Legal Centre
Privacy compliance statement
Backed is built to meet the Australian Privacy Principles in the Privacy Act 1988 (Cth). Where a customer or a person is covered by New Zealand’s Privacy Act 2020 or the EU or UK GDPR, the commitments below apply to them too.
An SC number is a control in the platform’s security control map: a rule the server enforces, each with the automated tests that prove it. We can show any of them to a customer on request, under confidentiality.
Australian Privacy Principles (Privacy Act 1988)
| Principle | How Backed meets it | Evidence |
|---|---|---|
| APP 1 Open and transparent management of personal information | Our Privacy Policy is published with every earlier version. Every stored field has a declared data class and purpose, and a field without one fails the platform’s checks. | SC-100 · SC-101 · Privacy Policy |
| APP 2 Anonymity and pseudonymity | You can read this website and ask general questions without saying who you are. Applying for funding usually cannot be anonymous, because a funder has to know who it is funding. | Privacy Policy, “Information we collect” |
| APP 3 Collection of solicited personal information | The platform collects what a funder’s programme asks for and what running the service needs. Nothing the platform ships asks for sensitive information, and a funder that adds such a question can limit which answers are shown, field by field. | SC-99 · SC-100 · Data-use register |
| APP 4 Dealing with unsolicited personal information | When we no longer need personal information and no law requires us to keep it, including information we did not ask for, we destroy or de-identify it. | Privacy Policy, “How long we keep information” |
| APP 5 Notification of the collection of personal information | Our Privacy Policy is linked from every page of this site and from the sign-in pages. For what a funder’s forms collect, the funder’s own privacy policy or collection notice explains why it needs the information. | Privacy Policy · Privacy Policy, “Our role, and the funder’s” |
| APP 6 Use or disclosure of personal information | Personal information is used only for the purposes in the data-use register, each with its basis, and shared only as our Privacy Policy says. Every feature that shares information outside the platform is off until a funder turns it on. | Data-use register · Privacy Policy, “Sharing” · SC-100 · SC-107 |
| APP 7 Direct marketing | The product holds no marketing lists or marketing preferences, and nothing a funder holds is used for our marketing. | SC-97 |
| APP 8 Cross-border disclosure of personal information | Every subprocessor is published with the country it processes in, and customers get 30 days’ notice, with the right to object, before a new one starts. | SC-108 · Subprocessor list (Legal Centre) |
| APP 9 Adoption, use or disclosure of government related identifiers | Every person and record is identified by the platform’s own number. A government identifier a funder collects, such as an ABN, is held as information, never used as the platform’s identifier for anyone. | SC-100 |
| APP 10 Quality of personal information | People keep their own profile details up to date, and a new email address takes effect only once it is confirmed. Every change to an answer is kept as a new version, and a change to a field a funder marks for review waits for its approval. | SC-52 · SC-83 |
| APP 11 Security of personal information | Every request is checked on the server for a live session, permission and organisation; each funder’s data is kept apart in the database itself; uploads are scanned; secrets never reach the logs; the audit trail cannot be edited; a Backed operator reading customer data through the platform’s operator screens needs a recorded confidentiality undertaking. | SC-1 · SC-3 · SC-23 · SC-30 · SC-35 · SC-39 · SC-98 · SC-105 |
| APP 12 Access to personal information | Anyone can ask what we hold about them, free, and we answer within 30 days. Requests about information in a funder’s portal go to the funder, and we help it answer. | Privacy Policy, “Your rights and choices” |
| APP 13 Correction of personal information | People correct their own profile details from their account at any time, and can ask a funder or us to correct anything else. | Privacy Policy, “Your rights and choices” · SC-52 |
New Zealand Information Privacy Principles (Privacy Act 2020)
| Principle | How Backed meets it | Evidence |
|---|---|---|
| IPP 1 Purpose of collection | Information is collected only for the purposes in the data-use register. | Data-use register · SC-100 |
| IPP 2 Source of personal information | The platform mostly collects information from the person it is about, through the forms they fill in. A funder’s form can also ask about other people, such as a referee, and the funder decides what its forms ask. | Privacy Policy, “Information we collect” |
| IPP 3 What to tell the person | Our Privacy Policy and each funder’s collection notice say what is collected and why. | Privacy Policy |
| IPP 4 Manner of collection | Collection is lawful and fair: no hidden collection, no tracker on a sign-in page or in a portal, and on this website only the Google Analytics visit statistics the Privacy Policy describes. | SC-95 · SC-96 |
| IPP 5 Storage and security | As APP 11. | SC-1 · SC-23 · SC-39 · SC-98 |
| IPP 6 Access | As APP 12. | Privacy Policy, “Your rights and choices” |
| IPP 7 Correction | As APP 13. | Privacy Policy, “Your rights and choices” |
| IPP 8 Accuracy | As APP 10: people keep their own details current, and every change is versioned. | SC-52 |
| IPP 9 Retention | By default, platform records are kept for the life of the funder’s account. When a customer leaves, its content is returned or deleted within 30 days. | Privacy Policy, “How long we keep information” |
| IPP 10 Limits on use | As APP 6: only the purposes in the data-use register. | Data-use register · SC-100 |
| IPP 11 Limits on disclosure | As APP 6: only as our Privacy Policy says; outbound sharing stays off until enabled. | Privacy Policy, “Sharing” · SC-107 |
| IPP 12 Disclosure outside New Zealand | As APP 8: every subprocessor is published with its country. | SC-108 · Subprocessor list (Legal Centre) |
| IPP 13 Unique identifiers | As APP 9: the platform assigns its own identifiers and adopts no one else’s. | SC-100 |