About this policy
This Privacy Policy explains how Excelar Pty Ltd (“we”, “us” or “our”) handles personal information. It covers our website and our online teaching and learning support platform (the Platform), which schools use to plan lessons and support students.
We handle personal information in accordance with the Privacy Act 1988 (Cth), including the Australian Privacy Principles, and the Health Records and Information Privacy Act 2002 (NSW) (together, the Privacy Laws).
We may update this Privacy Policy from time to time. The current version is always on our website.
Whose information we handle
We handle personal information about:
- students at schools that use the Platform;
- teachers and other school staff who use the Platform (Users);
- contacts at schools and other organisations we deal with; and
- people who visit our website or contact us.
What we collect
The kinds of personal information we collect depend on how you deal with us.
About students, we hold information that a school enters or uploads into the Platform, and information that students provide directly through the Excelar learning survey, which may include:
- name, year group, class and school;
- learning preferences and responses to the Excelar learning survey;
- learning diagnoses, such as autism or a specific learning disorder, and related reports;
- learning adjustments and learning support plans; and
- wellbeing support measures and related notes.
Some of this is health information or other sensitive information. Other than completing the learning survey, students and parents do not use the Platform.
About Users, we collect name, school email address, role and log-in details.
About school contacts and people who contact us, we collect name, contact details, role and the content of communications with us.
When you use our website or the Platform, we also collect some information automatically:
- device and technical information, such as IP address, device type, operating system, browser, and language and time zone settings;
- usage information, such as the pages and features used, time spent, and log-in and activity records; and
- information from cookies and similar technologies, including session cookies that keep Users securely logged in to the Platform and analytics cookies on our website.
You can set your browser to refuse cookies. Our website will still work, but Users cannot log in to the Platform without session cookies.
How we collect it
We collect most information about students from the school. We collect learning preferences directly from students, and in some cases from parents, when they complete the Excelar learning survey at the school’s request. The school is responsible for telling families about this and for obtaining any consent that is needed, including consent to the collection of health information.
We collect information about Users from the User and from their school, and automatically when they use the Platform.
We collect other information directly from you, or automatically when you use our website.
Why we collect and use it
We use student information only to:
- provide the Platform to the school, including to generate lesson plans, activities and adjustments for teachers;
- provide support to the school;
- keep the Platform and student information secure, including by investigating suspected misuse;
- create de-identified information in accordance with clause 7.4; and
- comply with the law.
We use other personal information to:
- provide, operate, maintain and support the Platform and our website;
- verify accounts and activity, keep the Platform secure, and investigate suspected misuse or breaches of our terms;
- measure and analyse how the Platform and our website are used, so that we can improve them and develop new features;
- respond to enquiries, and keep records of our communications to help resolve issues and disputes;
- manage our relationship with schools, and send school contacts information about Excelar, which they can opt out of at any time; and
- comply with the law.
We do not sell personal information, and we do not use identifiable student information for marketing or advertising. We may use de-identified and aggregated information (see clause 7.4) in our marketing, for example to publish aggregated results.
Who we disclose it to
We disclose student information only to the school that entered it, and to service providers that help us operate the Platform, such as Google Cloud, our cloud hosting provider. We do not disclose it to anyone else unless the Privacy Laws require or permit it, for example where a law or court order requires it, or to lessen or prevent a serious threat to someone’s life, health or safety.
We may disclose other personal information to our service providers and professional advisers, and to government authorities and law enforcement bodies where the law requires or authorises it.
Our service providers are bound to protect personal information. A current list of the service providers who store or have access to student information is on our website.
Artificial intelligence and automated decisions
The Platform uses artificial intelligence to suggest lesson plans, activities and adjustments, based on the curriculum, students’ learning preferences and any learning diagnoses entered by the school.
The Platform does not make decisions about students. Its outputs are suggestions for teachers, who must review them and apply their own professional judgment before using them. The Platform does not diagnose any condition.
The kinds of personal information used by the Platform’s AI features are the student information described in clause 3.2.
We do not use identifiable student information to train AI models, and we do not allow our service providers to do so. We may use information that has been de-identified and aggregated, so that no school or individual can be identified, to improve the Platform and for research, benchmarking and marketing.
How we keep it secure
We protect personal information using measures appropriate to its sensitivity, including encryption in transit and at rest, single sign-on through the school’s own identity provider where the school uses one (so that Users do not need a separate Excelar password), role-based access controls so that Users see only what their school permits, multi-factor authentication for our staff, and logging of access to student information.
If we become aware of a data breach that is likely to result in serious harm, we will notify the affected school promptly, and the Office of the Australian Information Commissioner and affected individuals where the Privacy Laws require.
Where it is stored
We store student information in Australia, using Google Cloud.
We are not likely to disclose personal information to recipients outside Australia.
How long we keep it
We keep student information for as long as the school uses the Platform. When a school stops using the Platform, we give it 30 days to export its information and then delete it from the Platform, and from our backups in the ordinary course of our backup cycle.
We keep other personal information for as long as we need it for the purposes in clause 5 or as the law requires, and then delete or de-identify it.
Access and correction
If you are a student or parent, ask the school for access to or correction of the student’s information. The school manages the information it holds in the Platform, and will contact us if it needs our help to respond.
If the school cannot resolve your request, or you are a User or another person whose information we hold, you can contact us using the details in clause 13.
We may need to verify your identity before responding. If we refuse a request, we will tell you why.
Complaints
If you have a concern about how we have handled your personal information, contact us using the details in clause 13. We will acknowledge your complaint within 5 business days and aim to respond within 30 days.
If you are not satisfied with our response, you can complain to the Office of the Australian Information Commissioner (oaic.gov.au) or, for health information, the NSW Information and Privacy Commission (ipc.nsw.gov.au).
Contact Us
Privacy Officer, Excelar Pty Ltd, privacy@excelar.com.au.
