Privacy Policy

Some information collected by MIC may be sensitive information under the Privacy Act. This can include information about a person's racial or ethnic origin, health, religious beliefs or other information given additional protection under privacy law.

For example, demographic or cultural information collected for a program may constitute sensitive information if it reveals or clearly implies a person's racial or ethnic origin.

We will only collect sensitive information where we have your consent and the information is reasonably necessary for one or more of our functions or activities, or where another exception permitted by law applies.

We take additional care when handling sensitive information and seek to minimise unnecessary use of sensitive information in technology systems and artificial intelligence tools.

We may collect personal information:

a. through our website, contact forms and program registration pages;

b. through email, telephone, video conference and in-person interactions;

c. when you apply for or participate in our programs, mentoring, advisory services, coaching, workshops, events or other services;

d. through surveys and feedback forms;

e. during meetings and sessions, including through approved recording, transcription, note-taking and artificial intelligence technologies;

f. from State and Commonwealth government agencies, funding bodies or program administrators where relevant to a program;

g. from program delivery partners or referral organisations where authorised and relevant; and

h. from publicly available sources where reasonably necessary for our activities.

Where we record a meeting, create a transcript or use technology to process a live conversation, we provide notice to participants and obtain consent before recording or transcription begins.

MIC may use Google Meet and approved Google Workspace technologies, including Gemini, to record, transcribe and assist with preparing notes and summaries of meetings and customer sessions.

Where these functions are used:

a. participants are informed that the meeting will be recorded or transcribed;

b. consent is obtained before recording or transcription begins;

c. the recording, transcript or meeting notes may contain personal information provided during the session;

d. access to meeting records is restricted to authorised personnel and other authorised recipients;

e. meeting records may be used to provide the relevant service, maintain program records and meet contractual or government reporting requirements; and

f. information from meeting records may also be used as described below to improve our programs, services and educational resources.

We do not intentionally seek to collect unnecessary sensitive information during meetings.

Our website uses cookies and similar technologies to operate the website, improve your experience and help us understand how people interact with our content and services.

These technologies may collect information such as browser and device information, pages visited, interactions with website content, approximate location information and other technical identifiers.

Depending on the information collected and the circumstances, this information may constitute personal information.

You can control or disable many cookies through your browser settings. Disabling certain cookies may affect the operation of some website features.

We may collect, hold and use personal information to:

a. deliver our programs, mentoring, advisory services, workshops, events and other services;

b. assess eligibility for funded programs;

c. administer programs and maintain appropriate participant and service records;

d. match or allocate participants to appropriate mentors, advisers or services;

e. report to State and Commonwealth government agencies, funding bodies or program administrators where required;

f. communicate with you about our programs and services;

g. respond to enquiries and requests;

h. conduct research, evaluation and quality improvement activities;

i. understand common issues, themes and trends affecting the businesses and customers we support;

j. identify areas in which businesses may need further assistance;

k. develop and improve webinars, workshops, educational content, resources and services;

l. maintain the security and integrity of our systems and services; and

m. comply with our legal, contractual and government funding obligations.

Where practicable, we use aggregated or de-identified information when analysing broader themes and trends.

Removing obvious identifiers such as a person's name, email address or telephone number does not necessarily mean information is de-identified. We take reasonable steps to minimise information that could identify a particular individual when identification is not required.

We do not use an identifiable participant's story, testimonial, quotation or case study for promotional or educational purposes without appropriate permission.

MIC uses selected artificial intelligence and AI-assisted technologies to support our staff and deliver our services.

Approved services currently include:

ChatGPT Business provided by OpenAI;

Claude for Work provided by Anthropic; and

Gemini and other artificial intelligence features available through MIC's Google Workspace environment.

We may use approved AI technologies to assist with activities including:

a. preparing and summarising meeting and session notes;

b. transcribing and summarising recorded meetings;

c. organising and analysing information;

d. identifying broader themes and trends across customer experiences;

e. understanding common challenges and support needs;

f. developing educational resources, webinars and workshops;

g. improving our programs and services; and
h. assisting with administrative activities such as matching or allocating participants to appropriate mentors or advisers.

Information processed using these technologies may constitute personal information even where obvious contact information has been removed.

MIC only permits customer information to be processed through approved organisational accounts. Staff are not permitted to use personal AI accounts to process MIC customer information.

We take reasonable steps to minimise the personal information provided to AI technologies and limit information to what is reasonably necessary for the relevant task.

Where it is not necessary for the task, we do not intentionally provide customer telephone numbers, email addresses or residential or business street addresses to generative AI tools.

Where practicable, we also remove or generalise names, business identifiers, unique circumstances and sensitive information where they are not necessary for the task.

Our purpose when analysing information across customers is to understand broader patterns, challenges and support needs rather than to profile individual customers.

MIC may use automated or AI-assisted systems to help match or allocate participants to mentors, advisers or services.

These systems may use information relevant to providing the service, such as the program you are participating in, your business needs, location, preferences, adviser expertise and availability.

We take reasonable steps to ensure information used for these purposes is appropriate and accurate.

If you have concerns about an allocation made using an automated or AI-assisted process, you may contact us and request that the allocation be reviewed by a member of our team.

We do not rely on generative AI alone to make decisions that determine a person's legal rights or entitlements.

Information obtained through customer sessions may be used to help MIC understand broader trends and recurring issues affecting businesses.

For example, we may analyse information to understand:

common challenges experienced by businesses;
areas in which customers regularly need additional support;

emerging business or digital capability issues; and
opportunities to improve our services and educational resources.

These insights may inform the development of webinars, workshops, training, resources and other program content.

Where reasonably practicable, we minimise, aggregate or de-identify information before undertaking broader cross-customer analysis.

Our objective is to identify patterns and support needs, rather than to identify individual customers.

We may communicate with you about MIC programs, services, events, news and opportunities where permitted by law.

You may opt out of marketing communications at any time by using the unsubscribe mechanism included in the communication or by contacting us.

We will take reasonable steps to action your request.

We do not sell personal information.

We may disclose personal information where reasonably necessary to:

a. State and Commonwealth government agencies;

b. funding bodies and government-contracted program administrators;

c. program delivery partners and referral organisations;

d. technology and service providers that assist us to operate our organisation, including cloud hosting, IT, CRM, communications, video conferencing, event, analytics, artificial intelligence, recording and transcription providers;

e. professional advisers, insurers, auditors and other professional service providers; and

f. courts, regulators, law enforcement agencies or other parties where required or authorised by law.

We take reasonable steps appropriate to the circumstances to assess service providers that handle personal information and apply relevant contractual, confidentiality, security and access controls.

We may also use or disclose personal information for another purpose where you have consented or where the use or disclosure is otherwise permitted by applicable law.

MIC primarily uses cloud-based software and technology providers.

Personal information may be stored or processed in Australia and overseas, or disclosed to service providers and their subprocessors located overseas.

Depending on the service, provider and configuration used, these locations may include:

• the United States;
• countries within the European Union;
• the United Kingdom;
• Canada;
• New Zealand;
• Singapore;
• India; and
• other jurisdictions used by approved suppliers and their subprocessors.

Data residency and processing locations vary according to the service, provider, subprocessor and tenant configuration.

Where the Australian Privacy Principles apply, we take reasonable steps as required in relation to overseas disclosures of personal information, including assessing the privacy and security practices of relevant service providers.

We periodically review our approved suppliers and their data-processing arrangements.

We take reasonable technical and organisational measures to protect personal information from misuse, interference and loss and from unauthorised access, modification or disclosure.

Depending on the systems and information involved, these measures may include:

• access controls;
• authentication measures;
• encryption;
• security monitoring;
• staff training;
• information security policies and procedures;
• approved organisational technology accounts;
• vendor privacy and security assessments; and
• incident and data breach response processes.

Access to personal information is restricted to staff, contractors and service providers who require access for authorised purposes.

We retain personal information only for as long as reasonably necessary for the purposes for which it was collected or used, or as required by law, government funding arrangements, contractual obligations or legitimate record-keeping requirements.

Retention periods vary according to the type of information and the program or service involved.

Meeting recordings and transcripts are not intended to be retained indefinitely. MIC periodically reviews these records and deletes them when the recording or transcript is no longer reasonably required, subject to any applicable legal, contractual, funding or record-keeping requirement.

Final meeting notes, summaries or program records may be retained for longer where required to provide our services or meet government program, contractual or legal requirements.

When personal information is no longer required and we are not legally or contractually required to retain it, we take reasonable steps to securely destroy it or de-identify it.

We also consider retention and deletion arrangements when selecting and configuring third-party technology providers, including artificial intelligence services.

You may request access to personal information we hold about you by contacting our Privacy Officer.

We will respond within a reasonable period and generally aim to respond within 30 days.

We will not charge you for making an access request. In some circumstances, we may charge a reasonable and non-excessive amount for the cost of providing access and will tell you about any proposed charge before proceeding.

There may be circumstances permitted by law in which we cannot provide access to some or all of the information requested. If we refuse access, we will provide a written explanation where required and explain available complaint mechanisms.

You may ask us to correct personal information we hold about you if you believe it is inaccurate, out of date, incomplete, irrelevant or misleading.

We will respond within a reasonable period and generally aim to respond within 30 days.

We do not charge for correction requests or for correcting personal information.

If we refuse a correction request, we will provide a written explanation where required and explain available complaint mechanisms.

MIC maintains processes for responding to suspected or actual data breaches.

If we become aware of a suspected data breach involving personal information, we will take reasonable steps to contain, investigate and assess the incident.

Where the Notifiable Data Breaches scheme under the Privacy Act applies and we have reasonable grounds to believe an eligible data breach has occurred, we will notify the Office of the Australian Information Commissioner and affected individuals as required by law.

If you become aware of suspected unauthorised access to, disclosure of or misuse of personal information held by MIC, please contact us promptly.

If you believe we have not handled your personal information appropriately, you may make a complaint to our Privacy Officer.

Please provide enough information for us to understand and investigate your concern.

We will acknowledge the complaint and investigate it within a reasonable period. We may contact you if we need additional information and will provide you with the outcome of our investigation.

If you are not satisfied with our response, you may be entitled to complain to the Office of the Australian Information Commissioner.

Office of the Australian Information Commissioner
Phone: 1300 363 992
Website: www.oaic.gov.au

For privacy enquiries, access or correction requests, concerns about our use of artificial intelligence, or privacy complaints, please contact:

Privacy Officer
Melbourne Innovation Centre
Level 3, 24–26 Cubitt Street
Cremorne VIC 3121
Email: hello@melbourneinnovation.com.au
Website: melbourneinnovation.com.au