Privacy Policy

What Information We Collect

The information we collect depends on a person's relationship with the College. It may include:

• Students and parents/guardians: names, addresses, contact details, date and country of birth, identity documents (such as birth certificates or passports), custody or court orders, previous school reports, NAPLAN results, immunisation and medical information, emergency contacts, parent occupation group and, where relevant, religion, language and cultural background.
• Job applicants, staff, volunteers and contractors: identity and contact details, qualifications, work history, referee reports, Working with Children Check details, tax and payroll details, and records of performance and conduct.
• Website visitors: limited technical information described under “Our website” below.

How We Collect It

We collect information directly from people through enquiry, tour, application, enrolment and onboarding forms, our online portal, email, phone and meetings. Sometimes we collect information from others, such as a previous school, a doctor or other health professional, a referee, or government agencies (for example NAPLAN data).

Sensitive and Health Information

Sensitive information includes health information, racial or ethnic origin, religious beliefs, and criminal record information. We collect it only with consent, or where the law allows or requires it, and we treat it with extra care. We use it only for the purpose for which it was provided, unless the person agrees otherwise or the law permits.

We ask for sensitive documents (such as medical and custody records) only when they are needed for the stage of enrolment the family has reached. Information about unsuccessful applicants is securely destroyed or de-identified once it is no longer needed.

How We Use and Share Information

We use personal information for the purpose it was collected, for related purposes a person would reasonably expect, and for purposes they have agreed to. These include assessing applications and enrolling students, teaching, wellbeing and duty of care, communicating with families, administering staff and contractor arrangements, managing safety and incidents, and meeting legal, insurance and funding obligations.

We may share information with:

• government bodies and regulators, such as NESA and the Commonwealth and NSW education departments;
• other schools, when a student transfers, and medical or health professionals, when needed for a student's care;
• Board and committee members, where needed for their role;
• service providers that help us run the College (for example our learning platform, email, forms and IT providers); and
• anyone else the person has authorised us to share it with, or where the law requires or permits it.

We do not sell personal information.

Overseas Service Providers

Some of our service providers are based overseas or store information outside Australia. These currently include Google, Microsoft, Apple, Adobe and Jotform (various forms including contractor onboarding, feedback and incident report forms) and Cloudflare (website security and delivery). Information handled by these providers may be stored or processed in the United States and other countries.

Our learning portal (Schoolbox) is provided by an Australian company and has its own privacy guidelines on the portal. Before using an overseas provider, we take reasonable steps to make sure it protects information in line with Australian privacy requirements.

Our Website

Photos, Student Names and Results

We publish student photos, names, and achievements (such as results) in newsletters, on our website and on social media only with consent from a parent or guardian and, for older students, the student. Consent can be withdrawn at any time by contacting the College, and we will remove content where reasonably possible.

Students and Parents

We usually deal with parents and guardians on behalf of students. Students aged about 15 and over may be able to make their own privacy decisions, and we consider each situation individually, taking into account the student's maturity, wellbeing and safety.

Direct Marketing

We may send information about the College, its events and fundraising to current and former families, and to prospective families who have asked us to or agreed to receive it. Every message will say who it is from. Opt-out requests can be sent to [email protected]. We will act on opt-out requests promptly.

Accuracy, Security and Retention

We take reasonable steps to keep personal information accurate, complete and up to date. Families and staff can update their details by contacting the College or, where available, through the portal.

We protect information from misuse, loss and unauthorised access or disclosure. Measures include password-protected and role-based access to systems, multi-factor authentication for staff accounts, locked storage for paper records, and staff training. We keep information only as long as needed for the purpose it was collected or as required by law, and then securely destroy or de-identify it.

Data Breaches

If personal information is lost or accessed without authorisation and this is likely to cause serious harm, we will assess it promptly, take steps to contain it, and notify affected individuals and the Office of the Australian Information Commissioner (OAIC) as required under the Notifiable Data Breaches scheme.

Accessing and Correcting Your Information

You can ask to see the personal information we hold about you, and ask us to correct it if it is inaccurate, out of date, incomplete or misleading. Please contact the Privacy Officer or your campus office. We will respond within 30 days. We may need to confirm your identity first, and in limited cases the law allows us to refuse access, in which case we will explain why. If we do not agree to correct information, you can ask us to attach a statement of your view to it.

Privacy Questions and Complaints

Contact the Privacy Officer, Amity College Australia Limited, at [email protected] or through any campus office.

If you believe we have mishandled your personal information, please complain to the Privacy Officer in writing, describing what happened and what outcome you are seeking. There is no set form. We will acknowledge your complaint, investigate, and respond within 30 days. You may also use the College's Complaints Handling Program.

If you are not satisfied with our response, you can contact the Office of the Australian Information Commissioner (oaic.gov.au or 1300 363 992). Complaints about health information may also be made to the Information and Privacy Commission NSW (ipc.nsw.gov.au).

Responsibilities and Training

• The Principal is responsible for ensuring this policy is implemented and working effectively.
• The Privacy Officer handles privacy enquiries, access and correction requests and complaints, and coordinates breach response.
• All staff must follow this policy and complete privacy training when they join and regularly after that, including how to handle health information and respond to a suspected data breach.