Atlas Innovation Collective Ltd. Privacy Policy

    Effective Date: 7th August 2025

    Atlas Innovation Collective Ltd. (“Atlas”, “we”, “our”, or “us”) is committed to protecting the privacy and cultural integrity of all individuals and communities we work with. This Privacy Policy outlines how we collect, use, disclose, and protect personal and cultural data in accordance with the Australian Privacy Act 1988 (Cth), the Australian Privacy Principles (APPs), and Indigenous Data Sovereignty principles, including the CARE Principles for Indigenous Data Governance.

    1. Who We Are

    Atlas Innovation Collective Ltd. is an Australian charity committed to ethical innovation in technology, language preservation, and cross-cultural engagement. Our primary project involves developing a culturally respectful, community-guided large language model (LLM) – a kind of digital “mind” – trained to become an expert in various Indigenous Australian dialects. This model will support the translation of the Bible, health and educational resources, and faith-based content into underrepresented languages, as well as gamified platforms to preserve Aboriginal dialects. Developed in partnership with Indigenous communities, this initiative upholds principles of cultural safety, linguistic integrity, and Indigenous data sovereignty.

    While we are not legally required to comply with the Australian Privacy Principles (APPs) under the Privacy Act 1988 (Cth) — as a developing organisation without an established annual turnover — we choose to voluntarily align our data handling practices with these principles as part of our commitment to ethical and responsible data stewardship.

    What This Policy Means For You

    At Atlas Innovation Collective Ltd., we respect your privacy and your cultural heritage. Here’s what you can expect when you share your information or cultural knowledge with us:

    • We keep your data safe and secure. We use strong protections to make sure your personal and cultural information stays private and protected.
    • You’re in control. We only collect information with your permission, and you can withdraw your consent anytime. If you want your data removed, we will work with you to do so respectfully and safely.
    • We respect cultural rights. Indigenous communities guide how cultural data is collected, used, and shared. We follow cultural protocols and work closely with communities to honor those traditions.
    • We use your data responsibly. Your information helps us develop tools for language preservation and education that benefit your community. We won’t sell or rent your data to anyone.
    • You can ask questions or make complaints. If you have any concerns or want to know what data we hold, just contact us at info@atlasinnovationco.org. We promise to respond quickly and fairly.
    • We’re transparent and accountable. We publish regular reports about how we handle data and involve community representatives in overseeing our work.

    2. Key Definitions

    • Personal Information: Information or opinion about an identified individual or an individual who is reasonably identifiable.
    • Sensitive Information: Includes information about racial or ethnic origin, religious beliefs, health information, etc.
    • Cultural Data: Includes stories, songs, symbols, traditional knowledge, and other Indigenous cultural expressions.
    • Children’s Data: Data collected from or about individuals under the age of 18.
    • CARE Principles: A framework that prioritizes Collective benefit, Authority to control, Responsibility, and Ethics in Indigenous data governance.
    • FPIC: Free, Prior, and Informed Consent. A process that ensures Indigenous Peoples have the right to give or withhold consent to projects or activities that may affect their lands, territories, resources, or cultural heritage. Consent must be given voluntarily (free), before any activity begins (prior), and based on full and accurate information (informed), without coercion, manipulation, or pressure.
    • AIATSIS: Australian Institute of Aboriginal and Torres Strait Islander Studies.

    3. What Information We Collect

    We collect the following types of information:

    a. Personal Information
    • Name, email address, phone number
    • Language preferences
    • Age (especially in education contexts)
    • Geographic region
    b. Sensitive Information
    • Cultural background or community affiliation (with consent)
    • Health or accessibility needs (for inclusive design)
    c. Cultural Data
    • Language samples (text, audio, video)
    • Traditional stories, songs, or practices
    • Community-provided materials for translation or AI training
    d. Children’s Data
    • Usernames or pseudonyms in educational apps
    • Progress in gamified learning systems
    • Guardian/teacher contact details (if applicable)

    4. How We Collect Information

    We collect data through:

    • Direct input from users (e.g. through our apps or websites)
    • Surveys and forms
    • Community consultations and workshops
    • Audio/video submissions for language documentation
    • Automated app usage tracking (with notice and consent)

    We commit to informing individuals at the time of data collection, including clear notices in apps, websites, and forms, explaining the purpose and use of their data.

    a. CARE Principles and Indigenous Data Governance

    We commit to upholding the CARE Principles for Indigenous Data Governance, which guide all our collection, storage, and sharing of cultural and Indigenous data:

    • Collective Benefit: Data initiatives must support the self-determination and wellbeing of Indigenous communities.
    • Authority to Control: Indigenous Peoples’ rights and interests in data must be recognized and respected.
    • Responsibility: Those using Indigenous data have a duty to engage respectfully, consult meaningfully, and use the data to benefit communities.
    • Ethics: All data work must minimize harm and reflect the values of the communities involved.

    All cultural data collection follows Free, Prior, and Informed Consent (FPIC) principles, ensuring communities have full understanding and voluntary agreement before any data use.

    We also adhere to established Indigenous knowledge frameworks such as the Protocols for Consultation and Negotiation with Aboriginal People by AIATSIS to guide respectful engagement and data stewardship. These protocols ensure culturally appropriate consultation processes and ongoing negotiation with Traditional Owners and communities.

    Additionally, we recognize the intergenerational nature of Indigenous cultural data and commit to honoring the rights and interests of future generations. This means considering long-term cultural preservation and transmission in all data governance decisions.

    These principles shape our engagement protocols, AI model design, consent procedures, and data stewardship responsibilities.

    5. Why We Collect and Use Your Information

    We collect and use data for the following purposes:

    • To develop and improve our language preservation tools
    • To generate and validate AI training data
    • To create cultural translations appropriate for Indigenous contexts
    • To report to funding bodies, in aggregate and de-identified formats
    • To provide educational feedback and progress reports to users or schools
    • To comply with legal obligations
    a. AI Model Development and Data Retention

    Anonymised/De-identified Definition: Removal of direct personal identifiers while preserving linguistic and cultural context necessary for AI training, with the anonymisation process approved by relevant communities.

    AI Model Governance: Our AI models undergo cultural bias testing with Indigenous community involvement before deployment. Communities participate in reviewing AI outputs for cultural appropriateness and accuracy.

    Data Retention for AI Models: When communities withdraw consent for AI training data, we commit to either:

    • Complete model retraining within 90 days, or
    • Retirement of the affected model version, or
    • Clear documentation of technical limitations preventing removal, with alternative remedies provided.

    AI Lifecycle Governance:

    • Training Phase: Only community-consented data with ongoing oversight
    • Testing Phase: Cultural bias testing with Indigenous community involvement
    • Deployment Phase: Community review of AI outputs before public release
    • Monitoring Phase: Continuous assessment for cultural appropriateness and bias

    Cultural Safety Measures:

    • Prohibition on AI generation of sacred or culturally inappropriate content
    • Regular testing for cultural bias and stereotyping in outputs
    • Community feedback mechanisms integrated into model performance evaluation

    Community Authority Over AI Models:
    Traditional Owners and language groups retain the right to:

    • Review AI model outputs using their cultural data before public deployment
    • Request removal of their data from AI models, requiring model retraining
    • Prohibit specific cultural contexts from being included in AI training
    • Participate in ongoing AI model performance evaluation and bias testing

    6. Legal Bases for Data Processing

    Where applicable, our processing of personal and sensitive information is based on the following legal grounds:

    • Consent: For collecting Indigenous cultural data, AI training data, and children’s information
    • Legal Obligation: For record-keeping and regulatory reporting
    • Public Task: For activities in the public interest, such as language preservation
    • Legitimate Interests: For internal analytics, platform improvement, or cultural safety evaluation, provided this does not override individual rights

    7. Who We Share Data With

    We share data only with:

    • Communities or organisations who originally contributed the data (with authority)
    • Government or philanthropic funders (only in aggregate or de-identified formats)
    • Technology partners under strict data agreements
    • Researchers with ethics approval and community consent

    We do not sell or rent personal or cultural information to third parties.

    Indigenous Cultural Data requires explicit community approval for any international transfer, regardless of adequacy decisions. Communities may prohibit international sharing even when technically legally permissible.

    For international transfers, we rely on:

    • Adequacy decisions by relevant authorities
    • Standard Contractual Clauses where appropriate
    • Binding Corporate Rules when applicable

    We may also disclose personal or cultural data:

    • To law enforcement agencies or in legal proceedings where required or authorised by law
    • In response to court orders, subpoenas, or regulatory investigations

    8. Children’s Privacy Protections

    We take additional steps to safeguard children’s privacy, particularly for users under 18:

    • Consent: We obtain parental or school-authorised consent before collecting children’s data
    • Education Use: Where data is collected via schools, we distinguish between school-authorised vs. individual/parental consent
    • Minimisation: We collect only essential data to support learning outcomes
    • Access Controls: Teachers or school administrators have secure access to children’s progress data, with parent visibility where relevant
    • Data Transition: When children reach adulthood, they may request access, deletion, or transfer of their data to personal accounts

    No Behavioral Profiling: We do not create behavioral profiles of children beyond immediate educational necessity, and no individual student data is shared with external parties without explicit consent.

    We monitor developments in children’s privacy regulation, including potential Children’s Privacy Codes, and commit to compliance with emerging standards.

    9. AI Training and Indigenous Language Models

    With informed community consent, we use data collected through our tools to:

    • Train Indigenous language models
    • Improve voice, text, and translation tools tailored to Aboriginal dialects
    • Create AI-generated content (e.g. culturally relevant Bible videos)

    We retain Indigenous training data for the life of the relevant model and conduct annual community review sessions to determine continuation, revision, or deletion.

    10. Data Retention and Review

    We retain information only as long as needed for the purposes outlined above:

    • Cultural data: Retained indefinitely with ongoing community consent; reviewed every 2 years
    • Children’s educational data: Retained for up to 7 years or until the individual reaches adulthood, whichever is longer
    • AI training data: Retained for the lifecycle of the model, with annual community review
    • General personal data: Deleted within 2 years of last contact or user request

    11. Security and Storage

    We use technical and organisational measures to protect your data, including:

    • Encryption of all data in transit and at rest
    • Access controls and audit logs
    • Secure cloud storage on Australian servers
    • Role-based access for staff and partners
    a. Cultural Breach Response Procedures

    In the event of a data breach involving cultural or community data:

    • We will notify affected communities within 24 hours of discovery
    • A Cultural Impact Assessment will be initiated with community representatives
    • Traditional protocols for redress, ceremony, or healing will be followed as requested
    • Affected communities will be provided with ongoing counselling and support services
    • Reports will be made available to relevant oversight bodies and community leaders

    While not legally required, we voluntarily implement enhanced notification procedures for cultural content breaches that go beyond the minimum legal requirements. These procedures prioritise community cultural protocols and aim to demonstrate our respect and commitment to affected communities.

    b. Secure Data Destruction Methods
    • Physical documents: Secure shredding with destruction certificates
    • Electronic data: Multi-pass cryptographic overwriting with verification
    • Cultural content: Community-approved destruction processes, including traditional ceremonies where culturally appropriate
    • AI model data: Removal of community data from AI models where technically feasible. Complete removal may require resource-intensive retraining. If immediate retraining is not possible, alternative measures such as retiring affected model versions or usage restrictions will be implemented. Technical limitations will be documented and addressed in collaboration with communities.
    • All destruction activities documented and reported to relevant communities
    c. Cyber Security Measures

    We maintain comprehensive cyber security procedures including:

    • Regular staff training on data security, including annual cyber security awareness training for all staff
    • Multi-factor authentication for all systems containing personal information
    • Regular penetration testing, security audits, and periodic cyber security assessments by qualified third parties, scheduled according to organisational risk profile and community needs.
    • Secure development practices for all applications handling personal data
    • Incident response procedures with 24-hour community notification for cultural data
    • Secure backup and recovery procedures

    12. Cross-Border Data Transfers

    We primarily store data in Australia. If data is processed outside Australia (e.g., via third-party services), we ensure:

    • Countries have adequate privacy protections, OR
    • We use standard contractual clauses, binding corporate rules, or other legally binding instruments
    • Indigenous cultural data requires community approval for any international transfer. Communities may prohibit international transfer regardless of adequacy decisions or contractual protections.

    13. Your Rights

    You have the right to:

    • Request access to your personal data
    • Request correction or deletion of your data
    • Withdraw consent at any time (where applicable)
    • You may lodge a complaint by emailing us at info@atlasinnovationco.org. We are committed to acknowledging and addressing all complaints promptly, and you can expect a response within 10 business days.
    • If you are not satisfied with our resolution, you have the right to escalate your complaint to the Office of the Australian Information Commissioner (OAIC) for independent review.
    • Request review of decisions involving AI or automated processes

    Automated Decision-Making:

    • You have the right to request a human review of any AI-generated translations or cultural content decisions that affect you.
    • You may challenge any automated profiling or educational assessments conducted through our platforms.

    Data Portability:

    • While not required under Australian law, you have the right to receive your data in a structured, commonly used format.
    • You may request transfer of your educational progress data between platforms, where technically feasible.

    For Indigenous contributors:

    • You may request that your data be handled in accordance with specific cultural protocols or restrictions

    14. Data Destruction and Withdrawal

    We are committed to respectful and secure data destruction:

    • Personal data will be securely deleted within 30 days of withdrawal or expiry of purpose
    • Cultural data will be deleted or archived only with community approval
    • AI training data will be removed from active datasets where technically possible upon withdrawal, with clear documentation of any technical limitations. Alternative remedies such as model retirement or versioning will be offered.
    • Physical storage devices, if used, are wiped or destroyed according to ISO/IEC 27040 standards

    15. Oversight, Governance and Accountability

    Atlas Innovation Collective will establish and maintain a Privacy and Cultural Ethics Committee (PCEC) composed of:

    • Indigenous Elders and cultural leaders
    • Technologists and data privacy experts
    • Legal representatives
    • Educational advisors

    The PCEC meets biannually to:

    • Review new data practices or tools
    • Audit compliance with privacy and cultural safety standards
    • Respond to community concerns

    Committee Reporting:

    • Biannual data use reports to participating Indigenous communities
    • Annual public transparency report on AI model cultural safety performance
    • Annual ACNC governance compliance reporting including privacy practices
    • Immediate reporting to communities for any cultural content concerns

    We publish an annual Transparency Report detailing:

    • Types of data collected
    • Breaches (if any)
    • Complaints received and resolved
    • Summary of ethical reviews conducted

    16. Privacy Policy Updates

    We may update this Privacy Policy from time to time to reflect changes in our practices, legal requirements, or community guidance. When we make significant changes, we will notify you by updating the effective date at the top of this policy and, where appropriate, through direct communication (such as email or notices on our website). We encourage you to review this policy periodically to stay informed about how we protect and use your information.

    17. Contact Us

    If you have any questions or concerns about this Privacy Policy or your data, please contact us:

    Atlas Innovation Collective Ltd.
    Email: info@atlasinnovationco.org
    Phone: 0474 700 491
    Mail: PO Box 1679, Nairne, South Australia

    Your trust is very important to us. We are committed to protecting your privacy, respecting your culture, and working together in a spirit of partnership.