Privacy Notice

The Tasmanian Women's Leadership Scholarship Program is delivered by a partnership of three organisations:

• Madfinch Pty Ltd — lead delivery organisation and grant recipient
• Just Beyond Consultancy — co-delivery partner
• Global Leadership Foundation — methodology, facilitation, and program systems

For the purposes of this privacy notice, "we", "us", and "our" refer to this delivery partnership operating collectively. Global Leadership Foundation acts as the data processor for program systems, operating under direction from Madfinch Pty Ltd as the lead organisation.

Global Leadership Foundation

Global Leadership Foundation
Unit 4, 535 Flinders Lane, Melbourne Victoria 3000, Australia
ABN: 65 104 582 381
Website: globalleadershipfoundation.com
Email: women@globalleadershipfoundation.com

The program is funded by the Tasmanian Government through the Department of Premier and Cabinet (DPAC), Women's Portfolio. The Tasmanian Government is a data recipient for program reporting and evaluation purposes (see Section 6).

We collect different categories of information depending on your role in the program.

Scholarship applicants and participants

Mentors

We collect name, contact details, professional profile (organisation, job title, industry, career stage), expertise and mentoring approach responses, availability and session format preferences, network source, and consent records.

Executive sponsors

We collect name, contact details, job title, organisation, and records of engagement with the program including session attendance, documented commitments, WEGA Gender Equality Diagnostic Tool completion, and three-month follow-up responses.

Information we do not collect

We do not collect government identifiers (such as Tax File Numbers or Medicare numbers), financial account information, or health records. Diversity information is self-reported, voluntary, and not verified.

We use your personal information for the following purposes:

• Administering the scholarship program — processing applications, communicating decisions, managing cohort records, scheduling events, and tracking attendance.
• Mentor matching — using professional profile, industry, career stage, and development goal information to match participants with appropriate mentors.
• Employer engagement — recording sponsor relationships and engagement session attendance to support the employer engagement objectives of the program.
• Program evaluation — measuring outcomes against the five program objectives using pre- and post-program assessments and follow-up surveys, for internal learning and for reporting to DPAC.
• Participant support — ensuring access and equity needs are met, including travel subsidies, accessibility arrangements, and cultural safety considerations.
• Alumni network — where you have consented, maintaining contact after the program concludes for alumni network purposes, future mentoring opportunities, and program follow-up surveys.
• Program reporting — providing aggregated and de-identified outcome data to DPAC as required under the grant agreement. Individual identifying information is shared with DPAC only where you have consented, or where required by law.
• Continuous improvement — using evaluation data across cohorts to improve program design.

We will not use your information for any purpose other than those listed here without first obtaining your consent or being required to do so by law.

We process your personal information under the following legal frameworks, depending on your location:

Australian participants

We process personal information in accordance with the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs). We also comply with the Personal Information Protection Act 2004 (Tas) in the context of this Tasmanian Government-funded program.

Our legal basis is:

• Consent — collected at application for data storage, alumni contact, photography and video, and sharing with DPAC.
• Contractual necessity — for administering the program once a scholarship is accepted, including attendance tracking, mentor matching, and evaluation.
• Legal obligation — for reporting to DPAC as required under the grant agreement.

Diversity self-identification

We ask applicants whether they identify as Aboriginal or Torres Strait Islander, culturally and linguistically diverse, a person with disability, or LGBTQIA+. This information is:

• Entirely voluntary — you may leave all fields blank or answer some but not others
• Used only to ensure the program reaches participants who may face additional barriers, and for aggregated, de-identified reporting to DPAC
• Never used to make decisions about individual applications
• Stored separately in the program database and accessible only to program leadership
• Not shared with mentors, sponsors, employers, or other participants

Workplace experience responses

Your written responses to application questions about workplace challenges, barriers, and experiences may contain sensitive information about your workplace relationships, health, or personal circumstances. These responses are read by the assessment panel for scholarship selection purposes only, and by program facilitators to support your development. They are not shared beyond the delivery team.

Access and equity information

Information about accessibility requirements, cultural safety needs, disability, or financial circumstances provided in the access and equity section is used only to support your participation. It is handled by program leadership and is not shared with other participants, mentors, or sponsors without your explicit agreement.

We do not sell your personal information. We do not share your information with advertisers or commercial third parties. We do not share individual application responses, scoring notes, or evaluation data beyond the delivery team and DPAC without your explicit consent.

The TWLSP program database is hosted on servers in Australia. All personal information collected through this program is stored and processed in Australia.

This program is open to Tasmanian participants only. Personal information is not transferred outside Australia as part of normal program operations. In the unlikely event that any transfer to an overseas recipient becomes necessary, we will take steps to ensure the recipient handles that information consistently with the Australian Privacy Principles.

When the retention period expires, we securely delete or anonymise the relevant records. You may request earlier deletion — see Section 10 for your rights.

We take the security of your personal information seriously. Our technical and organisational measures include:

• Access controls — the program database is accessible only to authorised members of the delivery team, using password-protected accounts with role-based access. Not all team members can see all data — roles are assigned based on what each person needs to do their job.
• Encrypted transmission — the program website operates over HTTPS. Data transmitted between your browser and our server is encrypted.
• Password security — admin passwords are stored using industry-standard one-way hashing (PHP password_hash with bcrypt). We never store passwords in plain text.
• Physical security — data is hosted on a managed server with appropriate physical and network security controls.
• Staff awareness — members of the delivery team with access to personal data understand their obligations under this notice and applicable privacy law.

No data transmission over the internet is completely secure. While we take all reasonable precautions, we cannot guarantee the absolute security of information you transmit to us.

Your rights under Australian Privacy Law

Under the Privacy Act 1988 and the Australian Privacy Principles, you have the right to:

• Access the personal information we hold about you
• Correct information that is inaccurate, out of date, incomplete, or misleading
• Withdraw consent for uses that are consent-based (such as alumni contact, photography, and DPAC data sharing)
• Make a complaint to us or to the Office of the Australian Information Commissioner (OAIC) if you believe we have mishandled your information

How to exercise your rights

Contact us at women@globalleadershipfoundation.com with your request. Please include your full name, the email address you used to apply, and a description of the information or right you are requesting. We may need to verify your identity before we can action the request.

Withdrawing consent

You may withdraw any consent you have given at any time by contacting us. Withdrawal of consent does not affect the lawfulness of processing carried out before withdrawal. Some withdrawal of consent may affect your ability to participate in certain aspects of the program — for example, if you withdraw consent to data storage, we cannot continue to administer your scholarship record. We will explain any such implications before acting on a withdrawal request.

We maintain procedures for detecting, investigating, and responding to data breaches. In the event of a data breach that is likely to result in serious harm to affected individuals:

• We will notify affected individuals as soon as practicable
• We will notify the Office of the Australian Information Commissioner (OAIC) within 30 days of becoming aware of an eligible data breach, in accordance with the Notifiable Data Breaches scheme under the Privacy Act 1988
• Notification to affected individuals will include a description of the breach, the types of information involved, what we are doing in response, and what you can do to protect yourself

The TWLSP application portal uses a single session cookie to maintain your login state for the duration of your browser session. This cookie is deleted when you close your browser. We do not use advertising cookies, tracking cookies, or third-party analytics cookies on this portal.

Server access logs record IP addresses and browser information as part of standard web server operation. These logs are used only for security and diagnostic purposes and are not used to identify individual visitors by name.

For any questions about this privacy notice, to exercise your rights, or to make a complaint about how we have handled your personal information:

Regulatory bodies

If you are not satisfied with our response to a complaint, you may contact:

• Australia: Office of the Australian Information Commissioner (OAIC) — oaic.gov.au
• Tasmania: Personal Information Protection Commissioner — ombudsman.tas.gov.au

We may update this privacy notice from time to time to reflect changes in the program, our practices, or applicable law. When we make material changes, we will notify active participants by email and update the version number and effective date at the top of this page. The current version will always be available at this URL.

Continued participation in the program after notice of changes constitutes acceptance of the updated notice for processing activities going forward. For consent-based activities, we will seek fresh consent where required by law.