Inventorium values and respects the privacy of students, caregivers, stakeholders, and others in the Inventorium community. Inventorium is committed to protecting personal information, complying with the Privacy Act 1988 (Cth) (Privacy Act) and other applicable privacy laws and regulations.

The Management of Personal Information Procedure describes how Inventorium collects, holds, uses and discloses personal information, and how Inventorium maintains the quality and security of personal information.

This procedure applies to all prospective and current students of Inventorium, Inventorium RTO and Inventorium Academy, and their parents and caregivers, as well as Inventorium staff, third-party service providers and stakeholders, who disclose personal information to Inventorium.

“Personal information” - any information or opinion, whether true or not, and whether recorded in a material form or not, about an identified individual or an individual who is reasonably identifiable. In general terms, this includes information or an opinion that personally identifies a person either directly (e.g. name) or indirectly.

“Sensitive information” – a type of personal information that may result in discrimination or harm if mishandled. 

Personal information collected by Inventorium depends on the services for which this information is used. 

This information may include:

· Name

· Gender

· Nationality

· Date of birth

· Mailing or street address

· Email address

· Phone number

· Current school enrolment

· School level

· Qualifications and certifications

· Work experience

· Identifying numbers such as:

o Unique Student Identifier (USI)

o SACE ID

o Student ID (school)

o Education Department ID

o Drivers Licence Number

o Passport ID

· Emergency contact information

· Australian residency status

· Employment status – employment details 

· Other information as required for enrolment into a course of study

Inventorium may also collect sensitive information, including the following:

· Country of birth

· Racial or ethnic origin

· Language spoken at home

· English proficiency

· Literacy and numeracy proficiencies

· Personal study goals

· Criminal record

· Disability information

· Health information including specific learning difficulties and support requirements

· Record of behavioural interventions

· OAC At-Risk status

· NCCD Classification

· Contact details of third-party services

· NDIS Plans & psychological reports

· Family circumstances and details of family court orders

· Mandatory Report information including personal information about other students involved 

· Government supports, including protective services and living arrangements

Sensitive information will only be collected upon the provision of consent by the individual to whom the sensitive information pertains, if it is necessary to prevent a serious and imminent threat to life or health, or as otherwise required or authorised by law.

Inventorium takes all appropriate measures to protect the security of this information. 

4.2.1 Information may be collected directly from service users and stakeholders via the following communication methods:

· In person

· Through the Inventorium platform

· Via web-based tutorials 

· Over the phone

· Via email

· From webforms

· From surveys or questionnaires

· Through a job application process 

· From interactions on social media

· Through mobile apps

· SMS

· Third Party platforms (e.g. Discord)

· Video-conferencing

· Video-conferencing transcripts 

· MS Teams chat 

4.2.2 Information may also be collected from third parties, for the purpose of providing educational services tailored to individual needs, for example:

· Schools

· Partnering education providers

· Medical professionals

· Allied Health service providers

· International education agencies

· Employment agencies

· Providers of study or work programs

· Employers

· Regulatory bodies

· Case workers

· NDIS Support Workers

· Government Department, e.g. Department of Education

· Recareer Mentors 

Inventorium uses personal information for purposes in connection with core functions and activities, including:

· The provision of requested services

· The delivery of personalised service offerings

· Ensuring services are appropriate and relevant

· The improvement of service quality

· Internal administrative purposes

· Marketing purposes 

· Educational research purposes

· Tracking and reporting of progress and attendance data

· Providing education services

· Making or adding to Mandatory Notifications 

· Allocating appropriate mentors and other supports

Inventorium may disclose personal information to third parties in accordance with this Procedure in circumstances where it may be reasonably expected that information is disclosed. For example, Inventorium may disclose personal information to:

· IT service providers, in the course of administrative tasks, for the purposes of ensuring access and consistency of online services (while IT service providers may have access to personal information within Inventorium’s information management system, this information will not be disclosed directly)

· Professional services advisors, for the purposes of ensuring tailored services are of the highest quality standard

· School partners, for the transmission of grades and progress data in accordance with State requirements

· Regulatory bodies, for confirmation of identity information and mandatory reports

· Health service providers, for the purposes of acquiring specific service to support individual student wellbeing

· Employers or employment service providers, in cases where students are seeking employment opportunities in conjunction with study (and references are requested)

· Recareer mentors, for the purposes of acquainting mentors with relevant details for the provision of support and guidance

Inventorium will take all reasonable steps to ensure that personal information held is kept confidential and secure, including by:

· Adhering to standards and controls set out in ISO 27001 certification

· Implementing best-practice methods for information security across the Microsoft 365 suite of products

· Taking measures to restrict access to only personnel who need that personal information to effectively provide services

· Having technological measures in place:

o Brute force protection (website)

o Data backups

o Multi-factor authentication

o Monitoring of access to all systems and platforms

· Commissioning regular penetration testing to identify security risks 

Cookies

The Inventorium websites use cookies. A cookie is a small file of letters and numbers a website puts on a device if allowed to do so. These cookies recognise when a device has visited an Inventorium website before, so specific users can be distinguished from other users of the website. This improves user experience of the Inventorium websites.

Inventorium does not use cookies to identify specific users, just to improve the experience on its websites. If website users do not wish to use the cookies, they can amend the settings on their internet browser so it will not automatically download cookies. However, if cookies are blocked on their computer, the browsing experience and the Inventorium website’s functionality may be affected.

Website analytics

The Inventorium website uses Google Analytics and the Jetpack app within WordPress to provide a better understanding of visitor traffic, in order to improve services. Although this data is mostly anonymous, it is possible that under certain circumstances, it may be connected to a specific user.

Direct marketing

Inventorium may send direct marketing communications and information about services, opportunities, or events considered to be of interest, if a user has requested or consented to receive such communications.

These communications may be sent in various forms, including mail, SMS, and email, in accordance with applicable marketing laws, such as the Australian Spam Act 2003 (Cth). Inventorium gains user consent for the transmission of direct marketing communications by any of those methods. If a preference for a method of communication is indicated, Inventorium will endeavour to use that method whenever practical to do so.

Users may opt-out of receiving marketing communications from Inventorium at any time by following instructions to unsubscribe set out in the relevant communication or by contacting Inventorium via the details set out in 4.11 Contacting Inventorium below.

Inventorium will not retain personal information for longer than is required. 

In the case of students, personal information will be retained for the duration of the pre-enrolment period, during the provision of contracted services (a course of study), and for a fixed period following graduation or cessation of study with Inventorium, in accordance with State-mandated record-keeping obligations (up to 7 years).  

Inventorium will endeavour to keep personal information accurate, complete, and up to date.

To make a request to access and/or correct personal information held, contact Inventorium via the details set out in 4.11 Contacting Inventorium below. Inventorium will endeavour to respond within seven (7) days. Requests will be dealt with following these guidelines:

· Personal information may only be requested by the owner of that information, or another authorised person, such as a legal guardian or authorised agent. Inventorium must be satisfied the request came from an authorised person.

· Inventorium may ask for requests to be provided in writing, and for information that identifies the requestor. If so, include:

o Name and contact details

o The specific personal information required

o Desired access method, e.g. receiving a copy by email or post

o Any persons or organisations authorised to access the personal information on the requestor’s behalf

· Inventorium can refuse to provide access to personal information if there is a valid reason. Examples of a valid reason include:

o Inventorium believes that providing access may endanger the life, health or safety of any individual, or endanger public health or safety

o Providing access would have an unreasonable impact on the privacy of other individuals

o The request is frivolous or vexatious

o The personal information is part of existing or anticipated legal proceedings between a requestor and the organisation

Inventorium will provide access to personal information in the way requested, if it is reasonable and practical to do so, e.g. by receiving a copy in an email or by post, by being given information over the phone or by inspecting the information in person. If Inventorium is unable to provide access via the requested method, they will attempt to provide access in a way that meets both the needs of the requestor and the organisation.

Inventorium websites and platforms may contain links to websites operated by third parties. If a third-party website is accessed through via an Inventorium website or platform, personal information may be collected by that third party website. 

Inventorium makes no representations or warranties in relation to the privacy practices of any third-party provider or website and are not responsible for the privacy policies or the content of any third-party provider or website. 

Third-party providers/websites are responsible for informing users about their own privacy practices. Inventorium encourages all users to read third-party privacy policies.

For complaints about how Inventorium handles, processes, or manages personal information, please contact Inventorium via the details set out in 4.11 Contacting Inventorium below. Note that Inventorium may require proof of identity and full details of a request before a complaint can be processed.

Please allow up to seven (7) days for Inventorium to respond to a complaint. It will not always be possible to resolve a complaint to everyone’s satisfaction. Requestors who are not satisfied with Inventorium’s response to a complaint have the right to contact the Office of Australian Information Commissioner (at www.oaic.gov.au) to lodge a complaint.

For more information about submitting a complaint, please see Inventorium’s Complaint Management Policyand Complaint Management Procedure. 

For question or concerns in relation to handling of personal information or this Procedure, contact Inventorium for assistance via the following methods:

Email

info@inventorium.com.au

Contact number

(+61) 0474 540 636

Post

Attention: Inventorium Privacy Officer

Unit 1, 355B Angas Street

Adelaide SA 5000