For the purposes of this policy, "Personal Information" means information or an opinion about an identified individual, or an individual who is reasonably identifiable.
We take our obligations under the Privacy Act 1988 (the "Privacy Act") and the Australian Privacy Principles ("APPs") very seriously. We are committed to maintaining the confidentiality and security of your Personal Information and managing it in an open and transparent way. To achieve this we have implemented practices, procedures and systems to ensure we comply with the Privacy Act.
Last updated: 6 February 2014
Key privacy points: The stuff you really care about
- Customer Data is stored on servers located in Australia. We collect different types of data (we explain the difference types below), but to be clear your Customer Data, which is the data you enter into the system and includes the submissions you receive from Applicants, is stored on servers located in Australia and we do not transfer this data offshore for processing.
- We do share some data with trusted service providers. In order to manage and improve SmartyGrants we use a number of third party service providers; for example, we may use Google to manage our email. See the summary table below for details about what we share and with whom and for what purposes. Please note that a number of these service providers are located outside of Australia and that the data we pass to them will therefore be processed outside of Australia.
- Anonymity and pseudonymity: You are free to browse SmartyGrants anonymously. However, to login into the SmartyGrants service you or an organisation you work with must register an account using your actual name and email address. It is impractical for us to manage and provide support for SmartyGrants where individuals have either not identified themselves or have used a pseudonym.
Summary table: what we share with whom
|Data Collected||Parties Involved||Use of data|
|Usage Data, Device Data, Referral Data, Metadata(For example: Cookies and IP address)||
Data Controller: Our Community
|Purpose: Website performance, availability and traffic analysis.|
Data Controller: Our Community
|Purpose: The operation of SmartyGrants. Providing support to you and analysis of the usage of the site.|
Data Controller: Applicant / Grantmaker
Grants Applicants retain full control of any response they have not formally submitted you. However once a response is submitted, it falls under your control.
Any privacy or information policies you have in place will also come into play once you take control of Applicants' information. SmartyGrants will direct any Applicants with questions about Grantmakers' privacy policies to you for further information.
|Email Contents, Customer Support Queries and other data you intentionally share
(For example: Emails to email@example.com)
Data Controller: Our Community
|Purpose:To provide support for the use of SmartyGrants and to maintain appropriate business records.|
The collection of personal and sensitive information
We will only collect your Personal Information where it is reasonably necessary for us to pursue one or more of our functions or activities (see below for how and why we use your Personal Information) or we are required to by law.
Some Personal Information (e.g. race, ethnicity, health information etc.) is sensitive and requires a higher level of protection under the Privacy Act. Our Community works hard to limit how much sensitive information is collected, as we don't have a need for it ourselves; however, in operating SmartyGrants we are often in a position whereby we are collecting sensitive information on behalf Grantmakers. We will only collect your sensitive information when we have your consent; and the collection is reasonably necessary for us to pursue one or more of our functions or activities.
How we deal with unsolicited Personal Information
If we receive your Personal Information from a third party without having asked you for it, then within a reasonable time, we will determine whether we could have collected it in the ways outlined above. If we determine that it could not have been collected in one of those ways and it is lawful and reasonable to do so, then as soon as practicable we will either destroy the information or ensure that it is de-identified.
How we maintain the quality of Personal Information
We will take such steps (if any) as are reasonable in the circumstances to ensure that your Personal Information we collect, use or disclose is accurate, up-to-date, complete and relevant.
How you will know when your Personal Information is collected
Before or at the time of collecting your Personal Information (or as soon as practicable afterwards) we will place on the screen a big bold notice that ensures you are aware of the following:
- our identity and contact details;
- circumstances where we have collected your Personal Information from you without your knowledge or from someone other than you;
- circumstances where we are required or authorised by law to collect your Personal Information;
- reasons why we have collected your Personal Information;
- what may happen if we do not collect all or some of your Personal Information;
- details of the persons or entities that we usually disclose Personal Information to;
- how you may access and seek correction of your Personal Information;
- how you can lodge a complaint with us;
- whether we are likely to disclose your Personal Information to overseas recipients and if so, details of the likely countries that may receive your Personal Information.
Are there exceptions to when you need my consent to collect personal and sensitive information?
You should be aware that there are some exceptions to the need for your consent to collect sensitive information. Under the Privacy Act we don't need your consent to collect your sensitive information when it is required or authorised by law, these exceptions exist under two broad categories of situations: Permitted General Situations and Permitted Health Situations. Let us apologise now for the turgid wording of these situations, as we have taken the wording for the General Situations from the Privacy Act (to save you going to have to look it up yourself).
Permitted General Situations
General Situation 1
- it is unreasonable or impracticable to obtain your consent to the collection, use or disclosure; and
- Our Community reasonably believes that the collection, use or disclosure is necessary to lessen or prevent a serious threat to the life, health or safety of any individual, or to public health or safety.
General Situation 2
- Our Community has reason to suspect that unlawful activity, or misconduct of a serious nature, that relates to our functions or activities has been, is being or may be engaged in; and
- Our Community reasonably believes that the collection, use or disclosure is necessary in order for us to take appropriate action in relation to the matter.
General Situation 3
- Our Community reasonably believes that the collection, use or disclosure is reasonably necessary to assist any APP entity, body or person to locate a person who has been reported as missing; and
- the collection, use or disclosure complies with the rules made under subsection (2) of Section 16a of the Privacy Act.
General Situation 4
- The collection, use or disclosure is reasonably necessary for the establishment, exercise or defence of a legal or equitable claim.
General Situation 5
- The collection, use or disclosure is reasonably necessary for the purposes of a confidential alternative dispute resolution process.
Permitted Health Situations
- The details of the Permitted Health Situations are long and complex and best viewed online. Our Community believe that these situations would rarely if ever apply to the information we collect from you, so we have not listed them here.
Adoption, use or disclosure of government related identifiers
We will not adopt a government related identifier (such as your medicare or social security number) as your identifier unless:
- we are required or authorised by law;
- it is reasonably necessary to verify your identity for the purposes of our activities or functions;
- it is reasonably necessary to fulfil our obligations to an agency or State or Territory authority;
- it is required or authorised by or under an Australian law, or a court/tribunal order;
- some (but not all) permitted general situations exist;
- we reasonably believe it is reasonably necessary for enforcement related activities by, or on behalf of, an enforcement body; and
- where it is allowed under the regulations.
What data is collected and how
In the process of conducting our businesses, we collect a broad range of Personal Information about our current and prospective customers, contractors, suppliers, agents, service providers, other business associates and the people who run the businesses we deal with. This information can include such things as contact details, financial information and supporting documentation, identification and transaction history information, banking details and personal references.
We will directly collect your Personal Information unless we have your consent to collect it from a third party or we are required or authorised by law to collect it or it is unreasonable or impracticable to do so.
Information we collect directly from you:
- You need to have a registered account to log into a SmartyGrants account before you use or view any information in SmartyGrants.
- You can block or delete cookies and still use SmartyGrants, although if you do, you will then be asked for your email address and password every time you access SmartyGrants.
- We safely store data submitted through SmartyGrants - including forms, responses, reports, grant information.
Customer support queries and other data you intentionally share.
- We may collect your Personal Information or data if you submit it to us in other contexts; for example, if you email us.
- We collect usage data about you whenever you interact with our services. This may include data on which SmartyGrants webpages you visit, what you click on, when you performed those actions, and so on.
- Additionally, like most websites today, our web servers keep log files that record data each time a device accesses those servers. The log files contain data about the nature of each access, including the IP address from which the contact originated.
- Some data will contain identification numbers, which might include the ID number of your user account or application. This information in and of itself does not identify you; however, when combined with data we hold within SmartyGrants would allow us to identify your activity on our website.
Information we collect about you from other sources
- We collect data from the device and application you use to access our services, such as your IP address and browser type. We may also infer your geographic location based on your IP address.
- If you arrive at our website from an external source (such as via a link on another website or an email), we record information about the source that referred you to us.
- We use the term 'metadata' to describe the context rather than the content of the data we collect. This might include, for example, the time and date and location of the creation of the data, the size of the data (for example: word count), and the time it took to create the data. Metadata, when taken as a whole, may help us to improve our services, as well as the way you as Grantmakers provide your services to those who use SmartyGrants to apply for funding.
How we use your Personal Information
We will only hold your Personal Information for the particular purpose that we collected it ("Primary Purpose"). We will not use or disclose your Personal Information (not being sensitive information) for another purpose ("Secondary Purpose") unless:
- we first obtain your consent; or
- you would reasonably expect us to use or disclose it for a Secondary Purpose that is related to the Primary Purpose or - in the case of sensitive information - directly related to the Primary Purpose;
- we are required to by law,
- a permitted general purpose exists,
- a permitted health situation exists.
- we reasonably believe it is reasonably necessary for one or more enforcement related activities conducted by, or on behalf of, an enforcement body. In this circumstance we will make a note of such disclosure.
We collect your Personal Information for the following Primary Purposes:
To provide you with our services including:
- applying for grants via SmartyGrants.
- support you if you need technical assistance with using SmartyGrants.
- some Grantmakers may use the ABN look-up functionality, which involves SmartyGrants passing your ABN to the Australian Business Register in order to retrieve your organisation's registration details.
To manage our services: We may use your Personal Information, for the following limited purposes:
- To monitor and improve our services and features. We perform statistical and other analysis on information we collect (including usage data, device data, referral data and metadata) to study and measure user behaviour and trends, to understand how people use our services, and to monitor, troubleshoot and improve our services.
- To assist the enforcement of our Agreement with Grantmakers.
- To prevent potentially illegal activities.
- To screen for undesirable or abusive activity. For example: We have an automated virus scan that checks all file attachments.
- To create new services, features or content (public data and metadata only): We may use Usage Data, Device Data, Referral Data and any other Metadata to create and provide new services, features or content. For example, we may look at statistics like response rates, question-and-answer word counts, and the average number of questions in a form in order to publish observations and findings for informational or marketing purposes. When we do this, neither individual Grantmakers nor applicants will be identified or identifiable unless we have obtained their permission.
- To contact you about your service or account: We may occasionally send you communications of a transactional nature (for example: service-related announcements, changes to our services or policies, a password reminder email). You can't opt out of these communications since they are required in order for us to provide our services to you.
- To respond to legal requests and prevent harm: If we receive a subpoena or other legal request, we may need to inspect the data we hold to determine how to respond.
Who controls the data and how you can access it or correct it
As the data controller, Our Community is the legal entity with the right to make decisions regarding the purposes, and the methods, of processing the Personal Information we have collected from you. This includes the security measures concerning the operation and use of the data.
You can request access to the Personal Information we hold about you, or request that we change that Personal Information. We will allow access or make the changes unless we consider that there is a sound reason under any relevant law to withhold the information, or not make the changes. Such reasons included:
- we reasonably believe that giving access would pose a serious threat to the life, health or safety of any individual, or to public health or public safety; or giving access would have an unreasonable impact on the privacy of other individuals; or
- your request for access is frivolous or vexatious; or the information relates to existing or anticipated legal proceedings between us and you, and would not be accessible by the process of discovery in those proceedings; or
- giving access would reveal our intentions in relation to negotiations with you in such a way as to prejudice those negotiations; or
- giving access would be unlawful; or
- denying access is required or authorised by or under an Australian law or a court/tribunal order; or
- we have reason to suspect that unlawful activity, or misconduct of a serious nature, that relates to our functions or activities has been, is being or may be engaged in and you giving access would be likely to prejudice
- the taking of appropriate action in relation to those matters; or
- giving access would be likely to prejudice one or more enforcement related activities conducted by, or on behalf of, an enforcement body; or
- giving access would reveal evaluative information generated within the entity in connection with a commercially sensitive decision-making process.
When you make a request to access or change your Personal Information, we will require you to provide some form of identification (such as a driver's licence or passport) so we can verify that you are the person to whom the information relates. In some cases we may also request an administrative fee to cover the cost of access.
How you can make corrections or raise concerns
Circumstances when we decline to make corrections
In certain circumstances we may decline to correct your Personal Information. When this occurs we will provide you with a written notice that sets out both the reasons for the refusal, and the mechanisms available to complain about the refusal.
How we store your data and when we destroy it
We take all reasonable steps to ensure the security of the Personal Information we hold is protected from unauthorised access, destruction, use, modification or disclosure.
All registration information, as well as Customer Data used as part of SmartyGrants, are password-protected to provide additional security. We ask that you do not reveal or share your password with anyone. Our Community will never ever ask for your password, either verbally or through phone or email contact (whether initiated by you or us).
Where we share data with service providers, the data is stored in their systems and is subject to their security and privacy standards. We have been careful about selecting our service providers and believe they all take data privacy and security seriously. For your information we have also provided links to all of our service provider's privacy policies below.
When we no longer need your Personal Information for a permitted purpose and we are not required to keep it to comply with any laws, we will take such steps as are reasonable in the circumstances to destroy your Personal Information or to ensure that the information is de-identified.
If you wish to have your Personal Information deleted please let us know and we will take reasonable steps to delete it (unless we need to keep it for legal, auditing or internal risk management reasons). If Our Community is not the Data Controller (for example you have submitted Customer Data to a Grantmaker), you will need to contact the relevant Data Controller/Grantmaker, as SmartyGrants cannot modify any information it does not control.
Information disclosed to people outside of Australia
While SmartyGrants is an Australian product, our services are used by organisations all around the world to manage their grant programs. If you, or the Grantmaker you are working with, are located outside Australia, then data will be transmitted outside of Australia. However, all Customer Data stored within SmartyGrants is kept on our servers, which are physically located in Sydney, Australia.
Our Community also uses a number of service providers to handle data that is not Customer Data. Some of these service providers are located outside Australia. Their details are listed below, including the jurisdiction in which the data will be processed. By using SmartyGrants you consent to the following types
|Data Disclosed||Service Provider|
|Usage Data, Device Data, Referral Data, Metadata||
|Emails, customer support queries and other data you intentionally share with us||
Details of direct marketing
For the purposes of this policy, "direct marketing" is the promotion and sale of goods and services directly to you including through emails, SMS, phone calls and the post.
No direct marketing
We will not use or disclose your Personal Information for the purposes of direct marketing material if you have previously told us not to.
If at any time in the future you do not want us (or one of our service providers) to send you direct marketing material or you wish to cancel a previous consent, then you can simply inform our Privacy Officer. We will effect the change in a reasonable time and without charge.
Adoption of direct marketing laws
How we use your Personal Information for direct marketing is tightly controlled by the Privacy Act. We will follow those laws to ensure you only receive direct marketing in circumstances where you are expecting to. We will always provide a simple means for you to "opt-out" from receiving it which typically involves a "tick-a-box" on the collection form or through a pop-up on your screen when you provide Personal Information online.
We will not use your sensitive information for the purposes of direct marketing unless you have given us permission in writing.
Circumstances when we will send you direct marketing material
We will not use your Personal Information for the purpose of direct marketing unless we collected the information from you and you would reasonably expect that we would use or disclose the information for that purpose.
How you can contact us
- Calling (+61) 03 9320 6800
- Emailing firstname.lastname@example.org
- Sending a letter to us at:
Attn: Privacy Officer
Our Community (SmartyGrants)
PO Box 354
North Melbourne VIC 3051
- You consent to us sharing your personal data with relevant persons working for service providers who assist us to provide our services.
What you are agreeing to by using SmartyGrants
- You consent to us sharing your personal data with relevant persons working for service providers who assist us to provide our services.