Privacy Policy

Upskroll (ABN: 66 666 375 819) ("we", "our", "us") operates Upskroll, a student management system for Australian Registered Training Organisations (RTOs). We are committed to protecting your privacy and complying with the Australian Privacy Principles (APPs) under the Privacy Act 1988 (Cth).

This Privacy Policy explains how we collect, use, disclose, and protect your personal information when you use our services.

2.1 Personal Information

We collect the following types of personal information:

• Account Information: Name, email address, phone number, job title, and organisation details
• Student Data: Names, contact details, dates of birth, Unique Student Identifiers (USI), demographic information, enrolment records, and academic progress
• AVETMISS Data: All data required for AVETMISS reporting including student demographics, course enrolments, and outcomes
• Payment Information: Billing details and payment history (processed through third-party payment providers)
• Usage Data: IP addresses, browser type, device information, and interaction with our platform

2.2 How We Collect Information

We collect information:

• Directly from you when you create an account or enter data into the system
• Automatically through cookies and similar technologies when you use our platform
• From third parties such as payment processors or authentication services

We use your personal information to:

• Provide and maintain our student management services
• Generate AVETMISS reports and ensure compliance with VET regulations
• Process payments and manage subscriptions
• Communicate with you about your account and our services
• Improve our platform and develop new features
• Comply with legal obligations and respond to lawful requests
• Detect and prevent fraud, security breaches, and technical issues

4.1 Australian Data Hosting

All personal information is stored on servers located in Australia. Your data never leaves Australian jurisdiction unless you explicitly authorise international transfers.

4.2 Security Measures

We implement industry-standard security measures including:

• Encryption of data in transit (TLS/SSL) and at rest (AES-256)
• Regular security audits and vulnerability assessments
• Access controls and authentication mechanisms
• Secure backup and disaster recovery procedures
• Employee training on data protection and confidentiality

We understand the sensitive nature of AVETMISS data. We handle this information in accordance with:

• The National VET Data Policy
• State and territory VET legislation
• Australian Skills Quality Authority (ASQA) requirements
• The Privacy Act 1988 (Cth) and Australian Privacy Principles

AVETMISS data is only used for the purposes of generating compliance reports and is not shared with third parties except as required by law or regulatory bodies.

We may disclose your personal information to:

• Service Providers: Third-party vendors who assist in operating our platform (e.g., hosting providers, payment processors)
• Regulatory Bodies: ASQA, state training authorities, or other government agencies as required by law
• Legal Compliance: Law enforcement or other authorities when required by law or to protect our rights

We do not sell, rent, or trade your personal information to third parties for marketing purposes.

We use cookies and similar technologies to enhance your experience, analyse usage patterns, and maintain session security. You can control cookie preferences through your browser settings, but disabling cookies may limit platform functionality.

Under the Australian Privacy Principles, you have the right to:

• Access: Request access to your personal information
• Correction: Request correction of inaccurate or incomplete information
• Deletion: Request deletion of your personal information (subject to legal retention requirements)
• Complaint: Lodge a complaint about our handling of your personal information
• Opt-Out: Unsubscribe from marketing communications

To exercise these rights, please contact us at support@upskroll.com.

We retain personal information for as long as necessary to fulfil the purposes outlined in this policy, unless a longer retention period is required by law. AVETMISS data is retained in accordance with VET sector retention requirements (typically 30 years for student records).

Our platform may integrate with third-party services such as:

• Payment processors (e.g., Stripe)
• Authentication providers (e.g., OAuth services)
• Cloud hosting providers

These third parties have their own privacy policies, and we encourage you to review them. We are not responsible for the privacy practices of third-party services.

Our platform is designed for use by RTOs and their staff. While student data may include information about individuals under 18, we do not knowingly collect personal information directly from children without parental or guardian consent as required by law.

We may update this Privacy Policy from time to time. We will notify you of significant changes by email or through a prominent notice on our platform. Your continued use of our services after changes constitutes acceptance of the updated policy.

If you have questions, concerns, or complaints about this Privacy Policy or our data practices, please contact us:

If you are not satisfied with our response to your privacy complaint, you may contact the Office of the Australian Information Commissioner (OAIC):