Privacy Policy

Privacy Protection Note Policy (version 1)

Policy Statement

The personal privacy of students information, data collected by the RTO is protected and maintained by the RTO and is compliant with privacy laws.

Purpose

To ensure that records are accurate and are systematically collected, recorded and stored in a safe and confidential method. Information is collected in accordance with Personal Privacy Principles (Information Act 2013 NT) and the Australian Privacy Principles Privacy Act 1988 / Privacy Amendment (Private Sector) Act 2000 (Cth). Confidentiality is maintained.

Train Safe NT has policies and procedures to ensure all data collected is protected and stored to all Australian data security and privacy regulations.

Privacy Note – National VET Data Policy December 2020

Why we collect your personal information as a registered training organisation (RTO), we collect your personal information so we can process and manage your enrolment in a vocational education and training (VET) course with us. If you do not provide Train Safe NT with all the required personal information, we may not be able to verify your USI and therefore cannot issue a statement of attainment. We use your personal information to enable us to deliver VET courses to you, and otherwise, as needed, to comply with our obligations as an RTO.

We are required by law (under the National Vocational Education and Training Regulator Act 2011 (Cth) (NVETR Act) to disclose the personal information we collect about you to the National VET Data Collection kept by the National Centre for Vocational Education Research Ltd (NCVER). The NCVER is responsible for collecting, managing, analysing and communicating research and statistics about the Australian VET sector. We are also authorised by law (under the NVETR Act) to disclose your personal information to the relevant state or territory training authority.

The NCVER will collect, hold, use and disclose your personal information in accordance with the law, including the Privacy Act 1988 (Cth) (Privacy Act) and the NVETR Act. Your personal information may be used and disclosed by NCVER for purposes that include populating authenticated VET transcripts; administration of VET; facilitation of statistics and research relating to education, including surveys and data linkage; and understanding the VET market. The NCVER is authorised to disclose information to the Australian Government Department of Education, Skills and Employment (DESE), Commonwealth authorities, State and Territory authorities (other than registered training organisations) that deal with matters relating to VET and VET regulators for the purposes of those bodies, including to enable: National VET Data Policy 28.

• ▪administration of VET, including program administration, regulation, monitoring and evaluation
• ▪facilitation of statistics and research relating to education, including surveys and data linkage
• ▪understanding how the VET market operates, for policy, workforce planning and consumer information.

The NCVER may also disclose personal information to persons engaged by NCVER to conduct research on NCVER’s behalf. The NCVER does not intend to disclose your personal information to any overseas recipients. For more information about how the NCVER will handle your personal information please refer to the NCVER’s Privacy Policy at www.ncver.edu.au/privacy. If you would like to seek access to or correct your information, in the first instance, please contact your RTO using the contact details listed below. DESE is authorised by law, including the Privacy Act and the NVETR Act, to collect, use and disclose your personal information to fulfil specified functions and activities. For more information about how the DESE will handle your personal information, please refer to the DESE VET Privacy Notice at https://www.dese.gov.au/national-vet-data/vet-privacy-notice.

Surveys you may receive a student survey which may be run by a government department or an NCVER employee, agent, third-party contractor or another authorised agency. Please note you may opt out of the survey at the time of being contacted. Contact information at any time, you may contact Train Safe NT to:

• ▪request access to your personal information
• ▪correct your personal information
• ▪make a complaint about how your personal information has been handled
• ▪ask a question about this Privacy Notice go to Train Safe NT https://trainsafe.net/privacy-policy/

Procedure

1.The Privacy Protection Note Policy is to be reviewed once (1) a year so that any changes to the Information Act 2013 (NT) and the Privacy Act 1988 can be considered and may result in amendments to the Privacy Protection policy.

2.The Privacy Note (December 2020) must be documented on the website and enrolment forms.

Student Records and Information Policy (version 1)

Policy Statement

The personal privacy of student’s information and data collected by the RTO is protected and maintained by the RTO and is compliant with privacy laws.

Purpose

To ensure that records are accurate and are systematically collected, recorded and stored in a safe and confidential method. Information is collected in accordance with Personal Privacy Principles (Information Act 2013 NT) and the Australian Privacy Principles Privacy Act 1988 / Privacy Amendment (Private Sector) Act 2000 (Cth). Confidentiality is maintained.

Train Safe NT has policies and procedures to ensure all information collected is protected and stored to all Australian data security and privacy regulations.

Train Safe NT uses the student management system (SMS) VETtrak, it is owned by a Melbourne based company Readytech, the server is based in Launceston Tasmania. VETtrak SMS is certified to meet the iSO 27001 global standard. Hosted Saas applications are located in a private cloud which is owned and operated by VETtrak staff.

The data centre and our upstream suppliers have been recognised with Cybersecurity Capability Maturity Model (C2M2) to ensure security of our supply chain. The data is subject to all Australian data security and privacy regulations. For more information go to https://www.vettrak.com.au/software/iso-certified-data-security/

VETtrak meets the following security standards:

• ▪The system must be hosted onshore in Australia (including data backup and disaster recovery)
• ▪Australian Government Privacy and Cloud Computing Framework
• ▪NT Government Cloud Computing Standard
• ▪NT Government Information Security Classification Framework / Policy NT Government Digital Security Policy
• ▪The privacy of the data from or collected on behalf of NTG stored on a cloud computing or externally hosted Service
• ▪Must be maintained under clause 36 Privacy in Part B Conditions of Contract. This includes the protection of users’ identities

The Principal’s Data is considered Confidential Information. The Contractors’ (and/or sub-contractors) use of data is limited as per Clause 36 Privacy in Part B Conditions of Contract. It expressly prohibits the following without the prior written consent from the Principal:

▪profiling;

▪data mining;

▪advertising; and

▪analytics.

Further to Clause 36.3 Principal’s Data in Part B Conditions of Contract, the Contractor must ensure that the data stored in its internal IT Systems meet the following requirements:

a)Is protected at all times from unauthorised access or use by a third party, and from loss, theft, misuse, damage, or destruction by any person and have quality procedures and IT security systems and measures in place to mitigate loss, misuse or theft or any security incidents

b)Has protective measures outlined in the Essential Eight IT Security requirements set out by the Australian Cyber Security Centre (ACSC), administrative, physical, and technical safeguards, in line with accepted industry standards, appropriate maturity level commensurate with the consequences and probability of unauthorised access to, or use, misuse or loss of, the Principal’s Data. The Essential Eight Maturity Model | Cyber.gov.au outlines the IT maturity levels of different organisational types.

c)The Contractor must maintain and provide to the Principal, on request, an audit log of access to the Principal’s Data.

d)The Contractor must ensure that Principal’s Data is backed up to prevent data loss.

e)The Contractor must inform the Principal as soon as possible after it becomes aware of any confirmed security incident, breach of confidentiality and as soon as practicable (and at least within five Business Days) confirm the details by notice in writing.

f)The Principal may undertake periodic review of the Contractor’s information security/cyber security management during the Contract term.

Procedure

1. The records are to be stored in the following formats and location:

High risk personal information and access

• ▪Student personal information collected at enrolment is stored on SMS VETtrak – electronic version backed up on server. Protected by Cybersecurity Capability Maturity Model (C2M2)

Access - James Gorrie CEO and the RTOs full time trainer.

• ▪Complaint Forms and correspondence from independent panel (arbitrator) – paper copy in complaints file Student Appeals Result Forms and correspondence from external assessor – paper copy student file.

Access - James Gorrie CEO and any Train Safe NT employee that “needs to know”.

Medium risk information and access

• ▪Rolls and Results - electronic version in roll and results file
• ▪Evidence of student’s work:
• §original paper copy in student work box
• §online student work is stored on the online platform (backed up to server) and the electronic copy is saved on the Online Training Evidence file.
• ▪Students Questionnaire – paper copy in questionnaire file
• ▪Problem areas identified by student surveys – paper copy in problem areas student file
• ▪Employers Questionnaire – paper copy in employers questionnaire file
• ▪Problem areas identified by employers’ surveys – paper copy in problem areas employers file
• ▪Industry Consultation meetings and minutes - paper copy in industry meetings file and electronic version in Train Safe NT & Business file
• ▪Validation assessment practice & assessment judgement – paper copy in assessment validation file
• ▪RPL Validation – paper copy in validation file
• ▪Withdrawal Form – paper copy in student file.
• ▪Credit For Prior Studies – paper copy in student’s file
• ▪Recognition of Prior Learning - paper copy in student’s file
• ▪Quotes, Invoices stored in Xero software – backed up to server

Access - James Gorrie CEO and the RTOs full time trainer.

Staff Records

• ▪Staff Qualifications – photocopies in staff files
• ▪Professional Development – paper copy in staff file and electronic version in Trainers Matrix
• ▪Police Checks, Ochre Card (Working with Children) – paper copy in staff files
• ▪Trainers Service Agreement – paper copy in staff file

Access - James Gorrie CEO.

Office Security and Storage

• 1.The office is not a public building and is locked. Only staff can enter the office, students can only enter the office with a staff member.

• 2.All electronic records are stored on James Gorrie CEOs laptop. This is not accessed by any other person other than the CEO. Password is needed to open.

• 3.All electronic records are ‘backed up’ onto a USB memory stick every month and all records for each academic year are to be stored in Records USB. This is stored in the locked filing cabinet in the office. Only the CEO has a key.

The following records are to be archived electronically for thirty (30) years:

• ▪SMS VETtrak database
• ▪Trainers Matrix

▪Trainers Service Agreement

The following records are to stored and protected for five (5) years:

• Rolls and Results
• Risk assessment forms
• Validation assessment practice & assessment judgement (students work)

• Complaints and correspondence from independent panel (arbitrator)
• Appeals and correspondence from independent assessor
• Credit transfers and evidence
• Recognition of prior learning and evidence
• Correspondence with NVR
• RPL validation
• Withdrawal Form

The following records are to be stored and protected for a period of two (2) years:

• ▪Students work, except for the sample of assessment judgement required for validation

Destruction of Personal Privacy, Information and Data

For paper destruction:

• 1.Contact “Shred X” a data destruction company, for best practices ensure their accreditation is AAA (National Association for Information Destruction). This will ensure compliant to Privacy Laws and Data Protection Regulations.

• 2.Follow their instruction and retain the receipt as evidence of proper paper destruction. Receipt to be scanned and stored in the Supporting Documents below.

For electronic data destruction:

• 3.Delete all documents from laptop, delete all documents from “trash bin”, restart computer.

• 4.This policy is be implemented once (1) a year.