SmartyGrants Privacy Policy
(Grantmakers)
This Privacy Policy relates to Our Community and its related entities and related bodies corporate
(collectively referred to as “we”, “us” and “Our Community”). Our Community operates the grant
management system called SmartyGrants, which is accessible through multiple sites on the
Internet domain smartygrants.com.au (“SmartyGrants Sites”).
For the purposes of this policy, “Personal Information” means information or an opinion about an
identified individual, or an individual who is reasonably identifiable.
This Privacy Policy explains how we handle your Personal Information that you provide to us in any
way including through SmartyGrants.
SmartyGrants is used by “Grantmakers” (people and organisations who manage grant programs
and build forms for Applicants to submit online) who are referred to here as “you”, “your”
and grantseekers, (people who fill in the forms created by Grantmakers) who are referred to here
as “Applicants”.
We take our obligations under the Privacy Act 1988 (the “Privacy Act”) and the Australian Privacy
Principles (“APPs”) very seriously. We are committed to maintaining the confidentiality and
security of your Personal Information and managing it in an open and transparent way. To achieve
this we have implemented practices, procedures and systems to ensure we comply with the
Privacy Act.
This policy may change periodically so please check back on a regular basis via the link on our
website [insert link to Privacy Policy]. Alternatively if you would like a free copy sent to you or you
have comments or questions regarding this Privacy Policy, please contact us using the details
provide at the end of this document.
Last updated: 6 February 2014
Table of contents
Key privacy points: The stuff you really care about ......................................................................... 3
Summary table: what we share with whom ..................................................................................... 3
The collection of personal and sensitive information ....................................................................... 4
What data is collected and how....................................................................................................... 6
How we use your Personal Information ........................................................................................... 8
Who controls the data and how you can access it or correct it ........................................................ 9
How we store your data and when we destroy it ........................................................................... 10
Information disclosed to people outside of Australia...................................................................... 11
Details of direct marketing............................................................................................................. 13
What you are agreeing to by using SmartyGrants ......................................................................... 14
SmartyGrants Privacy Policy (Grantmaker)
1
SmartyGrants Privacy Policy (Grantmaker)
2
Key privacy points: The stuff you really care about
1. Customer Data is stored on servers located in Australia. We collect different types of
date (we explain the difference types below), but to be clear your Customer Data, which is
the data you enter into the system and includes the submissions you receive from
Applicants, is stored on servers located in Australia and we do not transfer this data
offshore for processing.
2. We don’t sell your data your data to third parties. We treat all information collected as if
it were private. We don't sell the information to anyone and we don't use the responses
Grantmakers receive or that Applicants fill out for our own purposes, except in a limited set
of circumstances outlined in this Privacy Policy (for example: if we are compelled to by a
law or if you've made parts of your submission public).
3. We do share some data with trusted service providers. In order to manage and improve
SmartyGrants we use a number of third party service providers; for example, we may use
Google to manage our email. See the summary table below for details about what we share
and with whom and for what purposes. Please note that a number of these service
providers are located outside of Australia and that the data we pass to them will therefore
be processed outside of Australia.
4. SmartyGrants forms are administered by Grantmakers. You may create any form
required to administer your grants programs. SmartyGrants hosts these forms and collects
the responses Applicants submit to Grantmakers. Applicants will contact you directly if they
have any questions about forms they are completing, as we are not responsible for the
form’s content, nor an Applicant’s response to it. Of course, if you have a privacy policy of
your own, you will want to ensure your use and control of Applicants’ information complies
with it.
5. The Applicant owns the data until they submit it; and Grantmakers must be clear on
this. Until an Applicant submits a response to a form to you, the contents of the response
belong to the Applicant. You have no right to view the contents of an unsubmitted response
unless Applicants explicitly give you access. Once a response to a form is submitted, it then
becomes subject to your own privacy policy.
6. Anonymity and pseudonymity: You are free to browse SmartyGrants anonymously.
However, to login into the SmartyGrants service you or an organisation you work with must
register an account using your actual name and email address. It is impractical for us to
manage and provide support for SmartyGrants where individuals have either not identified
themselves or have used a pseudonym.
Summary table: what we share with whom
Data Collected
Parties Involved
Usage Data, Device Data,
Referral Data, Metadata
Data Controller: Our
Community
(For example: Cookies and IP
address)
Shared with:

SmartyGrants Privacy Policy (Grantmaker)
Use of data
Purpose: Website performance,
availability and traffic analysis.
Google
3
Registration Information
(For example: First Name, Last
Name, Email Address,
Organisation Name)
Customer Data
(For example: Any text,
attachments or other input)
 New Relic
 Preact.io
 Segment.io
Data Controller: Our
Community
Shared with:
 Campaign Monitor
 Preact.io
Data Controller: Applicant
/ Grantmaker
Shared with:



Email contents, Customer
Support Queries and other data
you intentionally share
Australian
Business Register
(ABN numbers
only)
Our Community
Grantmaker (only
with your
approval)
Data Controller: Our
Community
Shared with:
(For example: Emails to
service@smartygrants.com.au)
Purpose: The operation of
SmartyGrants.



Purpose: The operation of
SmartyGrants.
Grants Applicants retain full
control of any response they
have not formally submitted you.
However once a response is
submitted, it falls under your
control.
Any privacy or information
policies you have in place will
also come into play once you
take control of Applicants’
information. SmartyGrants will
direct any Applicants with
questions about Grantmakers’
privacy policies to you for further
information.
Purpose: To provide support for
the use of SmartyGrants and To
maintain appropriate business
records
Google
Highrise
Desk.com
The collection of personal and sensitive information
We will only collect your Personal Information where it is reasonably necessary for us to pursue
one or more of our functions or activities (see below for how and why we use your Personal
Information) or we are required to by law.
Some Personal Information (e.g. race, ethnicity, health information etc.) is sensitive and requires a
higher level of protection under the Privacy Act. Our Community works hard to limit how much
sensitive information is collected, as we don’t have a need for it ourselves; however, in operating
SmartyGrants we are often in a position whereby we are collecting sensitive information on behalf
Grantmakers. We will only collect your sensitive information when we have your consent; and the
collection is reasonably necessary for us to pursue one or more of our functions or activities.
How we deal with unsolicited Personal Information
SmartyGrants Privacy Policy (Grantmaker)
4
If we receive your Personal Information from a third party without having asked you for it, then
within a reasonable time, we will determine whether we could have collected it in the ways outlined
above. If we determine that it could not have been collected in one of those ways and it is lawful
and reasonable to do so, then as soon as practicable we will either destroy the information or
ensure that it is de-identified.
How we maintain the quality of Personal Information
We will take such steps (if any) as are reasonable in the circumstances to ensure that your
Personal Information we collect, use or disclose is accurate, up-to-date, complete and relevant.
How you will know when your Personal Information is collected
Before or at the time of collecting your Personal Information (or as soon as practicable afterwards)
we will place on the screen a big bold notice that ensures you are aware of the following:
a) our identity and contact details;
b) circumstances where we have collected your Personal Information from you without your
knowledge or from someone other than you;
c) circumstances where we are required or authorised by law to collect your Personal
Information;
d) reasons why we have collected your Personal Information;
e) what may happen if we do not collect all or some of your Personal Information;
f)
details of the persons or entities that we usually disclose Personal Information to;
g) how you may access and seek correction of your Personal Information;
h) how you can lodge a complaint with us;
i)
whether we are likely to disclose your Personal Information to overseas recipients and if
so, details of the likely countries that may receive your Personal Information.
Are there exceptions to when you need my consent to collect personal and sensitive
information?
You should be aware that there are some exceptions to the need for your consent to collect
sensitive information. Under the Privacy Act we don’t need your consent to collect your sensitive
information when it is required or authorised by law, these exceptions exist under two broad
categories of situations: Permitted General Situations and Permitted Health Situations. Let us
apologise now for the turgid wording of these situations, as we have taken the wording for the
General Situations from the Privacy Act (to save you going to have to look it up yourself).

Permitted General Situations
o
o
General Situation 1

it is unreasonable or impracticable to obtain your consent to the collection,
use or disclosure; and

Our Community reasonably believes that the collection, use or disclosure is
necessary to lessen or prevent a serious threat to the life, health or safety of
any individual, or to public health or safety.
General Situation 2
SmartyGrants Privacy Policy (Grantmaker)
5
o

Our Community has reason to suspect that unlawful activity, or misconduct
of a serious nature, that relates to the our functions or activities has been, is
being or may be engaged in; and

Our Community reasonably believes that the collection, use or disclosure is
necessary in order for us to take appropriate action in relation to the matter.
General Situation 3

Our Community reasonably believes that the collection, use or disclosure is
reasonably necessary to assist any APP entity, body or person to locate a
person who has been reported as missing; and

the collection, use or disclosure complies with the rules made under
subsection (2) of Section 16a of the Privacy Act.
o
General Situation 4

o
General Situation 5


The collection, use or disclosure is reasonably necessary for the
establishment, exercise or defence of a legal or equitable claim.
The collection, use or disclosure is reasonably necessary for the purposes of
a confidential alternative dispute resolution process.
Permitted Health Situations
o
The details of the Permitted Health Situations are long and complex and best
viewed online. Our Community believe that these situations would rarely if ever
apply to the information we collect from you, so we have not listed them here.
Adoption, use or disclosure of government related identifiers
We will not adopt a government related identifier (such as your medicare or social security number)
as your identifier unless:
a) we are required or authorised by law;
b) it is reasonably necessary to verify your identity for the purposes of our activities or
functions;
c) it is reasonably necessary to fulfil our obligations to an agency or State or Territory
authority;
d) it is required or authorised by or under an Australian law, or a court/tribunal order;
e) some (but not all) permitted general situations exist;
f)
we reasonably believe it is reasonably necessary for enforcement related activities by, or
on behalf of, an enforcement body; and
g) where it is allowed under the regulations.
What data is collected and how
We will only collect your Personal Information by lawful and fair means and our strong preference
is to try and collect your Personal Information directly from you as this is the best way to ensure it’s
accuracy. It also provides you with an opportunity to ask us any questions about our Privacy Policy
SmartyGrants Privacy Policy (Grantmaker)
6
before collection. We may also collect your Personal Information over the telephone, through
correspondence (whether by letter, fax or email), and through forms on our website.
In the process of conducting our businesses, we collect a broad range of Personal Information
about our current and prospective customers, contractors, suppliers, agents, service providers,
other business associates and the people who run the businesses we deal with. This information
can include such things as contact details, financial information and supporting documentation,
identification and transaction history information, banking details and personal references.
We will directly collect your Personal Information unless we have your consent to collect it from a
third party or we are required or authorised by law to collect it or it is unreasonable or impracticable
to do so.
Information we collect directly from you


Registration information:
o
You need to have a registered account to log into a SmartyGrants account before
you use or view any information in SmartyGrants.
o
When you or someone in your organisations register you, for an account we collect
your name, email address, organisation name and password. We use cookies to
store session information in order to enable login-based features.
o
You can block or delete cookies and still use SmartyGrants, although if you do you
will then be asked for your email address and password every time you access
SmartyGrants.
Customer Data:
o

Customer support queries and other data you intentionally share.
o

We safely store data submitted through SmartyGrants – including forms, responses,
reports, grant information.
We may collect your Personal Information or data if you submit it to us in other
contexts; for example, if you email us.
Usage data.
o
We collect usage data about you whenever you interact with our services. This may
include data on which SmartyGrants webpages you visit, what you click on, when
you performed those actions, and so on.
o
Additionally, like most websites today, our web servers keep log files that record
data each time a device accesses those servers. The log files contain data about
the nature of each access, including the IP address from which the contact
originated.
o
Some data will contain identification numbers, which might include the ID number of
your user account or application. This information in and of itself does not identify
you; however, when combined with data we hold within SmartyGrants would allow
us to identify your activity on our website.
Information we collect about you from other sources

Device data.
SmartyGrants Privacy Policy (Grantmaker)
7
o

Referral data.
o

We collect data from the device and application you use to access our services,
such as your IP address and browser type. We may also infer your geographic
location based on your IP address.
If you arrive at an our website from an external source (such as via a link on another
website or an email), we record information about the source that referred you to us.
Metadata.
o
We use the term 'metadata' to describe the context rather than the content of the
data we collect. This might include, for example, the time and date and location of
the creation of the data, the size of the data (for example: word count), and the time
it took to the create the data. Metadata, when taken as a whole, may help us to
improve our services, as well as the way you as Grantmakers provide your services
to those who use SmartyGrants to apply for funding.
How we use your Personal Information
We will only hold your Personal Information for the particular purpose that we collected it (“Primary
Purpose”). We will not use or disclose your Personal Information (not being sensitive information)
for another purpose (“Secondary Purpose”) unless:
a) we first obtain your consent; or
b) you would reasonably expect us to use or disclose it for a Secondary Purpose that is
related to the Primary Purpose or - in the case of sensitive information – directly related to
the Primary Purpose;
c) we are required to by law,
d) a permitted general purpose exists,
e) a permitted health situation exists.
f)
we reasonably believe it is reasonably necessary for one or more enforcement related
activities conducted by, or on behalf of, an enforcement body. In this circumstance we will
make a note of such disclosure.
We collect your Personal Information for the following Primary Purposes:
1. To provide you with our services including:
o
applying for grants via SmartyGrants.
o
support you if you need technical assistance with using SmartyGrants.
o
some Grantmakers may use the ABN look-up functionality, which involves
SmartyGrants passing your ABN to the Australian Business Register in order to
retrieve your organisation's registration details.
2. To manage our services:
We may use your Personal Information, for the following limited purposes:
SmartyGrants Privacy Policy (Grantmaker)
8
o
To monitor and improve our services and features. We perform statistical and
other analysis on information we collect (including usage data, device data, referral
data and metadata) to study and measure user behaviour and trends, to understand
how people use our services, and to monitor, troubleshoot and improve our
services.
o
To assist the enforcement of our Agreement with Grantmakers.
o
To prevent potentially illegal activities.
o
To screen for undesirable or abusive activity. For example: We have an
automated virus scan that checks all file attachments.
3. To create new services, features or content (public data and metadata only):
We may use Usage Data, Device Data, Referral Data and any other Metadata to create
and provide new services, features or content. For example, we may look at statistics like
response rates, question-and-answer word counts, and the average number of questions in
a form in order to publish observations and findings for informational or marketing
purposes. When we do this, neither individual Grantmakers nor applicants will be identified
or identifiable unless we have obtained their permission.
4. To contact you about your service or account:
We may occasionally send you communications of a transactional nature (for example:
service-related announcements, changes to our services or policies, a password reminder
email). You can't opt out of these communications since they are required in order for us to
provide our services to you.
5. To respond to legal requests and prevent harm:
If we receive a subpoena or other legal request, we may need to inspect the data we hold
to determine how to respond.
Who controls the data and how you can access it or
correct it
As the data controller, Our Community is the legal entity with the right to make decisions regarding
the purposes, and the methods, of processing the Personal Information we have collected from
you. This includes the security measures concerning the operation and use of the data.
You can request access to the Personal Information we hold about you, or request that we change
that Personal Information. We will allow access or make the changes unless we consider that there
is a sound reason under any relevant law to withhold the information, or not make the changes.
Such reasons included:
a) we reasonably believe that giving access would pose a serious threat to the life, health or
safety of any individual, or to public health or public safety; or
b) giving access would have an unreasonable impact on the privacy of other individuals; or
SmartyGrants Privacy Policy (Grantmaker)
9
c) your request for access is frivolous or vexatious; or
d) the information relates to existing or anticipated legal proceedings between us and you, and
would not be accessible by the process of discovery in those proceedings; or
e) giving access would reveal our intentions in relation to negotiations with you in such a way
as to prejudice those negotiations; or
f)
giving access would be unlawful; or
g) denying access is required or authorised by or under an Australian law or a court/tribunal
order; or
h) we have reason to suspect that unlawful activity, or misconduct of a serious nature, that
relates to our functions or activities has been, is being or may be engaged in and you giving
access would be likely to prejudice the taking of appropriate action in relation to those
matters; or
i)
giving access would be likely to prejudice one or more enforcement related activities
conducted by, or on behalf of, an enforcement body; or
j)
giving access would reveal evaluative information generated within the entity in connection
with a commercially sensitive decision-making process.
When you make a request to access or change your Personal Information, we will require you to
provide some form of identification (such as a driver's licence or passport) so we can verify that
you are the person to whom the information relates. In some cases we may also request an
administrative fee to cover the cost of access.
How you can make corrections or raise concerns
If you believe that information we hold about you is incorrect or out of date, or if you have concerns
about how we are handling your Personal Information, please contact us and we will try to resolve
those concerns.
If you believe that Our Community has not protected your Personal Information as set out in this
Privacy Policy you may lodge a complaint using the contact details below. We will respond to your
complaint within 30 days of receiving it, and treat seriously any claims of privacy breaches.
Circumstances when we decline to make corrections
In certain circumstances we may decline to correct your Personal Information. When this occurs
we will provide you with a written notice that sets out both the reasons for the refusal, and the
mechanisms available to complain about the refusal.
How we store your data and when we destroy it
We take all reasonable steps to ensure the security of the Personal Information we hold is
protected from unauthorised access, destruction, use, modification or disclosure.
All registration information, as well as Customer Data used as part of SmartyGrants, are passwordprotected to provide additional security. We ask that you do not reveal or share your password with
anyone. Our Community will never ever ask for your password, either verbally or through phone or
email contact (whether initiated by you or us).
SmartyGrants Privacy Policy (Grantmaker)
10
Where we share data with service providers, the data is stored in their systems and is subject to
their security and privacy standards. We have been careful about selecting our service providers
and believe they all take data privacy and security seriously. For your information we have also
provided links to all of our service provider’s privacy policies below.
Destruction
When we no longer need your Personal Information for a permitted purpose and we are not
required to keep it to comply with any laws, we will take such steps as are reasonable in the
circumstances to destroy your Personal Information or to ensure that the information is deidentified.
If you wish to have your Personal Information deleted please let us know and we will take
reasonable steps to delete it (unless we need to keep it for legal, auditing or internal risk
management reasons). If Our Community is not the Data Controller (for example you have
submitted Customer Data to a Grantmaker), you will need to contact the relevant Data
Controller/Grantmaker, as SmartyGrants cannot modify any information it does not control.
Information disclosed to people outside of Australia
While SmartyGrants is an Australian product, our services are used by organisations all around the
world to manage their grant programs. If you, or the Grantmaker you are working with, are located
outside Australia, then data will be transmitted outside of Australia. However, all Customer
Data stored within SmartyGrants is kept on our servers, which are physically located in Sydney,
Australia.
Our Community also uses a number of service providers to handle data that is not
Customer Data. Some of these service providers are located outside Australia. Their details are
listed below, including the jurisdiction in which the data will be processed. By using SmartyGrants
you consent to the following types
Data Disclosed
Service Provider
Usage Data,
Device Data,
Referral Data,
Metadata
►Google
Service provided: Google Analytics is a web analysis service supplied by
Google which uses "cookies" to collect your Navigation Data. This
information is forwarded to, and deposited on, Google's servers in the United
States.
Address: 1600 Amphitheatre Parkway, Mountain View, CA 94043 USA
More information: http://www.google.com/intl/en/policies/privacy/
Data processing location: United States of America
►New Relic
Service provided: New Relic is an all-in-one web application performance
tool that lets companies see their site’s performances from the end-user's
perspective through servers and down to the line of application code.
SmartyGrants Privacy Policy (Grantmaker)
11
Address: 101 Second Street, 15th Floor, San Francisco, CA 94105
More information: http://newrelic.com/privacy
Data processing location: Various countries, including the United States of
America.
►Segment.io
Service provided: Segment.io is a simple analytics API that transforms
business analytics data and routes it to other analytics services, such as
Google Analytics, Mixpanel, KissMetrics, Olark, Salesforce, etc.
Address: 101 Second Street, 15th Floor, San Francisco, CA 94105
More information: https://segment.io/privacy
Data processing location: Various countries, including the United States of
America.
►Preact.io
Service provided: Preact.io makes the context of user actions available to
members of the SmartyGrants support team as many problems can be
solved in a single response rather than complex troubleshooting.
Address: 13488 W. Maxella Ave., Suite 530 Marina del Rey, CA 90292
More information: http://www.preact.io/privacy
Data processing location: The United States of America
Registration
Information
►Campaign Monitor Pty Ltd
Service provided: hosted email newsletter service.
Address: Suite 404 3/5 Stapleton Avenue, Sutherland NSW 2232, Sydney,
Australia
More information: http://www.campaignmonitor.com/privacy/
Data processing location: The United States of America.
►Preact.io
See details above.
Emails, customer
support queries
and other data you
intentionally share
►Google
Service provided: hosted email service.
SmartyGrants Privacy Policy (Grantmaker)
12
with us
Address: 1600 Amphitheatre Parkway, Mountain View, CA 94043 USA
More information: http://www.google.com/intl/en/policies/privacy/
Data processing location: United States of America
►Highrise
Service provided: Highrise is a "shared contact management" web
application.
Address: 37signals, 30 North Racine Avenue #200, Chicago, IL 60607 USA.
More information: http://37signals.com/privacy
Data processing location: Various countries, including the United States of
America.
►Desk.com
Service provided: Desk.com is an online customer service and support tool
that is powered by Salesforce.com
Address: 501 2nd Street – Suite 350, San Francisco, CA 94107
More information: http://www.desk.com/privacy
Data processing location: Various countries, including the United States of
America.
Details of direct marketing
For the purposes of this policy, “direct marketing” is the promotion and sale of goods and services
directly to you including through emails, SMS, phone calls and the post.
No direct marketing
We will not use or disclose your Personal Information for the purposes of direct marketing material
if you have previously told us not to.
If at any time in the future you do not want us (or one of our service providers) to send you direct
marketing material or you wish to cancel a previous consent, then you can simply inform our
Privacy Officer. We will effect the change in a reasonable time and without charge.
Adoption of direct marketing laws
The Privacy Act tightly controls how we use your Personal Information for direct marketing. We will
follow those laws to ensure you only receive direct marketing in circumstances where you are
expecting to. We will always provide a simple means for you to “opt-out” from receiving it which
typically involves a “tick-a-box” on the collection form or through a pop-up on your screen when
you provide Personal Information online.
Sensitive information
SmartyGrants Privacy Policy (Grantmaker)
13
We will not use your sensitive information for the purposes of direct marketing unless you have
given us permission in writing.
Circumstances when we will send you direct marketing material
We will not use your Personal Information for the purpose of direct marketing unless we collected
the information from you and you would reasonably expect that we would use or disclose the
information for that purpose.
How you can contact us

Calling (+61) 03 9320 6800

Emailing service@ourcommunity.com.au

Sending a letter to us at:
Attn: Privacy Officer
Our Community (SmartyGrants)
PO Box 354
North Melbourne VIC 3051
Australia
What you are agreeing to by using SmartyGrants

You consent to the collection, use, disclosure and processing of your personal data in
the manner described in this Privacy Policy.

You consent to us sharing your personal data with relevant persons working for service
providers who assist us to provide our services.

If you have enabled cookies on your web browser, you consent to our use of cookies as
described in this Privacy Policy.

You consent to our use of metadata for the purposes described in this Privacy Policy.
SmartyGrants Privacy Policy (Grantmaker)
14