Educonnex Pty Ltd is a company based in NSW, Australia that sells and distributes software, primarily focused on school administration.

• Address: 15/1 Bounty Cl, Tuggerah, NSW Australia 2259
• Phone: +61 (02) 4304 3000
• Email: [email protected]

Educonnex is committed to protecting and respecting your privacy and as such are the Data Controller. We are subject to the privacy laws of the jurisdictions in which we operate, including the Australian Privacy Principles (APPs) under the Privacy Act 1988 (Cth) and the EU General Data Protection Regulation (Regulation 2016/679) as it applies to Australia and the European Economic Area.

The purpose of this Policy is to:

• explain the types of information that we may collect from customers or authorised users; and
• how that information will be processed by us or on our behalf.

This Policy does not apply to Personal Information that may be collected by a third party or how that third party may use, handle, store or disclose your Personal Information.

For the purposes of this Policy, the following definitions apply:

• Customer means the educational institutions, whether public or private, which have subscribed to our product/s.
• Educonnex, we, our, us means Educonnex Pty Ltd; ACN 160 850 322.
• Our product/s means the suite of software produced and/or sold by Educonnex Pty Ltd.
• Personal information means a set of data that could be used to identify a specific person.
• School administrator/s means authorised school/organisation staff who have administration-level access to our product/s.
• User/s means individuals associated with our customers that have their data in our product/s.

Our servers used for Booked, SSO, and Educonnex are located within Microsoft Azure, Australia. Our structure meets all privacy policy at federal and individual state and territory levels in Australia. 

• Data about users is supplied to our products by customers – either by school administrators or individual users. The information is needed in order to fulfil the purposeful functionality of the products.
• Additional information may be supplied by users, depending on the level of access granted to them by the school/organisation.
• Our customers are responsible for the maintenance and accuracy of information.
• Educonnex does not modify data, except when directly requested to do so by an authorised school administrator.
• When not logged in to our products, we collect anonymised information or details supplied voluntarily.
• The customer owns the data associated with their school/organisation.
• We retain information for a limited period. At any time, a school administrator can request that the data associated with their school/organisation be purged from our system.
• Requests to purge information of an individual user can be requested by a school administrator.
• We protect your information by using AES–256 encryption.
• We secure our website and other systems with technical and organisational measures against the loss, destruction, access, change or dissemination of your data by unauthorised persons.

The data we handle will vary based on the product and how the school/organisation and user choose to use it.

Booked

Data collected depends on role – ‘administrator’, ‘teacher’, or ‘parent/carer’

• All users
  • Name (mandatory, except in jurisdictions where legislatively anonymised for students)
  • Code/s to identify individual profiles (optional)
• Students
  • Class name and academic year level (mandatory)
  • Flag to indicate if school/organisation staff recommend interview for a class (optional)
• Parents/Carers
  • Email addresses (optional)
  • Preferred login details (optional)
  • Preferred phone number (optional)
• Teachers
  • Physical or virtual location for meetings (optional)
  • Preferred login details (optional)

SSO

Data collected depends on role – staff or student

• All users
  • Name (mandatory)
  • Login details (mandatory)
• Staff
  • Email address (mandatory)
• Students
  • Parent/Carer sign-off PIN (optional)
  • Home teacher’s code (optional)
  • Course Counsellor’s code (optional)
  • Secondary identifier code (optional)
  • School house (optional)
  • Previous academic results and/or recommendations for selections
  • Choices selected by or for the student from those made available by the school/organisation, answers to questions asked by the school/organisation
  • Reasons supplied by the students and responses from staff for special considerations
  • Record of payments made through connected BPoint service (no financial transactions take place within SSO, nor are any payment methods stored)

Educonnex

Data collected is based on utilisation by each school/organisation. Roles and associated permissions are customised for each school/organisation.

• A profile requires the following information at a minimum
  • Name
• A profile may contain information with the following themes
  • General information (such as date of birth, gender, languages spoken, religion, ethnicity, residential and citizenship status, indigenous status, disability, associations and related)
  • Contact details (such as address details, phone numbers, email address and contact preferences)
  • Relationships (such as carers, other relationships, living arrangements, guardians, and emergency contacts)
  • Medical information (such as Medicare, ambulance fund, doctors, medical conditions, immunisations, medication consents and sick bay visits)
  • Alerts (general and medical)
  • Attendance records
  • Awards, behaviour records, uploaded files and general note
  • Certifications, extra-curricular activity
  • Student details (such as classes, assessment results, academic reports and other schools)
  • General school-determined permissions
  • School calendar, diary and responses to forms
  • Invoicing and transactions (no credit card or bank details)
  • Results of Educonnex product training
  • Tasks and government-required staff information (staff only)

Enrolled

Access to data is determined by role. A Parent/Carer can only see information to applications they have submitted. Interviewers can only see applications which have been assigned to them. Administrators can see all information for their school/organisation.

• Parents/Carers must provide details about themselves in order to create a profile that can submit an enrolment application (such as name, date of birth, gender, address and contact details)
• Parent/Carers must provide details about prospective students, including:
  • The enrolment request (such as the starting academic year level and the starting date)
  • The prospective student (such as date of birth, gender, who they live with, their emergency contacts, their guardian/s)
• Parents/Carers can provide information about themselves and others any others with a relationship to the prospective student, including nationality, ethnicity, languages, marital status, employment details and religion
• Parent/Carers can provide information about the prospective student, including
  • Their relationship to others
  • Nationality, ethnicity, languages, marital status, employment details and religion
  • Medical membership numbers (such as Medicare, private health fund and ambulance)
  • Doctor, dentist and other health contacts
  • Medical conditions, medication and details of any disabilities and their severity and/or support requirements, and immunisation details
  • Alerts for the school/organisation to be aware of (such as court orders and critical medical condition information)
  • File uploads (such as profile photos, or other documentation requested by the school/organisation)
  • Responses to questions (as requested by the school/organisation)
• Interviewers and administrators can provide information about the application, including:
  • The status of the application
  • Interview details (such as scheduling and interviewer notes)

The following suppliers and sub-processors may process, store, transmit, or support information used by our products, depending on the product, features, and integrations enabled by the customer school/organisation. Not all suppliers are used for all customers. Where a supplier or feature is optional, processing occurs only where the customer or user enables, requests, or uses that feature.

We review this sub-processor information at least annually and whenever a new supplier, integration, feature, hosting region or relevant support process is introduced.

Our products use Microsoft Azure

Supplier and organisation

• Microsoft Azure, provided by Microsoft Corporation and its applicable Microsoft affiliates. Contact and privacy information: https://privacy.microsoft.com/ and https://azure.microsoft.com/en-us/explore/global-infrastructure/data-residency/

Product or module

• Cloud hosting, compute, database, storage, backup, security, monitoring and disaster recovery services for Azure-hosted Educonnex products. Currently listed Azure-hosted products include Booked, SSO and Educonnex.

Data types disclosed or processed

• School/organisation data, authorised user account data, student information, parent/carer and contact information, staff information, attendance records, medical information, booking information, login details, uploaded files, application records, audit logs, access logs, IP addresses, technical metadata, backups and other data entered into or generated by our products. Microsoft may also process limited operational, diagnostic, support and security metadata.

Purpose of processing

• To host, secure, back up, monitor, operate, troubleshoot and support the products, and to provide disaster recovery and service continuity.

Lawful basis / reason for processing

• Performance of the customer contract and processing on the customer school/organisation’s instructions; legitimate interests in operating, securing, monitoring and supporting the services; and compliance with applicable legal, contractual, privacy, security and operational obligations.

Countries or regions where data may be processed or stored

• Australia, within Microsoft Azure’s Australian regions, including Australia East (New South Wales) and Australia Southeast (Victoria).

Customer/user control

• Core infrastructure supplier required to provide hosted products.

Our products integrate with ClickSend to support delivery of SMS text messages

Supplier and organisation

• ClickSend Pty Ltd / Sinch group. Privacy contact: ClickSend Privacy Officer, [email protected]. Privacy and sub-processor information: https://www.clicksend.com/au/legal/privacy-policy/ and https://www.clicksend.com/au/legal/subprocessors/

Product or module

• SMS delivery for customer-generated SMS messages from within supported products.

Data types disclosed or processed

• Recipient mobile phone numbers, SMS message content, sender details, delivery status, message identifiers, timestamps and technical metadata required to deliver, monitor and troubleshoot SMS messages.

Purpose of processing

• To deliver SMS messages requested or authorised by customer schools/organisations, provide delivery reporting, monitor service operation and troubleshoot customer support issues.

Lawful basis / reason for processing

• Performance of the customer contract and processing on customer instructions; legitimate interests in operating and supporting the SMS service; and compliance with applicable legal, contractual, privacy, security and operational obligations.

Countries or regions where data may be processed or stored

• Australia, United States, United Kingdom, New Zealand, Brazil, Vietnam, the Philippines, and the recipient’s country or roaming country where required for SMS delivery.

Customer/user control

• Used only where the customer school/organisation sends or enables SMS functionality. We do not use this service to contact parents, students or non-administrative staff for Educonnex marketing.

Our products integrate with Firebase to support delivery of push notifications

Supplier and organisation

• Firebase Cloud Messaging, provided by Google LLC and applicable Google affiliates. Privacy and security information: https://firebase.google.com/support/privacy

Product or module

• Push notifications for supported mobile applications and features.

Data types disclosed or processed

• Firebase installation IDs, device notification tokens or identifiers, notification payloads, delivery metadata, technical device/application information and service metadata required to deliver push notifications.

Purpose of processing

• To identify the device a notification should be delivered to, transmit push notifications, support delivery, monitor operation and troubleshoot support issues.

Lawful basis / reason for processing

• Performance of the customer contract and processing on customer or user instructions; legitimate interests in delivering and supporting notification functionality; consent or user device permission where required; and compliance with applicable legal, contractual, privacy, security and operational obligations.

Countries or regions where data may be processed or stored

• Global, including outside Australia, at Google Cloud Platform locations and Google data centre locations worldwide.

Customer/user control

• Push notifications can be deactivated and reactivated in the mobile device settings. Notification payloads are limited to device identifiers and the minimum non-sensitive information required to deliver the notification. Medical information, unnecessary student identifiers and full message contents are not included.

We use Google Analytics internally to monitor website traffic

Supplier and organisation

• Google Analytics, provided by Google LLC and applicable Google affiliates. Privacy information: https://policies.google.com/privacy and https://support.google.com/analytics/answer/6004245

Product or module

• Public website analytics only. Website measurement data is collected through Google regional data collection centres and forwarded to Google Analytics processing servers.

Data types disclosed or processed

• First-party cookies or pseudonymous identifiers, device and browser information, on-site or in-app activity, page/referrer information, approximate geographic information and technical metadata. Google Analytics contracts prohibit sending personally identifiable information to Google Analytics.

Purpose of processing

• To measure website traffic, understand aggregate usage patterns, monitor performance and improve website or product usability.

Lawful basis / reason for processing

• Legitimate interests in measuring and improving website and service performance, and consent for analytics cookies or advertising features where required by applicable law.

Countries or regions where data may be processed or stored

• Global, including outside Australia, at Google regional data collection centres and Google Analytics processing servers worldwide.

Customer/user control

• Used only on Educonnex public websites. No names, email addresses, student IDs, phone numbers or other directly identifying product or customer information are collected by or sent to Google Analytics.

We use LiveChat to provide support services

Supplier and organisation

• LiveChat, provided by Text, Inc. and applicable affiliates including TEXT S.A. Privacy and sub-processor information: https://www.livechat.com/legal/privacy-policy/ and https://www.text.com/legal/sub-processors/

Product or module

• Online support chat on the public Contact Us page and within Booked for school administrators. LiveChat is not integrated with Educonnex product data.

Data types disclosed or processed

• Name, email address and chat content supplied by a user on the public website; for Booked administrator chat, the administrator username, email address and school/organisation may be passed to LiveChat to identify the administrator. LiveChat/Text may also process IP address, device/browser information, chat logs, region/geolocation information and technical metadata required to operate the chat service.

Purpose of processing

• To provide live support, respond to enquiries, troubleshoot customer issues, maintain chat history and improve support quality.

Lawful basis / reason for processing

• The individual’s or administrator’s request to use the chat service; performance of the customer support function under the customer contract; legitimate interests in providing support and improving service quality; and compliance with applicable legal, contractual, privacy, security and operational obligations.

Countries or regions where data may be processed or stored

• United States, European Union and worldwide edge/cache locations.

Customer/user control

• • Use is optional and at the discretion of the individual or school administrator. AI-enabled LiveChat/Text.com functionality is not enabled by Educonnex.

Our products integrate SMTP2GO to deliver emails

Supplier and organisation

• SMTP2GO email delivery service. Privacy and support information: https://www.smtp2go.com/privacy/ and https://support.smtp2go.com/

Product or module

• Email delivery for emails generated by customers from within supported products.

Data types disclosed or processed

• Recipient email addresses, sender details, subject lines, email body content, attachments where applicable, delivery status, message identifiers, timestamps, bounce information, unsubscribe information and technical metadata required to deliver and troubleshoot emails.

Purpose of processing

• To deliver emails generated from within our products, provide delivery reporting, handle unsubscribes, monitor service operation and troubleshoot customer support issues.

Lawful basis / reason for processing

• Performance of the customer contract and processing on customer instructions; legitimate interests in operating and supporting email delivery; and compliance with applicable legal, contractual, privacy, security and operational obligations.

Countries or regions where data may be processed or stored

• Australia, including Sydney.

Customer/user control

• The SMTP2GO account activity storage duration is configured to 30 days. Recipients can unsubscribe where an unsubscribe link is included.

Our products integrate with Wonde

Supplier and organisation

• Wonde. Privacy and sub-processor information: https://www.wonde.com/legal/privacy/apac and https://www.wonde.com/legal/subprocessors/

Product or module

• Optional customer-enabled integration service used to transfer approved school administration data between a customer’s school administration system and supported Educonnex products.

Data types disclosed or processed

• School-approved student information, parent/carer information, staff information, class/year/group information, enrolment or attendance-related information, user account information, identifiers and related school administration data required for the approved integration to operate. For setup, support or administration, Educonnex may share the name and work email address of a school administrator with Wonde.

Purpose of processing

• To securely transfer school-approved data between customer-approved systems and supported products, and to support setup and operation of the integration.

Lawful basis / reason for processing

• Performance of the customer contract and processing on customer instructions; the customer’s authorisation to enable the Wonde integration; legitimate interests in secure data synchronisation and support; and compliance with applicable legal, contractual, privacy, security and operational obligations.

Countries or regions where data may be processed or stored

• European Union, Australia, South Africa and the United Kingdom.

Customer/user control

• Optional integration. Subscription to and use of Wonde is at the discretion of the customer school/organisation. The customer controls which approved school data is shared through the integration. Wonde notes that not all listed sub-processors are relevant to every school or to school data processing.

We use Zoho CRM and Zoho Campaigns internally to maintain our sales database 

Supplier and organisation

• Zoho Corporation group. Privacy contact: [email protected]. Data Protection Officer: [email protected]. Privacy and data centre information: https://www.zoho.com/privacy.html and https://help.zoho.com/portal/en/kb/accounts/manage-your-zoho-account/articles/data-center-for-zoho-account

Product or module

• Internal customer contact, billing, sales, customer relationship management and customer communications. Zoho CRM is used to manage customer and prospective-customer relationships, including billing and sales communications. Zoho Campaigns is used to send product updates, relevant business news and customer communications to existing customers.

Data types disclosed or processed

• Limited business contact information for customer representatives, such as names, work email addresses, phone numbers, school/organisation name, role or title, billing and sales contact details, customer relationship notes, communications, campaign mailing lists, campaign engagement data, unsubscribe preferences and related business-contact information. Zoho is not used to store or synchronise student records or operational school staff records from Educonnex products.

Purpose of processing

• To respond to product and billing enquiries, manage customer and prospective-customer relationships, support sales activities, provide relevant product updates and business communications, and maintain suppression and unsubscribe records.

Lawful basis / reason for processing

• Legitimate interests in B2B customer relationship management and product communications; performance of contract or pre-contract steps; consent where required for marketing; and compliance with applicable legal, contractual, privacy, security and operational obligations.

Countries or regions where data may be processed or stored

• Australia, within Zoho’s Australian data centre region.

Customer/user control

• Recipients can unsubscribe from Zoho Campaigns emails using the unsubscribe link included in emails. Only limited customer and business-contact information is stored in Zoho; student records and operational school staff records from Educonnex products are not stored or synchronised in Zoho.

Our staff, partners, and subcontractors are bound by policies and agreements to protect personal data as outlined in this policy, and are not permitted to make independent use of any personal information.

• Our products are built primarily for use by school communities. This means that children may use our products.
• Our products do not require children to disclose personal details (such as name, address, phone number, email address, social media details etc).
• If schools/organisations subscribed to our products ask children to enter personal details, this is outside of our products’ minimum requirements. The school/organisation is responsible for the protection of this information outside of our products, prevention of misuse, and vetting of individuals who access this information.
• We actively promote that parents and carers monitor their child’s/dependent’s usage of our products, and the education of the child/dependent to not supply unnecessary information online.
• Where a parent/carer is not comfortable with personal information being requested of the child/dependent, they should contact the school/organisation to discuss the concern.

• This privacy policy may be updated from time to time. Check this page to see the latest information.
• We will advise school administrators when there are significant changes to this policy.
• If you do not accept any changes made to this privacy policy, please discontinue the use of our products.
• Users should direct any questions, complaints or requests to change their data within their school’s/organisation’s instance of our product/s to that same school/organisation – this is because they are the owners and administrators of
  the data. The school/organisation may contact us to facilitate the response to your question or complaint, or we will respond directly to you where appropriate.
• Users should direct any questions or complaints about their data on our public websites to us directly, at [email protected]
• We will respond to any question, complaint or request related to this policy within 2 business days. Any such items should be directed to us by emailing [email protected]. We will reply to the same email address that the contact was received from. We may be required to contact the relevant school/organisation for verification or to act as an involved third party in discussions.
• If you have submitted a complaint through the school/organisation or us and wish to take the matter further, you can do so by following the link on this page: https://www.oaic.gov.au/privacy/privacy-complaints/