The short version
- This website sets no cookies, runs no analytics or session recording, and loads nothing from a third party.
- The enquiry form sends nothing to us. It opens your own email program with your answers filled in, and we receive only what you choose to send.
- On the platform, the funder you apply to decides what its forms ask and why. We hold that information on the funder’s behalf, under contract, and use it only to provide the service.
- Platform data is hosted in Australia.
- We never sell, rent or trade personal information. We run no advertising and no ad-tracking, and nothing entered into a funder’s portal is used for our own marketing.
- You can ask what we hold about you, have it corrected, or complain. The last section says how.
1. Who we are and what this covers
Backed provides grants management software and grant administration services to organisations in Australia that distribute public and philanthropic funding. In this policy, “Backed”, “we” and “us” mean the business behind this website and that platform.
We handle personal information in accordance with the Australian Privacy Principles in the Privacy Act 1988 (Cth), and this policy is our statement under Australian Privacy Principle 1. It covers three groups of people:
- People who visit this website or contact us.
- Our customers (funders) and the staff, assessors and panel members they give access to the platform.
- Applicants, grantees, referees and anyone else whose details are entered into a funder’s portal.
2. Our role, and the funder’s
For this website, enquiries and our own customer relationships, we decide what is collected and why, and this policy is the whole account of it.
The platform is different. Each funder decides what its forms ask, who assesses an application, what is funded and how long records are kept. We handle that information on the funder’s behalf under our agreement with them, which limits us to providing and supporting the service. The funder’s own privacy policy, or the collection notice on its application form, explains why it needs your information and should be read alongside this one.
So if you applied for funding and want to see, correct or remove what you submitted, the funder is usually the quickest route. If you come to us instead, we will pass your request to them and help them answer it.
Where a customer is an Australian Government agency, our contract with it can also bind us to the Australian Privacy Principles as a contracted service provider, and to the agency’s record-keeping and Freedom of Information obligations. Where a customer is a state or territory body, we meet the privacy obligations its contract passes to us.
3. Information we collect
Through this website, very little:
- Request logs. The servers that deliver this site keep routine logs (IP address, the page requested, browser type and time) for security and troubleshooting.
- What you send us. The enquiry form composes an email in your own mail program. Nothing leaves your device until you press send, and the website stores nothing. We receive the name, email, role, phone number, organisation and message you choose to include, and anything else you write to us directly.
- Nothing else. No cookies, no analytics, no advertising or social-media pixels, and no fonts, images or scripts fetched from anyone else’s servers.
Through the platform, what a funder’s grant programme needs:
- Account details for the people who use it: name, work email, organisation, role, permissions, and sign-in and multi-factor authentication records.
- What applicants submit: contact and organisation details such as an ABN or charity registration, project descriptions, budgets, supporting documents, and bank account details for payment.
- Assessment and decision records: scores, comments, conflict-of-interest declarations, decisions and the reasons for them.
- Contracts, milestones, progress reports, acquittals and payments.
- The emails the platform sends for a funder, and whether they were delivered.
- An audit trail of who did what, and when. It is how a funder shows a decision was made properly, so it is kept for every action and cannot be switched off.
You can browse this site and ask us general questions without telling us who you are. Applying for funding usually cannot be anonymous, because a funder has to know who it is funding.
4. Sensitive information
The Privacy Act gives extra protection to sensitive information: health information, racial or ethnic origin, religious beliefs, sexual orientation and criminal record among it. Some programmes genuinely need it: a programme for Aboriginal and Torres Strait Islander applicants, a medical research round, a grant supporting people living with disability.
The platform’s default templates do not ask for sensitive information. A funder that adds such a question may collect it only with consent and only where the programme needs it, and can restrict the field so that only the people who need to see it can.
5. How we use information
- To run, secure and improve this website and the platform.
- To answer enquiries and arrange walkthroughs.
- To provide the platform to funders: setting up accounts, running their rounds, sending the emails their process requires, and supporting their users.
- To keep the audit trail that lets a funder show how a decision was reached.
- To detect, investigate and respond to security incidents and misuse.
- To bill customers and manage our relationship with them.
- To meet our legal obligations.
We do not use personal information for advertising or profiling, and we do not send marketing email unless you have asked for it. Information in a funder’s portal is never added to our marketing lists.
6. Funding decisions
Backed does not decide who is funded. Decisions are made by people at the funder, and the platform records who made each one and the reason they gave.
A funder can configure the platform to act on its own in limited ways: which questions a form shows, who an application is assigned to, when a reminder is sent. Where a funder sets up a rule that could significantly affect an applicant, the funder is responsible for explaining it, and we will give them what they need to do so.
8. Services that process data for us
Like any online service, we rely on a small number of providers, each bound by contract to use personal information only to provide their service to us, and to protect it:
- Cloud hosting · runs the platform and stores its databases, files and backups.
- Email delivery · sends the notifications a funder’s process requires and reports whether they arrived.
- Error monitoring · tells us when something breaks. Reports identify an account by an internal number, not by a name or email address.
- Website hosting · delivers this site and keeps its request logs.
- Email and office software · the inbox your enquiry arrives in.
Customers receive the current named list with our data processing agreement, and at least 30 days’ notice, with the chance to object, before a new provider starts handling their data.
Integrations a funder connects (a finance system, a CRM) are chosen and contracted by the funder, stay off until the funder turns them on, and receive only what the funder configures.
9. Where information is held
The platform’s databases, files and backups are hosted in Australia.
Some of our providers may process limited information outside Australia, and an email you send us passes through our email provider’s systems wherever they are. Before personal information is disclosed overseas, we take reasonable steps to ensure the recipient handles it consistently with the Australian Privacy Principles. Information held in another country can be subject to that country’s laws, including access by its courts and authorities.
10. How long we keep information
- Enquiries · for as long as the conversation is useful, then deleted, unless it becomes a customer relationship.
- Website request logs · for the hosting provider’s standard period, then deleted.
- Platform records · the funder decides. By default they are kept for the life of the funder’s account, because grant records often have to be kept for years; a Commonwealth agency’s records, for example, fall under the Archives Act 1983. A funder can set retention periods after which closed records are anonymised or deleted.
- When a funder leaves · its content is returned to it or permanently deleted, as it chooses, within 30 days of the agreement ending. Backup copies expire on their normal cycle.
When we no longer need personal information and no law requires us to keep it, we destroy or de-identify it.
12. Security and data breaches
- Encryption in transit and at rest.
- Each funder’s data kept separate from every other funder’s.
- Multi-factor authentication, and single sign-on for organisations that use it.
- Every action in the platform attributed and timestamped in the audit trail.
- Staff access to customer data limited to the people who need it, and logged.
- Collecting as little as possible in the first place, this website being the plainest example.
If a data breach is likely to cause someone serious harm, we notify them and the Office of the Australian Information Commissioner, as the Notifiable Data Breaches scheme requires. For information we hold for a funder, we notify the funder within 24 hours of confirming the breach, so it can meet its own obligations.
13. Your rights and choices
- Access · ask for the personal information we hold about you.
- Correction · ask us to fix anything inaccurate, out of date or incomplete. Platform users can update their own profile details at any time.
- Deletion · ask us to delete it. Where a funder must keep the record of a grant, the platform can replace your identifying details with a pseudonym while the grant and payment record itself survives.
- Marketing · we send marketing email only if you ask for it, and every one carries an unsubscribe link. Unsubscribing never stops the service emails a funder’s process sends, such as an application receipt.
Making a request is free. We will confirm who you are, respond within 30 days, and, if we refuse, tell you why in writing and how to complain. Requests about information in a funder’s portal go to that funder, with our help. If you are in the European Union or the United Kingdom, the GDPR may give you further rights, and we will honour them where it applies.
14. Children and young people
Neither this website nor the platform is directed at children, and we do not knowingly collect children’s information through this website. Some funders run programmes for young people. Where a funder’s portal collects information about someone under 18, the funder is responsible for any consent it needs from a parent or guardian.
15. Changes to this policy
Changes are published on this page, with a new effective date, before they take effect. Where a change materially affects how platform data is handled, customers are also told by email and at their next sign-in.
16. Contact and complaints
Email contact@backed.giving with “Privacy” in the subject line and it will reach the person responsible for privacy at Backed. The same address takes access and correction requests, and complaints.
We will acknowledge a complaint, look into it, and give you a written response within 30 days. If you are not satisfied with the outcome, you can complain to the Office of the Australian Information Commissioner at oaic.gov.au or on 1300 363 992.