Privacy Information

1. About this policy

The service is an online education platform that helps schools deliver learning activities, safety assessments, track student progress and manage related school activities.

We respect your privacy and are committed to protecting the personal information of students, teachers, school staff, parents, guardians and other authorised users.

This Privacy Policy explains:

• What personal information we collect.
• How and why we use that information.
• Who may access or receive your information.
• How we protect and store information.
• How long we retain information.
• How you can request access, correction or deletion of information.
• How you can raise privacy concerns or complaints.

This policy applies to our school application, public website and related services.

We handle personal information in accordance with applicable Australian privacy laws, contractual obligations and school requirements.

This policy is publicly available at [Privacy Policy URL] and can be viewed without signing in.

2. Who is responsible for your information?

Our service is operated by Emerlogic Pty Ltd (referred to as "we", "us" or "our").

Schools are responsible for managing their school accounts, users, learning activities and educational records. This includes determining which staff and students require access to the service.

We provide and maintain the platform, process information to deliver the service and take reasonable steps to protect information held by us or on our behalf.

Schools remain responsible for their decisions about the educational use, retention and disclosure of their records, subject to applicable laws and agreements.

If you have questions about your school account, assessment results or information entered by your school, contact your school administrator.

If you have questions about how we operate the platform or handle personal information, you can contact us using the details at the end of this policy.

3. What information do we collect?

We collect only the information reasonably needed to provide, support and secure our services.

The information collected depends on your role and the features used by your school.

Account and identification information

This may include:

• Your name, username and email address.
• Your school and account role.
• Your year level, class membership and faculty membership.
• Your staff responsibilities and assigned permissions.
• Information needed to manage account access and authentication.

School administrators create and manage authorised accounts. Information required for account creation is distinguished from optional information in the relevant account-management process.

Staff accounts: [Confirm mandatory and optional staff registration fields.]

Student accounts: [Confirm mandatory and optional student registration fields.]

Information not required for account creation may be provided when relevant to an authorised school activity or feature.

Because the service maintains identifiable learning, safety and accountability records, anonymous or pseudonymous accounts are not generally supported. Schools may use assigned identifiers or minimise identifying details where the service supports this, while maintaining the ability to identify the relevant user when necessary.

We do not require government-issued identifiers, such as Tax File Numbers or Medicare numbers, for ordinary account creation. We do not adopt government-related identifiers as our own account identifiers.

Learning and assessment information

When you participate in learning activities or assessments, we may collect:

• Activities and assessments assigned to you.
• Your answers, submissions and assessment attempts.
• Assessment scores, results and completion status.
• Your learning progress and activity history.
• Feedback and other records associated with your learning.

School administration information

Authorised school staff may enter or manage information related to school activities, staff responsibilities, practical learning activities and maintenance records.

These records may contain personal information where it is necessary for an authorised school purpose.

Technical and security information

We may collect technical information needed to operate and protect the service, including:

• IP addresses and basic device or browser information.
• Login attempts and account activity.
• Error reports and security-related events.
• Dates and times of relevant activities.
• Records of policy acknowledgements and account security settings.

We do not collect precise device location information, such as GPS coordinates, as part of ordinary use of the service. IP addresses may provide an approximate indication of location and may be processed for security and operational purposes.

Preferences and accessibility settings

Where supported, users may select preferences such as display themes, text size, fonts and accessibility features.

These preferences are used to personalise the service. Users are not required to disclose a disability or medical condition to use these settings.

Website and support information

If you contact us, request information or use our public website, we may collect your name, contact details, message and information reasonably necessary to respond to your enquiry.

We do not require students to provide unnecessary personal or sensitive information to complete ordinary learning activities.

Location information and geographic access restrictions

We do not collect GPS coordinates, track users' physical movements or maintain location histories.

For security purposes, we may use the IP address associated with a connection to estimate the country or region from which the service is being accessed.

Access from certain locations outside Australia and New Zealand may be restricted or blocked to help protect the service against unauthorised access, cyber threats and other security risks.

IP addresses and related access events may be retained in security logs for monitoring, troubleshooting and investigating potential security incidents.

This information is used for security and service protection purposes, not to track users' physical movements or for advertising or marketing.

4. How do we collect information?

We collect information in several ways:

• From your school: authorised staff create or manage user accounts, classes and school records.
• From you: information you provide when using the service, completing activities, changing settings or requesting assistance.
• Automatically: technical and security information generated while you use the platform.
• From authorised integrations: information supplied through school-approved authentication or integration services, where enabled.

If information needed for an account or activity is not provided, some features may be unavailable. Schools can explain which information is required for their activities.

Anonymous and pseudonymous enquiries

Where practical, individuals may make general enquiries or provide feedback without identifying themselves.

We may need to verify your identity when responding to requests involving accounts, educational records, personal information or other matters requiring authorised access.

Unsolicited personal information

If we receive personal information that we did not request, we assess whether it is reasonably necessary for our services or whether we are required or authorised to retain it.

Where information is not required or authorised to be retained, we take reasonable steps to securely delete or de-identify it as soon as practicable, where lawful and reasonable.

5. How do we use information?

We use personal information to:

• Create, authenticate and manage user accounts.
• Deliver learning activities, tests and safety assessments.
• Record assessment responses, results and progress.
• Allow authorised school staff to manage classes, users and activities.
• Generate reports and provide feedback to students and school staff.
• Support authorised school administration and maintenance activities.
• Provide technical support and respond to enquiries.
• Maintain the security, availability and reliability of the platform.
• Investigate suspected misuse, technical problems or security incidents.
• Meet applicable legal and contractual obligations.

We may use aggregated or appropriately de-identified information internally to understand service performance and improve the platform.

Marketing and communications

We do not sell personal information, use school account information for targeted advertising or send marketing communications to students.

Optional commercial marketing communications to eligible adult recipients are sent only where the recipient has expressly opted in. Recipients may unsubscribe at any time.

Essential service, account, security and administrative notifications may still be sent where necessary to operate the service.

We do not share personal information, including aggregated or de-identified user data, with third parties for advertising, market research, profiling or other unrelated commercial purposes.

Artificial intelligence and machine learning

We do not use student or staff personal information, learning records or school content to train artificial intelligence or machine-learning models.

We do not share user data, including aggregated or de-identified information, with third-party artificial intelligence services for model training or development.

Any future introduction of features that materially change these practices will require an appropriate privacy review, policy update and any necessary authorisation before implementation.

6. Who can access your information?

Access to information is restricted according to user roles, permissions and legitimate responsibilities.

Depending on the school's configuration:

• Students can access their own learning activities, progress and results.
• Teachers and authorised staff can access information about students and activities within their assigned responsibilities.
• School administrators can manage users, permissions and authorised school records.
• Parents and guardians, where access is enabled and authorised, may view permitted information about students for whom they are responsible.
• Authorised service personnel may access information when reasonably necessary to administer, maintain, secure or support the platform.

Access to one school's records does not ordinarily give users access to records belonging to another school.

The service does not provide general functionality allowing users at one school to search for or discover users or records belonging to another school.

Schools may download reports or export information for authorised educational and administrative purposes. Once exported, the school is responsible for handling those copies securely.

7. When do we share information?

We do not sell personal information or share student information with third parties for advertising, marketing or other unrelated commercial purposes.

We use contracted infrastructure and service providers to host, maintain, secure and operate the platform. These providers may process personal information only as necessary to provide their services and subject to applicable contractual and security safeguards.

Information may also be disclosed where authorised by the relevant school or required or permitted by law.

We do not otherwise provide personal information, school records or aggregated or de-identified user data to unrelated third parties for their independent commercial purposes.

Subprocessor Disclosure Statement

We maintain a separate Subprocessor Disclosure Statement identifying the external service providers involved in delivering the platform.

The statement provides further information about:

• The names of applicable infrastructure and service providers.
• The services and processing activities they perform.
• The categories of information they may access or process.
• The locations in which information may be processed or stored.

For further information about the external providers that may handle your information, please refer to our Subprocessor Disclosure Statement.

This statement should be read alongside this Privacy Policy and is updated as necessary to reflect changes to our service providers and processing arrangements.

8. Where is information stored?

Our primary application and school records are hosted using [Hosting Provider] in [Location, Country].

We use external infrastructure and communications providers to operate and protect the service. These providers may process personal information, including technical and account information, where necessary to deliver their services.

Overseas processing and disclosures

[Confirm whether personal information is likely to be disclosed to overseas recipients, the relevant countries where practicable, and the purposes of those disclosures.]

Our Subprocessor Disclosure Statement provides further information about the providers involved, the information they may process and their processing locations.

We review our service providers and take reasonable steps to ensure appropriate privacy and security protections are in place.

9. How do we protect information?

We use technical and organisational safeguards designed to protect personal information against loss, misuse, unauthorised access, modification and disclosure.

These safeguards include, where appropriate:

• Encrypted connections between users and the service.
• Encryption of stored information.
• Role-based access controls and account permissions.
• Authentication and account-security measures.
• Security monitoring, logging and incident-response procedures.
• Data backups and recovery arrangements.
• Access restrictions for infrastructure and administrative systems.

No online service can guarantee absolute security.

Users must keep account credentials confidential and report suspected unauthorised access.

We investigate suspected data breaches and notify affected schools, individuals and regulators where required by applicable law.

10. How long do we keep information?

We retain personal information only for as long as reasonably necessary to deliver our services, meet school requirements and fulfil applicable legal obligations.

School learning records, assessment results and related information are retained in accordance with the school's arrangements with us and any applicable recordkeeping requirements.

When a school stops using the service, its records are handled according to our service agreement and retention procedures. This may include returning, deleting or securely de-identifying information, subject to lawful retention requirements.

Deleted information may remain temporarily in protected backups until those backups expire under our backup-retention schedule.

Retention arrangements:

• School records: [Specify retention arrangements].
• Account and security records: [Specify retention periods].
• Support enquiries: [Specify retention period].
• Backups: [Specify maximum deletion period following removal from active systems].
• Records retained for legal obligations: [Specify applicable criteria].

Schools should contact us to discuss data export, deletion or retention requirements.

11. Cookies and technical information

Our application uses cookies and similar technologies where necessary to maintain login sessions, remember relevant preferences and protect the service.

Our public website may use additional technologies to understand website performance and respond to enquiries.

[Identify any analytics, marketing or other non-essential cookies used on the public website, and how users can manage their choices.]

Most browsers allow users to manage or delete cookies. Disabling essential cookies may prevent parts of the application from functioning correctly.

We do not use student activity within the school application for targeted advertising.

12. Children and young people

Our platform is designed for use in educational settings, including by children and young people.

We recognise the importance of protecting student information and handling it in a way that is appropriate for their age and circumstances.

Schools are responsible for ensuring that their use of the service is appropriately authorised, including obtaining any parental or guardian authorisation where required.

We aim to minimise the personal information required from students and limit access to authorised users.

Students should ask a teacher, parent or guardian if they need help understanding this policy.

Users are required to review and acknowledge the current Privacy Policy before first using the service.

This acknowledgement records that the policy has been presented and acknowledged. It does not replace any separate legal consent or authorisation that may be required.

Student access and restrictions

Schools are responsible for determining appropriate access to the service for their students, taking into account each student's age, maturity, abilities, individual needs and applicable school policies.

Schools may establish access restrictions, supervision requirements or additional safeguards where appropriate. They are also responsible for considering reasonable adjustments and accessibility requirements to support students with disabilities or additional learning needs.

The service operator provides the tools to manage user accounts and permissions but does not determine individual students' educational suitability or capacity to use the service.

Schools must ensure that their access decisions comply with applicable laws, including relevant child safety, privacy and anti-discrimination obligations.

13. Accessing, correcting and deleting information

You may request access to, correction of or deletion of personal information held about you.

We do not charge a fee for submitting or processing these requests.

For information managed by your school, such as account details, class membership or assessment records, contact your school administrator in the first instance.

For information held or managed directly by us, contact our privacy officer using the details below.

We aim to respond to and resolve eligible requests as promptly as practicable and within three months of receipt, unless a shorter period is required by applicable law.

Where a request cannot be completed within that period, or information must be retained for lawful reasons, we will explain the circumstances and any available options.

Requests for deletion may be subject to school recordkeeping obligations, contractual requirements or applicable laws.

Where information is managed by a school, we will work with the school to assess and respond to the request.

Some requests may be refused or restricted where permitted or required by law. Where appropriate, we will explain the reasons for our decision and any available complaint or review options.

Ownership of school and user content

We do not claim copyright or ownership of learning materials, assessment questions, student responses, school records or other content created or uploaded by users of the service.

Copyright and other intellectual property rights remain with the original creators or their respective rights holders, including schools, staff, students and third parties, as determined by applicable law and existing agreements.

We may store, process, display, back up and reproduce this content only as reasonably necessary to provide, maintain, secure and support the service, in accordance with applicable school arrangements.

We do not sell, publish or commercially reuse school or user content for unrelated purposes.

Schools may request the export or deletion of their content in accordance with their service agreement, applicable retention requirements and legal obligations.

Individual requests concerning school-managed content should be directed to the relevant school administrator. Copyright ownership does not override lawful school recordkeeping requirements.

14. Privacy concerns and complaints

If you believe your personal information has been handled incorrectly, you can contact us using the privacy contact details below.

Please provide enough information for us to understand and investigate your concern.

We will:

1. Acknowledge and review your complaint.
2. Investigate the relevant circumstances.
3. Consult with your school where appropriate.
4. Explain the outcome and any actions taken.

We aim to respond to privacy complaints within 30 calendar days, or otherwise within the period required by applicable law.

If you are dissatisfied with the outcome, you may be able to contact the Office of the Australian Information Commissioner or the relevant state or territory privacy regulator, depending on the circumstances.

15. Changes to this policy

We review this Privacy Policy at least annually and whenever material changes to our services or information-handling practices occur.

Each published version includes a version number and effective date.

Users must review and explicitly acknowledge the current Privacy Policy before first using the service.

When we publish an updated Privacy Policy, users will be required to review and acknowledge the new version before continuing to use the service.

When applicable Terms of Use are updated, users will also be required to review and explicitly accept the updated terms before continuing to use the service.

We retain records of the document versions presented and accepted or acknowledged, including the relevant date and time.

Where changes require additional legal consent or authorisation, we will obtain it through an appropriate process.

Our Terms of Use are maintained separately for staff and students.

16. Contact us

For questions about your school's own records, contact your school administrator.

1. Purpose

Emerlogic Pty Ltd engages selected third-party infrastructure and security providers to host, operate, maintain and protect its online education platform.

These providers may process personal information only as necessary to deliver their contracted services, subject to applicable privacy, confidentiality and security obligations.

We do not sell personal information or share student information with third parties for advertising, marketing or other unrelated commercial purposes.

This statement identifies the subprocessors used by our service, their purposes, the types of information they may process and the locations where processing may occur.

2. Subprocessor Register

Provider and contact	Purpose	Personal information processed	Lawful basis / authorisation	Processing and storage locations
Amazon Web Services (AWS) – Australia — Amazon Web Services, Inc. and applicable AWS contracting entity. Website · Privacy contact	Cloud infrastructure for Australian schools, including application hosting, database and file storage, backups and transactional email services.	User account information, student assessment responses and results, class records, application data, email addresses, transactional email content, IP addresses and system logs.	Processing for school-authorised educational services, platform security and applicable contractual and legal obligations.	Australia – Sydney (ap-southeast-2). Primary application data and configured regional storage for Australian school customers. Certain support, operational and service-specific processing may occur internationally under applicable AWS terms.
Amazon Web Services (AWS) – New Zealand — Amazon Web Services, Inc. and applicable AWS contracting entity. Website · Privacy contact	Cloud infrastructure for New Zealand schools, including application hosting, database and file storage, backups and supported AWS services.	User account information, student assessment responses and results, class records, application data, email addresses, IP addresses and system logs. Transactional email data may also be processed through the configured email service.	Processing for school-authorised educational services, platform security and applicable contractual and legal obligations, including relevant New Zealand privacy requirements.	New Zealand – AWS Asia Pacific (New Zealand) (ap-southeast-6). Intended primary hosting and regional storage for New Zealand school customers, subject to deployment. Services not hosted in this region, including any separately configured email services, must be disclosed according to their actual processing location. International support and service-specific processing may also occur under applicable AWS terms.
Cloudflare — Cloudflare, Inc. and applicable contracting affiliate. Website · Privacy Policy · Email: [email protected]	DNS management, DDoS protection, web application firewall, malicious traffic filtering, geographic access restrictions, TLS termination and reverse-proxy security services for Australian and New Zealand customers.	IP addresses, approximate location derived from IP addresses, browser and device information, request metadata, security events and potentially personal information contained in proxied web requests.	Processing necessary to secure the platform, prevent unauthorised access and provide school-authorised services under applicable agreements and laws.	Global network, including Australia and New Zealand. Traffic and associated security information may be processed internationally depending on service configuration and routing.

3. Australian and New Zealand customer data

Our intended hosting arrangements distinguish between schools located in Australia and New Zealand.

Australian schools

Primary application records, including student accounts, assessment results and school information, are hosted in the AWS Asia Pacific (Sydney) region (ap-southeast-2).

New Zealand schools

Where our New Zealand infrastructure is deployed, primary application records, including student accounts, assessment results and school information, will be hosted in the AWS Asia Pacific (New Zealand) region (ap-southeast-6).

Some supporting services, including email delivery, security processing and technical support, may operate outside the school's primary hosting region. Any such arrangements are identified in this statement.

A school's primary hosting region is determined by its provisioned service environment, not by the physical location or IP address of an individual user accessing the service.

4. Data protection and restrictions

We select service providers with appropriate technical, contractual and organisational safeguards.

Subprocessors are engaged for defined operational and security purposes and are not authorised by us to independently use school information for unrelated advertising or marketing.

Personal information is processed in accordance with applicable service agreements, provider data-processing terms and our Privacy Policy.

We take reasonable steps to maintain primary school application records within the region assigned to the school, subject to disclosed service arrangements and applicable laws.

5. Changes to subprocessors

We review our subprocessors periodically and update this statement when providers are added, removed or their processing arrangements materially change.

Where a change materially affects personal information handling, we will notify affected schools as required by applicable agreements and privacy obligations.

The latest version of this statement will be made publicly available alongside our Privacy Policy.

6. Further information

For information about our privacy practices, please refer to our Privacy Policy.