PRIVACY POLICY
Neutopia Pty Ltd ACN 167 226 977
Last updated: May 2026
About this policy
Neutopia Pty Ltd ACN 167 226 977 (Neutopia, we, us, our) provides a cloud-based digital engagement platform designed for learning and membership organisations to build online communities, deliver personalised content and learning experiences, and manage member relationships (the Platform).
This privacy policy explains how we collect, hold, use and disclose personal information. Where the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs) apply to our handling of personal information, we aim to comply with those requirements. It also notes upcoming changes under the Privacy and Other Legislation Amendment Act 2024 (Cth) to the extent those provisions are in force.
We handle personal information in two distinct capacities:
As a business in our own right: when we collect and manage personal information directly from visitors to our website at neutopia.co, from representatives of our business customers, from our employees and contractors, and through the generation of aggregated and de-identified data derived from use of the Platform.
As a technology provider and processor: when we process personal information on behalf of the organisations that use our Platform (our Customers) in order to provide them with the services described in our agreements with them. Each Customer determines how and why personal information is collected from its users. If you are an end user of the Platform through a Customer (for example, a student, educator or community member), that Customer’s privacy policy is the primary notice that governs how your personal information is handled. This policy supplements that notice by explaining Neutopia’s role as the technology provider.
In some contexts (for example, where the EU or UK General Data Protection Regulation applies), Neutopia will be treated as a processor and our Customers as controllers for personal information processed through the Platform. Nothing in this policy is intended to change those role allocations set out in our agreements.
Information we collect
Information we collect as a controller
We collect the following categories of personal information directly:
Website visitors
When you visit neutopia.co, we may collect your IP address, browser type and version, operating system, referring URL, pages viewed and time spent on our website, and any information you submit through contact forms, demo request forms or newsletter sign-up forms (such as your name, email address, organisation name and phone number).
Business customer representatives
When an organisation enters into an agreement with us, we collect the name, email address, phone number, job title and billing information of the individuals who represent that organisation for the purposes of account management, billing, support and communications.
Employees and contractors
We collect personal information from our employees and contractors as necessary for employment or engagement, including contact details, tax file numbers, superannuation details, banking information, emergency contacts and any other information required by law or reasonably necessary for the employment or engagement relationship.
Aggregated data
We generate aggregated and de-identified data derived from use of the Platform. This data cannot reasonably be used to identify any individual. We use aggregated data to improve and develop the Platform, conduct benchmarking and produce analytics insights. Because Aggregated Data does not reasonably identify any individual, we do not treat it as personal information. If Aggregated Data were ever to become reasonably capable of identifying an individual, we would treat it as personal information and handle it in accordance with this policy.
Information we process on behalf of Customers
When a Customer uses the Platform, personal information of its authorised users (such as students, educators, alumni, members and other community members) is processed through our systems. This may include names, email addresses, usernames, profile information, user-generated content (posts, comments, messages, media), usage and engagement data, device and browser information, and IP addresses.
We process this information solely on our Customer’s instructions and in accordance with our agreements with them. Our detailed obligations in this capacity are set out in the data processing addendum that forms part of our services agreement. We do not determine the purposes or means of processing this information. Our Customer (the organisation that operates the Platform) is responsible for providing you with a privacy notice that explains how your personal information is collected, used and disclosed in connection with the Platform.
How we use personal information
As a business
We use the personal information we collect directly for the following purposes:
to respond to enquiries and provide information about the Platform and our services;
to enter into and perform our agreements with Customers, including billing, account management and support;
to manage our employment and contractor relationships and comply with our obligations as an employer;
to operate, maintain and improve our website, including through analytics;
to comply with applicable laws, regulations and legal processes;
to protect our rights, property and safety and that of our Customers and their users; and
to generate high-level, de-identified analytics and insights about use of our website and commercial relationships (for example, to understand which features and content are of most interest to potential Customers).
As a technology provider and processor
We process personal information on behalf of Customers solely as necessary to:
provide, operate, secure and support the Platform and the services described in our agreements;
deliver AI-powered features where enabled by the Customer (see section 5 below);
perform automated backups, security monitoring and incident response;
provide technical support in response to Customer requests; and
comply with applicable laws.
We may also use Aggregated Data derived from Customer Data to improve and develop the Platform and our services. Aggregated Data does not identify individuals.
We do not use personal information processed on behalf of Customers for our own marketing, advertising or profiling purposes.
Disclosure of personal information
We may disclose personal information to the following categories of recipients:
Sub-processors
The Platform uses third-party service providers for core infrastructure functions including authentication, transactional email delivery, search, error monitoring and media processing. These providers process personal information as necessary to deliver the Platform’s functionality. This processing may occur outside Australia. A list of our current sub-processors and their processing locations is set out in the sub-processor schedule to our services agreement with each Customer and is available on request.
Sub-processors are bound by written agreements that impose data protection obligations no less protective than those we observe.
Third-party AI providers
Where a Customer enables AI-powered features on the Platform, personal information may be processed by third-party AI providers via API calls for the purpose of generating content moderation outputs, translations, text-to-speech outputs, personalisation and analytics insights. See section 5 for further detail.
Professional advisors
We may disclose personal information to our legal, accounting and other professional advisors in connection with the operation of our business.
Law enforcement and regulators
We may disclose personal information where required or authorised by law, including in response to a court order, subpoena or request from a regulatory authority such as the Office of the Australian Information Commissioner (OAIC).
Business transfers
In the event of a merger, acquisition, restructure or sale of all or part of our business, personal information may be transferred to the acquiring entity, subject to applicable privacy laws and any contractual obligations.
We do not sell personal information. We do not disclose personal information to third parties for their own direct marketing purposes.
AI services and automated processing
How we use AI
The Platform includes AI-powered features that Customers may enable or disable at an institutional level. AI-assisted features of the Platform are optional and may be enabled or disabled by each Customer in their configuration settings. These features are designed to support safety, accessibility and operational insight, and include:
Content moderation: automated classification and risk-scoring of user-generated content in community areas of the Platform to detect content that may breach community standards or pose safety risks.
Translation: translation of content to support accessibility and multilingual delivery.
Text-to-speech: conversion of written content into audio format for accessibility and neuroinclusive learning.
Analytics: analysis of aggregated data to provide high-level insights into content usage and engagement patterns.
AI features are assistive tools only. They do not make final decisions about individuals. Content moderation operates as a classification and risk-scoring tool. It does not make disciplinary decisions. Human review remains the responsibility of the Customer.
Data minimisation
We apply data minimisation principles when using AI. We do not intentionally provide AI providers with user profile identity fields (such as name, email address or student identifier), academic records, grades or assessment submissions, or behavioural histories or profiling records, other than where such information is incidentally contained within content submitted for processing and is necessary for the relevant function.
Where personal information is incidentally included in content submitted to an AI system (for example, a name in text or a face in an image), it is processed only for the limited purpose of providing the relevant AI functionality and is not used to create or enrich any independent profile of an identifiable individual.
Third-party AI providers
AI features are delivered through third-party AI providers via server-side API integrations. Each Customer chooses which AI features to enable on its instance of the Platform. Where a Customer enables AI features, processing by the relevant providers may occur outside Australia, including in the European Union (France, Finland, Germany, Ireland), the United States and Canada. A current list of our third-party AI providers and their processing locations is set out in the sub-processor schedule to our services agreement with each Customer and is available on request.
Data submitted to a third-party AI provider is encrypted in transit and, where stored by that provider, at rest. API calls do not persistently store the content of personal information beyond the time necessary to generate the requested output. Metadata about API calls (such as timestamps and response codes) may be retained for security monitoring purposes.
Neither we nor our third-party AI providers use personal information processed through the Platform to train or improve general-purpose AI models made available to other customers or third parties. For the avoidance of doubt, this does not prevent the use of aggregated, de-identified data for internal service improvement purposes where permitted under the relevant sub-processor agreement.
Automated decision-making
The Platform does not carry out automated decision-making that produces legal effects concerning an individual or similarly significantly affects an individual. AI outputs are decision-support tools only. Our agreements require Customers not to use AI features as the sole basis for any high-risk decision about an identifiable individual (including decisions relating to admission, assessment, employment or disciplinary action) and to ensure that such decisions are subject to appropriate human review.
From 10 December 2026, amendments to the Privacy Act 1988 (Cth) made by the Privacy and Other Legislation Amendment Act 2024 (Cth) will introduce additional transparency requirements for certain types of automated decision-making. We will review our use of automated decision-making and update this policy and our related documentation where necessary to comply with those requirements.
Data storage and security
Personal information processed through the Platform is stored using Google Cloud Platform infrastructure located in Australia. The primary data storage location is the Sydney region (australia-southeast1), and backup data is stored in the Melbourne region (australia-southeast2).
We implement technical and organisational security measures to protect personal information, including:
encryption of data at rest and in transit;
role-based access controls and multi-factor authentication for administrative access;
regular security assessments including vulnerability scanning and penetration testing;
continuous security monitoring and logging;
web application firewall protection;
incident response procedures; and
personnel security measures, including confidentiality obligations for all staff with access to personal information.
Further details of our security controls and certifications are available in our Security Overview documentation, which we make available to Customers on request.
We are working towards obtaining formal ISO/IEC 27001:2022 certification. Our infrastructure provider, Google Cloud Platform, maintains SOC 2, ISO/IEC 27001:2022 and other industry certifications.
No method of transmission or storage is completely secure. While we take reasonable steps to protect personal information, we cannot guarantee absolute security.
Overseas disclosure
We store personal information in Australia using Google Cloud Platform infrastructure (Sydney — australia-southeast1, with backup in Melbourne — australia-southeast2). In some cases, our third-party service providers (including certain AI and content-moderation providers) may process personal information using infrastructure located outside Australia, including in the European Union (France, Finland, Germany, Ireland), the United States and Canada. The specific jurisdictions in which data is processed will depend on which services and AI features are in use. We maintain a current list of all providers and their processing locations, which is available on request.
We rely on contractual safeguards (including the EU Standard Contractual Clauses where applicable) and, where required, informed consent to ensure that overseas recipients handle personal information in accordance with the APPs.
Where personal information is disclosed to an overseas recipient, we take reasonable steps in accordance with APP 8 to ensure that the overseas recipient does not breach the APPs in relation to the information. These steps include contractual obligations requiring the recipient to protect personal information to a standard no less protective than the APPs.
Where the General Data Protection Regulation (GDPR) applies to any personal information we process, and that information is transferred outside the European Economic Area, we will use appropriate transfer mechanisms such as the Standard Contractual Clauses approved by the European Commission.
Cookies and analytics
Our website at neutopia.co uses cookies and similar technologies to operate the website, analyse usage and improve your experience. The categories of cookies we use are:
| Category | Purpose |
|---|---|
| Essential | Required for the website to function correctly, including session management and security. |
| Analytics | Help us understand how visitors interact with our website, including pages visited, time spent and navigation paths. We use this information to improve the website. |
| Functional | Enable enhanced functionality such as remembering your preferences and settings. |
You can manage your cookie preferences through your browser settings. Where required by law, we will present you with a cookie notice or settings tool that allows you to manage non-essential cookies. Disabling certain cookies may affect the functionality of the website.
The Platform itself (as accessed by end users through a Customer-branded instance) may use cookies and similar technologies as necessary for its operation. Cookie usage on Customer-branded instances of the Platform is subject to the Customer’s privacy policy.
Data retention
Information we hold as a controller
We retain personal information we collect directly for as long as necessary to fulfil the purposes for which it was collected, to comply with our legal obligations, to resolve disputes and to enforce our agreements. When personal information is no longer required, we will delete or de-identify it in accordance with our retention policies.
Information we process on behalf of Customers
We retain personal information processed on behalf of Customers for the duration of our agreement with them. Upon termination or expiry of an agreement, we make the Customer’s data available for export for 30 days. Following that period, we delete personal information from our active systems, except where retention is required by applicable law or where the data has been transformed into aggregated data. Personal information in backups is deleted or anonymised in accordance with our standard backup retention policies.
Your rights
If you are a website visitor or business customer representative
Under the APPs, you have the right to:
request access to the personal information we hold about you (APP 12);
request correction of personal information that is inaccurate, out of date, incomplete, irrelevant or misleading (APP 13); and
make a complaint about our handling of your personal information.
To exercise any of these rights, please contact us using the details in section 12 below.
If you are an end user of the Platform
If you access the Platform as an end user through a Customer (for example, as a student, educator or community member), your Customer is the controller of your personal information. You should direct any access, correction or deletion requests to your organisation in the first instance. We will assist the Customer in responding to such requests in accordance with our agreements.
Where the EU or UK General Data Protection Regulation applies to your use of the Platform, you may have additional rights in relation to your personal information under those regimes. Our Customers are primarily responsible for honouring those rights in their capacity as controllers. We will provide them with reasonable assistance as required under our agreements.
If you have concerns about how Neutopia handles personal information in its capacity as a technology provider, you may also contact us directly using the details in section 12.
Data breach notification
We maintain incident response procedures for responding to data breaches. If we become aware of a data breach that is likely to result in serious harm to any individual whose personal information is involved, we will notify the affected individuals and the OAIC as required by the Notifiable Data Breaches scheme under Part IIIC of the Privacy Act 1988 (Cth).
Where we are processing personal information on behalf of a Customer, we will notify the Customer without undue delay and where practicable within 24 hours of confirming a data breach, and will cooperate with the Customer in investigating, mitigating and remediating the breach.
Contact us
If you have any questions about this privacy policy, wish to exercise your rights, or wish to make a complaint about our handling of personal information, please contact us:
Privacy Officer: Jamie Engel
Email: privacy@neutopia.co
Post: Neutopia Pty Ltd, Level 1, 63-73 Ann Street, Surry Hills, NSW 2010
We will acknowledge your complaint within five business days and will endeavour to respond substantively within 30 days. If you are not satisfied with our response, you may lodge a complaint with the Office of the Australian Information Commissioner:
Website: www.oaic.gov.au
Phone: 1300 363 992
Post: GPO Box 5218, Sydney NSW 2001
Changes to this policy
We may update this privacy policy from time to time to reflect changes in our practices, technology or legal requirements. We will publish the updated policy on our website and update the date at the top of this policy. Where a change is material, we will take reasonable steps to notify affected individuals, including by posting a notice on our website or notifying our Customers so that they can update their own privacy notices as appropriate. Where a change is material to the way personal information is handled through the Platform, we will also notify our Customers so that they can update their own privacy notices and end-user terms where appropriate.
