond within a reasonable timeframe, subject to any legal limitations applying to access or correction.
12. Confidentiality
All Wonsie workers are expected to maintain the confidentiality of participant and customer information.
Personal information must not be discussed with family members, friends, other customers or unauthorised persons.
Information should only be accessed where necessary to perform legitimate Wonsie duties.
Confidentiality obligations continue after a worker or contractor ceases working with Wonsie.
13. Privacy and Dignity
Wonsie recognises that privacy extends beyond information security and includes treating people with disability with dignity and respect.
Wonsie will communicate respectfully and will avoid unnecessarily requesting, recording or sharing information about a participant's disability, continence, personal care or other private circumstances.
14. Privacy or Data Breaches
Any actual or suspected loss, unauthorised access, disclosure or misuse of personal information must be reported immediately to the Director.
Wonsie will:
• identify and contain the breach where possible;
• assess what information has been affected and the potential consequences;
• take reasonable steps to reduce the risk of harm;
• investigate the cause and implement corrective action; and
• make any notifications required by applicable privacy, NDIS or other legislation.
Privacy incidents will be documented where appropriate and used to improve Wonsie's information-management practices.
15. Complaints About Privacy
Anyone who believes Wonsie has not appropriately handled their personal information may make a complaint directly to Wonsie.
Complaints will be handled respectfully, confidentially and in accordance with Wonsie's Complaints Handling Policy.
Where appropriate, individuals may also contact the NDIS Quality and Safeguards Commission or another relevant privacy or regulatory body.
16. Responsibilities
The Director of Wonsie Pty Ltd is responsible for ensuring appropriate privacy and information-management systems are maintained and that privacy concerns or breaches are appropriately addressed.
All workers are responsible for:
• protecting confidential information;
• accessing personal information only when required for their duties;
• following Wonsie's privacy and information-management procedures;
• keeping passwords and systems secure; and
• immediately reporting suspected privacy breaches or inappropriate disclosures.
17. Legal and NDIS Framework
This policy has been developed with reference to applicable requirements and guidance, including:
• National Disability Insurance Scheme Act 2013;
• NDIS Code of Conduct;
• NDIS Practice Standards and Quality Indicators;
• National Disability Insurance Scheme (Provider Registration and Practice Standards) Rules 2018;
• Privacy Act 1988 and Australian Privacy Principles, where applicable to Wonsie; and
• applicable NSW privacy requirements.
The Privacy Act 1988 does not apply to every Australian small business in the same way. Wonsie will comply with privacy legislation to the extent applicable to its operations and will, regardless, maintain privacy and confidentiality practices consistent with its obligations as a registered NDIS provider.
18. Review
This policy will be reviewed at least annually and earlier where:
• privacy or NDIS requirements change;
• Wonsie's systems or business practices materially change;
• a privacy breach or incident identifies a need for improvement; or
• an audit or regulatory review identifies required changes.
