Privacy Policy

Purpose

Real Schools is committed to protecting the privacy, security and confidentiality of personal information held about employees, partner schools, contractors and third parties. This policy outlines how we collect, store, use, protect and disclose personal information in compliance with:

• The Privacy Act 1988 (Cth)
• The Australian Privacy Principles (APPs)
• The PDP Act
• The HR Act
• Relevant education sector privacy standards
• Essential 8 Maturity Level 1 requirements (ACSC)

Scope

This policy applies to:

• All personal and organisational data collected and stored by Real Schools
• All staff and contractors who access Real Schools systems
• All data stored in Real Schools platforms. This includes the Real Schools Partner Portal (partner-portal.realschools.com.au) and the Real Schools learning platform (learning.realschools.com.au), as well as Microsoft 365 and HubSpot
• Any third-party service provider acting on behalf of Real Schools

Definitions

Personal Information
Identifies or could reasonably identify an individual, such as names, contact details, job titles, or survey responses.

Sensitive Information
A protected category of personal information under the Privacy Act. Real Schools does not collect sensitive case notes or student behavioural/mental health information.

Partner School Information
Professional and organisational information collected from partner school staff for partnership delivery (e.g., names, roles, emails, attendance records, schedules). Does not include individual student case data.

Data Breach
Unauthorised access, disclosure, or loss of personal information, whether accidental or intentional.

Third-Party Service Provider
Any external organisation engaged to support Real Schools services, including IT, storage, communication, and administrative systems.

Disclosure
Providing personal information to someone outside Real Schools, including to contractors or regulatory bodies when required.

Security Controls
Measures used to protect information, such as MFA, encryption, device protection, password requirements, and Essential 8 Maturity Level 1 practices.

Zero Trust
A security approach where all users must be authenticated and authorised before accessing any Real Schools systems or data.

Notifiable Data Breach
A data breach likely to cause serious harm and therefore must be reported under the Notifiable Data Breaches scheme.

 

How we collect personal information and how we use it

1. How do we collect your personal information and how do we use it?

We collect personal information directly from you when you register for an event or webinar,  complete forms on our website (or a website administered by Real Schools), if you contact us in person, by e-mail, in writing, over the telephone or via social media.

The personal information collected generally includes salutation, name, job title, contact details and payment details if you have made a purchase with us. We may also collect sensitive information about you such as membership of any professional associations, dietary requirements or information from a purchased list.

The information we collect is used only to:

• Verify your identity.
• Assist you to enrol for our events or to subscribe to our publications.
• Promote our events to you.
• Maintain and develop our database.
• Share information from time to time with other professional organizations.

Financial information that is collected (like the customer’s account or credit card number) is used only to bill the user for services requested and any transaction details remain secure.

2. Disclosure of Personal Information

Personal information may be forwarded onto third parties only for the purpose to assist in the supply of services to you and for sponsorship purposes. At no time is the information collected disclosed to any third party for any other reason.

At times we use third party companies to collect personal information and communicate with you via email or telephone on our behalf, in accordance with the Act.  In all of these communications we ensure you will clearly be able to identify us.

We will only disclose personal information in accordance with the Act. This means that it will be disclosed if:

• we told you when collecting it that it would be disclosed for that purpose or for a related purpose that you would reasonably expect;
• we have your consent;
• it is part of business assets which we are selling;
• we are required by law to disclose it; or
• it is otherwise permitted under the Act

We will endeavour to process any request for opting out as soon as possible, but you may receive communications from us or from third parties whilst we are processing your request.

Email communications are only sent to:

• recipients who have opted to receive them
• participants in our events unless they have asked us not to do so
• those who enquire about our events unless they have asked us not to do so

In sending email communications, we ensure that you can identify us as the originator.

3. What are cookies and why do we use them?

We also use cookies to collect some statistical data about visitors to our websites.  Cookies are small pieces of data stored on the web browser on your computer.  This website and associated websites (including those you reach by clicking on advertising) may store cookies on your browser.  The cookie doesn’t track any personal information about you or provide us with any way to contact you, and the cookie doesn’t extract any information from your computer.

The main reasons we store cookies are to:

• Gather statistics such as number of visits, pages viewed, types of transactions conducted, time online and documents downloaded to improve site usability
• Enable us to present customised and appropriate messages from our events and third parties such as targeting more relevant advertisements to you

If you wish to disable or remove cookies, please visit the ‘Help’ section of your browser or mobile device.  Please be aware however, that parts of the website may not function correctly as a result of disabling cookies.

4. Maintaining accurate records

The main purpose for collecting personal information is to enable Real Schools to market its events and products. Real Schools takes all reasonable precautions to ensure that the information we collect, use and disclose is accurate, complete and up-to-date. The accuracy of the information, however, depends to a large degree on the information provided to us.

If you have any questions about the security or accuracy of your stored personal information you can contact us at the details provide below.

You can help us to protect your privacy by contacting us immediately if your contact details change.

The Partner Portal and learning platform

Partner school staff have accounts on our portal and learning platform. Through those we hold:

• Account and role information — name, work email, school, and what the account may see.
• Learning progress — which lessons have been started and completed.
• Activity — which pages have been visited, used to understand how the portal is being used.
• Anything typed into a tool — described under Artificial intelligence below, because the AI tools are where most of it is entered.

Our activity log

We keep an operational log of what our systems did: a record that an email was sent, a user was synchronised, a document was uploaded, a question was answered. It exists so that when something goes wrong we can establish what happened and in what order.

The log records what happened, not what was said. It holds system events and may include the email address or account of the person who acted. It does not hold the content of conversations, documents, or questions asked of our AI tools. Entries are kept for 365 days and then deleted.

Artificial intelligence

We use AI tools in the portal and in our own work. This section covers what they do with information you give them.

Where your information goes

What we keep, and for how long

We have been clearer here than our previous AI page was. It said the only information we kept was anonymised and used for error logging. That is not accurate for every tool, and we would rather say what actually happens.

What the AI providers do with it

Under our commercial agreements, the AI providers we use do not train their models on information we send them. We have not opted into any programme that would allow it.

Anthropic
Information sent to Anthropic is held by them for 30 days and then deleted. They do not use it to train their models. Their privacy policy and data retention policy set out their position in full.

OpenAI
The AI assistants in the portal are provided for us by Rispose, which uses OpenAI to generate their replies. We have no direct account with OpenAI for these tools — what you type reaches OpenAI through Rispose, and is held by OpenAI for up to 30 days in the logs they keep to enforce their usage policies. OpenAI does not use it to train their models.

Real Schools staff also use ChatGPT in our own work. That is separate from the portal and does not involve anything you type into it.

Rispose
Rispose keeps your conversation history for 30 days so you can return to it, after which it is deleted.

Those conversations can be read by the Real Schools team member who administers the tool, and are looked at only to test it and to work out what went wrong when something breaks. They are not reviewed routinely, not used to assess you or your school, and not shared.

As with our other AI tools, please don’t enter information about individual students.

What does not happen

• We do not sell your information, and we do not share it with third parties except the providers listed above, who process it on our behalf.
• AI providers do not train their models on it.
• It is not exposed to other schools or other users.
• Information is encrypted in transit.

Documents you upload

Where the portal lets you upload your school’s own policy documents:

• Word documents (.docx) are processed entirely on our own servers and are not sent to any AI provider.
• PDFs are sent to Anthropic to extract their text, because we cannot read a PDF reliably without help. We ask you to confirm this for each PDF before it is uploaded, so the choice is yours and is made document by document.
• We keep both the file you uploaded and the text extracted from it, so that anything we quote back to you can be checked against your original.
• Deleting a document removes both.

Students

Our AI tools are for school staff, about school practice. They are not for recording information about individual students, and we ask you not to enter it. Where a tool invites you to describe a situation — the Policy Advisor does — it tells you on screen to leave out students’ names.