Last updated: 05/10/2026
Santi Group Pty Ltd (ABN 37 652 623 428) trading as Ormeau Plan Managers (“Ormeau”, “we”, “us”, “our”) provides NDIS plan management services. We are committed to protecting your privacy and handling your personal information in line with the Privacy Act 1988 (Cth), including the Australian Privacy Principles (APPs), and our obligations as an NDIS provider.
This policy explains what personal information we collect, how we collect, use, store and disclose it, and how you can access or correct it or make a complaint. It applies to information we collect through our website (ormeaupm.com.au), our forms and portals, and when you deal with us by phone, email or in person.
This policy applies to everyone whose personal information we handle, including:
The information we collect depends on how you deal with us.
Participants and their representatives:
Sensitive information: because of the nature of NDIS supports, we may collect health information and information about disability, which is “sensitive information” under the Privacy Act. Information about a person’s disability, supports and the services they receive is often visible from NDIS plans and invoices. We only collect sensitive information with your consent (or a representative’s consent) and where it is reasonably necessary to provide our services, or where the law otherwise allows it.
Service providers: business name, ABN, contact details, bank account details, invoices, and payment and remittance records.
Website visitors and enquiries:
You can generally browse our website and read our Information Hub without telling us who you are. You can also ask to deal with us anonymously or under a pseudonym, but in most cases we cannot provide plan management services without identifying you, because the NDIS requires us to.
We collect personal information:
If we receive personal information we did not ask for, we will decide whether we could have collected it lawfully. If not, we will destroy or de-identify it where it is lawful and reasonable to do so.
Some forms and portals linked from our website are provided by other companies on our behalf:
Information you enter in these forms and portals is collected for Ormeau and stored by those providers. Those providers handle it under their own privacy policies and their agreements with us. We encourage you to read their privacy policies.
We collect, use and disclose personal information to:
We only use or disclose personal information for the purpose we collected it, a related purpose you would reasonably expect (directly related, for sensitive information), with your consent, or where the law requires or allows it.
Direct marketing: we do not use personal information for direct marketing without your consent. If we ever send you marketing messages, every message will include a simple way to opt out, and you can ask us to stop at any time.
Automated decisions: Ormeau does not use computer programs to make decisions that significantly affect your rights or interests without a person being involved.
We may disclose personal information to:
We require our contractors to keep personal information confidential and to handle it in line with the Privacy Act. We do not sell personal information.
Cookies: our website uses cookies, which are small files stored on your device. Some are needed for the website to work. Others help us understand how the website is used.
Google Analytics: we use Google Analytics, installed through Google’s Site Kit plugin, to understand how visitors use our website. This includes pages and Information Hub articles viewed, how visitors arrive (for example from a search engine or social media), the type of device and browser used, approximate location (city level), and actions such as clicking our Register, Contact, phone or email links or sharing an article. Google Analytics uses cookies such as _ga and _ga_*. It does not give us your name or contact details. This information is processed by Google, including on servers outside Australia. You can learn more in Google’s privacy policy, and opt out using the Google Analytics opt-out browser add-on.
Information Hub search: when you search the Information Hub, the words you search for and the time of the search are recorded so we can improve our articles and search results. We do not record your IP address with these searches.
Google Maps: our Contact page shows an embedded Google Map. When it loads, Google may collect information such as your IP address and set its own cookies, under Google’s privacy policy.
Fonts: our website’s fonts are stored on our own web server, so loading them does not send your information to a third party.
Social sharing: the share buttons on our articles are plain links. Nothing is sent to Facebook or LinkedIn unless you click a share button, after which their own privacy policies apply.
Links to other websites: our website links to other websites, such as the NDIS, the NDIS Quality and Safeguards Commission, government websites and our form and portal providers. We are not responsible for the privacy practices of those websites.
You can set your browser to refuse or delete cookies. Some parts of our website may not work properly if you do.
We hold personal information electronically, in our plan management software, email, file storage, and the form and portal systems described above. Our website is hosted by GoDaddy [location of servers].
We take reasonable steps to protect personal information from misuse, interference, loss, and unauthorised access, change or disclosure. These steps include access controls and passwords, limiting staff access to what they need, secure (encrypted) website connections, software updates and backups, and confidentiality requirements for staff and contractors.
We keep personal information only for as long as we need it for our services or to meet legal requirements, including NDIS and tax record-keeping rules. [Records are generally kept for at least 7 years.] When we no longer need personal information, we take reasonable steps to destroy or de-identify it.
Some of our service providers store or process information outside Australia. This includes Google, for Google Analytics and Google Maps, which may process information in the United States and other countries. [List any others confirmed by the client, e.g. email, file storage, website hosting.] Where we disclose personal information overseas, we take reasonable steps to ensure it is handled in line with the APPs.
You can ask to see the personal information we hold about you, and ask us to correct it if it is wrong, out of date or incomplete. Contact us using the details in section 14. We will respond within 30 days. We may need to confirm your identity, or your authority to act for someone else, first.
In limited cases the law allows us to refuse access, for example where giving access would unreasonably affect someone else’s privacy. If we refuse access or a correction, we will tell you why in writing and how to complain.
If a data breach is likely to result in serious harm to anyone whose information is involved, we will notify the affected people and the Office of the Australian Information Commissioner (OAIC), as required by the Notifiable Data Breaches scheme. We also manage incidents in line with our NDIS obligations.
If you have a concern about how we have handled your personal information, please contact us first (section 14). We will acknowledge your complaint within [5 business days] and aim to resolve it within 30 days.
If you are not satisfied with our response, you can complain to the Office of the Australian Information Commissioner (OAIC) at oaic.gov.au or on 1300 363 992.
If your complaint is about the quality or safety of NDIS supports or services, you can also contact the NDIS Quality and Safeguards Commission at ndiscommission.gov.au or on 1800 035 544.
Privacy Officer, Ormeau Plan Managers Email: [hello@ormeaupm.com.au] Phone: 07 5623 8756 Post: 1 Zupp Dr, Ormeau QLD 4208
If you need help communicating with us, you can use the National Relay Service or an interpreter (TIS National, 131 450).
We may update this policy from time to time. The current version will always be on our website, with the date it was last updated.