Policy and Procedure Name	Privacy Policy
Version	3.1
Approved By	Chief Operating Officer
Date Approved	20TH May 2025
Review Date	July 2026

 

1. Purpose and Scope

 

Gradability Pty Ltd., in accordance with the Australian Privacy Principles has a commitment to ensuring that all reasonable steps are taken to protect the privacy of its consumers and staff team. The following policy and procedure outlines how personal information is collected, used, disclosed, stored, destroyed.

The Privacy policy and procedure applies to staff, students, employers, clients, and potential consumers and is used throughout all aspects of business operations

 

2. Abbreviations/Definitions

 

AVETMISS	The agreed national data standard for the collection, analysis and reporting of vocational education and training information.
Data breach	Where personal information is held by an organisation and is lost or subjected to unauthorised access, use, modification, disclosure, or other misuse.
Governing Bodies	For Professional Year Program– this relates to Department of Home Affairs (DHA), Australian Computer Society (ACS) and Accounting PYP (APYP). For RTO Registration– this refers to Australian Skills Quality Authority (ASQA).
OAIC	Office of the Australian Information Commissioner
Personal information	Types of information that are specific to an individual for example name, address, contact or bank account details.
Sensitive information	A type of personal information that is sensitive in its nature – for example race or ethnic origin, political opinion, religious belief or affiliation, medical history, or criminal record.

 

3. Policy

 

In order to deliver a high quality education service Gradability Pty Ltd. is required to collect a variety of personal information from both consumers and staff members. We are committed to safeguarding the privacy of individuals (“you”, “your”) whose “personal data” (also called “Personal Information” under Australian laws) we collect and use. Where personal and sensitive information is collected, it is stored, disclosed, and destroyed in accordance with the Australian Privacy Principles. Personal data is any data about an identified or identifiable natural person, or any information that in combination with other non-personal information can reasonably be used to identify a natural person. By accessing or using our website and enrolling in and engaging in our courses you confirm that you accept the terms of this Privacy Policy and the terms and conditions found on https://www.gradability.com.au/terms-and-conditions .

Gradability Pty Ltd.’s website may contain links to other websites and applications over which Gradability Pty Ltd. does not have control. Such links do not constitute an endorsement by Gradability Pty Ltd. and Gradability does not control the content or privacy policies or practices of such sites. Any access to and use of such linked websites is governed by the privacy policies of those third parties’ websites.

If you have any questions about anything to do with this Privacy Statement, our data processes and practices or simply to exercise your privacy rights, please contact Gradability directly via info@gradability.com.au  or compliance@gradability.com.au .

 

3.1. Why does Gradability collect personal data and what type of data is collected?

Gradability collects personal data so that we can:

• Properly identify you and conduct applicable checks for enrolment purposes;
• Understand your requirements to provide you with our services;
• Set up, administer and manage our services;
• Gather and aggregate information for statistical, prudential, reporting and research purposes;
• Manage, train and develop our staff;
• Get a better understanding of you and your needs so that we can effectively deliver services to you.

 

3.1.1 Gradability Pty Ltd. may also collect information relating to the use of our websites and our services through the use of various technologies. For example, when an individual visits our websites, we may log certain information that their browser sends, such as your IP address, browser type and language, access time, and referring web site addresses. We may collect information about the pages that are viewed within our websites and other actions taken while visiting the site.

 

3.1.2 If Gradability cannot collect your personal data from you, Gradability will not be able to provide you with any, or all of the services we provide, process your application for enrolment, fulfil our contractual obligations to you or others, and fulfil our reporting obligations and/or our legal compliance obligations to government agencies. New “right to erasure” regulations now permit individuals to request Gradability delete their personal data where it is no longer necessary for record keeping and regulatory purposes, where consent has been withdrawn, or when data has been unlawfully collected.

 

3.1.3 We may also collect information that pertains to an individual indirectly through other sources, such as vendors or agents. When we do so, we ask the vendors or agents to confirm that the information was legally acquired and that we have the right to obtain it from them and use it.

 

3.1.4 Personal and sensitive information is routinely collected from staff and consumers for the purpose of either employment or enrolment into our courses only.

 

3.1.5 Pertaining to clause 3.1.4, information collected for the purpose of employment may include

• Name
• Address
• Contact details
• Recent professional development activities
• Superannuation details
• Tax File Number
• Emergency contact
• Employment history
• Verification documentation and evidence
• Bank details
• Reference checks
• Vulnerable person checks – National Police Clearance Checks, Working with Children Checks
• Registration/ Licensing documentation
• Qualifications
• Insurance documentation

 

3.1.6 Pertaining to clause 3.1.4, information collected for the purpose of enrolment into a program may include

• Name
• Indigenous status
• Address
• Unique Student Identifier (USI) where applicable
• Contact details
• Disability/additional needs requirements
• Emergency contact information
• Third party permissions details
• Schooling/Qualifications completed
• Employment history/status
• Verification documentation, proof of identity evidence
• Fee payment information- e.g., credit card and bank account information
• Language, Literacy and Numeracy assessments
• Visa information and Visa checks via DHA Vevo online

 

3.1.7 Other data collected is included in the table below. We don’t use all this personal data in the same way. Some of it is used for marketing, or for providing services to you.

 

Data Types	Description
Website Data	This is data on how you use our website and may include your IP address, geographical location, browser type and version, operating system, referral source, length of visit, page views and Website navigation paths, as well as information about the timing, frequency and pattern of your use of our website.
Services and Systems Data	This may include billing data, your name and contact details such as your email address relating to the services we provide including information held in the learning management and customer relationship systems we use.
Correspondence Data	This may include personal data contained in or relating to any communication that you send to us (e.g. when you provide feedback, respond to a survey, or communicate with our customer support etc.), or that we use to communicate with you. (E.g. updates regarding our Website, services, systems etc.)
Marketing Data	This may include personal data you provide to us if you sign up to receive our newsletters and choose whether you wish to receive promotional communications (e.g. offers, invitations to promotional activities such as events, webinars etc.) from us by email.
Cookies and Similar Technology Data	This may include personal data that we obtain about you through cookies and similar technologies.
Profile Data	This may include your name and contact details and some of the personal data set out in this table. E.g., Third-Party data, registration data.
Registration Data	This may include information you provide to register for our services, events, webinars, surveys, etc. and may include your name and contact details e.g. an email address.
Applicant Data	This may include your name and contact details and any other additional personal information as well as a CV when you apply for a position with Gradability or enrol in a course.
Third-Party Data	This may include your name and contact details we obtain from third-party services providers, social media, publicly available sources of information etc.
Financial Data	This may include bank account and payment card details.
Transaction Data	This may include details about payments to and from you and other details of services you have purchased from us.
Other Data	This is personal data other than the ones set out in the table above.
Aggregated Data	We also collect, use and share aggregated data such as statistical or demographic data for any purpose. Aggregated data could be derived from your personal data but is not considered personal data in law as this data will not directly or indirectly reveal your identity. For example, we may aggregate you Website data to calculate the percentage of users accessing a specific website feature. However, if we combine or connect aggregated data with your personal data so that it can directly or indirectly identify you, we treat the combined data as personal data which will be used in accordance with this Privacy Policy.

 

3.1.8 Data we collect about you from others may include:

• Online through social media we use and the internet in general;
• Employers (if you apply for a job with us and we contact your current or previous employer);
• Lead generation companies;
• Events organising companies;
• Our parent company and other companies in our corporate group; and
• If you visit other websites employing our cookies and other similar technologies.

 

3.1 Data Control

3.2.1 The data controller of www.gradability.com.au and any subpages thereto (e.g., https://support.Gradability.com) is Gradability Pty Ltd. If you have any questions on this Policy or any of our data processing practices, please contact compliance@gradability.com.au

3.2.2 The following principles underpin the organisations privacy policy and procedure:

• Gradability Pty Ltd. takes all reasonable steps required to protect and maintain personal and sensitive information.
• A governance framework is used to assess, plan, implement and review the protection of personal information against misuse, loss, inappropriate access, and inappropriate
• Prior to the collection of personal and sensitive information the individual is told what information is to be collected and stored, the purpose of collection, if this information is to be disclosed to a third party and/or under what circumstances disclosure may See Course Terms and Conditions
• Pre-enrolment interviews are conducted and recorded for the collection of The applicant is asked to agree to such recording at the beginning of the interview. Should the applicant not agree, the recorded and pre-enrolment interview cannot be completed and the enrolment process cannot continue
• Personal and sensitive information is used only for the purpose of its collection and by team members who require the information in order to complete their
• Individuals have the right to access their information when required except where we cannot reasonably cooperate with the request because of the following:

i) It might pose a threat to life, health or safety;

ii) It may unreasonably impact the privacy of others;

iii) The request is frivolous or vexatious;

iv) It relates to legal proceedings and would not be available via legal discovery in the proceedings;

v) It would prejudice ongoing negotiations with the individual;

vi) It would be unlawful;

vii) Denying access is authorised by law or a court order;

viii) We reasonably believe that there is, or may be, unlawful activity or serious misconduct related to its functions or activities and providing access                       to the Personal Information is likely to prejudice appropriate action being taken in relation to the matter;

ix) Providing access would likely prejudice any legal enforcement activities; or

x) Providing access may reveal commercially sensitive decision-making information generated within

1. Personal information is stored in electronic format.
2. Security measures such as unique password requirements and restricted file access are used to maintain and protect students/clients and employee’s
3. Gradability Pty Ltd. will only disclose personal information to a third party where written consent has been obtained from the individual unless the request is made under legal duress, which requires Gradability to follow the applicable Australian laws.
4. Where Gradability Pty Ltd. receives unsolicited information it is either destroyed or de-identified
5. Compliance to Privacy

 

3.3 Data Correction

3.3.1 You may request us to correct your Personal information and we must take reasonable steps, within a reasonable period, to correct personal Information that we hold which is inaccurate, out of date, incomplete, irrelevant, misleading or that you have notified us requires correction.

3.3.2 If you require more information about your privacy rights, or if you have complained to us about treatment of your privacy data and we have not been able to resolve the complaint within 30 business days, you may contact the Office of the Australian Information Commissioner (‘OAIC”) at oaic.gov.au or at GPO Box 5218, Sydney NSW 2001. Complaints must be in writing.

 

3.4 Methods of data collection and storage

In general, the provision of any personal data or granting of consent to a processing activity is entirely voluntary. However, there are certain circumstances in which Gradability Pty Ltd. cannot act without processing certain personal data, for example to process applicant enrolments, or to assist with use of our services, or to provide access to content, log in to the online Learning Management System or to contact the service for further information. In these cases, it will not be possible for Gradability Pty Ltd. to provide the requested service or product without the relevant personal information.

 

3.4.1 In some circumstances, Gradability Pty Ltd. may need to terminate an individual’s ability to use the services without access to personal data. Gradability Pty Ltd. intends to notify the individual of whether such communication or data sharing is deemed mandatory and the impact of not sharing.

 

3.4.2 Individuals may disclose information through the website, over the telephone, via email, in person and by the completion of relevant forms. Written and/or verbal consent is obtained prior to collection of personal information obtained outside of the website personal data and stored appropriately (e.g., in the students/employee file or on the student management system, the CRM). In this instance, only information disclosed by the individual is used in the collection of information. Relating to this instance, prior to the collection of this personal information the individual is told what information is to be collected and stored, the purpose of collection, if this information is to be disclosed to a third party and/or under what circumstances disclosure may occur. See Terms and Conditions of the related course of study for further details.

 

3.4.3 The types of information collected or disclosed by the individual will vary depending on the method of collection, the purpose of that collection and the individual disclosing the information.

 

3.4.4 Forms used by Gradability Pty Ltd. to collect personal information from students include but are not limited to

• • Enquiry Forms, including contact web forms on our Website
  • Application forms/online enrolment forms on our Website
  • Terms and Conditions
  • Account creation and log in to Moodle/Student portal on our Website
  • Letter of Offer/ Direct Debit Authority Form (DDA)
  • Subscriptions to newsletters or marketing communications from us informing you of our news, events etc.
  • Assessment task submission forms and declarations
  • Individual Training Plans
  • Training Agreements
  • Assessment plans
  • Applying for a job with us and providing your name and contact details
  • Participation in a promotion, survey, market research, competition, provide a testimonial etc.

 

3.4.5 Documentation used by Gradability Pty Ltd. to collect personal information from staff team members include but are not limited to

• Application documentation
• Trainer/ Assessor Professional Development Portfolio
• Team Member details form
• Trainer/ Assessor Matrix
• Superannuation documentation
• Tax File declaration
• Applying for a job with us and providing your name and contact details

 

3.4.6 For students: Information is held in either a locked filing cabinet or electronically on the organisations hard drive and/or student management system. Access to information is limited to personnel with the correct authorisation and is only available to staff for the purpose of collection or management of student progression to course completion and graduation

 

3.4.7 Security measures such as unique password requirements and restricted file access are used to maintain and protect students/clients and employee’s privacy. Where staff team members leave the organisation their access to data is removed/deleted. When students complete their course and receive their certificates, their access to the learning and assessment materials are removed.

 

3.4.8 Where a prospective student completes an online enquiry or payment, the student’s privacy is protected by:

• Security certificate attached to our URL (https://).
• Unique Application Reference ID for students to track their applications. Using the Reference ID, students are able to return and complete the full application/enquiry at a later date.
• Different levels of system access for staff depending on role and permissions given based on their responsibilities.
• Australian Privacy Laws

 

3.4.9 Student payments are processed by Ezypay Pty Ltd, an external provider. Details of Ezypay’s privacy & security policies are located https://www.ezypay.com/privacy-security/.

 

3.4.10 Students are provided unique password access to their student portal. More than five incorrect attempts will lock the account. Students must make enquiries with Gradability Pty Ltd. to unlock the portal. In this instance verification of identity is required to authenticate the person making the request.

 

3.5 Personal data usage and processing

If an individual uses our website, we may use various website navigation information including tracking technologies such as cookies and web beacons to collect and store information. Website navigation information includes standard information from the individual’s Web browser (such as browser type and browser language), language choices, time zone, your Internet Protocol (IP) address, actions you take on our websites, URL and page metadata, installation data (such as the operating system type and application version), system crash information, system activity and hardware settings. We may also automatically collect and store certain information in activity logs such as: details of how the individual uses our websites, their search queries, and their IP address.

 

Providing the requested information or services.

3.5.1 If an individual requests information on our Services, order our services or become our business partner, we typically ask for personal contact information such as name, business email address, business telephone number, company name and address, job title, role and, if payment is to be made to Gradability Pty Ltd., financial and billing information, such as billing name and address, credit card information, bank details or other payment information. We use the personal data only to process the order or to provide the requested Service. Specifically, this includes, taking the necessary steps prior to entering into a contract, responding to applicant’s enquiries, processing, or providing customer feedback and support, information about changes to our services and other related notices or disclosures as required by law.

 

3.5.2 When an individual chooses to provide us with information, including personal data, they understand that we are storing this and/or transferring it to Gradability Pty Ltd. locations, internally between management systems and to affiliates or service providers and government departments.

 

3.5.3 Gradability Pty Ltd. complies with applicable law when transferring your personal information outside of the country where the information has been collected.

 

3.5.4 Gradability Pty Ltd. may invite students, team members, alumni to participate in questionnaires and surveys designed to improve its services, as advised on section 3.4.4 above Personal information in these surveys is only used for the purpose of its collection outlined in the survey invitation. Participation is voluntary. Individuals provide Gradability Pty Ltd. with permission to use information captured through these documents by participating in and completing these documents in full or part thereof.

 

Usage Data details.

3.5.5 In the course of providing our services to stakeholders, we may collect, use, process and store usage data such as number of sessions, users, number of users, page views, number of page views per sessions, average session duration, bounce rate, percentage of new sessions, language of user, country, city, new versus returning users, browser type, operating system, internet service provider, IP address, screen resolution size, service used, service version number and mobile device brand. The usage data is collected and processed in order to create, and compile anonymised, aggregated datasets and/or statistics about the services for the following purposes:

 

• To maintain and improve the performance and integrity of our Gradability Pty Ltd. services,
• To understand which services are most commonly preferred by customers and how customers interact with our services,
• To identify the types of services that may require additional maintenance or support,
• To comply with regulatory, legislative and/or contractual requirements,
• To inform quality improvement and assurance

 

Please note that such aggregated datasets and statistics will not enable any living individual to be identified.

 

Relationship Intelligence Products.

3.5.6 Gradability Pty Ltd. employs the use of legitimate relationship intelligence products that may collect supplemental usage data including without limitation IP address, company identifier, browser type, browser language and locale, operating system, device type, date and time of request, user id, and the person or company name being looked up. The supplemental usage data may be used for the following purposes:

1. To provide a better service, more detailed and higher quality returned data, support service troubleshooting and performance improvement, and
2. Understand usage patterns and frequency.

Supplemental usage data will not be shared with third parties except for lookup parameters which may be provided to third party content providers in order to provide enriched data response.

 

3.6 Sharing your personal data

Customers can now request access to their data, ask for corrections, transfer data to another provider (data portability), and lodge complaints directly with the OAIC. When requesting any such changes, Gradability expects written instruction on what data needs to be transferred and reserves the rights to ensure the identity of the customer before completing the request.

Gradability may share data about stakeholders with other entities where the express purpose is business related in connection with the uses identified in this Privacy Policy. Specifically, Gradability may provide personal data to others as per the below.

 

3.6.1 Group Companies: We may disclose your personal data to any member of our group of companies to help us administer, operate and/or manage our business, Website, services and systems (including learning management systems and customer relationship systems)’ perform a contract between you and us, or perform a contract on behalf of a third party.

 

3.6.2 Third-party Service Providers: We may disclose your personal data such as your name and contact details to our third-party service providers to help us administer, operate and manage our business, provide services related to us, our Website and/or systems (including the learning management systems and customer relationship systems). Service providers may be located inside or outside of Australia.

 

3.6.3 Aggregated Data: We may also share aggregated information and non-personally identifiable information for industry and market analysis, demographic, marketing and advertising, and other business purposes.

 

3.6.4 Sale/Investment: If there is (a) a sale or an asset transfer to a third party of, and/or (b) an investment in Gradability, part of the sale, asset transfer and/or investment may include your personal data. Purchasers, investors and/or their advisers may have access to your personal data as part of the corporate due diligence they perform as part of the (a) sale or asset transfer, and/or (b) the investment. However, use of your personal data will remain subject to this Privacy Policy.

 

3.6.5 Insolvency: Your personal data may be passed on to a successor in interest as part of a corporate re-organisation or in the unlikely event of an insolvency event such as a liquidation, insolvency, bankruptcy or administration. In the case of an insolvency event, our customer database may be sold separately from the rest of the business, in whole or in a number of parts. It could be that the purchaser’s business is different from ours too.

 

3.6.6 Our Insurers and Professional Advisers:  We may disclose your personal data to our insurers and /or professional advisers insofar as reasonably necessary for the purposes of obtaining and maintaining insurance coverage, managing risks, obtaining professional advice and/or managing legal disputes.

 

3.6.7 Legal Compliance: In addition to the specific disclosures of personal data set out in this Section 3.6, we may also disclose your personal data where such disclosure is necessary for compliance with a legal obligation to which we are subject, or in order to protect your vital interests or the vital interests of another individual.

 

3.7 Direct Marketing

3.7.1 Gradability Pty Ltd. only uses or discloses personal information for direct marketing purposes unless otherwise specified in this Privacy Policy if consent has been gained directly from the individual. Gradability Pty Ltd. may use your data after you have granted your consent in the following cases:

• We may use your name, email address, telephone number, job title and basic information about you or your employer to keep you up to date with the latest products and services on offer from Gradability Pty Ltd directly.

 

To provide additional training services, webinars, seminar or register for these events. If you do register for these events your personal information may be shared with other participants of the same event. We may also ask you to consent to sharing your participant information with sponsors of these events.

3.7.2 Individuals have the opportunity to be removed from circulation or subscription lists if they choose not to receive organisation related materials. We do not, in any event, sell or lease any personal information to any party.

 

3.7.3 Where individual’s post information to our Blogs, Facebook, Social Media Environments, or websites this information will been seen and shared with those audiences within those platforms. Individuals may be required to create a user profile which may provide them with the option to display personal information to others. This includes, but is not limited to their name, photo, social media accounts, postal address, email address, telephone number, personal interests, skills, and basic information about themselves or their company. All of the information that individuals post will be available to all visitors to our site.

 

3.7.4 Gradability Pty Ltd. is not responsible for the personal information that individuals choose to submit in these forums. This is the sole responsibility of the individual and Gradability Pty Ltd. will not be liable for this information in any way. Individuals are not permitted to provide any personal information about other data subjects in those forums and blogs, and we also encourage limiting any personal information to a minimum.

 

3.7.5 We may share personal data based on good faith that disclosure of this information is necessary to investigate, prevent, or act regarding legal activities, suspected fraud, or potential threats to the safety of any person or peoples. We may also use personal data in litigation in which we are involved, to protect the safety of any person or entity, to protect the rights of any person or entity, to respond to judicial or government enquiry or as required by law.

 

3.7.6 We may also work with partners to try and promote the reach of our adverts and use analytics and retargeting for this reason. We may use information we or others collect about you from cookies and similar tracking technologies to deliver relevant online advertising (e.g. Google AdWords), including via websites and social media (e.g. LinkedIn). We use social media and pages in different ways, which include, but are not limited to, promotions, marketing, advertising and communication about our brand, services and systems or to communicate with each other. We may also use social media for lead generation through the information you choose to share with us through these accounts, as previously indicated.

 

3.7.7 Gradability has integrated social media features and plugins on our Website. These features and plugins may collect your IP address, which page you visited on our website and may set a cookie to enable the feature function properly. Clicking the social media buttons will re-direct you to our social media account page on the relevant social media site. This means that social media providers will have a record of you visiting their site. Your social media provider may relate this information to your social media account and possibly present your actions on your social media profile to be shared with others in your network. These social media features and plugins are governed by the privacy policies of the social media providers and not our Privacy Policy.

 

3.8 Disclosure of personal information to a Third Party

We do not and will not sell to third parties or deal in your personal data or customer information generally.

3.8.1 Gradability Pty Ltd. only discloses information to a third party where written consent has been provided from the individual. Where possible, data is encrypted so that the individual has a level of pseudonymity. Gradability Pty Ltd. does not disclose any individual’s personal information to overseas recipients. Our Website may contain links to third party websites. Please note that if you follow a link to any such website, we do not accept any liability and/or responsibility, because these websites have their own terms and conditions and Privacy Policies. These links are made for your convenience only and do not constitute a partnership, endorsement or approval of these websites. We encourage users to be aware, when they leave our Website, to read the privacy policies of each of these websites to ensure your data is protected sufficiently before continuing on. This Privacy Policy applies solely to the information and use of the Gradability and related business products websites only.

3.8.2 In accordance with legislative and regulatory requirements Gradability Pty Ltd. is required to provide information to State and Commonwealth government departments and other government departments for the purpose of administration, research, and quality assurance. Gradability Pty Ltd. does not use or disclose government related identifiers.

 

3.9 Retention, restriction, and destruction of personal information

Gradability Pty Ltd.’s policy is to retain personal data no longer than

(a) Is necessary to fulfil the purposes for which the personal data is processed,

(b) If processing is based on consent, until consent is withdrawn or

(c) If processing is based on a legitimate interest of Gradability Pty Ltd., until objection is made by the individual to such processing.

 

3.9.1 Personal information is securely destroyed in accordance with the organisations Records Retention and Management Table. The duration of processing and storage of personal data depends on the legal basis and reporting requirements according to Australian legislation. Gradability Pty Ltd. may need to retain data and personal information in accordance with National Vocational Education and Training Regulator Act 2011 and the Standards for RTOs 2015. However, if required by law Gradability Pty Ltd. will retain personal data for a longer period of time.

 

3.9.2 Gradability Pty Ltd. will also store data for a longer period of time if such data is required to assert, support, or defend against legal claims. If this is the case, we will retain such data until the relevant retention period or until the claims related to the data have been settled. Gradability Pty Ltd.  can only delete personal data if there is no statutory obligation or prevailing right of Gradability Pty Ltd. to retain it. Deletion of any individual’s personal data will result in an inability to continue with any Gradability Pty Ltd. services to said individual that require the use the data, including, but not limited to, enrolment and completion of a Gradability Pty Ltd. course.

 

3.9.3 Gradability Pty Ltd. strives to ensure the security, integrity and privacy of your personal data by applying administrative, technical and physical safeguards designed to protect personal data provided to us. We periodically review these safeguards and update these as needed. While no system is fool-proof, we believe the measures implemented reduce our vulnerability to security problems to an appropriate level for our business use and needs.  Individuals can request that Gradability Pty Ltd. restrict further processing of their personal data without deleting said personal data for the following reasons

• If the personal data is incorrect, for the duration of the time Gradability Pty Ltd. need to verify the accuracy of the personal data
• If there is no legal basis for Gradability Pty Ltd. to process said personal data
• If Gradability Pty Ltd. no longer needs said personal data however the individual as the data subject claim that it is required to be retained retain in order to establish, exercise, or defend a legal claim
• Where Gradability Pty Ltd. processes personal data on the basis of its legitimate interest and the individual objects to the processing of said personal data for as long as it is required to review whether Gradability Pty Ltd. has a prevailing interest or legal obligation to process said personal data.

 

3.9.4 Should an individual request Gradability Pty Ltd. to withdraw a consent to use their personal data any withdrawal has no effect on past processing of personal data up to the point in time of the withdrawal.

 

3.9.5 If the use of services requires consent and the consent is withdrawn, Gradability Pty Ltd. will no longer be able to provide these services.

 

3.9.6 Any non-personal data, communications and material you submit to a Gradability Website or to us by email, or which we obtain from third parties that is not subject to obligations of confidentiality, may be kept, used and disclosed by us on a non-confidential basis. We are free to use and reproduce any such information freely, and for any purpose whatsoever. Specifically, we will be free to use any ideas, concepts, know-how or techniques contained in such information for any purpose, including developing, manufacturing or marketing products.

 

3.10 Complaints and appeals

Feedback on the organisations compliance with the privacy policy and procedure is encouraged by contacting the Compliance Manager or by making a complaint. Where an individual wishes to make a complaint they are required to lodge the complaint in writing by letter or email to Compliance Manager, Level 6 11-31 York St, Sydney 2000, or email: compliance@gradability.com.au. The Compliance Manager will acknowledge the complaint within three (3) business days of receipt of the complaint. A comprehensive investigation will follow. Corrective actions, if any, will be identified and the complainant will be informed of the outcome within ten business days following acknowledgement of the complaint.

If the complainant is dissatisfied with the outcome of their complaint they can approach their relevant ASQA for further resolution. Further action may be taken by approaching the state-based Training Ombudsman, or the OAIC.

See Complaints and Appeals policy and procedure for more information.

 

3.11 Use of Gradability Pty Ltd. website by children

Gradability Pty Ltd. does not intend for the use of their website by children under 16 years of age and thereby does not target audiences below the age of 16 years old. Gradability Pty Ltd. does not knowingly collect personal data from children under 16 years of age. Gradability Pty Ltd. supports and encourages parents and guardians to take an active role in their children’s online activities and interests.

 

3.12 Governance mechanisms

Gradability Pty Ltd. has a governance framework in place to ensure its compliance with the Australian Privacy Principles. The following governance framework underpins and supports the operationalisation of this policy through the following actions,

• Risk assessments including privacy impact assessments are undertaken when required.
• Team members receive training on the handling of personal and sensitive information on employment commencement and as changes and/ or amendments occur.
• Team members who regularly manage personal information are provided with supervision and support from their line manager.
• Performance development and management processes ensure team members have the knowledge and skills required to complete their role requirements.
• Where an agent or contractor is collecting personal information from a consumer on behalf of Gradability Pty Ltd., systematic processes are implemented to monitor compliance and maintain the individual’s privacy, including relevant training and support from internal Gradability Team members.
• The Privacy Policy is publicly available on the website and the Learning Management System.
• The organisations privacy policy and procedure is reviewed and updated regularly or where required for legislation or governance changes.
• Gradability Pty Ltd. takes all reasonable steps required to protect and maintain personal and sensitive information in accordance with the Australian Privacy Principles and EU GDPR (if or where required). If a data breach were to occur the organisation has an approach to managing the critical incident in an open and transparent manner that manages risk effectively. The process for managing a data breach includes conducting a preliminary assessment and investigation, undertaking a risk assessment, notifying all relevant parties, and developing an action plan to prevent potential future breaches. Where necessary, Gradability Pty Ltd.’s compliance to trade sanctions with any third parties, including host companies supporting interns, includes

 

1. Automated checks of any user registration data and other information a user provides about his or her identity against applicable sanctioned-party
2. Regular repetition of such checks whenever a sanctioned-party list is updated or when a user updates his or her information.
3. Blocking of access to Gradability Pty Ltd.’s

OAIC can now impose penalties on a business if it is found that the business is negligent in its management of data resulting in a serious data breach.

The organisation’s Compliance Manager monitors the effectiveness of the policy/procedure and is actively involved in its review.

 

3.13   General Business communications

Gradability Pty Ltd. communicates with users of the service on a regular basis. Communications can take place via email or phone contact. These such communications are not marketing related but are required to conduct relevant business related services to ensure the delivery of our product and services.

Marketing- related communication may be made by phone or email where an individual may have opted in to receiving these. Gradability Pty Ltd. will always provide the opportunity to opt out of receiving any further marketing information. Individuals can contact the Gradability team to request this action.

Gradability commits to anti-doxxing laws and will not intentionally publish or use a carriage service to publish personal and/or private, identifiable information about an individual without their permission.

 

3.14   Changes to Privacy Policy

Gradability Pty Ltd. reserves the right to change, modify, add, or remove portions of this Privacy Policy from time to time and in our sole discretion. We will also amend this Privacy Policy without notice to support compliance to legislative changes. Our policy is to alert stakeholders to changes that have been made by indicating on the Privacy Policy the date it was last updated and by the version control indicators.

 

4. References

 

• Australian Skills Quality Authority (2015) “Standards for Registered Training Organisations (RTOs) 2015”.
• Privacy Act 1988
• Privacy Amendment Act 2012
• Office of the Australian Information Commissioner Australian Privacy Principles (APPs)
• Office of the Australian Information Commissioner (2014) Guide to developing an APP privacy policy