Get in touch

Privacy Policy

CH3CKPOINT PTY LTD
ABN 64 702 506 125
Version 2.0 (web), October 2026

1. About this policy

This policy explains how CH3CKPOINT PTY LTD ("CH3CKPOINT", "we", "us") collects, uses, stores and shares personal information. It covers participants, families and carers, guardians, support coordinators, plan managers and other professionals, job applicants, and anyone who visits our website or contacts us.

We follow the Privacy Act 1988 (Cth) and the Australian Privacy Principles. We also follow the NDIS Code of Conduct, which requires us to respect the privacy of people with disability.

If anything in this policy is unclear, please ask us. We can explain it by phone or in person, or give you an Easy Read version.

2. Who we are

CH3CKPOINT PTY LTD runs CH3CKPOINT, an esports hub for NDIS participants in Adelaide, South Australia. We are not a registered NDIS provider. We currently support participants whose NDIS funding is self-managed or plan-managed.

3. What information we collect

We only collect information we need to provide our services, run our business and meet our legal duties.

Participants

  • Name, date of birth, contact details, and emergency contacts.
  • NDIS number, plan management type, the funding categories relevant to our services, plan dates and plan manager details.
  • Information about disability, health, support needs, communication preferences, sensory needs, medications, allergies and anything else we need to support you safely. This is sensitive information under privacy law, and we treat it with extra care.
  • Your goals, session notes, progress reports, assessment results and exit reports.
  • Incident records, if something happens at a session.
  • Photos or video, only if you agree (see section 10).

Families, carers, guardians and representatives

  • Names, contact details, and your relationship to the participant.
  • For participants under 18, the details of the parent or guardian who gives consent.

Support coordinators, plan managers and other professionals

  • Names, organisation, work contact details, and what you tell us about a referral.

Job applicants, staff and contractors

  • Application details, references, qualifications, and screening check details (NDIS Worker Screening Check and Working with Children Check).
  • Records about current and former employees may be covered by the employee records exemption in the Privacy Act. We still keep them secure.

Website visitors and people who contact us

  • If you email us, we keep your email address and what you write.
  • Our website does not use analytics, advertising or tracking cookies. Our website host keeps standard technical logs (such as IP address and browser type) for security and to keep the site running.

At the hub

  • Our hub computers use a content filter to keep sessions safe. It keeps a short record of websites visited on hub devices (currently about 24 hours).
  • If we install CCTV at the hub, we will put up clear signs and update this policy first.

4. How we collect information

We collect most information directly from you, for example by email, phone, intake calls, forms and the service agreement.

We may also collect information from other people with your agreement. This could be your parent, guardian or nominee, your support coordinator, or your plan manager. We also record information during sessions, such as session notes and progress reports.

If you are referring someone else. Please make sure the person (or their parent or guardian) agrees before you contact us. In your first email, just send their first name, your contact details and the service they are interested in. Please do not send NDIS numbers, diagnoses or plan details by email until we ask. We will collect them securely at intake.

You can contact us without giving your name. You can ask general questions anonymously or under a different name. We will need your real details before we can provide a service or make an NDIS claim.

If you do not give us information. If we do not have the information we need, we may not be able to provide a service safely, or to claim for it from your NDIS plan.

5. Why we use your information

We use your information to:

  • answer enquiries and referrals;
  • check whether our services suit you, and plan your support;
  • keep you safe during sessions, including in an emergency;
  • deliver sessions and write your progress and exit reports;
  • invoice your plan manager, or invoice you if you self-manage;
  • keep the records the NDIS requires;
  • meet our legal duties, including work health and safety, worker screening, incident reporting and mandatory reporting;
  • handle feedback and complaints;
  • improve our services, using information that does not identify you wherever we can.

We only use your sensitive information with your consent, or where the law allows or requires it. We do not use your information for any other purpose unless you agree, or the law allows it.

We do not make decisions about you using automated systems. A person makes every decision about your support.

6. Participants under 18 and consent

For participants under 18, we ask a parent or guardian to give consent and sign the service agreement. We still talk with the young person, explain things in a way that works for them, and take their views seriously.

Adult participants make their own privacy decisions. If you have a nominee, guardian or someone who helps you make decisions, tell us how you would like us to involve them.

7. Your NDIS number

We use your NDIS number only to make and check NDIS claims and invoices, and when we deal with your plan manager or the NDIA. We do not use it as our own customer number, and we do not share it for any other reason unless the law requires us to.

8. Who we share information with

We share only what is needed:

  • Your plan manager, to send invoices. Invoices show your name, NDIS number, the support item, the dates and the amount.
  • Your support coordinator or other providers, only with your consent. For example, we share a progress or exit report with them only if you ask us to.
  • Your emergency contact, ambulance or hospital, in an emergency.
  • Service providers who help us run the business, such as email and document storage, website hosting, our content filter, payroll, accounting, legal advice and insurance. They may only use the information to provide their service to us.
  • Government and regulators where the law requires it. This includes child protection reporting (Child Abuse Report Line), the police, the NDIS Quality and Safeguards Commission, the NDIA, and courts or other bodies with a legal power to ask.
  • The NDIA, for claims, but only once we are a registered NDIS provider. We are not registered now, so this does not currently apply.

We do not sell, rent or trade personal information. We do not use it for advertising.

9. Research

At the date of this policy, CH3CKPOINT has no research partnership in place, and no research is carried out in our program. We're in discussions with a university about a possible research partnership. Nothing is confirmed yet.

If a research partnership goes ahead, taking part in research will always be voluntary and will need your separate, written research consent. Saying no to research will never affect your service. We will update this policy to name the research partner before any research begins.

10. Photos, video and streaming

We only take photos or video of participants with consent, and with a parent or guardian's consent for participants under 18. You can say no, or change your mind at any time, and this will not affect your service.

We do not currently live-stream sessions. If we start, streaming will need a separate streaming consent, with choices such as face on screen, screen only, or not at all. We will never show a participant's full name, NDIS status or diagnosis in a stream or post.

11. Information stored outside Australia

Some of our service providers may store or process information outside Australia. This includes our email and document system (Microsoft 365), our website host (Vercel) and our content filter (Cloudflare), whose systems may be in countries including the United States. We choose reputable providers and take reasonable steps to make sure they protect personal information in line with Australian privacy law.

12. How we keep information safe

  • We use password-protected accounts and turn on multi-factor authentication wherever our systems offer it.
  • Staff can see only the information they need for their role.
  • We keep paper records locked away and keep as few of them as we can.
  • Everyone who works with us is trained in privacy and confidentiality before they start.

If there is a data breach. If we think personal information has been lost, or accessed or shared without permission, we will act quickly to contain it and assess the harm. Where the breach is likely to cause serious harm, we will tell the people affected and the Office of the Australian Information Commissioner, as the Notifiable Data Breaches scheme requires.

13. How long we keep information

We keep participant records for at least 7 years after our last service to you, as NDIS record-keeping rules require. For participants under 18, we keep records until the participant turns 25 or for 7 years, whichever is later. Some records, such as those about the safety of children, may need to be kept for longer. When we no longer need information, we securely destroy it or remove anything that identifies you.

14. Seeing and correcting your information

You can ask to see the personal information we hold about you, and ask us to correct it if it is wrong, out of date or incomplete. Email hamid@ch3ckpoint.com.au or ask any of our team. We will respond within 30 days. There is no charge. If we cannot give you access, or we do not agree to a correction, we will explain why in writing and tell you how to complain.

15. Marketing

We will only send you news or updates if you agree. You can unsubscribe at any time.

16. Privacy complaints

If you are worried about how we have handled your information, please tell us first: hamid@ch3ckpoint.com.au or Shop 3, 36-42 Wright Street, Adelaide SA 5000. We will acknowledge your complaint within 2 business days and respond within 30 days. See our Complaints and Feedback page for how we handle complaints.

If you are not happy with our response, you can contact:

You can also contact the NDIS Commission directly at any time.

17. Changes to this policy

We review this policy at least once a year, and when our services change. The current version is always on our website, and we can give you a copy on request. If we make an important change, we will tell participants and families directly.

Last updated 5 October 2026