The short version
- This website uses Google Analytics to count visits and see which pages are used. It runs no session recording, and nothing you type into it reaches Google.
- The enquiry form sends nothing to us. It opens your own email program with your answers filled in, and we receive only what you choose to send.
- On the platform, the funder you apply to decides what its forms ask and why. We hold that information on the funder’s behalf, under contract, and use it only to provide the service.
- Platform data is hosted in Australia.
- We never sell, rent or trade personal information. We run no advertising and no ad-tracking, and nothing entered into a funder’s portal is used for our own marketing.
- You can ask what we hold about you, have it corrected, or complain. The last section says how.
1. Who we are and what this covers
Backed provides grants management software and grant administration services to organisations in Australia that distribute public and philanthropic funding. In this policy, “Backed”, “we” and “us” mean the business behind this website and that platform.
We handle personal information in accordance with the Australian Privacy Principles in the Privacy Act 1988 (Cth), and this policy is our statement under Australian Privacy Principle 1. It covers three groups of people:
- People who visit this website or contact us.
- Our customers (funders) and the staff, assessors and panel members they give access to the platform.
- Applicants, grantees, referees and anyone else whose details are entered into a funder’s portal.
2. Our role, and the funder’s
For this website, enquiries and our own customer relationships, we decide what is collected and why, and this policy is the whole account of it.
The platform is different. Each funder decides what its forms ask, who assesses an application, what is funded and how long records are kept. We handle that information on the funder’s behalf under our agreement with them, which limits us to providing and supporting the service. The funder’s own privacy policy, or the collection notice on its application form, explains why it needs your information and should be read alongside this one.
So if you applied for funding and want to see, correct or remove what you submitted, the funder is usually the quickest route. If you come to us instead, we will pass your request to them and help them answer it.
Where a customer is an Australian Government agency, our contract with it can also bind us to the Australian Privacy Principles as a contracted service provider, and to the agency’s record-keeping and Freedom of Information obligations. Where a customer is a state or territory body, we meet the privacy obligations its contract passes to us.
3. Information we collect
Through this website, very little:
- Request logs. The servers that deliver this site keep routine logs (IP address, the page requested, browser type and time) for security and troubleshooting.
- What you send us. The enquiry form composes an email in your own mail program. Nothing leaves your device until you press send, and the website stores nothing. We receive the name, email, role, phone number, organisation and message you choose to include, and anything else you write to us directly.
- How the site is used. Google Analytics, loaded through Google Tag Manager, records the pages you visit, how you arrived, your device and your approximate location. It doesn’t tell us who you are, and it never receives what you type into the enquiry form.
- Nothing else. No advertising or social-media pixels, and no fonts, images or scripts fetched from anyone else’s servers but Google’s, for the analytics above.
Through the platform, what a funder’s grant programme needs:
- Account details for the people who use it: name, work email, organisation, role, permissions, and sign-in and multi-factor authentication records.
- What applicants submit: contact and organisation details such as an ABN or charity registration, project descriptions, budgets, supporting documents, and bank account details for payment.
- Assessment and decision records: scores, comments, conflict-of-interest declarations, decisions and the reasons for them.
- Contracts, milestones, progress reports, acquittals and payments.
- The emails the platform sends for a funder, and whether they were delivered.
- An audit trail of who did what, and when. It is how a funder shows a decision was made properly, so it is kept for every action and cannot be switched off.
You can browse this site and ask us general questions without telling us who you are. Applying for funding usually cannot be anonymous, because a funder has to know who it is funding.
4. Sensitive information
The Privacy Act gives extra protection to sensitive information: health information, racial or ethnic origin, religious beliefs, sexual orientation and criminal record among it. Some programmes genuinely need it: a programme for Aboriginal and Torres Strait Islander applicants, a medical research round, a grant supporting people living with disability.
The platform’s default templates do not ask for sensitive information. A funder that adds such a question may collect it only with consent and only where the programme needs it, and can restrict the field so that only the people who need to see it can.
5. How we use information
- To provide the platform to funders: setting up accounts, running their rounds, sending the emails their process requires, and keeping the audit trail that lets a funder show how a decision was reached.
- To sign people in and keep their accounts safe, with the sign-in methods their organisation chooses.
- To detect, investigate and respond to security incidents and misuse.
- To answer enquiries, arrange walkthroughs and support the people who use the platform.
- To bill customers and manage our relationship with them.
- To run and improve this website and the platform, from aggregated statistics that never include what funders and applicants put into the platform.
- To meet our legal obligations.
We do not use personal information for advertising or profiling, and we do not send marketing email unless you have asked for it. Information in a funder’s portal is never added to our marketing lists.
6. Funding decisions
Backed does not decide who is funded. Decisions are made by people at the funder, and the platform records who made each one and the reason they gave.
A funder can configure the platform to act on its own in limited ways: which questions a form shows, who an application is assigned to, when a reminder is sent. Where a funder sets up a rule that could significantly affect an applicant, the funder is responsible for explaining it, and we will give them what they need to do so.
8. Services that process data for us
Like any online service, we rely on a small number of providers, each bound by a contract with obligations equivalent to our data processing agreement to use personal information only to provide their service to us, and to protect it. These are the providers that process personal information for us today, with the service each provides and where it processes the information:
- Cloud hosting · runs the platform and stores its databases, files and backups.
- Email delivery · sends the notifications a funder’s process requires and reports whether they arrived.
- Error monitoring · tells us when something breaks. Reports identify an account by an internal number, not by a name or email address.
- Website hosting · delivers this site and keeps its request logs.
- Website analytics · counts visits to this site and shows which pages are used.
- Email and office software · the inbox your enquiry arrives in.
We tell every customer at least 30 days before a new provider starts handling their data, or an existing provider’s processing changes, and a customer can object during that time. The list above is the one the platform keeps; it changes only through that notice.
Integrations a funder connects (a finance system, a CRM) are chosen and contracted by the funder, stay off until the funder turns them on, and receive only what the funder configures.
9. Where information is held
The platform’s databases, files and backups are hosted in Australia.
Some of our providers may process limited information outside Australia, and an email you send us passes through our email provider’s systems wherever they are. Before personal information is disclosed overseas, we take reasonable steps to ensure the recipient handles it consistently with the Australian Privacy Principles. Information held in another country can be subject to that country’s laws, including access by its courts and authorities.
10. How long we keep information
- Enquiries · for as long as the conversation is useful, then deleted, unless it becomes a customer relationship.
- Website request logs · for the hosting provider’s standard period, then deleted.
- Platform records · the funder decides. By default they are kept for the life of the funder’s account, because grant records often have to be kept for years; a Commonwealth agency’s records, for example, fall under the Archives Act 1983. A funder can set retention periods after which closed records are anonymised or deleted.
- When a funder leaves · its content is returned to it or permanently deleted, as it chooses, within 30 days of the agreement ending. Backup copies expire on their normal cycle.
When we no longer need personal information and no law requires us to keep it, we destroy or de-identify it.
12. Security and data breaches
- Encryption in transit and at rest.
- Each funder’s data kept separate from every other funder’s.
- Multi-factor authentication, and single sign-on for organisations that use it.
- Every action in the platform attributed and timestamped in the audit trail.
- Staff access to customer data limited to the people who need it, and logged.
- Collecting as little as possible in the first place, this website being the plainest example.
If a data breach is likely to cause someone serious harm, we notify them and the Office of the Australian Information Commissioner, as the Notifiable Data Breaches scheme requires. For information we hold for a funder, we notify the funder within 24 hours of confirming the breach, so it can meet its own obligations.
13. Your rights and choices
- Access · ask for the personal information we hold about you.
- Correction · ask us to fix anything inaccurate, out of date or incomplete. Platform users can update their own profile details at any time.
- Deletion · ask us to delete it. Where a funder must keep the record of a grant, the platform can replace your identifying details with a pseudonym while the grant and payment record itself survives.
- Restriction · ask us to stop using it while a question about it is settled, where the GDPR applies.
- Portability · ask for what you gave us in a form another service can read, where the GDPR applies.
- Objection · object to our using it for our legitimate interests, where the GDPR applies.
- Withdrawing consent · where something was collected with your consent, withdraw it at any time; this does not undo what was done before, and applies where the GDPR applies.
- Marketing · we send marketing email only if you ask for it, and every one carries an unsubscribe link. Unsubscribing never stops the service emails a funder’s process sends, such as an application receipt.
Making a request is free. We will confirm who you are, respond within 30 days, and, if we refuse, tell you why in writing and how to complain. Requests about information in a funder’s portal go to that funder, with our help. If you are in the European Union or the United Kingdom, the GDPR may give you further rights, and we will honour them where it applies.
14. Children and young people
Neither this website nor the platform is directed at children, and we do not knowingly collect children’s information through this website. Some funders run programmes for young people. Where a funder’s portal collects information about someone under 18, the funder is responsible for any consent it needs from a parent or guardian.
15. Changes to this policy
Each version of this policy is published in the Legal Centre at backed.giving/legal, with the date it takes effect, before it takes effect. Earlier versions stay there, each at its own address, so you can always read the version that applied at a given time.
Where a change materially affects how platform data is handled, everyone who uses the platform is also told by email and at their next sign-in, at least 30 days ahead where practicable.
16. Contact and complaints
Email contact@backed.giving with “Privacy” in the subject line and it will reach the person responsible for privacy at Backed. The same address takes access and correction requests, and complaints.
Questions about this policy, our terms or our data processing agreement go to contact@backed.giving too.
We will acknowledge a complaint, look into it, and give you a written response within 30 days. If you are not satisfied with the outcome, you can complain to the Office of the Australian Information Commissioner at oaic.gov.au or on 1300 363 992.