Araya Tuition · PR-01

Privacy Policy

Document

PR-01

Version

2.0

Current as at

4 October 2026

Next review

October 2027

ABN

46 535 961 069

Araya Tuition (ABN 46 535 961 069). Version 2.0. Current as at 4 October 2026. Next review: October 2027. Document owner: Privacy Officer (Araya administration). Supersedes the version current as at 30 August 2026.

1. About this policy

This policy explains how Araya Tuition ("Araya", "we") collects, holds, uses, discloses and protects personal information. It covers the Araya website and online forms, and the Araya portals and apps: the Parent, Student, Teacher, Driver and Admin portals, the volunteer and teacher application, and the Child Safety Foundations online course. It also covers information collected on paper, by phone and in person.

2. Our privacy commitment

Araya is a small community program. Small businesses and not-for-profits with an annual turnover of $3 million or less are generally exempt from the Australian Privacy Principles (APPs) under the Privacy Act 1988 (Cth). Whether or not the APPs bind Araya by law, Araya has chosen to comply with the 13 Australian Privacy Principles. Araya also follows the assessment and notification steps of the Notifiable Data Breaches scheme (section 15).

Araya also recognises that:

• individuals, including children, can seek remedies for serious invasions of privacy under the statutory tort in Schedule 2 to the Privacy Act, whatever the size of the organisation. Araya therefore limits location tracking and other monitoring to what is needed to keep students safe;
• if the Children's Online Privacy Code applies to Araya's portals, Araya will comply with it;
• if Araya delivers services under a contract with a Queensland government agency, it will also comply with the Queensland Privacy Principles under the Information Privacy Act 2009 (Qld) to the extent the contract requires.

3. What we collect

3.1 Students

Name and preferred name, date of birth, gender, school, year level and class, and home address. If the student uses Araya transport, we also collect the home address used for transport. We record attendance, including arrival and departure times, as well as homework, session notes, weekly reports, assessments and learning needs, learning account details (for example IXL), messages sent in the Student portal, transport and handover records (section 4), and incident reports.

3.2 Parents, carers and emergency contacts

Names, relationship to the student, phone numbers, email and home addresses, collection and drop-off arrangements, and the consents and declarations given at enrolment (participation, excursions, incursions, emergency treatment and photos). We also hold transport consents with drawn signatures, handover confirmations, messages sent in the Parent portal, and Parent portal account details.

3.3 Health and other sensitive information

Medical conditions, allergies, dietary requirements, medication, access and disability needs, and safety notes, and cultural or language information where families choose to give it. We collect sensitive information only with consent, or where the law allows it (for example in an emergency). It is used to keep the student safe and to support their learning.

3.4 Applicants, volunteers, staff and drivers

• Application details: name, email, a password (stored only in hashed form), date of birth, address, mobile, emergency contact, class and time preferences, years of experience, a description of your experience, résumé, and qualification certificates you upload.
• Identity and screening documents: identity documents you upload (for example a driver licence), your Blue Card or exemption card number, expiry date and a copy of the card, your screening status, referee details and referees' answers, interview notes and declarations. Araya does not need a Medicare card and does not use a Medicare number to identify anyone.
• Training: Child Safety Foundations course records (section 3.7) and induction records.
• Drivers: licence number, a description of your vehicle, registration and insurance details, your home address (used as the start or end point of runs), your roster, and your run, route and handover records (section 4).

3.5 Portal records and communications

Messages sent through Araya's portals (between parents, students, teachers and Araya administrators), attendance rolls, session and lesson notes, notes shared with parents, homework, reports, incident reports and uploaded documents.

3.6 Login and security records

Your email address and password hash, two-factor authentication settings (an authenticator secret), single-use codes for password resets and course access (stored in hashed form), and the time of your last login. We use a session cookie to keep you signed in. To stop password-guessing and spam, Araya records repeated attempts against a hashed (scrambled) version of your internet address. These rate-limit records are deleted after about a day. Our hosting provider may keep standard web server logs (internet address, date and time, page requested and browser type) for security and troubleshooting. This website uses only cookies that are needed for it to work. It does not use tracking or advertising cookies.

3.7 Child Safety Foundations online course

Your name, email address and access code, which parts of the course you have completed, your quiz answers, score and number of attempts, your completion date, and your certificate. When you pass, your certificate is emailed to you as a PDF, and Araya's reception is notified that you have completed the course.

3.8 Enquiries, support, donations and sponsorship

Name, organisation, contact details, preferred contact method, the support you offer, any donation amount, and your message. Support-interest forms are saved as a PDF and emailed to Araya's reception.

3.9 Photos and video

Araya takes or publishes photos or video of a student only if a parent or carer has given permission on the enrolment form. See section 9.

3.10 Payments

Invoices, receipts, payment status and donation records. Araya does not collect or store full payment card numbers through its website.

4. Transport: GPS, handovers, signatures and consents

4.1 GPS location of driver runs

• The Araya Driver app records the location of the driver's phone only while a run is active, from when the driver taps Start run until they tap End run. It does not record location at any other time.
• Because of how phone browsers work, location is recorded only while the app is open on screen. The app asks the phone to keep the screen on during a run. The driver can see whether GPS is on.
• The app records location points (latitude, longitude, accuracy and time) and the start and end positions. The server uses them to work out the kilometres driven and to draw a map of the actual route.
• Run records (times, odometer readings, planned and actual route maps and kilometres) can be seen by Araya administrators and the driver. A parent can see the trip report and route maps for runs their child was on. Route maps show numbered stops, and may mark the driver's home as the start or end point, but do not show other children's names. Families are asked not to share route maps.
• Location is used only for student safety, transport records and reimbursing drivers' travel. It is not used to monitor drivers at other times.

4.2 Handover records, QR codes and signatures

• Each time a student is handed between a parent or carer, a volunteer driver and Araya, the handover is confirmed in the Araya apps. This is done either by scanning a QR code or typing a 6-character code (each code works once and expires after 5 minutes), or by the parent or carer drawing a signature on the driver's screen and typing their name.
• Araya records the student, the date, drop-off or pickup, who handed over and who received the student, the method used, the time, the run it belongs to, and whether the student was on that driver's regular roster. Where a signature is used, we also store the signature image and the signer's name. Where a handover is recorded manually by Araya, we store the written reason.
• The QR code contains only a random, single-use link. It does not contain the student's name or other personal details.

4.3 Transport consents and risk assessments

Parents and carers sign transport risk assessments in the Parent portal: a routine transport consent for each child, and a separate consent for each excursion. Araya stores the signer's name, the drawn signature, the acknowledgements given, any reason for declining, and the signed PDF, which includes the route map and trip details.

4.4 Addresses used for route planning

To plan the order of stops, Araya's system converts addresses into map coordinates and works out driving routes. The addresses involved are students' transport addresses, drivers' home addresses, the venue and excursion destinations. The system stores the results to avoid repeat look-ups, and saves a map image of each plan. It uses either Google Maps Platform or OpenStreetMap-based services, depending on how Araya's system is set up (section 7). When a driver taps Open route in Google Maps, the stop addresses for that run are sent to Google so that it can give directions on the driver's phone.

5. How we collect information

We collect information directly from you through forms, the portals and apps, email, phone and in person. Parents and carers give us most information about students. We also collect information from referees, from Blue Card Services (to validate a card), from a driver's phone (location during a run, with the phone's permission), and automatically when you use our website (security records). Each Araya form displays a short collection notice that explains why the information is collected and links to this policy.

6. Why we use it, and who can see it

We use personal information to assess enrolments and applications, keep students safe, deliver tuition, mentoring, sport and transport, communicate with families, screen and train workers, meet legal obligations (including Blue Card, child-safety and work health and safety duties), handle complaints and incidents, manage payments and donations, and secure our systems.

Access inside Araya depends on a person's role:

• Araya administrators can see the records they need to run the program, including child-safety records.
• Teachers can see records for the students in their classes.
• Parents and carers can see their own children's records, notes marked as visible to parents, and their children's handover and trip records.
• Students can see their own work, reports and messages.
• Drivers can see the names, transport addresses and pickup and drop-off arrangements of students on their runs, and their own run and handover history.

Portal messages are stored on Araya's systems as Araya records. Araya may access them to respond to a child-safety concern, a complaint or a legal requirement.

Outside Araya, we disclose personal information only where you have consented, where it is needed for the purpose it was collected for, or where the law requires or permits it. Recipients may include emergency services, police, Child Safety, Blue Card Services, the Queensland Family and Child Commission, WorkSafe Queensland, insurers, professional advisers, and the service providers in section 7.

7. Service providers and overseas disclosure

Araya uses these providers, which may hold or access personal information outside Australia:

Araya takes reasonable steps under APP 8 to ensure these providers handle personal information consistently with the APPs. It shares only what each provider needs.

8. Identity documents and Blue Card information

Identity documents and Blue Card details are used only to verify who you are and whether you can safely work with children, as the Working with Children (Risk Management and Screening) Act 2000 (Qld) requires. Uploaded documents are stored in a private area of Araya's system that can be opened only by authorised Araya administrators. Once identity has been verified, Araya deletes uploaded copies of identity documents and keeps a record of the check (document type, date and who checked it). Araya does not use government identifiers (such as licence or Blue Card numbers) as its own identifier for you. Blue Card details are kept in Araya's Blue Card register (see the Recruitment, Screening and Blue Card Policy).

9. Photos and video

Photos and video of students are optional and are used only with a parent's or carer's permission. Araya does not publish a student's full name, school or location with their image. Some families have safety reasons for keeping a child's identity private. Tell us, and we will not publish that child's image. You can withdraw permission at any time by emailing reception@arayatuition.com. We will remove the image from websites and accounts we control within 5 business days, but we cannot recall copies that others have already shared.

10. Children's information

Most information about students is provided by their parent or carer. Araya explains to students, in age-appropriate language, what the Student portal records and who can see it. Students aged 15 or over who have the capacity to do so may make their own privacy requests. A parent or carer can make requests for a younger student.

11. Automated processing

Araya's systems calculate some things automatically: attendance percentages and progress summaries, the most efficient order of stops on a run, and course quiz scores against the pass mark. A person can retake the course quiz. These calculations do not by themselves decide enrolment, access to services, fees or whether someone may work with children. A person at Araya always makes those decisions. If this changes, Araya will update this policy.

12. Marketing

Araya sends newsletters, fundraising or promotional emails or SMS only with your consent. Each one identifies Araya and gives you a way to unsubscribe. Service messages about attendance, safety, transport or payments are not marketing.

13. Security

Araya takes reasonable steps to protect personal information from misuse, interference, loss, and unauthorised access, change or disclosure. These steps include role-based access in the portals, passwords stored only in hashed form, an authenticator app (two-factor authentication) for teacher and driver accounts, limits on repeated login attempts, private storage for uploaded documents, and induction of workers on privacy.

14. How long we keep information

When information is no longer needed, Araya securely deletes or de-identifies it.

15. Data breaches

If Araya suspects a data breach, it will:

1. contain it straight away (for example by changing passwords, removing access, or asking our hosting provider for help);
2. assess it quickly, and within 30 days at most, to decide whether it is likely to cause serious harm. Araya gives extra weight to children's, health, identity, location and family-violence information;
3. notify affected people and the Office of the Australian Information Commissioner as soon as practicable if serious harm is likely, following the Notifiable Data Breaches scheme. Where Blue Card, child-safety or family-violence information is involved, Araya will also consider telling police or other agencies needed to keep people safe;
4. review what happened and fix the cause, and record the breach in a breach register.

16. Access and correction

You can ask to see, or correct, the personal information Araya holds about you or your child. Email reception@arayatuition.com (attention: Privacy Officer) or call 0466 373 048. Parents can update some details, such as the transport address, in the Parent portal. Araya will need to confirm your identity first. Araya will respond within 30 days and does not charge for making a request. Araya may refuse or limit access only where the law allows, for example where access would put someone's safety or privacy at risk or would prejudice a police investigation. If it does, Araya will tell you why in writing.

17. Complaints

Make a privacy complaint to Araya (attention: Privacy Officer) using the contact details above, in writing if possible. Araya will acknowledge it within 5 business days and give you a written response within 30 days. If you are not satisfied, you can contact the Office of the Australian Information Commissioner (OAIC) at oaic.gov.au or on 1300 363 992. The OAIC will usually expect you to have complained to Araya first. It can investigate complaints only about organisations that the Privacy Act covers.

18. Changes to this policy

Araya reviews this policy at least once a year and whenever its systems change how personal information is handled. The current version is always at arayatuition.com/policy-privacy.html, with a PDF copy.

This document is Araya's policy. It is not legal advice. If it differs from the law, the law applies; where this document sets a stricter rule than the law, Araya follows the stricter rule.