Privacy and Information Handling Policy

1. Purpose and commitment

Learnivation Pty Ltd (Learnivation, RTO 45570) delivers nationally recognised qualifications through coaching-led programs, most of them in partnership with other organisations and many of them to young people under 18. Every one of those programs runs on trust: learners and their families trust us with their details, their progress and sometimes their struggles; partners trust us with their people; funders and the regulator trust us to keep accurate records. This policy explains what personal information we collect, why, how we protect it, who we share it with, and what rights people have.

This policy replaces our 2021 Privacy Policy, which was built on a regulator’s template and no longer fits how we work. It is written to match the CABA Progressive Privacy, Screening and Child-Safe Information Handling Policy so that a learner or family moving between a CABA program and a Learnivation qualification meets the same commitments in both places, and so that every partner we work with can see one consistent standard.

1.1 Who this policy applies to

It applies to everyone who handles personal information for Learnivation: the CEO and Management, learning coaches, trainers and assessors, administration and marketing staff, contractors, volunteers and work-experience mentors, and the personnel of every partner organisation while they work in a Learnivation program. It covers information about learners of every age, their parents, guardians and carers, employers and work-experience hosts, our workforce, our partners’ people, and anyone else who deals with us.

1.2 Our partners

Learnivation delivers with four aligned partners at the date of this policy. Section 7 sets out exactly what information passes between us and each of them.

2. Key terms

Personal information is information or an opinion about an identified individual, or one who is reasonably identifiable, whether true or not and whether recorded or not. Sensitive information includes health information, criminal record, racial or ethnic origin, and biometric information; we only collect it with consent and where reasonably necessary. Child or young person means anyone under 18. Screening information is what we collect to decide whether a person may work with young people: police check results, Blue Card details, referee checks and identity documents. Partner means an organisation with a written agreement to deliver, support or host a Learnivation program.

3. What we collect and why

We collect only what we reasonably need to enrol, train, assess, support and certify learners, to meet our obligations as an RTO, and to run the business. We collect by lawful and fair means and, wherever practicable, directly from the person or, for a child, from their parent together with the child.

3.1 Sensitive information

Two kinds of sensitive information are routine for an RTO and are collected with consent and used only for their purpose: health and disability information needed to support a learner and make reasonable adjustments, and criminal history and Blue Card information collected to screen our workforce and partner personnel. AVETMISS requires us to ask about Aboriginal or Torres Strait Islander identity and disability; answering is voluntary and the answers are reported to NCVER in the form the National VET Data Policy requires.

3.2 Unsolicited information and anonymity

Information we receive but did not ask for and could not lawfully have collected is destroyed or de-identified unless we must keep it. A disclosure by a young person about their safety is never treated as unsolicited; it is handled under the Child Safe Policy. People may deal with us anonymously for general enquiries and anonymous feedback, but not for enrolment, assessment, certification or screening, where identity must be verified.

4. Learners under 18

Most Spark Leadership, Event Spark and Bootstraps learners are under 18. Standard 2.4 of the Standards for RTOs 2025 requires us to support the wellbeing of these learners and to have arrangements for their safety; these are the information-handling commitments that go with that.

• We obtain written consent from a parent or guardian at enrolment, and the young person’s own agreement, for collecting their information, for sharing it with partners, employers and hosts, for photographs and recordings, and for use of online platforms. Consent is recorded on the enrolment form and can be withdrawn at any time by contacting the Privacy Officer.
• Program communications with a learner under 18 include, or are copied to, the parent or guardian nominated on the enrolment form. A learner aged 16 or over may ask us to limit what we share with a parent and we consider each request on its merits, weighing maturity, safety and legal obligations.
• We ask for the least information we can, explain things in language young people understand, and never make participation depend on information we do not need. We presume a young person aged 15 or over can consent to routine matters about their own information unless there is reason to think otherwise.
• Images and recordings are taken only with consent recorded separately for internal use, partner use (for example STUFFit’s festival media) and public use; a young person’s full name is never published with their image, images are not geotagged, and a young person can say no even where a parent has consented.
• Online tools used with young people have privacy settings set to the minimum data with public profiles, location and advertising turned off. We will align the portal and every tool we use with the Children’s Online Privacy Code once the OAIC registers it (due by 10 December 2026).
• What a young person tells a coach in confidence stays private unless we are worried about their safety or someone else’s, in which case we act under the Child Safe Policy and tell them what we are doing unless that would put them at greater risk.

5. Screening information: police checks and Blue Cards

Every adult who trains, assesses, coaches, mentors or supervises learners under 18 on our behalf is screened before they start and remains cleared for as long as they hold the role. The Child Safe Policy sets out who must be screened; this section covers the information involved, which is among the most sensitive we hold.

5.1 Nationally Coordinated Criminal History Checks (police checks)

How we obtain them. Through an ACIC-accredited body, CrimCheck, with the applicant’s informed written consent naming the purpose (work with children and young people), after identity is verified to the ACIC standard. We accept only a check less than three months old obtained for this purpose, and require a new check every three years. Workers must tell the CEO within 48 hours if they are charged with any offence.

Assessment. A disclosable outcome does not automatically exclude a person. The CEO and Zuzana Vachalek, Operations, assess it against the role, considering the nature, relevance and age of the offence and any explanation, and give the person the chance to respond before a decision is recorded. Any offence against a child, any sexual offence and any offence of violence is disqualifying. The person may see and dispute their result through the accredited body, and no adverse decision is made while a dispute is open.

Access, storage and destruction. Results are seen only by the CEO and the second assessor, are stored in a restricted Google Drive folder (encrypted by Google at rest and in transit, shared only with those two accounts, link sharing off, two-step verification required), and are destroyed no later than 12 months after issue. A screening register entry — name, role, check type, date, reference, assessment outcome and next-check date, with no criminal history detail — is kept for seven years after the person leaves. Partners and auditors receive confirmation of clearance and dates, never the result itself.

5.2 Blue Cards and interstate Working with Children Checks

We collect the card number, type (paid or volunteer), expiry and the verification date, and we verify every card online with Blue Card Services rather than relying on the card. Every holder is linked to Learnivation in the Blue Card organisation portal so that we are notified of a suspension, cancellation or expiry, and holders must tell us the same day if that happens. Cards are re-verified at least annually. Where a partner’s personnel work in our programs, the partner keeps its own register and provides it to us before those people have contact with learners and at each six-monthly review, as the partner agreements require. Blue Card details are held in the screening register with the same protections as police checks and are kept for seven years after the person leaves.

5.3 Young people under 18 in mentoring or crew roles

Some learners take on leadership, mentoring or crew roles in their programs, for example Event Spark learners crewing STUFFit or Spark Leadership learners mentoring older residents in a CABA program. In Queensland a person under 18 who volunteers does not need a Blue Card, and a police check tells us little about a young person, so we do not screen under-18 learners in those roles. Instead they take part with parental consent, complete a child-safe induction, agree to the learner code of conduct, and are always supervised by a screened adult who is responsible for the session. The volunteer exemption does not apply if a young person is paid to work with children or is studying a course where working with children is compulsory; in those cases a Blue Card is required regardless of age. As each young person turns 18 we help them apply for a Blue Card in the three months beforehand if they will continue in the role.

6. How we use and share information

We use personal information for the purpose it was collected for, for closely related purposes a person would reasonably expect, with consent, or where the law requires or authorises it. We never sell personal information. The people and organisations we share it with are:

• The National Centre for Vocational Education Research (NCVER) and the Department of Employment and Workplace Relations, and Queensland funding bodies where training is funded: enrolment and completion data as the National VET Data Policy requires. Every learner receives the NCVER privacy notice at enrolment and may be contacted for surveys.
• The Office of the Student Identifiers Registrar to create or verify a USI, and the QCAA where a learner links their qualification to the QCE.
• ASQA and other regulators during audit, monitoring or investigation, and the Queensland Family and Child Commission, Blue Card Services, Child Safety and Police where child safety requires it.
• Partners as set out in section 7, and only the information each needs.
• Employers and work-experience hosts sponsoring or hosting a learner: enrolment status, attendance, progress relevant to the placement, and the learner’s own placement documents.
• Parents and guardians of learners under 18, subject to section 4.
• Service providers that help us operate — Google Workspace, the portal (learn.learnivation, hosted by TMD hosting, Canva, Zoom, Xero, Anthropic (Claude, our AI assistant), our website host, our enrolment-form provider, MailerLite, CrimCheck, insurers and accountants — all bound to protect the information and to report any breach to us.
• Emergency services and medical practitioners where there is a serious threat to a person’s life, health or safety.

6.1 Overseas disclosure

Some of our providers store data outside Australia: Google Workspace (Australia and the United States), Canva (Australia and the United States), Zoom (United States), Xero (United States and Australia), Anthropic’s Claude (United States) and MailerLite (European Union). Each encrypts data in transit and at rest and is bound by its own privacy terms. Screening information and assessment evidence are stored in Australia.

6.2 Direct marketing

We send program news only to people who have opted in, through MailerLite with an unsubscribe link in every message. We do not market directly to a learner under 18 without a parent’s consent and never use sensitive information for marketing. Learner stories and images used in marketing require the specific public-use consent in section 4.

6.3 Automated decision-making and AI

No assessment, enrolment or screening decision is made by a computer program. A qualified person always makes the final decision, and AI output is treated as a draft for a person to check.

We use Claude, an AI assistant made by Anthropic, to help design programs and learning resources, draft documents and communications, and support administration. We use it only under these conditions:

We hold a business subscription with Anthropic under which our inputs and outputs are not used to train Anthropic’s AI models, and we do not submit conversations to Anthropic as feedback.

We enter the minimum the task needs. A learner’s USI, date of birth, home address, identity documents, health, disability or support-needs information, screening information and assessment evidence are never entered into an AI tool. Where a learner must be referred to at all, we use a first name, initials or a code, never a full record.

Conversations that contain any personal information are deleted as soon as the task is complete. Anthropic removes deleted conversations from its systems within 30 days.

Data sent to Claude is processed and stored by Anthropic in the United States, encrypted in transit and at rest, under Anthropic’s commercial privacy terms.

Only Learnivation staff who have completed privacy and child-safe induction use AI tools with Learnivation information. Partners and their personnel may not enter Learnivation learner information into any AI tool.

How learners and coaches may use AI in assessment is governed by our AI in Assessment Policy. From 10 December 2026 the Privacy Act requires privacy policies to describe any automated decisions that significantly affect people; we will update this section if that ever applies.

7. Information sharing with each partner

Standard 4.4 makes Learnivation responsible for everything a partner does in our name, and every partner agreement includes privacy obligations mirroring this policy. This table is the working summary. Where a partner’s own policy is stricter, the stricter rule applies while the partner holds the information.

8. Keeping information secure

• Access is on a need-to-know basis with individual accounts, two-step verification and prompt removal of access when a person or partner leaves.
• Screening information is held apart from other records with access limited to the CEO and second assessor. Learner records live in Google Drive under the Learnivation filing standard and in the portal; nothing is stored on personal devices, personal email or messaging apps.
• Learner names never appear in filenames inside program folders; the learner is the folder.
• Paper records, including STUFFit sign-on sheets and Bootstraps workshop records, are brought back to Learnivation or scanned into Drive within five business days and the paper shredded.
• Everyone who handles personal information completes privacy and child-safe induction before starting and a refresher at least every two years; partner personnel are inducted by the partner to the same standard and Learnivation verifies this at each review.
• Service providers are assessed before engagement and bound by contract to protect information and report breaches.

8.1 Retention

8.2 Data breaches

If information is lost, or accessed or disclosed without authorisation, the person who discovers it tells the Privacy Officer the same day. We contain the breach, assess within 30 days whether serious harm is likely, and where it is we notify affected people and the OAIC under the Notifiable Data Breaches scheme. A breach involving a child’s information, screening information or assessment records is treated as likely to cause serious harm unless we can clearly show otherwise. Partners must notify us immediately of any actual or suspected breach involving learner information, and we notify a partner without delay where its people or contacts are affected. Every breach is logged.

9. Your rights

9.1 Access and correction

Anyone may ask to see the personal information we hold about them and ask us to correct it. We respond within 30 days and do not charge for access. Learners can see their own results and progress in the portal at any time. A parent may ask for access to their child’s information; we consider the child’s age, maturity and wishes and any risk before providing it. If we refuse, we explain why in writing and how to complain.

9.2 Complaints

A complaint about how we have handled personal information follows our Complaints and Appeals Policy and Procedure: it can be made to any staff member or partner, is acknowledged within 24 hours, and is resolved within 30 days where possible. If the person is not satisfied they can complain to the Office of the Australian Information Commissioner (oaic.gov.au, 1300 363 992). Nobody is disadvantaged for raising a privacy concern.

10. Governance and review

The CEO owns this policy and acts as Privacy Officer. It is reviewed annually, when the law changes (including on registration of the Children’s Online Privacy Code, the automated decision-making transparency requirements from 10 December 2026, and the national Working with Children Check reforms), when a new partner is engaged, and after any breach or complaint that reveals a gap. It is published at learnivation.edu.au

11. Contact

Related documents

Child Safe Policy and Code of Conduct v1.0 · Complaints and Appeals Policy and Procedure v1.0 · Partner Management Procedure v1.0 (with operational checklist) · AI in Assessment Policy v1.0 · Student Number Policy v1.0 · LLND Policy and Procedure · Work Placement Framework and Procedure v1.1 · Learnivation and Cultivate the Chaos Mentor Handbook and Agreement · Third-party agreements with Bootstraps and Cultivate the Chaos · CABA Progressive Privacy, Screening and Child-Safe Information Handling Policy v1.0.