Privacy policy
Last updated 3 November 2026
DutyHouse (dutyhouse.com) helps clubs, school P&Cs, churches and community groups run volunteer rosters, duty quotas and levy refunds. This policy explains what personal information DutyHouse handles, why, and your choices. It is operated by [business name, ABN].
Who is responsible for your information
Each organisation that uses DutyHouse decides what it records about its members and volunteers, and is responsible for that information. DutyHouse stores and processes it on the organisation's behalf. For questions about what your club holds about you, contact your club first. For questions about DutyHouse itself, email [email protected].
What we hold
- People who run an organisation: name, email address, optionally a mobile number for sign-in codes, and a record of what they change (the audit log).
- Families and volunteers: names, email addresses and mobile numbers, household details, duties booked and done, and any extra details the organisation chooses to keep.
- Children: first name and age group or birth year only. Children never have accounts.
- Enquiries sent through an organisation's web page: name, email address, optionally a phone number, what you're interested in and your message. Only the organisation's team sees them.
- Working with Children Check details (number, state, expiry) where an organisation records them, visible only to people the organisation allows.
- Bank details for refunds, where an organisation pays refunds by bank transfer, visible only to people the organisation allows.
How we use it
Only to provide the service: rosters, sign-ups, reminders, duty tracking, refund calculations and the messages that go with them. We don't sell personal information or use it for advertising. Refund amounts are calculated automatically from the organisation's rules, and a person at the organisation always reviews and approves each refund batch.
Emails and texts
Every email and text message includes a one-tap link to stop receiving them. Sign-in links and codes you ask for are always sent.
Where it is stored and who helps us
- Data is stored on servers in Australia.
- Cloudflare protects and delivers the website; your connection is encrypted, and Cloudflare may process traffic at locations outside Australia.
- Resend sends our emails. Resend runs on Amazon Web Services, so email addresses and message content pass through its servers outside Australia while an email is sent. Mobile Message (an Australian provider) sends our texts.
- Where an organisation's web page form is protected by Cloudflare Turnstile, Cloudflare checks your browser to tell people from automated spam.
- Backups are encrypted and kept in Australia.
How long we keep it
Organisations' records are kept while they use DutyHouse. Children's details are removed from archived seasons after the organisation's retention period (7 years by default). Sign-in emails are deleted after a day and other sent emails after 90 days. Web page enquiries are deleted 12 months after they were last updated. Backups are kept for 30 days.
Your choices
You can ask your organisation, or us, to see or correct your information, or to delete it where the law allows. To make a privacy complaint, email [email protected]; if you're not satisfied with our reply you can contact the Office of the Australian Information Commissioner (oaic.gov.au).
Security
Sign-in is by single-use emailed links (and, where turned on, a texted code); there are no passwords to steal. Each organisation's data is kept separate, access depends on each person's role, and changes are recorded in an audit log. If a data breach is likely to cause serious harm, we will notify the people affected and the OAIC.