Privacy Policy - Scootle

What is personal data?

"Personal data" is anything that discloses your identity, that is unique to you. For example: a name, an identification number, location data or an online identifier. It also includes "personal information" as defined in subsection 6(1) of the Privacy Act:

What personal data does ESA collect

When you register on the Website as:

1. a guest, ESA does not collect any personal data; or

2. an education user, directly or via Single Sign On*, ESA may collect the following personal data:

   • your title;
   • your first and last name;
   • your email address;
   • your year level;
   • your learning area;
   • your current role; and/or
   • your country.

   Single Sign On enables certain users to gain access to the Website via their jurisdiction or school education network (Identity Provider) without going through the usual registration process and having to log in each time. When first connecting to the Website, a user record will automatically be created for the user. The user record will include the user's name and email address provided from the relevant Identity Provider and information provided in the account details screen, which is optional for the user to complete.

   When you use the Website, ESA collects the following information relating to your use of the Website:

   • your server address;
   • your top level domain name (for example: .com., .gov, .au, .edu, .net, etc.);
   • the time and date of your visit to the Website;
   • the pages and documents you have accessed or viewed; and
   • the type of browser you are using (for example Chrome, Firefox, Internet Explorer).

   Usage statistics or patterns obtained from tracking the level and range of interest in the Website are collected in order to improve the Website. This information may be connected to a user's profile but will be de-identified prior to any use in reports.

How does ESA collect your personal data?

ESA may collect your personal data when you:

• register on the Website for a Scootle account;
• use the Website via Single Sign On; and/or
• browse, make an enquiry or otherwise interact with the Website.

Sometimes ESA collects your personal data from a third party for example, ESA may collect your personal Data from a relevant jurisdiction or school in order to enable Single Sign On.

Handling of Personal data

1. 4.1 Remaining anonymous or using a pseudonym: are you required to provide personal data?

   Where it is not impractical or unlawful, you may interact with ESA without identifying yourself or using a pseudonym. As a general principle, you provide ESA with your personal data voluntarily and there are no detrimental effects for you if you choose not to consent or to provide personal data. However, there are circumstances in which ESA cannot take action without certain of your personal information. For example:

   • in order to enable Single Sign On, your jurisdiction needs to provide ESA with your personal information in order for ESA to identify you and enable your Single Sign On connection; and
   • ESA requires your email address if you elect to receive a newsletter.

2. 4.2 Use of your personal data

   ESA will only use your personal data for the stated purpose for which it was provided or otherwise in accordance with the law.

   Therefore, ESA will use your personal data for the following purposes only ("Permitted Purposes"):

   • providing services or things you have requested, for example receiving a newsletter, to personalise the user experience or providing access to Single Sign On;
   • compliance with ESA's legal obligations (such as record keeping obligations);
   • for insurance purposes;
   • for monitoring and assessing compliance with ESA's policies and standards;
   • to comply with ESA's legal and regulatory obligations and requests anywhere in the world, including reporting to and/or being audited by national and international regulatory bodies;
   • to comply with court orders and exercises and/or defend ESA's legal rights; and
   • for any purpose related and/or ancillary to any of the above or any other purpose for which your personal data was provided to ESA.

   ESA will only communicate with you via email after you have opted in on the Website to receive emails and ESA will provide you the opportunity to opt out anytime if you do not want to receive further communication from ESA.

3. 4.3 With whom will ESA share your personal data?

   ESA may share your personal data in the following circumstances:

   • to instruct service providers within or outside of ESA, domestically or abroad, for example, shared service centres to process personal data for Permitted Purposes on ESA's behalf and in accordance with ESA's instructions only. ESA will retain control over and will remain fully responsible for your personal data and will use appropriate safeguards as required by applicable law to ensure the integrity and security of your personal data when engaging such service providers;
   • to use aggregated personal data and statistics for the purpose of monitoring Website usage in order to help ESA develop its Website and services.

   Otherwise ESA will only use or disclose your personal data as described in this privacy policy, when you direct ESA or give ESA permission or when ESA is required by applicable law or regulations to do so

   Specifically ESA may use data from your use of the Website for developing aggregated data and statistics (refer to section 4.4 below).

4. 4.4 Use of Cookies

   Usage statistics or patterns obtained from tracking the level and range of interest in the Website are collected in order to improve and develop the Website.

   This Website uses:

   • Google Analytics, a web analytics service provided by Google Inc. Google Analytics uses cookies, which are text files placed on your computer, to help the Website analyse how users use the Website. The cookie identifies your browser, not you personally. The information generated by the cookie about your use of the Website (including your IP address) will be transmitted to and stored by Google Inc. on servers in the United States.
     
     Google Inc. uses this information for the purpose of evaluating your use of the Website, compiling reports on Website activity for ESA and providing other services relating to Website activity and internet usage. Google Inc. may also transfer this information to third parties where required to do so by law, or where such third parties process the information on Google Inc's behalf. Google Inc. will not associate your IP address with any other data held by Google Inc.
     
     You may refuse the use of cookies by selecting the appropriate settings on your browser, however if you do this you may not be able to use the full functionality of the Website. When using this Website, you consent to the processing of data about you by Google Inc. in the manner and for the purposes set out above; and
     
     
   • Hotjar, a technology service that uses cookies and other technologies to help ESA collect data on how users use this Website. Hotjar assists ESA in providing its users with a better experience and service as well as assisting ESA in diagnosing technical problems and analysing user trends. Through using this service, the functionality of this Website can be improved, making it more user-friendly, more valuable, and simpler to use for the end users. You may opt-out from having Hotjar collect your information when visiting this Website at any time by visiting the Hotjar Opt-out page and clicking 'Disable Hotjar' or enabling Do Not Track (DNT) in your browser. You can get more information about Hotjar here and read its privacy policy here.
     
     

5. 4.5 Personal data about other people which you provide to ESA

   If you provide personal data to ESA about someone else you must ensure that you are entitled to disclose that personal data to ESA and that, without our taking any further steps, ESA may collect, use and disclose that personal data as described in this privacy policy. In particular, you must ensure the individual concerned is aware of the various matters detailed in this privacy policy, as those matters relate to that individual, including ESA's identity, how to contact ESA, ESA's purposes of collection, ESA's personal data disclosure practices (including disclosure to overseas recipients), the individual's right to obtain access to the personal data and make complaints about the handling of the personal data, and the consequences if the personal data is not provided (such as ESA's inability to provide services).

6. 4.6 Security of your personal data

   ESA takes reasonable steps to:

   • protect personal data that it holds against misuse, interference, loss, unauthorised access, modification or disclosure by utilising up-to-date electronic and physical security controls that comply with relevant industry standards and guidelines; and
   • destroy or permanently de-identify personal data if it is no longer required.

   Personal data may be kept on ESA's personal data technology systems, those of ESA's contractors or in paper files.

   Please note that if you link to a web page from an ESA website, ESA's privacy policy will no longer apply. Therefore, you should check the privacy and security statement that apply to the linked website.

7. 4.7 Location of personal data

   Personal data collected by ESA via this Website is stored in Australia; and not disclosed, accessed or transferred to overseas recipients.

Accessing and correcting personal data

If any of the personal data that you have provided to ESA changes, for example if you change your email address or if you wish to cancel any request you have made of ESA, or if you become aware that ESA has any inaccurate personal data about you, please let ESA know using the contact information in paragraph 8 below. ESA will not be responsible for any losses arising from any inaccurate, inauthentic, deficient or incomplete personal data that you provide to it. If you are a Single Sign On user, you:

• will not be able to update your name and/or email address as this personal data is provided to ESA by your Identity Provider; and
• should contact your Identity Provider if you wish to access and correct this personal data.

For how long does ESA retain your personal data?

ESA will delete your personal data when it is no longer reasonably required for the Permitted Purposes or you withdraw your consent (where applicable) and ESA is not legally required or otherwise permitted to continue storing such data.

Your rights

Subject to certain legal conditions, you have the right to request a copy of the personal data about you which ESA holds, to have any inaccurate personal data corrected and to object to or restrict ESA using your personal data. You may also make a complaint if you have a concern about ESA's handling of your personal data.

If you wish to do any of the above, please contact ESA using the contact information below. ESA may request that you prove your identity by providing ESA with a copy of a valid means of identification in order for ESA to comply with its security obligations and to prevent unauthorised disclosure of data.

ESA will consider any requests or complaints which it receives and provide you with a response in a timely manner. If you are not satisfied with ESA's response, you may take your complaint to the relevant privacy regulator. In Australia, the relevant regulator is the Office of the Australian Information Commissioner.

Contact information for ESA for questions, comments, concern or complaints

If you have any questions, comments, concerns or complaints about ESA's privacy practices for this Website, you can contact ESA by:

• Telephone: +61 3 92079600
• Post: Post Office Box 177, Carlton South, Victoria, Australia 3053; or
• Email: [email protected].

Changes to this Privacy Policy

ESA may make changes to this privacy policy from time to time to take account of new laws and technology or changes to ESA's operation and practices. ESA recommends that you regularly check this privacy policy. Any changes will take effect as soon as they are posted on this Website. You may obtain a paper copy of this privacy policy by contacting ESA via the contact details provided above.