Privacy Policy

 1. Purpose 

Inventorium values and respects the privacy of students, caregivers, stakeholders, and others in the Inventorium community. Inventorium is committed to protecting personal information, complying with the Privacy Act 1988 (Cth) (Privacy Act) and other applicable privacy laws and regulations. 

The Management of Personal Information Procedure describes how Inventorium collects, holds, uses and discloses personal information, and how Inventorium maintains the quality and security of personal information. 

2. Scope 

This policy applies to all prospective and current students of Inventorium, Inventorium RTO and Inventorium Academy, and their parents and caregivers, as well as Inventorium staff, third-party service providers and stakeholders, who disclose personal information to Inventorium. 

3. Definitions 

“Personal information” - any information or opinion, whether true or not, and whether recorded in a material form or not, about an identified individual or an individual who is reasonably identifiable. In general terms, this includes information or an opinion that personally identifies a person either directly (e.g. name) or indirectly. 

“Sensitive information” – a type of personal information that may result in discrimination or harm if mishandled.  

 4. Privacy Policy 

4.1 Types of personal information collected 

Personal information collected by Inventorium depends on the services for which this information is used. 

This information may include: 

• Name 
• Gender 
• Nationality 
• Date of birth 
• Mailing or street address 
• Email address 
• Phone number 
• Current school enrolment 
• School level 
• Qualifications and certifications 
• Work experience 
• Identifying numbers such as: 
• Unique Student Identifier (USI) 
• SACE ID 
• Student ID (school) 
• Education Department ID 
• Drivers Licence Number 
• Passport ID 
• Emergency contact information 
• Australian residency status 
• Employment status – employment details  
• Other information as required for enrolment into a course of study 

Inventorium may also collect sensitive information, including the following: 

• Country of birth 
• Racial or ethnic origin 
• Language spoken at home 
• English proficiency 
• Literacy and numeracy proficiencies 
• Personal study goals 
• Criminal record 
• Disability information 
• Health information including specific learning difficulties and support requirements 
• Record of behavioural interventions 
• OAC At-Risk status 
• NCCD Classification 
• Contact details of third-party services 
• NDIS Plans & psychological reports 
• Family circumstances and details of family court orders 
• Mandatory Report information including personal information about other students involved  
• Government supports, including protective services and living arrangements 

Sensitive information will only be collected upon the provision of consent by the individual to whom the sensitive information pertains, if it is necessary to prevent a serious and imminent threat to life or health, or as otherwise required or authorised by law. 

Inventorium takes all appropriate measures to protect the security of this information. 

4.2  In person Personal information collection methods 

4.2.1  Information may be collected directly from service users and stakeholders via the following communication methods: 

• Through the Inventorium platform 
• Via web-based tutorials  
• Over the phone 
• Via email 
• From webforms 
• From surveys or questionnaires 
• Through a job application process  
• From interactions on social media 
• Through mobile apps 
• SMS 
• Third Party platforms (e.g. Discord) 
• Video-conferencing 
• Video-conferencing transcripts  
• MS Teams chat 

4.2.2  Information may also be collected from third parties, for the purpose of providing educational services tailored to individual needs, for example: 

• Schools 
• Partnering education providers 
• Medical professionals 
• Allied Health service providers 
• International education agencies 
• Employment agencies 
• Providers of study or work programs 
• Employers 
• Regulatory bodies 
• Case workers 
• NDIS Support Workers 
• Government Department, e.g. Department of Education 

4.2.3  Changes to this Privacy Policy and other service terms 

Inventorium may update this Privacy Policy, Terms of Use, student agreements, or other relevant service terms from time to time. 

Where a material change affects how personal information is collected, used, disclosed or otherwise handled, Inventorium will provide affected users or customers with at least 28 days' notice before the change takes effect. Notice may be provided by email, through the relevant Inventorium platform or service, or by another appropriate communication method. 

Where required, users may also be required to review and explicitly consent to the updated Privacy Policy before continuing to access the relevant Inventorium system or service. 

The current version of this Privacy Policy will be published on the Inventorium website. 

4.3  Uses for personal information 

Inventorium uses personal information for purposes in connection with core functions and activities, including: 

• The provision of requested services 
• The delivery of personalised service offerings 
• Ensuring services are appropriate and relevant 
• The improvement of service quality 
• Internal administrative purposes 
• Marketing purposes  
• Educational research purposes 
• Tracking and reporting of progress and attendance data 
• Providing education services 
• Making or adding to Mandatory Notifications  
• Allocating appropriate mentors and other supports 

4.3.1  Use of artificial intelligence technologies 

Inventorium may use approved artificial intelligence technologies in limited educational contexts, such as generating static visual learning content or supporting educational content presentation. 

Inventorium does not use artificial intelligence for automated decision-making, behavioural profiling, disciplinary decisions, student risk classification, or eligibility determinations. 

Inventorium does not use personal information submitted through its learning platform to train or develop artificial intelligence or machine learning models. 

4.4  Disclosure of personal information to third parties 

Inventorium may disclose personal information to third parties in accordance with this Policy in circumstances where it may reasonably be expected that the information will be disclosed. For example, Inventorium may disclose personal information to: 

• IT service providers, where access to personal information is necessary to provide system administration, technical support, maintenance, security or other technology services. 
• Professional services advisors, for the purposes of ensuring tailored services are of the highest quality standard 
• School partners, for the transmission of grades and progress data in accordance with State requirements 
• Regulatory bodies, for confirmation of identity information and mandatory reports 
• Health service providers, for the purposes of acquiring specific service to support individual student wellbeing 
• Employers or employment service providers, in cases where students are seeking employment opportunities in conjunction with study (and references are requested) 

4.4.1  Overseas Disclosure of Personal Information 

Inventorium primarily stores personal information in Australia through approved service providers. In some circumstances, personal information may be processed, backed up, or supported by technology providers operating infrastructure in Australia or other jurisdictions. 

Where overseas disclosure or processing occurs, Inventorium takes reasonable steps to ensure appropriate privacy, confidentiality, and security protections are in place in accordance with applicable Australian privacy laws. 

4.4.2  Approved third-party service providers 

Inventorium engages approved third-party service providers to support the delivery of educational, administrative, communication and security services. These providers may process personal information only for authorised business purposes and are subject to appropriate contractual, confidentiality and security requirements. 

Inventorium primarily stores personal information in Australia. Some service providers may process, support or otherwise access information from other jurisdictions, as described below. 

Current approved service providers include: 

My Learning Space (Moodle Workplace hosting provider) 

Moodle Workplace hosting, support, maintenance 

Learning records and course participation data 

Australia (via approved hosting provider) 

https://www.mylearningspace.com.au/ 

BigBlueButton 

Online classes integrated with the Learning Platform 

Session participation data, recordings and chat/transcript data where applicable 

Australia 

https://marketplace.moodle.com/?type=96 

Cloudflare 

Security, DNS and traffic optimisation for Inventorium website and the Learning Platform 

IP addresses and website traffic metadata 

Australia and other approved service regions 

https://www.cloudflare.com/education/ 

Microsoft 

Document storage and collaboration services 

Student work submissions, shared files and learning resources 

Australia and other locations where Microsoft and its service providers process data 

https://account.microsoft.com/ 

Skodel 

Student wellbeing and engagement 

Wellbeing and engagement data 

Australia 

https://skodel.com/ 

Wisenet 

Student Management System 

Enrolment, compliance, and academic records 

Australia 

https://www.wisenet.co/ 

OpenAI 

Generation of static images for the Travel Theme learning activity in the Learning Platform 

Non-personal text prompts/content required to generate images; personal and sensitive information is not intended to be submitted 

United States and other locations where OpenAI and its service providers process data 

https://developers.openai.com/ 

4.5  Personal information protection methods 

Inventorium will take all reasonable steps to ensure that personal information held is kept confidential and secure, including by: 

• Adhering to standards and controls set out in ISO 27001 certification 
• Implementing best-practice methods for information security across the Microsoft 365 suite of products 
• Taking measures to restrict access to only personnel who need that personal information to effectively provide services 
• Having technological measures in place: 
• Brute force protection (website) 
• Data backups 
• Multi-factor authentication 
• Monitoring of access to all systems and platforms 
• Commissioning regular penetration testing to identify security risks  

4.6  Online activity 

Cookies 

The Inventorium websites use cookies. A cookie is a small file of letters and numbers a website puts on a device if allowed to do so. These cookies recognise when a device has visited an Inventorium website before, so specific users can be distinguished from other users of the website. This improves user experience of the Inventorium websites. 

Inventorium does not use cookies to identify specific users, just to improve the experience on its websites. If website users do not wish to use the cookies, they can amend the settings on their internet browser so it will not automatically download cookies. However, if cookies are blocked on their computer, the browsing experience and the Inventorium website’s functionality may be affected. 

Website analytics 

The Inventorium website uses Google Analytics and the Jetpack app within WordPress to provide a better understanding of visitor traffic, in order to improve services. Although this data is mostly anonymous, it is possible that under certain circumstances, it may be connected to a specific user. 

Direct marketing 

Inventorium may send direct marketing communications and information about services, opportunities, or events considered to be of interest, if a user has requested or consented to receive such communications. 

These communications may be sent in various forms, including mail, SMS, and email, in accordance with applicable marketing laws, such as the Australian Spam Act 2003 (Cth). Inventorium gains user consent for the transmission of direct marketing communications by any of those methods. If a preference for a method of communication is indicated, Inventorium will endeavour to use that method whenever practical to do so. 

Users may opt-out of receiving marketing communications from Inventorium at any time by following instructions to unsubscribe set out in the relevant communication or by contacting Inventorium via the details set out in 4.11 Contacting Inventorium below. 

4.7  Retention of personal information 

Inventorium will not retain personal information for longer than is required.  

In the case of students, personal information will be retained for the duration of the pre-enrolment period, during the provision of contracted services (a course of study), and for a fixed period following graduation or cessation of study with Inventorium, in accordance with State-mandated record-keeping obligations (up to 7 years). 

4.8  Accessing and correcting personal information 

Inventorium will endeavour to keep personal information accurate, complete, and up to date. 

To make a request to access and/or correct personal information held, contact Inventorium via the details set out in 4.11 Contacting Inventorium below. Inventorium will endeavour to respond within seven (7) days. Requests will be dealt with following these guidelines: 

• Personal information may only be requested by the owner of that information, or another authorised person, such as a legal guardian or authorised agent. Inventorium must be satisfied the request came from an authorised person. 
• Inventorium may ask for requests to be provided in writing, and for information that identifies the requestor. If so, include: 
• Name and contact details 
• The specific personal information required 
• Desired access method, e.g. receiving a copy by email or post 
• Any persons or organisations authorised to access the personal information on the requestor’s behalf 
• Inventorium can refuse to provide access to personal information if there is a valid reason. Examples of a valid reason include: 
• Inventorium believes that providing access may endanger the life, health or safety of any individual, or endanger public health or safety 
• Providing access would have an unreasonable impact on the privacy of other individuals 
• The request is frivolous or vexatious 
• The personal information is part of existing or anticipated legal proceedings between a requestor and the organisation 

Inventorium will provide access to personal information in the way requested, if it is reasonable and practical to do so, e.g. by receiving a copy in an email or by post, by being given information over the phone or by inspecting the information in person. If Inventorium is unable to provide access via the requested method, they will attempt to provide access in a way that meets both the needs of the requestor and the organisation. 

4.9  Links to third-party sites 

Inventorium websites and platforms may contain links to websites operated by third parties. If a third-party website is accessed through an Inventorium website or platform, personal information may be collected by that third party website.  

Inventorium makes no representations or warranties in relation to the privacy practices of any third-party provider or website and are not responsible for the privacy policies or the content of any third-party provider or website.  

Third-party providers/websites are responsible for informing users about their own privacy practices. Inventorium encourages all users to read third-party privacy policies. 

4.10  Inquiries and complaints 

For complaints about how Inventorium handles, processes, or manages personal information, please contact Inventorium via the details set out in 4.11 Contacting Inventorium below. Note that Inventorium may require proof of identity and full details of a request before a complaint can be processed. 

Please allow up to seven (7) days for Inventorium to respond to a complaint. It will not always be possible to resolve a complaint to everyone’s satisfaction. Requestors who are not satisfied with Inventorium’s response to a complaint have the right to contact the Office of Australian Information Commissioner (at www.oaic.gov.au) to lodge a complaint. 

For more information about submitting a complaint, please see Inventorium’s Complaint Management Policy and Complaint Management Procedure.  

4.11 Contacting Inventorium 

For questions or concerns in relation to the handling of personal information or this Policy, contact the Inventorium Privacy Officer for assistance using the following details: 

Privacy Officer 

Email: Privacy@inventorium.com.au