Privacy Policy

Tasmanian Bands League Incorporated (ABN 40 759 019 145) (“the League”, “TBL”, “we”, “us”) is the association of Tasmania’s community brass and concert bands. This policy explains how we handle personal information across our website (including the member portal) and the Chordinate mobile app when it is connected to our site. We handle personal information in line with the Australian Privacy Principles in the Privacy Act 1988 (Cth).

Who holds your information

The League runs one shared system for its member bands. If you are a member of a League band, your record is entered and looked after by your band, inside a workspace that only that band’s officers can open. The League keeps the system running and uses the parts of your record it needs to run registrations, transfers and contests. Each band is responsible for the accuracy of what it records about its own members.

What we collect

For members of League bands and people who register to join one:

• Identity and contact details: name, email address, phone numbers, postal address and date of birth (required at registration; we use it to apply the extra protections for members under 18 described below).
• Membership details: the band(s), ensembles and sections you play in, your instrument or part, your registration status with the League (registered, non-registered or permit player), band and League roles (for example committee positions), the date you joined and your years of service, your uniform size, whether you consent to photos of you being used for band promotion and, where you provide one, a profile photo.
• Participation records: your responses to events (yes / no / maybe and any note you add), attendance history, announcements you post and replies you make.
• Care and compliance details: emergency contact name and phone number, any medical needs you choose to tell us about and, where a role requires it, compliance information such as Working with Vulnerable People registration status, child-safety training and your agreement to the Code of Conduct.
• Parent / guardian details (under-18s): a parent or guardian’s name and email address, and a record of their decisions (whether they approve the membership, who band correspondence should go to, and whether the member may use the Chordinate app).
• Registration, transfer and permit records: requests to register with a band, to transfer between bands or to play on permit, and the decisions made on them.
• Contest records: band entries and their player lists, solo and ensemble entries, conductors, the draw and the results.
• App and device information: if you use the Chordinate app and enable notifications: a push notification token, your device’s name and platform, the app version, and your per-device notification preferences (including quiet hours).

For member bands: the names and contact details of band officers, and the invoices we issue to the band (affiliation and contest entry fees) with their payment status. Invoices are paid by bank transfer; we do not take card payments, so no card details reach our systems.

For visiting bands and other entrants from outside the League: the contact and entry details you give us when you apply to enter a contest.

For visitors to the public website: only what you submit (for example a mailing-list subscription or an account deletion request). We do not run advertising or third-party analytics trackers. Two things are worth knowing about:

• Address lookup. When you start typing an address into one of our forms, the text you type is sent to an address-search service (Photon, operated by Komoot) so it can suggest matches. Nothing else about you is sent with it.
• Audience Choice voting. At contests that run an audience vote, your ballot is stored against a random identifier created on your device for that contest only. There is no account, we do not ask your name, and we do not record your IP address. Individual ballots are deleted once the result is final; only the totals are kept.

How we use it

• Running each band: scheduling rehearsals and performances, collecting RSVPs, taking attendance, and communicating with members by email and push notification.
• Running the League: player registrations, transfers and permits, contest entries and eligibility, the draw, results, and recognising long service.
• Publishing announcements and news to the right audience (the whole League, a band, an ensemble, a section, or a committee).
• Publishing contest results and the League’s history. Results, honour rolls and office-bearer lists on the public website name bands, conductors, soloists and award recipients, as contest programmes always have.
• Issuing and tracking invoices to member bands, and sending renewal or compliance reminders.
• Maintaining the member directory (see “What other members can see” below).
• Keeping members safe: any member can report an announcement or reply as inappropriate. A copy of the reported content, its author and the reporter’s name goes to the League Secretary so it can be acted on.
• Meeting our legal and association-governance obligations.

We do not sell personal information, and we do not use it for third-party advertising.

What other members can see

• Everything in the member area is scoped to your own band(s): you see the events, announcements and directory of the bands and ensembles you belong to, plus public events. Members of one band cannot see another band’s members.
• The directory shows names, sections and parts. Your phone number and email are shown to other members of your band only if you opt in (you choose phone and email separately in your profile). Your own band’s officers can see contact details regardless, so the band can reach you.
• Members under 18 never have their contact details shown to other members in the directory or the app, even if the opt-in is ticked.
• Event responses (who answered yes / no / maybe, with any note) are visible to members of the invited band(s) to the extent each event’s settings allow. An event can show all responses, counts only, or only your own.
• Committee-only events and announcements are visible only to members of that committee.
• Sensitive details (date of birth, address, medical needs, emergency contacts, guardian details and compliance records) are restricted to you and to the authorised officers of your own band — by default its Band Admin and Band Secretary.
• League committee members and office bearers see rosters, registration status, transfers and contest entries across all bands, because that is what running the League requires. They do not see the sensitive details above.
• The site administrator (webmaster) has technical access for maintenance only, under a duty of confidentiality.

The Chordinate app

Chordinate is the companion mobile app for members of League bands. It signs in to the same member account and shows the same band-scoped information as the member portal. When you use it:

• Your sign-in token is stored in your device’s secure storage.
• Members under 18 can sign in to the app only if a parent or guardian has given permission (see “Young members” below). The app has no private member-to-member messaging; communication is limited to announcements posted by band leaders and replies to them.
• The schedule and announcements are cached on your device so the app works offline; read/unread state is kept on the device.
• If you turn on biometric lock, the fingerprint / face check happens entirely on your device using the operating system’s own mechanism. Biometric data is never sent to us and we cannot access it.
• Calendar access is used only when you tap “Add to calendar”, and only to add that event.
• The app contains no ads and no third-party analytics or tracking SDKs.
• Signing out removes your sign-in token and unregisters the device from push notifications.

Your band’s own website

A member band can connect its own website to the League system, so that its members have one account and one set of details rather than two.

• Through a secured connection issued to that band alone, the band’s website can show and update its own members’ records, events and announcements. It cannot see any other band’s members.
• If you choose “Sign in with TBL” on your band’s website, we confirm to that website who you are: your name, your email address, and your membership and roles in that band. Nothing about any other band you belong to is passed on.

Each band is responsible for its own website, which may have its own privacy policy.

Who we share information with

We use a small number of service providers to run our systems. They process data on our behalf and are not permitted to use it for their own purposes:

• Railway hosts our website and database.
• Cloudflare stores uploaded photos and documents.
• Microsoft 365 or Resend delivers our emails.
• Expo, Apple and Google deliver push notifications to your device.
• Photon (Komoot) suggests addresses as you type one into a form.

Some providers store data outside Australia. We only share what each service needs to do its job. Beyond these providers and your own band’s website, we disclose personal information only with your consent or where the law requires it.

Young members

We apply extra protections to members under 18 (identified by date of birth):

• A parent or guardian registers them. When someone under 18 joins a band, the registration is completed or approved by a parent or guardian through a link emailed to the guardian’s own address, and the membership does not begin until then. We collect the guardian’s name and email address, and the guardian tells us who band correspondence should go to.
• The guardian decides about the app. The guardian chooses whether the member may use the Chordinate app. Without that permission the member cannot sign in to the app. The guardian can change this decision at any time by contacting the band or the League.
• Their contact details are never shared. An under-18 member’s phone number, email and address are never shown to other members in the directory, on the website or in the app, even if the sharing opt-in is ticked. Only the authorised officers of their own band can see them, for band administration.
• No one can privately message them. It isn’t possible. Under-18 members can read their band’s announcements and post replies, but our website and app have no direct-messaging feature at all, for anyone. All communication happens in group announcements and their replies.
• Posts are seen and moderated by the band’s leaders. Announcements and replies are visible to the officers who run the band, and they moderate what is posted. Any member can also report any post or reply with one tap, and the report goes straight to the League Secretary.
• A parent or guardian consents to this policy on the member’s behalf, can be given their own sign-in linked to the member’s record, and can exercise all of the rights below for them.

Security and retention

All traffic to our website and app is encrypted (HTTPS). Passwords are stored only as salted hashes, and accounts lock after repeated failed sign-ins. Access to member information is role-based and enforced on our servers on every request: ordinary members, band officers, League office bearers and administrators each see only what their role permits.

We keep membership records while you are a member of a League band and for a reasonable period afterwards for association and financial record-keeping (financial records are kept as required by Australian law), after which they are deleted. The League’s register of players and transfers, contest results and honour rolls are kept as the permanent record of the League’s history. Audience Choice ballots are deleted once the result is final.

Your rights

• You can view and update most of your details yourself in the member portal or the app.
• You can ask us, or your band, for a copy of the personal information held about you, or ask for it to be corrected or deleted.
• You can request deletion of your account and associated data at any time via our account deletion page. Records we are required to keep (for example financial records, and registration history required by League rules) are retained for the mandated period.
• You can turn notifications off per category and per device at any time, and unsubscribe from the mailing list via the link in any email.

To make a request or a complaint, email the League Secretary at secretary@tbl.org.au. If you are not satisfied with our response, you can contact the Office of the Australian Information Commissioner (oaic.gov.au).

Changes to this policy

If we change how we handle personal information, we will update this page and the “last updated” date above, and flag significant changes to members directly. Using our website, member portal and app is also covered by our Terms of Service.