Privacy Policy

In this policy:

• “Incubate Creative”, “we”, “us” and “our” means Incubate Creative Pty Ltd.
• “Platform” means the IncubateAI LMS learning and knowledge platform, including any branded version of it provided to a Client Organisation.
• “Client Organisation” means a business, institution or other organisation that subscribes to the Platform and gives its people access to it.
• “Affiliated Organisation” means a business connected to a Client Organisation, such as a related company, head office, franchisee, dealer, retailer, distributor, branch, member organisation or partner network.
• “User” or “you” means any person who uses the Platform, including learners, managers, trainers, administrators and content authors.

This policy applies to all Users of the Platform in every industry and country where it is used. A Client Organisation may give you additional privacy information about how it uses your training records. Where that happens, you should read both documents together.

Most people use the Platform because an organisation has given them access, usually an employer, a franchisor, an education provider or a membership body.

When we process your information to deliver the Platform to your organisation, we do so on behalf of, and under the instructions of, that Client Organisation. Under GDPR and similar laws, the Client Organisation is the “controller” of that information and we are its “processor”. The Client Organisation decides what information is loaded into the Platform, who within its organisation can see it, and how training results are used.

We act as the party responsible for your information (a “controller”) when we:

• manage subscriptions, billing and contracts with Client Organisations
• operate, secure, maintain and improve the Platform itself
• respond to support requests and communicate with you about the service
• comply with our own legal obligations

In all cases, Incubate Creative complies with the Australian Privacy Principles.

We only collect personal information that is reasonably necessary to provide the Platform and related services. Depending on how your organisation uses the Platform, this may include:

Account and Profile Information

• Name, email address and phone number
• Username, login credentials and authentication data (including single sign-on and one-time login links)
• Profile photo or avatar, if you choose to add one
• Preferred language and accessibility settings
• Your time zone, taken from your device (for example “Australia/Perth”, not your location), so times in emails and messages show in your local time

Organisational Information

• The Client Organisation and any Affiliated Organisation you belong to
• Your site, branch, region, department or team
• Job title, role, and your manager or trainer
• Employee, member or student identification number, where supplied by your organisation

Learning and Assessment Records

• Course, module and lesson enrolments
• Progress, completion status and time spent
• Quiz, test and assessment responses, results and number of attempts
• Video and media viewing activity, including playback and completion events
• Certificates, qualifications, credits and continuing professional development records
• Feedback and ratings you give on content

Engagement and Recognition Information

• Points, badges, achievements, rewards and rankings, where these features are enabled

Content You Submit

• Files, assignments, comments, forum posts and messages
• Questions and prompts you enter into AI features (see Section 7)

Resource Sharing Information

• Where the Platform allows you to share a resource (such as a brochure, guide or document) with someone outside the Platform, we collect the recipient's name and email address, and a record of what was shared and when

Billing Information

• Contact and billing details of Client Organisation account holders
• Payment card details are handled by our payment provider and are not stored on the Platform

Technical and Usage Information

• IP address, device type, operating system and browser
• Login times, session data and approximate location based on IP address
• Pages visited, features used, error reports and system logs

Sensitive Information

We do not ask for sensitive information (such as health, racial or ethnic origin, religious beliefs, or biometric information) and ask Client Organisations not to load it into the Platform. If you choose to share sensitive information, for example an accessibility need, we will only collect and use it with your consent and only for the purpose you provided it for.

We collect personal information:

• directly from you, when you register, complete your profile, take part in learning or contact us
• from your Client Organisation, for example when it creates your account, uploads user lists, or connects the Platform to its HR, student or identity systems
• automatically, through your use of the Platform
• from our service providers, for example sign-in or payment providers

If we receive personal information we did not ask for and do not need, we will destroy or de-identify it where lawful and reasonable to do so.

We use personal information to:

• create and manage your account and verify your identity
• deliver courses, lessons, assessments and learning resources
• record progress, completion and results, and issue certificates
• provide reports to authorised people within your Client Organisation and, where your Client Organisation has arranged it, to authorised people in its Affiliated Organisations
• operate engagement features such as points, badges and leaderboards
• provide AI-assisted learning features (see Section 7)
• send you service messages, such as enrolment notices, reminders and account alerts
• deliver resources you choose to share with others
• respond to questions and provide technical support
• maintain the security and integrity of the Platform, including assessment integrity, fraud prevention and access control
• analyse Platform use to fix problems and improve features and content, using aggregated or de-identified information where practicable
• manage subscriptions, billing and our contracts with Client Organisations
• comply with our legal and regulatory obligations

We only use personal information for the purpose it was collected, for related purposes you would reasonably expect, or as permitted or required by law.

Where GDPR or UK GDPR applies, we process personal information on these bases:

• Contract: to provide the Platform under our agreement with your Client Organisation, or with you
• Legitimate interests: to secure, support and improve the Platform, where those interests are not overridden by your rights
• Legal obligation: to comply with laws that apply to us
• Consent: for optional features, where we ask for it. You can withdraw consent at any time without affecting earlier processing

Where India's DPDPA applies, we process personal information with your consent, which is requested through a clear notice, or for legitimate uses permitted by that law, including purposes connected with your employment or engagement with a Client Organisation.

Where we act for a Client Organisation, that Client Organisation is responsible for identifying its own legal basis.

The Platform includes AI-assisted features, such as learning assistants that answer questions, explain content and suggest next steps.

How it works

• When you use an AI feature, the text you enter and relevant learning content are sent to our AI service providers to generate a response.
• We take steps to remove or limit personal information before it is sent, and we limit AI features to the information needed to answer your request.
• We do not permit our AI service providers to use your information to train their AI models.
• AI responses may be inaccurate or incomplete. They are learning aids and should not be relied on as professional, legal, financial, medical or safety advice.
• Do not enter sensitive information or confidential third-party information into AI features.

Automated processing

The Platform uses automated processing to score some assessments, confirm course completion, award points and badges, and recommend content. We do not make decisions based solely on automated processing that have legal or similarly significant effects on you.

Your Client Organisation may use your Platform results when making its own decisions, for example about certification, compliance or performance. Those decisions are the Client Organisation's responsibility. If you believe an automated result is wrong, you can ask for it to be reviewed by a person by contacting your Client Organisation or us.

Incubate Creative does not sell, rent or trade personal information, and we do not use it for third-party advertising.

Your personal information may be accessible to or disclosed to:

(a) Your Client Organisation

• Authorised administrators, managers and trainers can see information about you according to their role, which usually includes your profile, progress, results and certificates.

(b) Affiliated Organisations

• Where your Client Organisation has arranged it, authorised people in its Affiliated Organisations, including those in other countries, may see training and results information for oversight, compliance and reporting purposes.

(c) Other Users

• If engagement features are enabled, other Users in your organisation may see your name or display name, avatar, points, badges and ranking. Your Client Organisation controls whether these features are switched on.

(d) People you share resources with

• If you share a resource with someone outside the Platform, they receive the resource and your name as the sender.

(e) Service Providers

• We use trusted service providers for cloud hosting and storage, content delivery, email delivery, AI processing, payment processing, and error monitoring.
• Our Platform is hosted with Amazon Web Services (AWS) in Australia.
• All service providers are bound by contract to protect personal information, keep it confidential and use it only to provide services to us.
• A current list of our key service providers is available on request.

(f) Professional Advisers

• Our lawyers, accountants, auditors and insurers, where needed and under confidentiality obligations.

(g) Legal Requirements

• Courts, regulators, law enforcement or other authorities where required or authorised by law, or where necessary to protect a person's safety or our legal rights.

(h) Business Changes

• A buyer or successor if all or part of our business is sold or restructured. We will require them to protect personal information in line with this policy.

The Platform is hosted in Australia. Personal information may be accessed from, or transferred to, other countries where:

• our service providers operate, including the United States for AI processing and email services
• a Client Organisation or its Affiliated Organisations have authorised personnel, which may include countries across Asia, Europe, the Americas and elsewhere, depending on the Client Organisation

Before disclosing personal information overseas, we take reasonable steps to ensure the recipient protects it in a way that is consistent with the Australian Privacy Principles. For information subject to GDPR or UK GDPR, we use approved transfer mechanisms, such as Standard Contractual Clauses, or rely on adequacy decisions.

Where a Client Organisation directs us to make information available to its overseas personnel or Affiliated Organisations, the Client Organisation is responsible for that disclosure.

We protect personal information with measures that include:

• encryption of data in transit, and encryption at rest of stored files and media (encryption at rest of the Platform's primary database is being completed, and this policy will be updated when it is in place)
• secure authentication and role-based access controls
• separation of each Client Organisation's data from other Client Organisations
• logging and monitoring of access and system activity
• regular security updates and testing
• access to personal information limited to those who need it

All Incubate Creative employees and contractors are required to keep personal information confidential.

No system can be guaranteed to be completely secure. You can help by keeping your login details private and telling us promptly if you suspect unauthorised access to your account.

If we become aware of a data breach involving personal information, we will act quickly to contain it and assess the risk of harm. Where a breach is likely to result in serious harm, we will notify affected individuals and the Office of the Australian Information Commissioner (OAIC) under the Notifiable Data Breaches scheme, and notify relevant Client Organisations and overseas regulators as required by law, including within the timeframes set by GDPR.

We keep personal information only for as long as it is needed for the purposes described in this policy, or as required by law.

• Active accounts: for as long as your account is active.
• Learning records and certificates: for the period required by your Client Organisation, which may be longer than your account where records are needed for compliance, accreditation or audit purposes.
• When a Client Organisation's subscription ends: we return or delete its data in line with our agreement with that Client Organisation, and within 90 days unless the Client Organisation instructs otherwise or the law requires us to keep it.
• Backups: deleted information is removed from backups as they are replaced in the normal backup cycle.
• Billing and contract records: as required by tax and corporate laws.

When personal information is no longer needed, we securely destroy or de-identify it.

Depending on where you live, you may have the right to:

• Access: ask for a copy of the personal information we hold about you
• Correction: ask us to correct inaccurate, incomplete or out-of-date information
• Deletion: ask us to delete your personal information, subject to legal and contractual requirements
• Restriction: ask us to limit how we use your information
• Objection: object to processing based on our legitimate interests
• Portability: receive your information in a structured, commonly used format
• Withdraw consent: where processing is based on consent
• Human review: ask for an automated result to be reviewed by a person
• Nominate: where local law allows (for example in India), nominate another person to exercise your rights if you die or become unable to act
• Complain: lodge a complaint with us or a privacy regulator (see Section 19)

How to make a request

• Where your account is provided by a Client Organisation, you can contact that organisation directly or contact us. If we receive a request that the Client Organisation is responsible for, we will pass it on to them and assist them to respond.
• We may need to verify your identity before acting on a request.
• We aim to respond within 30 days. We do not charge for making a request or for giving you access to your information.
• If we refuse a request, we will explain why in writing, unless it would be unlawful to do so, and tell you how to complain.

Where practicable, you can contact us for general enquiries without identifying yourself. Because the Platform records individual learning progress and results for your organisation, you generally cannot use it anonymously. Where your Client Organisation allows, you may use a display name on leaderboards and other visible features.

The Platform is designed for adults and for people aged 16 and over in workplace, vocational and educational settings.

If a Client Organisation provides access to anyone under 18, the Client Organisation is responsible for obtaining any required consent from a parent or guardian and for ensuring the Platform is used appropriately. We do not knowingly collect personal information from children under 13, or from anyone below the age at which consent is required under local law, without authorised consent. If we learn that we have done so, we will delete it.

We do not send marketing to Users. Messages sent through the Platform are service messages about your account and learning.

We may send product and service updates to Client Organisation administrators and account holders. You can unsubscribe at any time using the link in each message or by contacting us.

The Platform uses cookies and similar technologies to:

• keep you signed in and secure your session
• remember your settings
• record your learning progress
• understand how the Platform is used and performing

We do not use advertising or cross-site tracking cookies. You can set your browser to refuse cookies, but some features of the Platform will not work without them.

The Platform may link to external websites or connect to third-party systems chosen by your Client Organisation, such as single sign-on, HR, student or communication systems. We are not responsible for the privacy practices of those websites or systems, and we recommend reviewing their privacy policies.

If you have a concern about how we handle personal information, please contact our Privacy Officer using the details below. We will acknowledge your complaint promptly and aim to resolve it within 30 days.

If you are not satisfied with our response, you can contact:

• Australia: the Office of the Australian Information Commissioner (OAIC), www.oaic.gov.au, phone 1300 363 992
• European Union: your local data protection authority
• United Kingdom: the Information Commissioner's Office (ICO), www.ico.org.uk
• Japan: the Personal Information Protection Commission (PPC), www.ppc.go.jp
• India: the Data Protection Board of India, after first raising your complaint with us
• Other countries: your local privacy regulator

We may update this policy to reflect changes to the Platform, our practices or the law. The current version is always available within the Platform and on our website, and can be provided in other languages on request. We will notify Users and Client Organisations of significant changes by email or Platform notification before they take effect.

Privacy Officer

Incubate Creative Pty Ltd

Email: not yet published — this contact address has not been supplied.