Privacy Statement

Customer Experience Insight Pty Ltd ABN 61 634 039 759, trading as WA AI Hub, Western Australian AI Hub and Responsible AI Governance Sprint, of Perth, Western Australia (we, us), runs the website at aigovsprint.online, the AI Governance Hub™ and the Responsible AI Governance Sprint™.

We decide why and how the personal information described here is used. In privacy law terms we are the controller. Our Privacy Officer can be reached at privacy@wahub.ai or through the contact form.

Our annual turnover is below $3 million. That makes us a small business operator under the Privacy Act 1988 (Cth), and small business operators are generally not required to comply with the Australian Privacy Principles (APPs).

We have chosen to handle personal information in line with the APPs anyway, including the open and transparent management, collection, use and disclosure, overseas disclosure, security, access and correction principles, and the automated decision-making transparency rules in APP 1.7 to 1.9 that start on 10 December 2026. We handle suspected data breaches in line with the Notifiable Data Breaches scheme. We make this commitment to you, and you can hold us to it.

If the law changes and the exemption no longer applies to us, we will comply with the law from the date it applies.

The Spam Act 2003 (Cth) and the Australian Consumer Law apply to us whatever our size. We are a private company, so the Privacy and Responsible Information Sharing Act 2024 (WA) does not apply to us. It applies to Western Australian public entities.

If you are in the European Economic Area (EEA) or the United Kingdom, the General Data Protection Regulation (GDPR) or the UK GDPR may apply to our handling of your personal information. Where it does, we follow it, and the sections below on lawful bases, your rights and international transfers are written for you.

We have not appointed a representative in the EEA or the United Kingdom. We do not target our services at people there, and we expect to handle their personal information only occasionally and at low risk. If you are in the EEA or the United Kingdom, you can still contact us at the address above.

visitors to aigovsprint.online; people who create an account; Hub subscribers and the seats on a team plan; people who apply for the Sprint; Sprint participants; people who contact us; and people who receive our communications.

Our services are for adults. We do not knowingly collect personal information from children. See our Children's Policy.

We do not ask for government identity documents, dates of birth, or precise location. If you give us anything we did not ask for, we will treat it with the same care.

We do not knowingly collect information about children, and we ask you not to give us any.

We do not sell personal information, we do not use it for advertising, and we do not use it to train AI models.

We use personal information for a different purpose only if you would reasonably expect it and it is related to the original purpose, if you consent, or if the law requires or authorises it.

We send two kinds of messages. Service messages are part of what you asked for, such as account, billing, application and programme messages. Marketing messages promote our programmes, events and resources.

We send you marketing only if you have said yes. That choice is separate from applying, subscribing or creating an account, and the answer does not affect whether you get a service. Each marketing message identifies us and has an unsubscribe link.

You can withdraw consent at any time by using the unsubscribe link, or by email to privacy@wahub.ai. We act on it within 5 business days. Withdrawing consent does not affect past use.

We do not use automated scoring, ranking or profiling to assess applicants, and an automated check cannot refuse an application.

We do not use artificial intelligence to decide admission, pricing, refunds or access to a service.

We use AI language models to help find, draft and check public information for the Hub, such as laws and policies. We do not give them members' personal information.

We do not make decisions about you based solely on automated processing that produce legal or similarly significant effects, so GDPR Article 22 does not apply to our use of your information.

We also disclose personal information to external reviewers who help assess applications, under confidentiality terms, and to a sponsoring government department only where you have been told or agreed. We do not disclose it to others for their own use.

We may disclose information where the law requires or authorises it, for example to a court, regulator or law enforcement agency, or to protect our legal rights or someone's safety. We may also disclose it to our professional advisers, and to a buyer of our business, who must keep it protected.

Some providers above process information outside Australia, mainly in the United States. Before we disclose personal information overseas, we take reasonable steps to ensure the recipient handles it in line with the APPs, for example through contract terms and by choosing providers that hold independent security assurance such as SOC 2 or PCI DSS reports.

If you are in the EEA or United Kingdom, we rely on safeguards that those laws recognise for transfers, such as the European Commission's standard contractual clauses or an adequacy decision, as our providers offer. You can ask us for details.

HTTPS on every page, with strict transport security so that browsers connect securely.

Encryption of stored data by our database and hosting providers.

No payment card details on our systems. Card details are entered on Stripe's own page.

Passwords held only by our identity provider, in protected form.

Access to administrative tools limited to named staff who sign in through our identity provider, and secrets held in a managed secret store, not in code.

Automated checks on our code before it is released, and providers that publish independent assurance reports.

If personal information is lost or accessed without authorisation, we will assess it promptly, and within 30 days at the latest. If it is likely to result in serious harm, we will notify the people affected and the Office of the Australian Information Commissioner, as the Notifiable Data Breaches scheme requires. Where the GDPR applies, we will also notify the relevant supervisory authority within 72 hours of becoming aware, where it is required, and affected individuals where there is a high risk to them.

We keep a record for longer only if the law requires it, if a claim or complaint is open, or if you have an active subscription, refund or programme. Information that cannot be linked to a person, such as total counts, may be kept without limit. If you ask us to delete something we must keep by law, we keep only that record and use it for nothing else.

To use a right, email privacy@wahub.ai or use the contact form, saying what you want and how to reach you. If we refuse, we will tell you why in writing and how to complain.

Tell us first. Write to privacy@wahub.ai with details of your concern. We will acknowledge it within 5 business days and respond within 30 days.

If you are not satisfied, you can complain to the Office of the Australian Information Commissioner (oaic.gov.au (opens in a new tab), 1300 363 992, enquiries@oaic.gov.au, GPO Box 5218, Sydney NSW 2001). We recognise that the OAIC may not be able to investigate a complaint about a small business that is not covered by the Act, but we will deal with your complaint fairly in any case.

If you are in the EEA or United Kingdom, you can complain to the data protection authority in the country where you live, work or where you think the problem happened.

We ask for your choice on analytics when you first visit. You can change it at any time by clearing your browser storage for this site, after which the banner shows again. You can also set your browser to block cookies, but sign-in will not work.

We treat sign-in cookies as strictly necessary because they are needed to provide the sign-in you request, and we do not use them for anything else.

We review this statement at least once a year and when our practices or the law change. We will post changes here with a new date, and tell you by email about material changes if we have your email address.