Privacy Policy

---

We collect personal information necessary to deliver our student services and administration platform. This includes:

2.1 Students — full name, date of birth, and contact details (email, phone, address); educational institution and enrolment details; academic records and progress information; student identifiers including Education Queensland Identifier (EQID), Learner Unique Identifier (LUI), and Unique Student Identifier (USI), where applicable.

2.2 Institutional Partners & Clients — organisation name, ABN, and contact details; authorised representative contact information; agreement information; payment and billing information.

2.3 Website and Platform Users — device and browser information collected via cookies (see our Cookies Policy); usage data and interaction logs; any information you submit via forms or enquiries.

2.4 Parent Reporting Module — where One Student's platform includes a Parent Reporting Module, the following personal information relating to a student's parent or guardian may be collected and held: parent email address; parent first name; communications sent through our platform. This information is linked to the student's unique Education Queensland Identifier (EQID) and is used solely for the purpose of delivering parent-facing reports and communications through the platform. Parent information is not used for any other purpose, is not disclosed to third parties beyond those necessary to deliver the service, and is handled in accordance with the Australian Privacy Principles.

Australian Law Note: The collection of parent personal information linked to a student identifier (EQID) may engage obligations under the Privacy Act 1988 (Cth) and, where Education Queensland data is involved, may also be subject to Queensland state privacy legislation.

2.5 Sensitive Information — we may, in limited circumstances, collect sensitive information (e.g., health or disability information) where required to deliver tailored services. We only collect sensitive information with your consent and where permitted by law.

We use personal information to:

• Deliver, maintain, and improve our student services platform

• Manage enrolments, records, and communications

• Process payments and manage accounts

• Comply with legal and regulatory obligations

• Respond to enquiries and provide customer support

• Improve our products and services (using aggregated or de-identified data where possible)

• Send service-related communications (e.g., platform updates, account notices)

We do not use personal information for direct marketing without consent. You may opt out of any marketing communications at any time.

One Student hosts the OneStudent platform on Microsoft Azure cloud infrastructure, with all platform data (including student records and academic information) stored on servers located in Australia. Microsoft Azure provides hardware-based Trusted Execution Environments (TEEs), ensuring that personal information — whether at rest, in transit, or inactive — is protected from unauthorised access and tampering.

Parent report emails are delivered through Amazon Web Services from the AWS Sydney region (Australia), and system notification emails are sent through Microsoft 365 under Australian tenant data residency. Xero, used for invoicing school billing contacts, holds no student or parent data; it processes data in Australia, New Zealand and the United States (per Xero's Privacy Notice).

Where any personal information may be disclosed to a recipient outside Australia, the arrangement is assessed against One Student's obligations under APP 8 of the Privacy Act 1988 (Cth) before any agreement is entered into. The sub-processor register below sets out each provider, the data disclosed, and the countries of processing and storage.

We protect personal information using technical and organisational measures, including:

• Encrypted data storage and transmission

• Role-based access controls, with user access provisioned and revoked by the school's nominated administrator

• Regular vulnerability assessments and penetration testing

• Staff training on data handling and security

• Incident response procedures (see Incident Response Plan)

All personal information is hosted in Microsoft Azure data centres located within Australia, supported by enterprise-grade physical and logical security controls.