We

In this document, ‘we’ means Diversity Atlas Pty Ltd, the company that supplies Diversity Atlas and the Inclusive Employer Index. We are a Data Processor as defined by the European Union’s General Data Protection Regulation (GDPR).

The term ‘our service’ refers to the Diversity Atlas website, which includes any Diversity Atlas survey and the Diversity Atlas administrator dashboard.

Client Organisation

The entity to whom Diversity Atlas is providing access to our survey tool. This could be a private business, a government agency or non-governmental organisation (NGO). A client organisation is a Data Controller as defined by GDPR.

Organisational Administrator

An employee of a client organisation whom the processor gives access to the Diversity Atlas dashboard to view and analyse results of the survey.

Respondent/Participant

A respondent is a person who provides their personal information as part of their participation in a Diversity Atlas survey. A respondent is a Data Subject as defined by the GDPR.

We may collect information on how the Diversity Atlas website is accessed and used, which is known as Usage Data. For survey participants, this Usage Data does not include your Internet Protocol address (IP Address) or any other Personal Identifiable Information (PII), but can give us information about browser type, browser version, the pages of our website that you visit, the time and date of your visit, the time spent on those pages, which type of device you are using, and other diagnostic data.

We use cookies and similar tracking technologies to monitor and hold certain information about your use of our website. Cookies are filed with small amounts of data, which may include an anonymous unique identifier. Cookies are sent to your browser from a website and are stored on your device. Tracking technologies we also use are beacons, tags, and scripts to collect and track information and to improve our service and analyse how visitors use it. We do not use advertising cookies.

You can instruct your browser to refuse all cookies or to indicate when a cookie is being sent by a website. However, if you do not accept cookies, you may not be able to use some portions of our website.

We use google analytics to collect and store the information while participants interact with our services. The information collected is kept confidential and not shared with any outsourcing companies. This is used for internal analysis. The location of the participant is not tracked while tracking their usage.

Your participation in a Diversity Atlas survey involves the provision of cultural and demographic information—that is, information about you which a third party might be able to use to identify you if they gained access to it.

As a survey respondent, you should understand that there are unavoidable risks involved in the provision of personal information to any entity, however we believe that we have taken every available measure to ensure this will not happen, including but not limited to full encryption, anonymity, ISO27001 certification, systems to ensure pseudonymisation (see ‘rule of 20’ below) and a decision to lodge the platform in a secure cloud-based server.

We also do not validate and verify the participants’ input.

Your organisational coordinator has access to the overall results, but not any participant’s specific answers. Diversity Atlas also has this same level of access, but only upon request by the organisation to provide technical, administrative or expert support. Your data is never nor will it ever be disclosed to, shared or sold to a third party.

Anonymous method of surveying:

The beauty of Diversity Atlas is that you are anonymous. Your answers form part of your organisation's diversity snapshot but cannot be attributed to any participant individually.

Additionally, the Diversity Atlas survey invites respondents to provide information about themselves which is considered ‘sensitive information’ under Section 6(1) of Australia’s Privacy Act and article 9 of the European Union GDPR. This includes information about:

• Ancestral and/or cultural heritage
• Sexual orientation
• Religion / Worldview
• Disability

Answering these questions is entirely voluntary. Respondents are under no obligation to answer these questions and can indicate in the Diversity Atlas survey that they prefer not to answer them.

Once a Diversity Atlas survey has been completed, the results are made available to the client organisation’s Organisational Admin via the Diversity Atlas online dashboard.

Using this dashboard, Organisational Administrators can undertake analysis and generate reports based on the results of the survey. Access to this Dashboard is limited to the designated Organisational Contact Person and is protected with SSL-encrypted passwords. Each page of Diversity Atlas has an SSL certificate. Our web server is located in a highly secured domain where its security is guaranteed. All website data is backed up on a daily, weekly and monthly basis.

Diversity Atlas’ administration and analytics dashboard limits the visibility of participants’ data to preserve their confidentiality. Organisational admins can see how many in their organisation have completed the survey but they cannot see respondents’ individual answers to survey questions.

What admins can see:

• How many people responded to the survey
• Overall organisational results
• Diversity metrics disaggregated to the level of teams or departments with 20+ participants

What they can’t see:

• Respondent’s individual answers
• The names of any respondents
• Team-level results for teams within the organisation in which less than 10 people have responded

What can Diversity Atlas see?

Diversity Atlas’ development team do not have access to the results of a survey unless the organisational administrator officially asks for help and allows us ‘View’ consent. Diversity Atlas team members cannot view or modify respondents’ responses.

Rule of 20

No survey results are shown unless 20 people have submitted a survey.  This applies not just to ‘all’ but also by department, or office, or business unity.

Filter enquiries are also subject to the rule of 20.  For example, the dashboard allows administrators to search the results by gender or age.  If the query is to show results of ‘women’ between the ages of 20 and 40, no results will be shown unless there were 20 women in that age range.

For the DCA IE survey, the ‘all’ figure is even higher, at ‘36’, but the filter queries across diversity demographics is set at ‘10’.

We store all users’ information on servers protected by world-leading standards of data integrity.

In Australia, all databases containing users’ data are stored on our Amazon Web Services (AWS) servers in Sydney, Australia. We have the capacity to make our service available to clients off servers located anywhere in the world, pursuant to their needs and any legislative requirements for the storage of personal data. There are no other outsourcing companies involved in collection and data storage. In EU jurisdictions, data is hosted at AWS servers in Berlin, Germany.

Encryption

The admin dashboard is only accessible to organisational admins with a password. All admin passwords are SSL encrypted using the Hash function, meaning that nobody has access to them—including the Diversity Atlas team.

Diversity Atlas uses column-based encryption to offer additional protection to the information provided by respondents in a Diversity Atlas survey.

Shared responsibility is collaboration between two parties performing their duties to maintain the secure environment. Diversity Atlas and its customers share equal responsibility of security and compliance. This security model helps to establish secure environment with less operational overhead as Diversity Atlas operates, manages, and controls the facilities that they run.

As shown below, there are different responsibilities that refers to the security of the platform versus security in the platform.

This shared responsibility model offers IT controls. There are few shared controls like operation of IT environment like management and verification of IT controls. Diversity Atlas helps to reduce the overload of operating controls by managing controls deployed in platform that were managed by customers before. Following are the controls managed by customers, Diversity Atlas, or both:

Shared Controls: In a shared control, AWS gives the information of requirements for the infrastructure and the customer comes up with their own control implementation within their use of AWS services. For example:

• Patch management.
• Configuration management
• Awareness and training.