Privacy and Data Protection Policy and Procedure

1. Policy Objective

The purpose of this privacy policy is to:

clearly communicate the personal information handling practices of Strata Education RTO.
provide individuals with a better understanding of the types of personal information that Strata Education RTO holds and how to access or correct the RTO’s personal information holdings
enhance the transparency of Strata Education RTO’s operations.

2. Scope

This Privacy and Data Protection Policy and Procedure applies to all personal information collected, held, used, disclosed, stored, or managed by Strata Education RTO in connection with its operations as a Registered Training Organisation (RTO).

This policy applies to:

all employees, contractors, consultants, trainers, assessors, third-party service providers, and other persons acting on behalf of Strata Education RTO;
all current, prospective, and former learners;
employers, clients, industry representatives, and other stakeholders who provide personal information to Strata Education RTO; and
all records and systems, whether physical or electronic, that contain personal information.

This policy applies to the handling of personal information in all activities undertaken by Strata Education RTO, including:

learner enrolment and administration;
training and assessment services;
student support services;
recruitment and human resource management;
marketing and communication activities;
regulatory reporting and compliance activities; and
engagement with third-party providers and government agencies.

This policy applies to personal information collected through all channels, including online systems, email, telephone communications, paper-based forms, websites, learning management systems, and face-to-face interactions.

All personnel engaged by Strata Education RTO are required to comply with this policy and associated procedures when handling personal information.

3. Relevant Legislation and Regulatory Requirements

Strata Education handles personal information in accordance with applicable privacy, student identifier and vocational education and training legislation and regulatory requirements, including:

Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs);
National Vocational Education and Training Regulator Act 2011 (Cth);
Student Identifiers Act 2014 (Cth) and Student Identifiers Regulation 2014 (Cth);
applicable National VET Data Policy and VET data reporting requirements;
applicable Commonwealth, state and territory funding and training authority requirements; and
other legislation or regulatory requirements applying to the collection, use, disclosure, storage and protection of learner information.

Strata Education will also provide learners with any privacy notices required by Commonwealth, state or territory authorities as part of enrolment or participation in government-funded training.

4. Definitions

Personal information is defined under the Privacy Act 1988 (Cth) as information or an opinion about an identified individual, or an individual who is reasonably identifiable:

(a) whether the information or opinion is true or not, and

(b) whether the information or opinion is recorded in a material form or not.

Some examples of personal information include names, addresses, phone numbers and email addresses. The definition of personal information only relates to ‘natural’ persons. It does not extend to other ‘legal’ persons, such as companies.

Sensitive information Under the Privacy Act 1988 (Cth), sensitive information is defined as:

(a) information or an opinion about an individual’s:

racial or ethnic origin
political opinions
membership of a political association
religious beliefs or affiliations
philosophical beliefs
membership of a professional or trade association
membership of a trade union
sexual orientation or practices, or
criminal record

that is also personal information; or

(b) health information about an individual

(d) biometric information that is to be used for the purpose of automated biometric verification or biometric identification, or

(e) biometric templates.

5. Responsibility

The Strata Education RTO Manager is responsible for the implementation, administration, and oversight of this Privacy Policy and Procedure, including responding to enquiries about how Strata Education collects, holds, uses, or discloses personal information, requests for access to or correction of personal information, and privacy complaints.

6. Policy

This policy outlines the requirements within the Strata Education Registered Training Organisation (RTO) to protect personal and health information disclosed as part of educational, training, research, community engagement and associated administrative procedures and activities.

The policy ensures that:

Strata Education RTO complies with the requirements of:

The Australian Privacy Principles (APPs) set out in the Privacy Act 1988 (Cth).

Strata Education will only collect personal information that is reasonably necessary for its functions and activities or required or authorised by law. Individuals will be informed of the purposes for which information is collected, how it may be used and disclosed, and any consequences that may arise if required information is not provided. Consent will be obtained where consent is required by law or is otherwise appropriate.

7. Procedure

7.1 Strata Education RTO will comply with the requirements of:

The Australian Privacy Principles (APPs) set out in the Privacy Act 1988 (Cth).

7.2 Collection and use of student personal information

Personal information may be collected and used for purposes including:

confirming an individual's identity;
creating, verifying or accessing a Unique Student Identifier (USI);
processing and administering enrolment;
delivering training, assessment and learner support;
monitoring participation and academic progress;
issuing qualifications, statements of attainment and other certification documentation;
maintaining required student and training records;
meeting AVETMISS, VET data and other regulatory reporting requirements;
administering government-funded training or other applicable programs; and
complying with Strata Education's legal and regulatory obligations as an RTO.

Students who elect to not provide the required information, will not be able to be enrolled in a training program.

7.3 Direct Marketing

Strata Education will only use personal information for direct marketing where permitted by law. Marketing communications will provide a clear means of opting out, and opt-out requests will be actioned within a reasonable period.

7.4 Data Quality

Strata Education will take reasonable steps to ensure that the personal information collected is accurate, up to date and complete.

7.5 Data Security

The Strata Education takes all reasonable steps to protect the personal information they hold against misuse, interference, loss and unauthorised access, modification or disclosure. When no longer required, personal information is destroyed in a secure manner, or deleted in accordance with Strata Educations Records Management Policy.

7.6 Privacy and Data Breaches

All personnel must immediately report any actual or suspected loss, misuse, unauthorised access, disclosure or modification of personal information to the RTO Manager.

Strata Education will take reasonable steps to contain and assess the incident, minimise potential harm, document the response and prevent recurrence.

Where an eligible data breach has occurred, Strata Education will notify the Office of the Australian Information Commissioner and affected individuals as required under the Privacy Act 1988 (Cth) and the Notifiable Data Breaches scheme.

The RTO Manager is responsible for coordinating the response and any required notifications.

7.7 Disclosure of student personal information

Strata Education may disclose learner personal information where required or authorised by law or where necessary to meet its obligations as a Registered Training Organisation.

This includes disclosure of VET student information to the National Centre for Vocational Education Research Ltd (NCVER) in accordance with applicable VET data reporting requirements.

Personal information may also be disclosed, where required or authorised, to:

the Australian Government Department responsible for vocational education and training;
the Australian Skills Quality Authority (ASQA) and other VET regulators;
Commonwealth authorities;
relevant state and territory training authorities;
the Student Identifiers Registrar;
government departments or agencies responsible for funding, administering, monitoring or evaluating training programs; and
other bodies where disclosure is required or authorised by law.

Information disclosed may include personal and contact information, demographic information, USI-related information, enrolment and participation information, training activity, unit and qualification information, assessment outcomes and certification information.

Information provided to NCVER and government authorities may subsequently be used or disclosed for purposes permitted by law, including VET administration, regulation, monitoring and evaluation, authenticated VET transcripts, statistics and research, surveys, data linkage, policy development, workforce planning and consumer information.

Strata Education will provide learners with the applicable Commonwealth and, where required, state or territory privacy notices as part of the enrolment process.

7.8 VET data reporting and validation

Student information submitted through VET data reporting systems may be subject to validation and quality assurance processes. This may include checking information against records held in other authorised information systems, including the Unique Student Identifier Registry and other government registers, where permitted or required by law.

7.9 State and territory training programs

Where a learner's enrolment is associated with government-funded training or another state or territory program, additional privacy and data collection requirements may apply. Strata Education will provide the learner with the relevant state or territory authority's privacy notice or privacy information where required.

7.10 Student surveys

Learners may be contacted to participate in surveys conducted or commissioned by NCVER, an Australian Government department, a state or territory authority, or another authorised body or contractor. Where applicable, learners may elect not to participate when contacted.

7.11 Disclosure of academic progress and results

Students must be informed with their academic progress.

7.12 Storage of student personal information

Personal information may be collected electronically, in hard copy format or by other means. The RTO stores an individual’s personal information in the secure information technology systems.

7.13 Access to a student’s Unique Student Identifier record

Students may provide permission for the RTO to access their Unique Student Identifier (USI) record through the USI portal.

Strata Education will only create a USI on a learner’s behalf or access their authenticated VET transcript where the learner has provided the required authorisation or permission.

7.14 - Student right to access and correct personal records

Students can access their personal records at any time and request that their information is corrected and or updated. Individuals wanting to amend their personal information can request to do so in writing. Strata Education may need to verify the requester’s identity before providing access or making a correction.

Amendment requests may be addressed to:

RTO Manager, enquiries@strata.edu.au

7.15 Privacy complaints

Individuals who consider that Strata Education RTO has breached their privacy may make a written request for an internal review. The request should be addressed to: RTO Manager, enquiries@strata.edu.au

The complaint should describe the privacy concern and include any relevant supporting information. Strata Education will acknowledge the complaint, investigate the matters raised and provide a response within a reasonable period. We aim to respond within 30 calendar days.

The written request should:

Specify an address within Australia to which a notice can be sent
Be lodged within 6 months from when the alleged breach occurred
Set out details of why the breach is said to have occurred.

The review will be completed by the RTO Manager as soon as is reasonably practical and within 60 days from the date the application is received. Upon completion, the RTO Manager will notify the applicant in writing of:

The findings of the review
The reasons for the findings described in terms of the Information Privacy Principles
Any proposed actions
The reasons for the proposed action (or no action); and
The applicant’s entitlement to have the findings and reasons reviewed through external review, Office of the Australian Information Commissioner (OAIC), provided the complaint falls under the Privacy Act 1988 (Cth).

The RTO Manager will notify the RTO CEO of the assessment outcome.

Individuals who are dissatisfied with the outcome of an internal review, may apply to the , Office of the Australian Information Commissioner (OAIC), provided the complaint falls under the Privacy Act 1988 (Cth) for an external review of the earlier conduct which was subject to the internal review. A person has 28 days from completion of the internal review to seek an external review. OAIC has the power to make binding decisions on an external review.

8. Continuous Improvement

Strata Education’s privacy policy will be reviewed every two years unless otherwise required or desired, by the RTO Manager.

9. Related Documents

Strata Education Pre-Enrolment Form

Strata Education Records Management Policy and Procedure

Student Enrolment Policy and Procedure

Complaints and Appeals Policy and Procedure

Applicable Commonwealth VET Privacy Notice

Applicable state or territory training authority privacy notices

The RTO for Strata Professionals