data breach response & notification

1. Purpose
Resolute Strength & Conditioning (RSC) is committed to protecting the privacy, confidentiality and security of personal information entrusted to the business.
This policy establishes the procedures for identifying, reporting, containing, investigating and responding to actual or suspected data breaches.
Its objectives are to:

Protect athletes, parents, guardians, clients and staff from harm resulting from compromised information.
Establish clear responsibilities and response procedures.
Minimise unauthorised access, disclosure, alteration or loss of personal information.
Preserve evidence and maintain accurate incident records.
Meet applicable obligations under the Privacy Act 1988 (Cth) and the Notifiable Data Breaches (NDB) scheme.
Restore affected services safely and implement measures to prevent recurrence.

This policy applies regardless of whether an incident results from malicious activity, human error, system failure or third-party compromise.
2. Scope
This policy applies to all personal information collected, stored, processed or accessed by RSC, including information managed through:

Resolute Periodisation Calendar.
HubFit athlete management and training applications.
Supabase databases and authentication services.
Netlify hosting and serverless functions.
Calendly scheduling and booking integrations.
Wix Studio websites and associated forms.
Email, cloud storage, spreadsheets, downloaded backups and other business systems.

It applies to the business owner, employees, contractors, authorised coaches, technology providers and any other parties granted access to RSC information.
3. Personal information covered
Information protected under this policy may include:
Identification and contact information: Names, dates of birth, ages, email addresses, telephone numbers, emergency contacts and parent or guardian details.
Athlete performance information: Strength assessments, sprint results, conditioning assessments, training history, body measurements, performance testing and athlete development records.
Health and wellbeing information: Injury information, physical limitations, wellness questionnaires, fatigue, soreness, recovery indicators and other health-related information collected during coaching.
Account and technical information: Login credentials, authentication records, account identifiers, access logs, integration tokens and API credentials.
Particular care must be taken when handling information relating to children and adolescents, health information, and combinations of records that could identify or expose an athlete.
4. Definition of a data breach
A data breach occurs when personal information is accessed or disclosed without authorisation, or is lost in circumstances that compromise its security.
Examples include:

Unauthorised access to the Periodisation Calendar or athlete profiles.
A compromised Supabase, HubFit, Netlify or email account.
Exposure of database records through incorrectly configured permissions.
Theft or disclosure of API keys or authentication credentials.
Accidental distribution of an athlete's information to another individual.
Loss or theft of an unencrypted device containing personal information.
Unauthorised downloading, copying or exporting of athlete records.
Malware, ransomware or other malicious activity affecting business systems.
Exposure of confidential information through publicly accessible files, backups or logs.

A security vulnerability does not automatically establish that a data breach has occurred. However, vulnerabilities involving personal information must be investigated promptly to determine whether information was accessed, disclosed or lost.
5. Roles and responsibilities
Business Owner / Privacy Officer
The business owner is responsible for overseeing the response to suspected and confirmed data breaches.
Responsibilities include:

Receiving and assessing incident reports.
Coordinating containment and investigation.
Authorising emergency security measures.
Contacting relevant technology providers.
Determining whether external technical or legal assistance is required.
Assessing notification obligations.
Communicating with affected individuals and their parents or guardians where appropriate.
Maintaining incident documentation.
Approving recovery and corrective actions.

Authorised staff and contractors
Any person who becomes aware of a suspected data breach must immediately notify the business owner.
Staff must not independently delete evidence, conceal incidents, disclose confidential information or attempt unauthorised investigations.
External service providers
Where an incident involves a third-party system, RSC will seek relevant technical assistance and information from the provider, including incident scope, affected records, access logs, containment actions and recovery measures.
6. Incident response procedures
RSC will follow four principal response stages.
Stage 1 – Contain
Objective: Prevent further unauthorised access, disclosure, loss or compromise.
Upon discovering a suspected breach, RSC will take appropriate immediate action, which may include:

Restricting or suspending compromised accounts.
Revoking exposed credentials, access tokens or API keys.
Disabling affected integrations or endpoints where necessary.
Correcting database permissions and access-control vulnerabilities.
Isolating affected devices or services.
Securing backups and preventing further unauthorised downloads.
Preserving logs, records and other relevant evidence.
Contacting affected technology providers.

Containment measures must consider the need to preserve evidence and avoid unnecessary destruction or alteration of records.
Stage 2 – Assess
Objective: Establish what occurred, what information was affected and the likelihood of harm.
The assessment will consider:

When the incident occurred and was discovered.
How the incident occurred.
Whether unauthorised access or disclosure took place.
Which systems, accounts and databases were affected.
The categories and sensitivity of personal information involved.
The number and identity of potentially affected individuals.
Whether junior athletes or health information were involved.
Whether information was downloaded, copied, modified or deleted.
Whether the information is encrypted or otherwise protected.
Whether the information can be recovered or secured.
The likelihood and seriousness of potential harm.
Whether remedial action has prevented the likely risk of serious harm.

Where the NDB scheme applies and RSC has reasonable grounds to suspect an eligible data breach, RSC will undertake a reasonable and expeditious assessment, taking all reasonable steps to complete it within 30 calendar days of becoming aware of the grounds for suspicion.
This assessment period is not a general waiting period. Investigation, containment and necessary protective communication should begin promptly.
Stage 3 – Notify
Objective: Notify affected individuals, regulators and other relevant parties when required.
RSC will assess whether the incident constitutes an eligible data breach under the NDB scheme.
Generally, an eligible data breach involves:

Unauthorised access to or disclosure of personal information, or loss where unauthorised access or disclosure is likely.
A likelihood of serious harm to one or more affected individuals.
An inability to prevent the likely risk of serious harm through remedial action.

Where RSC is subject to the NDB scheme and reasonably believes an eligible data breach has occurred, it will prepare the required statement, notify the OAIC and notify individuals at risk of serious harm as soon as practicable, unless a relevant exception applies.
Notifications will include, as required:

The name and contact details of RSC.
A description of the incident.
The types of personal information involved.
Recommended actions individuals can take to protect themselves.

Where affected individuals are under 18, RSC will consider the child's circumstances, privacy, safety and capacity when determining appropriate communication with the child and their parent or guardian, including any relevant legal arrangements.
RSC may also notify individuals voluntarily where doing so would meaningfully reduce risk, even if mandatory notification is not required.
Any public communication must be accurate, proportionate and respectful of the privacy of affected individuals.
Stage 4 – Review and prevent recurrence
Following containment and investigation, RSC will conduct a post-incident review.
This review will:

Identify the root cause.
Evaluate the effectiveness of the response.
Identify weaknesses in security controls or operational procedures.
Review account permissions and authentication.
Confirm that compromised credentials have been replaced.
Assess whether software, integrations or databases require changes.
Verify that affected systems are functioning securely.
Update staff procedures and training where appropriate.
Document corrective actions and responsibilities.
Determine whether additional monitoring or external security testing is required.

7. Incident severity classification
RSC will use the following internal classifications to prioritise response. These classifications do not replace the legal assessment required under the NDB scheme.
Critical: Confirmed or strongly suspected large-scale unauthorised disclosure, exposure of sensitive junior athlete information, active compromise of privileged systems, or circumstances presenting an immediate risk of serious harm.
High: Suspected unauthorised access to personal information, exposure of privileged credentials, or a significant vulnerability that may permit access to athlete records.
Moderate: A limited or contained incident involving personal information, with no presently identified likelihood of serious harm, subject to investigation.
Low: A security event with no identified compromise of personal information, or a vulnerability assessed as presenting limited immediate risk.
All incidents must be assessed individually. Classification may change as additional evidence becomes available.
8. Incident reporting and documentation
RSC will maintain a confidential incident register containing:

Incident reference number.
Date and time discovered.
Person reporting the incident.
Systems and services affected.
Description of the event.
Information potentially compromised.
Number of affected individuals, if known.
Containment actions and timestamps.
Investigation findings and evidence references.
Serious-harm assessment and reasoning.
Notification decisions and supporting reasons.
Notifications issued, where applicable.
Recovery actions.
Corrective measures.
Date of incident closure.
Date of follow-up review.

Incident records must be stored securely with access restricted to authorised personnel.
9. Third-party service provider incidents
Where an incident involves HubFit, Supabase, Netlify, Calendly, Wix Studio or another service provider, RSC will:

Contact the provider through its official support or security channel.
Request information about the nature and extent of the incident.
Identify whether RSC athlete information was affected.
Determine whether access tokens, credentials or integrations require changes.
Obtain relevant incident records where available.
Coordinate investigation and notification responsibilities.
Document the provider's findings and remediation actions.

RSC will not assume that a provider's notification automatically satisfies every obligation applicable to the business.
10. Security and preventative measures
RSC will maintain security controls proportionate to the sensitivity of information held, including:
Access management: Individual user accounts, least-privilege permissions, restricted administrator access and periodic account reviews.
Authentication: Strong passwords, multifactor authentication where supported, secure account recovery and appropriate session management.
Database protection: Row Level Security, access-control testing, restricted service-role credentials and monitoring of security advisories.
Application protection: Secure hosting, validated API requests, authenticated access to protected functions and secure handling of integration credentials.
Data protection: Encryption in transit, appropriate encryption at rest, secure backup storage and controlled data exports.
Operational security: Software updates, vulnerability remediation, access logging, incident monitoring and regular security reviews.
Information management: Collection of only necessary personal information, appropriate retention periods and secure deletion when records are no longer required.
11. Special considerations for junior athletes
RSC recognises that unauthorised disclosure of a child's personal information may create additional safety, privacy and wellbeing risks.
Incidents involving junior athletes will receive heightened consideration, particularly where they involve:

Health, injury or psychological wellbeing information.
Home addresses, contact details or identifiable schedules.
Parent or guardian information.
Sensitive personal circumstances.
Information that could expose an athlete to harassment, exploitation or other harm.

RSC will assess the individual circumstances of affected children and seek appropriate legal or specialist guidance where necessary.
12. Recovery and restoration
Affected systems will be restored only after RSC has reasonably established that the relevant threat has been contained and the necessary security controls are in place.
Recovery activities may include:

Restoring data from verified backups.
Reconfiguring authentication and access permissions.
Rotating compromised credentials.
Correcting vulnerable application code.
Verifying database integrity.
Testing affected integrations.
Monitoring systems for renewed suspicious activity.

Where a system cannot be restored safely, access may remain suspended until the risk is adequately addressed.
13. Training, testing and review
This policy will be reviewed at least annually and following:

A significant security incident.
Material changes to the Periodisation Calendar or connected systems.
The introduction of new service providers handling athlete information.
Significant changes to applicable privacy or data breach requirements.

RSC will periodically test its incident response procedures using realistic scenarios, such as a compromised administrator account or unintended exposure of athlete check-in information.
14. Compliance and legal obligations
RSC will assess and comply with privacy, confidentiality, contractual and data breach notification obligations applicable to its operations.
The Privacy Act 1988 (Cth), Australian Privacy Principles and Notifiable Data Breaches scheme may apply depending on the business's legal status, activities and circumstances.
RSC will seek qualified legal advice where the applicability of these obligations is uncertain or an incident presents a material risk of serious harm.
15. Policy approval
Approved by: Business Owner, Resolute Strength & Conditioning
Approval date: To be completed
Next review date: 12 months after approval
Policy status: Draft – Pending formal approval
End of Policy

data breach response & notification

Protect athletes, parents, guardians, clients and staff from harm resulting from compromised information.

Establish clear responsibilities and response procedures.

Minimise unauthorised access, disclosure, alteration or loss of personal information.

Preserve evidence and maintain accurate incident records.

Meet applicable obligations under the Privacy Act 1988 (Cth) and the Notifiable Data Breaches (NDB) scheme.

Restore affected services safely and implement measures to prevent recurrence.

This policy applies regardless of whether an incident results from malicious activity, human error, system failure or third-party compromise. 2. Scope This policy applies to all personal information collected, stored, processed or accessed by RSC, including information managed through:

Resolute Periodisation Calendar.

HubFit athlete management and training applications.

Supabase databases and authentication services.

Netlify hosting and serverless functions.

Calendly scheduling and booking integrations.

Wix Studio websites and associated forms.

Email, cloud storage, spreadsheets, downloaded backups and other business systems.

Unauthorised access to the Periodisation Calendar or athlete profiles.

A compromised Supabase, HubFit, Netlify or email account.

Exposure of database records through incorrectly configured permissions.

Theft or disclosure of API keys or authentication credentials.

Accidental distribution of an athlete's information to another individual.

Loss or theft of an unencrypted device containing personal information.

Unauthorised downloading, copying or exporting of athlete records.

Malware, ransomware or other malicious activity affecting business systems.

Exposure of confidential information through publicly accessible files, backups or logs.

Receiving and assessing incident reports.

Coordinating containment and investigation.

Authorising emergency security measures.

Contacting relevant technology providers.

Determining whether external technical or legal assistance is required.

Assessing notification obligations.

Communicating with affected individuals and their parents or guardians where appropriate.

Maintaining incident documentation.

Approving recovery and corrective actions.

Restricting or suspending compromised accounts.

Revoking exposed credentials, access tokens or API keys.

Disabling affected integrations or endpoints where necessary.

Correcting database permissions and access-control vulnerabilities.

Isolating affected devices or services.

Securing backups and preventing further unauthorised downloads.

Preserving logs, records and other relevant evidence.

Contacting affected technology providers.

Containment measures must consider the need to preserve evidence and avoid unnecessary destruction or alteration of records. Stage 2 – Assess Objective: Establish what occurred, what information was affected and the likelihood of harm. The assessment will consider:

When the incident occurred and was discovered.

How the incident occurred.

Whether unauthorised access or disclosure took place.

Which systems, accounts and databases were affected.

The categories and sensitivity of personal information involved.

The number and identity of potentially affected individuals.

Whether junior athletes or health information were involved.

Whether information was downloaded, copied, modified or deleted.

Whether the information is encrypted or otherwise protected.

Whether the information can be recovered or secured.

The likelihood and seriousness of potential harm.

Whether remedial action has prevented the likely risk of serious harm.

Unauthorised access to or disclosure of personal information, or loss where unauthorised access or disclosure is likely.

A likelihood of serious harm to one or more affected individuals.

An inability to prevent the likely risk of serious harm through remedial action.

The name and contact details of RSC.

A description of the incident.

The types of personal information involved.

Recommended actions individuals can take to protect themselves.

Identify the root cause.

Evaluate the effectiveness of the response.

Identify weaknesses in security controls or operational procedures.

Review account permissions and authentication.

Confirm that compromised credentials have been replaced.

Assess whether software, integrations or databases require changes.

Verify that affected systems are functioning securely.

Update staff procedures and training where appropriate.

Document corrective actions and responsibilities.

Determine whether additional monitoring or external security testing is required.

Incident reference number.

Date and time discovered.

Person reporting the incident.

Systems and services affected.

Description of the event.

Information potentially compromised.

Number of affected individuals, if known.

Containment actions and timestamps.

Investigation findings and evidence references.

This policy applies regardless of whether an incident results from malicious activity, human error, system failure or third-party compromise.
2. Scope
This policy applies to all personal information collected, stored, processed or accessed by RSC, including information managed through:

Containment measures must consider the need to preserve evidence and avoid unnecessary destruction or alteration of records.
Stage 2 – Assess
Objective: Establish what occurred, what information was affected and the likelihood of harm.
The assessment will consider:

Incident records must be stored securely with access restricted to authorised personnel.
9. Third-party service provider incidents
Where an incident involves HubFit, Supabase, Netlify, Calendly, Wix Studio or another service provider, RSC will:

Where a system cannot be restored safely, access may remain suspended until the risk is adequately addressed.
13. Training, testing and review
This policy will be reviewed at least annually and following: