Collection Notice

The entity collecting personal information described in this Collection Notice is:

CourseMatch collects personal information directly from students and determines the purposes and means of handling that information.

Schools may facilitate student access to the Platform, but:

• schools do not provide student personal information to CourseMatch as part of the ordinary account-creation process;
• schools do not control how CourseMatch handles information collected by CourseMatch through the Platform; and
• schools do not act as a data controller or processor in relation to CourseMatch-held student data,

except to the extent that a school refers, or purchases access for, a Student in accordance with clause 5 below.

CourseMatch collects personal information that is reasonably necessary for its functions and activities. The personal information collected may include the following.

2.1 Account Information

• name;
• personal email address;
• school email address, where registration occurs through a school;
• date of birth;
• password;
• year group, where registration occurs through a school; and
• gender, where provided optionally on a self-reported basis.

2.2 Assessment Information

• responses to personality, trait, career and course matching assessments;
• written responses entered into free-text fields; and
• progress information, including when assessment components are started and completed.

2.3 Recommendations

• results, summaries and recommendations generated through the Platform, including personality and trait summaries and interests profiles;
• recommended educational pathways;
• recommended tertiary courses and occupations; and
• account and platform activity records relating to the generation and review of recommendations.

2.4 Technical Information

• session cookie information used to keep users logged in;
• IP address, where collected for security and audit purposes for certain access methods; and
• limited system and access information necessary to operate, secure and maintain the Platform.

CourseMatch does not use advertising cookies, third-party tracking cookies or analytics cookies, and does not collect detailed behavioural data such as mouse movements or individual keystrokes.

2.5 Communications

• ratings, feedback and comments submitted through the Platform;
• enquiries and correspondence sent to CourseMatch; and
• records of support requests and related communications.

CourseMatch may collect personal information:

3.1 Directly from the individual

including when the individual:

• creates an account;
• logs into the Platform;
• completes an assessment;
• uses the dashboard or related services;
• submits feedback;
• contacts CourseMatch; or
• otherwise interacts with the Platform.

3.2 Through a school or educational institution

including where access is provided under a school licence, school trial, school referral or other school-managed arrangement.

3.3 From a parent or guardian

where that person provides information in connection with a student's use of the Platform.

3.4 Automatically

through limited technical means such as session cookies and platform security logs.

If a person provides CourseMatch with personal information about another individual, that person must ensure that the individual has been made aware of this Collection Notice.

CourseMatch collects personal information for the following purposes.

4.1 To provide and operate the CourseMatch Platform

• to create and manage user accounts;
• to verify identity and manage access;
• to deliver assessments and related platform functionality; and
• to provide user dashboards, results and recommendations.

4.2 To generate assessment outputs and recommendations

• to analyse assessment responses;
• to generate written summaries of personality, trait and career results;
• to suggest responses to study survey questions based on prior results; and
• to produce final course recommendations.

4.3 To communicate with users

• to send verification emails and password reset communications;
• to respond to enquiries, support requests and feedback; and
• to provide service-related notices and administrative communications.

4.4 To improve and develop the service

• to review how the Platform is used;
• to improve functionality, user experience and assessment processes; and
• to support service development, quality assurance and internal administration.

4.5 To meet legal and contractual obligations

• to comply with applicable laws;
• to protect the security and integrity of the Platform; and
• to enforce CourseMatch's legal rights and contractual arrangements.

CourseMatch does not use personal information for advertising, marketing or profiling unrelated to Platform functionality without separate, explicit consent. Where consent to receive marketing communications is given, it may be withdrawn at any time by using any unsubscribe facility provided in the communication or by contacting CourseMatch. CourseMatch may still send non-marketing communications, including account, security and service-related notices.

Where a Student's access to the Platform has been referred by, or purchased by, a participating school ("school-referred or school-purchased Student"), CourseMatch may make available to authorised school personnel identifiable information regarding that Student, including:

• assessment completion status;
• recommendations generated through the Platform;
• personality summaries;
• interests profiles;
• recommended educational pathways; and
• engagement information relating to the Student's use of the Platform.

This identifiable school access applies only to school-referred or school-purchased Students. It does not apply to a Student who independently created and paid for their own CourseMatch account outside of any school referral or school purchase arrangement. CourseMatch does not provide identifiable Student information to a school in respect of an independently acquired Student account.

Where a school-referred or school-purchased Student ceases to be enrolled at, or associated with, the relevant school, CourseMatch will convert that Student's information from identifiable to aggregated and de-identified form for the purposes of any ongoing school reporting.

If a Student's CourseMatch account is deleted, the corresponding personal information and assessment data are removed from CourseMatch's systems and, correspondingly, from the school's reporting access.

CourseMatch's intended minimum user age is 15 years. This age floor applies to both school-facilitated (B2B) users and direct (B2C) users of the Platform.

Where a Student accesses the Platform through a participating school (that is, as a school-referred or school-purchased Student) and is under 18 years of age, CourseMatch relies on the Student, the School and/or the Student's parent or guardian (as applicable) to ensure that appropriate authorisation has been obtained for the collection, use and disclosure of the Student's personal information, including the identifiable school access described in this clause, the AI-assisted processing described in clause 6, and the overseas disclosure described in clause 8 of this Notice. This position is consistent with the School's own consent and notification practices, which are addressed in the Parent and Guardian Notice.

Where a Student under 18 instead registers directly as a Direct User, independently of a school, CourseMatch's sign-up process requires:

• the Student to enter their details and date of birth;
• where the Student indicates they are under 18, provision of a parent or guardian email address;
• the nominated parent or guardian to review a notice addressing the use of artificial intelligence and payment, and to provide consent;
• CourseMatch to create a consent record showing the parent or guardian's email address, the notice presented, the consent action taken, and the date and time of activation, and to activate the account with notification to both the Student and the parent or guardian; and
• the Student to subsequently log in and complete assessments under their own login.

This clause should be read together with the Parent and Guardian Notice, the Privacy Policy and the Terms of Use, and any applicable Data Processing Agreement or School Agreement.

CourseMatch uses AI-assisted analysis as part of the operation of its Platform. This may include the use of personal information and assessment data to:

• generate written summaries of assessment results;
• assist with completion of survey responses based on prior inputs; and
• generate final course recommendations.

CourseMatch does not make automated decisions that have legal or similarly significant effects on users. Recommendations and outputs generated using AI are indicative only and do not determine admission, eligibility, enrolment, employment or other outcomes.

CourseMatch states in its Privacy Policy that it does not use personal information or assessment data to train artificial intelligence or machine learning models, including its own models or those of third parties.

CourseMatch may disclose personal information where reasonably necessary for the purposes described above, including to the following categories of recipients.

7.1 Service providers

CourseMatch may disclose personal information to a limited number of third-party service providers that assist in operating the Platform, including providers of:

• cloud hosting and infrastructure;
• technology systems;
• security and audit functions; and
• AI processing used to generate recommendations and summaries.

Those providers act on CourseMatch's instructions and are not permitted to use the information for their own purposes.

7.2 Amazon Web Services

CourseMatch uses Amazon Web Services (AWS) to host the Platform in the Asia Pacific (Sydney) region. Data is stored in Australia.

7.3 OpenAI

CourseMatch may disclose selected assessment responses to OpenAI through its API for the purpose of generating written summaries, suggested survey responses and final course recommendations. CourseMatch states in its Privacy Policy that OpenAI's infrastructure is located in the United States, that CourseMatch has not opted in to the use of API data for model training, and that API data may be retained by OpenAI for up to 30 days for abuse monitoring purposes before deletion. CourseMatch does not intentionally transmit directly identifying information (such as name or email address) to OpenAI for those purposes. However, free-text responses may contain identifying information.

7.4 Legal and regulatory disclosures

CourseMatch may disclose personal information where required or authorised by law, including to:

• regulators;
• government agencies;
• law enforcement bodies;
• courts or tribunals; or
• other persons where disclosure is necessary to protect rights, property or safety.

7.5 Corporate transactions

CourseMatch may disclose personal information to advisers, investors, financiers or transaction counterparties where reasonably necessary in connection with a proposed or completed investment, restructuring, financing, sale or other corporate transaction, subject to appropriate confidentiality protections.

7.6 Security

CourseMatch takes reasonable steps to protect personal information held by, or disclosed to, its service providers, including through encryption in transit and at rest, access controls, and infrastructure security measures appropriate to the nature of the data held.

CourseMatch stores its Platform data in Australia using AWS infrastructure located in Sydney.

However, selected assessment responses may be processed through OpenAI's systems in the United States for the purpose of generating written outputs and recommendations.

Accordingly, personal information may be disclosed to, or processed by, recipients located in:

• Australia; and
• the United States.

Before making such disclosures, CourseMatch takes reasonable steps to satisfy itself that the overseas recipient's handling of the information provides protections substantially similar to those required under the Australian Privacy Principles, or otherwise relies on a permitted basis for the disclosure under the Privacy Act.

By providing personal information to CourseMatch, the individual acknowledges that relevant personal information may be processed in the United States for the purposes described in this Collection Notice.

CourseMatch may create aggregated and de-identified information from personal information collected through the Platform ("Aggregated Data").

Before creating Aggregated Data, CourseMatch takes reasonable steps to remove or de-identify information capable of identifying an individual, so that no individual can reasonably be identified from the Aggregated Data.

Aggregated Data forms part of CourseMatch's own proprietary information and, subject to applicable privacy law, CourseMatch owns all rights, title and interest in Aggregated Data.

CourseMatch does not sell, rent or trade personal information to any third party, including universities, TAFEs, course providers, government bodies or advertisers.

However, CourseMatch may license, supply, publish or otherwise commercialise Aggregated Data for purposes including:

• educational benchmarking;
• workforce and labour market planning;
• tertiary education planning;
• academic and policy research;
• statistical and industry reporting; and
• other lawful commercial purposes.

Because Aggregated Data has been de-identified so that no individual can reasonably be identified, the commercialisation of Aggregated Data described in this clause is not inconsistent with CourseMatch's statement that it does not sell, rent or trade personal information. Only de-identified Aggregated Data is commercialised; identifiable personal information is not sold, rented or traded.

Aggregated Data may be supplied to organisations including:

• Australian universities;
• TAFEs and Registered Training Organisations;
• government departments and agencies;
• education authorities;
• research institutions; and
• other organisations involved in education, employment or workforce planning.

Any information supplied to these organisations under this clause will be aggregated or de-identified, unless otherwise authorised by law or with the individual's express consent.

CourseMatch states in its Privacy Policy that it retains personal information:

• while the account remains active; and
• for up to five years from the date of the individual's last active use of the Platform, or as otherwise required by law.

Where an account has been inactive for three years or more, CourseMatch may contact the user to confirm whether the account should be retained.

If an account is deleted, CourseMatch states that personal information and assessment data are removed from its systems, although anonymised and non-identifiable records, including previously created Aggregated Data, may continue to be retained for service improvement and other purposes described in this Notice.

In some circumstances, collection of personal information may be required or authorised by law, including where necessary to comply with legal obligations, lawful requests or regulatory requirements.

In most cases, provision of personal information is voluntary. However, if an individual does not provide personal information requested by CourseMatch, CourseMatch may be unable to:

• register that individual as a user;
• allow the individual to complete assessments;
• generate or display profile results, career matches or course recommendations;
• provide AI-assisted written outputs;
• reset passwords or maintain account security;
• respond to enquiries or support requests; or
• provide the Platform in full or at all.

Because CourseMatch provides account-based assessment, recommendation and dashboard services, it will generally not be practicable for individuals to deal with CourseMatch anonymously or by pseudonym. If the requested identifying information is not provided, CourseMatch may be unable to deliver the relevant services.

Under the Privacy Act 1988 (Cth), an individual may request access to, or correction of, personal information held by CourseMatch.

Requests for access or correction may be made by contacting the Privacy Officer using the details set out in clause 17.

Before responding, CourseMatch may take reasonable steps to verify the identity of the requester. CourseMatch states in its Privacy Policy that it will respond to access and correction requests within 30 days.

An individual may make a complaint if they believe that CourseMatch has handled personal information in a way that is inconsistent with the Australian Privacy Principles.

Complaints may be made by contacting the Privacy Officer using the details set out in clause 17. CourseMatch states in its Privacy Policy that it will respond to privacy complaints within 30 days.

If an individual is not satisfied with CourseMatch's response, the individual may contact the Office of the Australian Information Commissioner (OAIC) at www.oaic.gov.au.

CourseMatch may update this Collection Notice from time to time to reflect changes in its practices, services, technology, law, regulatory guidance or business operations. The current version will be made available through the website or Platform.

Any questions about this Collection Notice or the handling of personal information may be directed to: