Privacy policy – No Room for Racism

Last updated: 29 July 2026

No Room for Racism is a campaign run by Common Threads. This policy explains what personal information we collect through this website, why we collect it, who else gets to see it, and how you get it back, corrected or deleted.

We have written it in plain language on purpose. If anything here is unclear, email us at info@commonthreads.org.au and we will explain it.

Two things worth saying up front. We do not sell or rent your details to anyone, ever. And we do not hand your details to a political party or a candidate.

What we collect

When you add your name, sign a petition or join the list

Your first and last name. On some forms these are optional.
Your email address. Always required, because that is how the campaign talks to you.
Your postcode, if you give it. We use it to tell you what is happening near you.
Whether you ticked the box agreeing to campaign emails.
Which form you used, the date you used it, and any utm_source, utm_medium, utm_campaign, utm_term or utm_content values that were in the link you arrived on. That is how we know which ad, post or email brought you here.

When you contact us

Your name, your email address, your phone number if you choose to give it, the subject you picked, and whatever you write in the message.

When you donate

The name on your card, your email address, the amount, whether you chose to add 2% to cover the card fee, and whether the donation is one-off or monthly.

Your card number, expiry and security code are entered into fields hosted by Stripe and go straight from your browser to Stripe. They never touch our servers and we never see them.

When you make a poster

The suburb you type is used to draw the poster in your own browser. The finished poster is generated on your device.

We do send the suburb name, the template and the size to our analytics as an event, so we can see which suburbs are claiming posters. That event carries no name, email or phone number. If a download ever asks for your email before it will hand over a file, that email goes into our CRM as described below and you will be told so on the form.

Automatically, just by visiting

Your IP address, rough location derived from it, your browser and device type, the pages you look at, and the site or link that referred you. This comes through Google Tag Manager and Google Analytics, and through the server logs kept by our hosting provider.

What we do not collect

We do not collect card numbers. We do not ask about your race, ethnicity, religion, health, sexuality or political party membership, and no form on this site has a field for any of it. If you choose to tell us something like that in a message to us, we use it only to answer you.

Why we collect it

To send you campaign updates, and to tell you about things happening near you.
To count and present petition signatures and pledges to the people they are addressed to.
To answer your question, complaint or offer to help.
To take your donation, send you a receipt, and keep the financial records the law requires us to keep.
To work out which of our own materials are actually reaching people, so we do not waste money that supporters gave us.

Petition signatures deserve a specific note. Total numbers are public. Individual names are shown to the target of the petition and used in campaign reporting. They are not published on this site and they are not given to anyone else.

Who else sees your information

We use a small number of third-party services to run the campaign. Each one only gets what it needs to do its job.

Action Network is our supporter database and email tool. It receives your name, email address, postcode, phone number if you gave one, the campaign tags that describe what you signed, and the UTM values from your link. Action Network is based in the United States.
Stripe processes donations. It receives your card details, the name on the card, your email address and the amount. Stripe is based in the United States and holds an Australian financial services licence.
Freshdesk runs our contact inbox. When you use the contact form, a ticket is created in Freshdesk containing everything you put in the form. Freshdesk is operated by Freshworks, based in the United States and India.
Humanitix or Eventbrite handle event bookings. This site only reads their public event listings. If you book a ticket you do that on their site, and they collect your details under their own privacy policy, not this one.
Google, through Tag Manager and Analytics, receives the technical and usage information described above along with the conversion events we fire. It does not receive your name, email address, phone number or postcode from us.

We may share your details with a partner organisation for a specific joint activity, such as a co-hosted event. If we ever do, we will tell you at the point where you give us the information, not afterwards.

Your information leaves Australia

Action Network, Stripe, Freshdesk and Google all store data outside Australia, mostly in the United States. By using the forms on this site you accept that your information will be handled overseas, where Australian privacy law does not apply in the same way. We pick vendors that publish a privacy policy and a security posture we are willing to stand behind, but we cannot control an overseas provider the way we control our own systems.

Cookies

This site sets three first-party cookies of its own, all of them for attribution rather than advertising:

nrfr_signup_completed records that you have finished a signup on this site. It is how a gated download can recognise you and let you straight through instead of asking for your email a second time.
nrfr_signup_timestamp records when that signup happened.
nrfr_signup_source records which form you used, as a short campaign source code such as nrfr_pledge_website.

None of the three contains your name, email address or any other personal detail. They last twelve months, they are readable only by this site, and they are never used to target advertising. If you clear them, nothing breaks except that a gated download will ask for your email again.

Google Tag Manager and Google Analytics set their own cookies to tell one visit from another and one visitor from another. Those are Google's cookies, governed by Google's policies.

You can set your browser to refuse or delete cookies. The site keeps working if you do.

How long we keep it

Supporter records stay in Action Network while the campaign is running and while you are on the list. If you unsubscribe we keep a minimal suppression record so we do not accidentally email you again.
Petition signatures are kept as the record of that petition, because the petition was presented to its target with those names on it.
Contact tickets stay in Freshdesk while we may need them to deal with a follow-up, and are then deleted.
Donation records are kept for at least seven years, because Australian tax and financial record-keeping rules require it. This is the one category we cannot delete on request.

Getting a copy, fixing it or deleting it

Email info@commonthreads.org.au and tell us what you want:

A copy of what we hold about you. We will send it to you in a readable format.
A correction, if something we hold is wrong. Tell us what it should say.
Deletion. We will delete your supporter record and take you off every list. We cannot delete a donation record inside the retention period described above, and we will tell you plainly what we have kept and why.

We will get back to you within 30 days. We may ask you to confirm you are who you say you are before we hand over or delete anything, which protects you rather than us.

Unsubscribing

Every campaign email has an unsubscribe link at the bottom. It works, immediately, and it does not send you to a form that argues with you. You can also email us and we will do it for you.

Unsubscribing stops the emails. It does not delete your record. If you want the record gone as well, say so.

Security

Connections to this site are encrypted. Access to the supporter database is limited to the people running the campaign who need it. Card details are handled by Stripe and are not stored by us. Our own logs record identifiers and outcomes, not full personal details, and there is no endpoint on this site that reports our configuration back to a browser.

If a data breach happens that is likely to cause you serious harm, we will tell you and we will notify the Office of the Australian Information Commissioner, as the Notifiable Data Breaches scheme requires.

If you are under 16

You are welcome in this campaign. If you are under 16, check with a parent or guardian before you give us your details or make a donation.

Links to other sites

This site links out to other places, including Action Network petition pages, event listings and social media. Once you follow a link you are on someone else's site under someone else's privacy policy. We do not control those sites and we are not responsible for what they do with your information.

Complaints

If you think we have mishandled your personal information, tell us first at info@commonthreads.org.au. We will look into it and write back within 30 days.

If you are not satisfied with our response, you can complain to the Office of the Australian Information Commissioner:

Online: oaic.gov.au/privacy/privacy-complaints
Phone: 1300 363 992
Post: GPO Box 5218, Sydney NSW 2001

Changes to this policy

We will update this policy when what we do changes. The new version goes up on this page with a new "Last updated" date. If a change materially affects how we use information you have already given us, we will tell the people affected rather than quietly swapping the page.

Contact us

Common Threads, No Room for Racism campaign: info@commonthreads.org.au