Privacy Policy

1.        We respect your privacy

1.1 Xcursion Pty Ltd (ABN 42 607 149 299), trading as Xcursion Safety (“Xcursion”, “we”, “us”) respects your privacy. This policy explains what personal information we collect, how we use it, who we share it with, how long we keep it, and the choices and rights you have.

1.2 The laws we work to. We serve schools in Australia, New Zealand and Singapore, and we comply with:

•     the Australian Privacy Principles (APPs) in the Privacy Act 1988 (Cth);

•     the Information Privacy Principles (IPPs) in the Privacy Act 2020 (NZ); and

•     the Personal Data Protection Act 2012 (Singapore), where we handle personal data in or from Singapore.

We support our school customers in meeting their own obligations under applicable state and territory legislation, including the Privacy and Personal Information Protection Act 1998 (NSW), the Health Records and Information Privacy Act 2002 (NSW), the Privacy and Data Protection Act 2014 (Vic) and the Information Privacy Act 2009 (Qld).

1.2A Our schools are located in Australia, New Zealand and Singapore. If we ever provide services to individuals in the United Kingdom or the European Union, we will comply with the UK GDPR and the EU General Data Protection Regulation in respect of that activity, and we will update this policy accordingly.

1.3 “Personal information” means information about an identified individual, or an individual who is reasonably identifiable. “Sensitive information” (Australia) includes health information, and health information is separately protected in New Zealand under the Health Information Privacy Code. Either way, it is subject to the additional protections described in clause 4.

1.4 This policy is not the whole picture for schools. Where we hold information on behalf of a school, our services agreement and data processing terms with that school govern how we handle it. If there is any inconsistency between this policy and that agreement in respect of school data, the agreement prevails.

1.5 This policy covers www.xcursionplanner.com, www.xcursionsafety.com and the Xcursion Planner platform.

1.6 This policy is available at https://www.xcursionsafety.com/privacy-policy.html and also within the www.xcursionplanner.com app, and in an alternative format on request.

2. Contact us

Students and parents: if your child’s school uses Xcursion Planner, please contact the school. The school controls what student information is shared with us and is best placed to answer questions about it. We assist schools in responding to these requests.

3. Our role: Who is responsible for what

We handle personal information in two distinct capacities:

Where we act on the school’s behalf, the school determines what data is shared and for what purpose. We do not use that data for our own purposes.

3.1 Ownership. The school retains ownership of its data at all times, as recorded in our services agreement. Our role is to hold and process it on the school’s behalf.

4. Student information and children

4.1 Students and parents are not users of Xcursion Planner. Students and parents do not create accounts, log in, or interact with the platform. We do not collect any information directly from students or from parents and guardians. The platform holds no record of any parent or guardian. All student information reaches us from the school..

4.2 How student information reaches us. Student information reaches us only from the school’s own systems. Schools may connect their Student Information System (SIS) to Xcursion Planner through Wonde, or their co-curricular group data through Clipboard. The school selects which data fields are shared and must expressly authorise the connection. The platform functions without these integrations, and school staff can enter what they need directly. Where a school enables an integration, the information shared may include:

•     student first name and surname

•     class, year level and group memberships

•     medical conditions and medical alerts

•     dietary requirements

•     relevant abilities, such as swimming, cycling, skiing or horse riding

No parent or guardian contact details are shared with us through these integrations.

4.3 Health and other sensitive information. Medical conditions, medications, allergies and dietary requirements are health information, and a dietary requirement can also reveal religious beliefs. All of this is sensitive information under the Privacy Act 1988(Cth), and health information is subject to additional protection under New Zealand’s Health Information Privacy Code. Dietary information is held in the same student profile as medical information and is protected by exactly the same controls described below.

We collect it because it is necessary for the purpose the school engages us for: preparing risk assessments that support the school’s duty of care to students on excursions, camps and outdoor learning activities. We rely on the school’s authority, as the school supplies the information and determines what is shared, and, in an emergency, on the grounds available where information is needed to lessen or prevent a serious threat to an individual’s life, health or safety.

4.3A Who can see student health information. Access is deliberately narrow and time-limited:

•     only the staff specifically allocated to a program, including the users and approvers responsible for it, can see a student’s medical information;

•     designated health professionals nominated by the school, such as the school nurse, can also access it;

•     it is encrypted at the database level.

4.3B Keeping the school’s record authoritative. The school’s Student Information System remains the authoritative record of a student’s medical and dietary information. Xcursion Planner reads that information so it can be used in risk assessments; it does not write back to the school’s system, and it is not a place for a school to maintain its student health records. Corrections are made in the school’s own system and flow through on the next synchronisation.

4.4 What we do not do with student information. We do not:

•     use student information for marketing, advertising or profiling;

•     sell, rent or trade student information;

•     use student information to train artificial intelligence or machine learning models;

•     disclose student information to any third party except the sub-processors listed in clause 7, or as required by law;

•     use student information for any purpose other than delivering the platform to the school.

4.5 Our staff access. Our personnel access student information only where strictly necessary to provide technical support requested by the school, to investigate a security or platform incident, or to meet a legal obligation. All such access is logged. We do not browse or review student information outside these circumstances.

4.6 Rights of students and parents.

For anything about your child’s records or an activity, contact your school. Your school controls your child’s information and decides what is shared with us. Requests to access, correct or delete your child’s records, and questions about an excursion or camp, are all handled by the school, and we support the school in doing so. Our support team will refer general enquiries back to your school.

For a privacy or data question about us, ask us directly. If you want to know what we hold, how we handle it, where it is stored, who can see it, or how long we keep it, contact our Privacy Officer and we will answer in accordance with our obligations under the Privacy Act 1988 (Cth) and the Privacy Act 2020 (NZ).

5. What we collect and why

5.1 School staff and account holders. Name, work email, phone, school and role; account credentials and authentication data; activity and audit logs; risk assessments and activity content you create; support correspondence.

5.2 Schools and billing contacts. School details, contract and billing information, and payment records. Invoices are issued annually and may be paid by EFT or credit card. All credit card payments are handled by a third-party payment processor and never stored by Xcursion.

5.3 Website visitors. IP address, browser and device type, operating system, referring page, and pages viewed. Used in aggregate to understand and improve the site. See clause 13.

5.4 Enquiries and marketing contacts. Contact details and correspondence where you contact us, request a demonstration, subscribe to updates, or respond to a survey.

5.5 Student information. As described in clause 4.

5.6 Anonymity and pseudonymity

(a) You may browse our websites without identifying yourself.

(b) Xcursion Planner is an access-controlled platform, and users are identified to it because school staff need to know who prepared, reviewed and approved a risk assessment. We do not, however, require any user to provide a legal name, and we do not prohibit the use of a preferred or commonly used name. We do not verify names against identity documents, and we do not operate a real-name policy.

(c) In almost all cases we do not set account identity details at all. Staff accounts are provisioned from the school’s own directory through single sign-on with Microsoft Entra ID or Google Workspace, or through the school’s Student Information System. The name and email address recorded in Xcursion Planner are whatever the school holds in its own records. We neither choose nor validate them, and any change is made in the school’s directory rather than with us.

(d) The one account where an individual enters their own details is the initial school administrator account, created by secure invitation. That person may register under the name they usually go by.

(e) Your school may have its own requirements about how staff are identified in records that support its duty of care. Those are the school’s requirements, set in the school’s own systems and policies — not requirements we impose.

(f) Students and parents are not users of Xcursion Planner and do not create accounts (clause 4.1).

5.7 Accuracy of information. We take reasonable steps to ensure the personal information we hold is accurate, up to date and complete, as required by APP 10 and by IPP 8 of the Privacy Act 2020 (NZ). Because student information reaches us from the school’s own systems, accuracy is maintained by the school keeping its records current and by the regular synchronisation of those records.

Neither this policy nor our terms of service requires a user to warrant that the information they provide is complete or accurate, and neither prohibits the use of a preferred name or requires an individual to register under a legal name.

5.8 Why we collect it. To provide and operate the platform; to authenticate users and secure the service; to provide support and onboarding; to administer our contracts and billing; to improve and develop the platform; to comply with legal obligations; and, where permitted, to communicate with school staff about our services.

5.9 Our authority to collect. We collect student information on the school’s instruction and under the school’s authority. We collect staff and account information because it is necessary to provide the service the school has engaged us for. We rely on consent for marketing and for non-essential cookies. Under the Australian Privacy Principles and the New Zealand Information Privacy Principles alike, we collect only what is necessary for a lawful purpose connected with our functions.

5.10 We collect personal information directly from you wherever reasonable and practicable. Where we receive it from a third party for example, a school administrator creating your account, or a school system integration we handle it under this policy.

5.10A New Zealand: information collected indirectly. From 1 May 2026, IPP 3A of the Privacy Act 2020 (NZ) requires reasonable steps to make individuals aware when their personal information is collected from someone other than them. Where we receive information about New Zealand staff or students from a school, the school, as the source, informs its staff, students and families through its own privacy notices, and this policy is available for the school to refer them to. Where we collect information indirectly in our own right, we take reasonable steps to let the individual know, unless an exception in IPP 3A applies.

5.11 If you do not provide personal information. You are not obliged to give us personal information, but there are consequences.

School staff: we cannot create an account or provide the platform without a name and a work email address. Without these you will not be able to use Xcursion Planner.

Schools: the Student Information System integration is optional. If your school chooses not to connect it, Xcursion Planner works without it and staff enter what they need directly. Where a school chooses not to share medical or dietary information, staff will need to source that information through the school’s own processes in order to plan appropriately.

Enquiries and marketing: if you do not give us contact details we cannot respond to your enquiry or send you updates. This does not affect your school’s use of the platform.

5.12 How we hold your information is described in clause 8 (how long we keep it), clause 9 (where it is held) and clause 10 (how it is protected).

6. How we use and disclose information

6.1 We use personal information only for the purposes set out in clause 5.8, for a directly related purpose you would reasonably expect, or as permitted or required by law.

6.2 Marketing. We may send school staff information about our products, updates and events. Every marketing message includes a functional unsubscribe, and you can opt out at any time by contacting us. We do not use contact details obtained through a school system integration for marketing. We do not sell or provide personal information to third parties for their marketing.

6.3 De-identified and aggregate data. We may produce aggregate, de-identified statistics for example, on platform usage or activity types to improve the platform and to report on trends. This information cannot reasonably be used to identify any individual, and is derived only from irreversibly de-identified information related to activities and risk assessments, not from any other school information.

6.4 Who we disclose to. Our personnel, on a need-to-know basis; the sub-processors in clause 7; professional advisers and insurers where reasonably necessary; and any party where required by law, including in response to a court order, subpoena, warrant or law enforcement request. Where we receive a law enforcement or government request for school data, we will notify the school unless legally prohibited from doing so.

6.5 Sensitive information sent to us outside the platform. Student information belongs in Xcursion Planner, not in an email or a support ticket. If someone sends us sensitive information outside the platform, for example, a screenshot of a student record attached to a support request, we delete it from our systems as soon as practicable and do not retain it, and we ask the sender to use the platform instead. Please do not send us student information by email, chat or support ticket.

6.6 Change of control. If our business or its assets are sold or transferred, personal information may transfer to the acquirer. In that event: the acquirer will be bound by commitments materially equivalent to this policy; we will notify affected schools in advance; and school and student data will transfer only in accordance with the relevant school agreement, with the school able to terminate and require deletion of its data.

7. Sub-processors and service providers

7.1 We use a small number of vetted providers to deliver and support Xcursion Planner. Each is bound by contractual privacy and security obligations equivalent to our own, and we remain accountable for their handling of personal information.

7.2 For every sub-processor we publish the provider’s name and organisation, its contact details, the data types disclosed to it and the purpose of that disclosure, the basis on which we disclose, and the countries in which data may be processed or stored. That information is set out below and is maintained in our Hosting & Sub-processor Schedule: The register below is current as at the effective date of this policy.

7.3 We will give school administrators at least 30 days’ notice before adding a new sub-processor that handles school data, and schools may object in accordance with their agreement.

Part A: Platform sub-processors

These providers handle information within or connected to the Xcursion Planner platform.

A1. Amazon Web Services

A2. Wonde

A3. Clipboard

A4. Google Weather & Place API

A5. Microsoft Entra ID and Google Workspace: SSO

Part B: Business system sub-processors

These providers support the operation of our business. They hold no account data from the Xcursion Planner platform. No student information, medical or dietary information, risk assessment or activity record is exported, synchronised or copied into them.

B1. Intercom

B2. Customer relationship management (CRM)

7.4 A note on lawful basis. The “lawful basis” framework is drawn from the GDPR, which does not apply to our processing because our schools are in Australia, New Zealand and Singapore. The bases stated above are the equivalents that do apply: disclosure for the primary purpose of collection under APP 6.1 of the Privacy Act 1988 (Cth), with the school’s authority as the party that controls student information; IPP 11 of the Privacy Act 2020 (NZ), with data held in Australia as agent for the school under s 11; and the Consent and Purpose Limitation Obligations under Singapore’s Personal Data Protection Act 2012. Cross-border disclosures are addressed in clause 9 under APP 8, IPP 12 and the PDPA’s Transfer Limitation Obligation.

8. How long we keep information

8.1 While a school is our client, we do not delete its data. Schools rely on their activity records and risk assessments as evidence that their duty of care was met, so we retain them for the life of the engagement. Individual records are removed only in the circumstances below.

8.1A Retention limitation. We do not keep personal information longer than we need it for a legal or business purpose. This reflects APP 11.2, IPP 9 in New Zealand and the Retention Limitation Obligation under Singapore’s Personal Data Protection Act.

8.2 Soft and hard deletion. A soft delete removes the record from the platform immediately: it can no longer be viewed or used. A hard delete permanently removes it from our systems 30 days later. The 30-day window exists so that an accidental deletion can be reversed on the school’s request.

8.3 End of engagement. When a school’s engagement ends:

•     we provide a complete export of the school’s data in a structured, machine-readable format (CSV, JSON or equivalent), including historical risk assessments, activity records, audit trails and associated metadata;

•     the school’s live account is not deleted until the school confirms it has received the export;

•     we then hard delete all of the school’s data 30 days later, unless the school has elected the optional archival access period below;

•     on written request we can provide archival access for up to 12 months, subject to reasonable cost recovery, after which the same deletion applies; and

•     backups containing the school’s data are purged within 30 days of account deletion.

We will confirm deletion in writing on request.

8.3A Your own retention obligations. We hold your records for as long as you are our client, not for as long as you are required to keep them. Schools have their own retention obligations that can extend for decades. The export we provide at the end of an engagement is your permanent record, and should be stored in accordance with your own retention schedule.

8.4 We delete all client data when it is no longer needed for a purpose set out in this policy and we are not required by law to keep it beyond this period of time.

9. Where your information is held

9.1 All client data stays in the region agreed with your organisation. Student information, medical and dietary information, risk assessments, activity records and staff account records are held in the region agreed with your school and are not disclosed overseas.

Our business systems are hosted in the United States. Our customer relationship management system and the administrative support systems we use to run the business are hosted securely in the United States. These hold business contact information about the adults we deal with school staff, contacts and enquirers. They do not hold account data from the Xcursion Planner platform. No student information, medical or dietary information, risk assessment or activity record is exported, synchronised or copied into them.

9.2 The Xcursion Planner platform does not straddle jurisdictions. All of a school’s data is held on our AWS infrastructure in a single region, agreed with that school. It is not replicated to, processed in, or accessible from any other region.

9.3 Which region. The region for each school is confirmed as part of its engagement with us. Where a school’s data is hosted outside its own country, that is disclosed to and agreed with the school before the engagement begins we do not make that decision unilaterally, and schools are offered the alternative where one is available.

Our current hosting regions available on request and outlined in all individual client proposals and agreements.

9.3A New Zealand schools. Where New Zealand school data is hosted in Australia by agreement, we hold it as an agent for the school, so under section 11 of the Privacy Act 2020 (NZ) it remains information held by the school rather than information disclosed to us, and the cross-border disclosure rule in IPP 12 is not engaged. We are contractually bound to protect it to New Zealand standards, and every control in clause 10 applies to it identically.

9.3B Singapore schools. Where Singapore school data is hosted outside Singapore by agreement, we satisfy the Transfer Limitation Obligation under the Personal Data Protection Act by binding ourselves contractually to a standard of protection comparable to the PDPA. Again, every control in clause 10 applies identically.

9.4 Our business systems are global, by design. Our customer relationship management, helpdesk ticketing and general business operations run on a single global platform stack rather than a separate one per country, because one consistent set of controls is easier to secure, monitor and audit than several. These providers are principally hosted in the United States, and are listed in clause 7 and in the Hosting & Sub-processor Schedule.

9.5 No data flows from the platform into these systems. Student information, medical and dietary information, risk assessments and activity records stay in Xcursion Planner. They are not exported, synchronised or copied into our CRM, helpdesk or business systems. Those systems hold information about the adults we do business with — school staff, contacts and enquirers. See also clause 6.5: sensitive information sent to us outside the platform is deleted and not retained.

9.6 Safeguards for information held overseas. Access to these systems is strictly controlled, role-based and monitored. Where they hold personal information outside Australia or New Zealand we take reasonable steps under APP 8 to ensure the overseas recipient handles it consistently with the Australian Privacy Principles, and we satisfy ourselves under IPP 12 of the Privacy Act 2020(NZ), and under the Transfer Limitation Obligation of Singapore’s Personal Data Protection Act, that the recipient is subject to comparable safeguards. We do this through contractual obligations and security requirements, and we apply the same privacy standards wherever these systems are hosted.

10. How we protect information

10.1 We design and operate Xcursion Planner to protect personal information from misuse, interference, loss, and unauthorised access, modification or disclosure. Our information security controls are designed and operated in alignment with ISO/IEC 27001:2022. We have not sought external certification — we have prioritised independent penetration testing of the live platform over certification documentation. Our controls include:

Encryption

•     TLS 1.3 for data in transit

•     AES-256 encryption at rest, including database and file storage

•     Additional encryption of sensitive fields at the database level

Access control

•     Multi-factor authentication, and single sign-on via Microsoft Entra ID or Google Workspace

•     Role-based access control with granular permissions

•     Public registration disabled: staff accounts are created only by secure invitation

•     The platform is for staff only. Students and parents have no accounts and no means of access, so there are no student or parent credentials to compromise

•     Role and privilege changes restricted to school administrators

•     Managed session lifecycle with automatic expiry

Isolation and data protection

•     Authorisation checks enforced across all APIs to keep each school’s environment separate

•     Non-sequential UUID identifiers for platform resources

•     Private files accessible only through signed, time-limited URLs

•     Logging of every view of student health and dietary information, retained for the life of the record

Monitoring and assurance

•     Continuous monitoring via AWS CloudWatch and GuardDuty

•     Independent penetration testing of the live platform, conducted annual. Summary findings are available to schools on request under a confidentiality agreement

•     Enforced SSL certificate verification; no publicly accessible configuration artefacts

10.2 Our sub-processors are bound to comparable standards.

10.3 No system can be guaranteed completely secure, but we maintain an incident response process and review our controls regularly.

10.4 Assessment status. Xcursion Planner has been prepared against the Safer Technologies 4 Schools (ST4S) assessment requirements and is currently in the ST4S assessment queue. We will publish our outcome on completion.

11. Data breaches

11.1 We maintain an incident response process for suspected data breaches.

11.2 If we suspect an eligible data breach, we will take all reasonable steps to complete our assessment within 30 days, in accordance with the Notifiable Data Breaches scheme in Part IIIC of the Privacy Act 1988 (Cth).

11.3 Where a breach is likely to result in serious harm, we will notify the Office of the Australian Information Commissioner and affected individuals as soon as practicable.

11.3A New Zealand. Where a notifiable privacy breach affects New Zealand schools or individuals, we will notify the Office of the Privacy Commissioner (NZ) and affected individuals as soon as practicable after becoming aware of it, as required by Part 6 of the Privacy Act 2020 (NZ).

11.3B Singapore. Where a notifiable data breach affects Singapore schools or individuals — that is, a breach likely to result in significant harm, or affecting 500 or more individuals — we will notify the Personal Data Protection Commission as soon as practicable and in any event within 3 calendar days of completing our assessment, and we will notify affected individuals, as required by the Personal Data Protection Act 2012.

11.4 Notification to schools. Where a breach affects information we hold on behalf of a school, we will notify that school without undue delay and in any event within 48 hours of becoming aware, consistent with our services agreement. We will tell the school the nature of the breach, the data affected so far as known, and the immediate mitigation steps taken, so the school can meet its own notification obligations. We will support the school’s response, including any notification it makes to parents and students.

12. Automated decision-making

12.1 We do not use automated decision-making. No computer program makes, or does anything substantially and directly related to making, a decision about an individual that could reasonably be expected to significantly affect their rights or interests.

12.2 Risk assessments are written, reviewed and approved by school staff. Xcursion Planner provides templates, guidance and prompts, but it does not generate risk controls from a student’s medical information, does not assess a student’s suitability to participate, and does not make supervision or participation decisions. School staff read the information and make the decision.

12.3 Our weather alerting is automated, but it reports environmental conditions for a planned activity. It does not make decisions about any individual. Any decision to proceed with, modify or cancel an activity is made by school staff.

12.4 We do not use personal information to train artificial intelligence or machine learning models.

13. Website and cookies

13.1 Our websites. When you visit www.xcursionplanner.com or www.xcursionsafety.com we collect technical information (browser type, operating system, referring site, pages viewed) in aggregate, to understand how the site is used and improve it.

13.2 Cookies on our website. We use:

•     Strictly necessary cookies, required for the site to function;

•     Analytics cookies, to measure how the site is used; and

Where required, we obtain your consent before setting non-essential cookies, and you can withdraw consent at any time through our cookie settings. Browser settings can also be used to block cookies, though some site features may not work.

13.3 Cookies in the Xcursion Planner platform. The platform uses only strictly necessary and functional cookies, for authentication, session management, security and user preferences. The platform contains no advertising cookies and no third-party cross-site tracking.

13.4 Third-party sites. Our website may link to sites we do not control. We are not responsible for their privacy practices, and we encourage you to read their policies.

14. Your rights

14.1 Access and correction. You may ask for a copy of the personal information we hold about you, or ask us to correct it if it is inaccurate, out of date, incomplete, irrelevant or misleading. Contact our Privacy Officer. We aim to respond within 30 days. We may ask you to verify your identity. We may refuse access in the limited circumstances permitted by the Privacy Act, and if we do, we will explain why and how to complain.

14.2 Marketing. You can opt out of marketing at any time.

14.3 New Zealand. If you are in New Zealand, IPP 6 gives you the right to access personal information we hold about you, and IPP 7 gives you the right to request correction. If we decline a correction, you may ask us to attach a statement of the correction sought, and we will do so. We will respond within 20 working days, as required by the Privacy Act 2020 (NZ).

14.3A Singapore. If you are in Singapore, the Personal Data Protection Act gives you the right to request access to personal data we hold about you and information about how it has been used or disclosed in the past year, and to request correction of inaccurate or incomplete data. We will respond within a reasonable time and will tell you if we need longer than 30 days.

14.4 If the GDPR or UK GDPR applies. We do not currently provide services to schools or individuals in the EU or UK. If we do, and the GDPR or UK GDPR applies to that activity, you will have the right:

•     to be informed how your personal data is used;

•     to access it and receive a copy;

•     to have inaccurate or incomplete data corrected;

•     to erasure (“the right to be forgotten”) in defined circumstances;

•     to restrict processing;

•     to data portability — to receive personal data you provided to us in a structured, commonly used and machine-readable format, and to have it transmitted to another controller where technically feasible;

•     to object to processing based on legitimate interests, and to object to direct marketing at any time;

•     not to be subject to a decision based solely on automated processing that produces legal or similarly significant effects (see clause 12); and

•     to withdraw consent at any time, where we rely on consent.

14.5 Where we hold information on behalf of a school, we will refer your request to the school and assist it in responding.

14.6 Where the GDPR applies, we respond within one month, extendable by two further months for complex requests, and will tell you if an extension applies.

15. Complaints

15.1 If you have a concern about how we have handled your personal information, contact our Privacy Officer at privacy@xcursionplanner.com. We will acknowledge your complaint within 5 business days and respond substantively within 30 days.

15.2 If you are not satisfied with our response, you may complain to the Office of the Australian Information Commissioner: www.oaic.gov.au, 1300 363 992, GPO Box 5288, Sydney NSW 2001.

15.3 If you are in New Zealand, you may complain to the Office of the Privacy Commissioner: www.privacy.org.nz, 0800 803 909, PO Box 10094, Wellington 6143.

15.3A If you are in Singapore, you may complain to the Personal Data Protection Commission: www.pdpc.gov.sg. Under the Personal Data Protection Act we ask that you raise your complaint with us first so we have the opportunity to resolve it.

15.4 If your concern relates to student information, please contact the school first — the school controls that information.

16. Changes to this policy

16.1 We may update this policy from time to time. The version number and effective date at the top of this policy will show when it last changed.

16.2 Where a change materially affects how we handle personal information, we will notify school administrators at least 30 daysbefore it takes effect, so schools can review it against their own obligations.

16.3 Review cycle. We review this policy at least annually, each June, and additionally whenever there is a material change to our systems, our sub-processors, the way we handle personal information, or the law. Routine operational detail — current hosting regions and the current sub-processor list — is maintained separately in our Hosting & Sub-processor Schedule, which we update as it changes without republishing this policy. Changes to the Schedule that affect a school’s data are notified to that school directly.

16.4 Each version of this policy carries a version number and effective date.

17. Governing law

This policy is governed by the laws of New South Wales, Australia. Nothing in this policy limits your rights under the Privacy Act 1988 (Cth), the Privacy Act 2020 (NZ), the Personal Data Protection Act 2012 (Singapore), or any other applicable law.

Policy Updated - 1st July 2026