Privacy Policy

CourseMatch Pty Ltd (ACN 693 408 409) ("CourseMatch", "we", "us" or "our") operates the CourseMatch platform, an online education technology service that assists secondary school students to better understand their interests, personality, capabilities and potential post-school education and career pathways through psychometric assessment, artificial intelligence-assisted analysis and course matching ("Platform"), including through a user's individual account within the Platform ("Account").

This Privacy Policy explains how CourseMatch collects, uses, stores and discloses personal information ("Personal Information", as defined in the Privacy Act 1988 (Cth)) in connection with the Platform and related services. Where CourseMatch collects information directly from a student, that information is referred to in this Privacy Policy as "Student Information".

CourseMatch is bound by the Privacy Act 1988 (Cth) and the Australian Privacy Principles, and is committed to handling personal information responsibly, particularly given that many Platform users are secondary school students.

This Privacy Policy applies to all users of the Platform, whether accessing the Platform directly or through a participating school, and to information derived from Platform activity which has been aggregated with information relating to other individuals and de-identified so that no individual can reasonably be identified ("Aggregated Data").

Personal Information is collected by CourseMatch Pty Ltd of PO Box 64 Nobby Beach LPO, QLD 4218, Australia. Questions about this Privacy Policy can be directed to contact@coursematch.au.

CourseMatch collects Student Information directly from students and determines the purposes and means of handling that information.

Schools may facilitate student access to the Platform. Where a school refers or purchases access to the Platform for its students, CourseMatch may provide authorised school personnel with access to identifiable Student Information for that student, where doing so supports a legitimate educational purpose such as pathway planning, subject selection or careers counselling.

Students who access the Platform independently of a school — for example, by purchasing their own access directly from CourseMatch — are not made visible to any school, regardless of the school they attend.

Where a student who has been visible to a school in this way subsequently leaves that school, the student's information is transitioned from identifiable school-level visibility to aggregate, de-identified treatment, as described further in clause 12 (Retention of Personal Information) below.

Other than the authorised access described above, schools do not provide student personal information to CourseMatch as part of the ordinary operating model, do not determine how CourseMatch otherwise handles information collected through the Platform, and do not act as a data controller or processor in relation to CourseMatch-held Student Information.

CourseMatch may collect:

• name;
• personal email address;
• school email address;
• date of birth;
• password;
• year group;
• gender, where optionally self-reported;
• assessment responses;
• personality, trait, career and course preference data;
• study pathway preferences;
• free-text responses;
• AI-generated results, summaries and recommendations;
• feedback and ratings;
• support and correspondence records;
• session cookies;
• IP address, where collected for security and audit purposes;
• parent or guardian contact details, where provided as part of the consent process for a student under 18; and
• limited technical and usage information necessary to operate and secure the Platform.

CourseMatch does not collect detailed behavioural data such as mouse movements or individual keystrokes.

CourseMatch may collect personal information:

• directly from students when they register, log in, complete assessments, submit feedback or otherwise use the Platform;
• from a parent or guardian, including as part of the consent process where a student under 18 seeks to purchase direct access to the Platform;
• through a school or educational institution, where access is facilitated, referred or purchased under a school arrangement; and
• automatically through session cookies, security logs and related technical systems.

CourseMatch collects personal information because it is reasonably necessary to operate the Platform, generate assessment results and recommendations, support authorised school access to identifiable Student Information for school-referred or school-purchased students, communicate with users, improve the Platform, and comply with CourseMatch's legal and contractual obligations. The specific uses of personal information are set out in clause 6 below.

Platform Services

• provide and operate the Platform;
• create and manage user accounts;
• verify identity and manage access;
• generate personality, trait, career and course matching outputs;
• generate AI-assisted written summaries and recommendations;
• provide authorised school personnel with reporting on identifiable Student Information for school-referred or school-purchased students;
• provide university and TAFE partner dashboards limited to high-level trend and course-planning reporting using unnamed, segmented cohorts; and
• send transactional and service-related communications.

Administration

• respond to enquiries, support requests and feedback;
• process payments in connection with direct student purchases of the Platform;
• maintain security and integrity of the Platform; and
• comply with legal, regulatory and contractual obligations.

Research and Development

• improve and develop the Platform;
• create Aggregated Data for benchmarking, research and product development; and
• support AI development, consistent with clause 7 below.

CourseMatch does not use personal information for advertising or marketing without separate, explicit consent, or for profiling unrelated to Platform functionality.

AI-Assisted Educational Services

CourseMatch uses AI-assisted analysis to generate written summaries of personality, trait and career results, to suggest responses to study survey questions based on previous results, and to produce final course recommendations.

Human Decision-Making

CourseMatch does not make automated decisions that have legal or similarly significant effects. Recommendations are indicative only and do not determine admission, enrolment, eligibility, employment or other outcomes. Students, parents and schools remain responsible for making educational decisions.

Third-Party AI Providers

To generate AI-assisted outputs, selected assessment responses may be processed through OpenAI's API using infrastructure in the United States. CourseMatch does not intentionally transmit directly identifying information (such as name or email address) to OpenAI for those purposes. However, free-text responses may contain identifying information.

AI Training

CourseMatch does not use personal information to train artificial intelligence or machine learning models, and has not opted in to OpenAI's API data being used to train OpenAI's models. CourseMatch may use Aggregated Data, once appropriately de-identified, to support AI development and product improvement, consistent with clause 9 (Aggregated and De-identified Data) below.

CourseMatch may disclose personal information where reasonably necessary to provide the Platform or comply with legal obligations. Recipients may include:

Schools

CourseMatch may disclose identifiable Student Information to authorised school personnel for school-referred or school-purchased students, for the legitimate educational purposes described in clause 2 above. CourseMatch does not disclose a student's individual assessment results or personal information to a school where the student has accessed the Platform independently of that school.

Service Providers

CourseMatch discloses personal information to service providers that assist in operating the Platform, including Amazon Web Services (cloud hosting and storage) and OpenAI (AI-assisted processing). These providers act on CourseMatch's instructions and are not permitted to use the information for their own purposes.

Professional Advisers

CourseMatch may disclose personal information to professional advisers, insurers and contractors, where reasonably necessary in connection with their engagement.

Regulatory Authorities

CourseMatch may disclose personal information where required or authorised by law, including to regulators, government agencies, law enforcement bodies, courts or tribunals.

Corporate Transactions

CourseMatch may disclose personal information in connection with a proposed or completed investment, restructuring, financing, sale or other corporate transaction, subject to appropriate confidentiality controls.

CourseMatch does not sell, rent or trade personal information to any third party, including universities, TAFEs, course providers or advertisers. Only Aggregated Data that has been appropriately de-identified may be commercialised, as described in clause 9 below.

Creation

CourseMatch may create Aggregated Data from Student Information and Platform activity. Before Aggregated Data is created, CourseMatch takes reasonable steps to remove or de-identify information capable of identifying an individual student.

Ownership

Aggregated Data, once de-identified, forms part of CourseMatch's proprietary datasets. Subject to applicable law, CourseMatch owns all rights, title and interest in Aggregated Data.

Permitted Uses

• product improvement;
• AI development;
• benchmarking;
• educational research;
• workforce planning;
• labour market analysis;
• higher education planning;
• policy development;
• statistical reporting; and
• commercial analytics and business intelligence.

Commercialisation

CourseMatch may, subject to applicable privacy law, licence, sell, supply, publish or otherwise commercialise Aggregated Data, provided the information has been appropriately de-identified and no individual can reasonably be identified. No identifiable personal information is sold, rented or traded under this clause.

Universities and Government

Aggregated Data may be supplied to Australian universities, TAFEs, Registered Training Organisations, Government departments and agencies, education authorities and research institutions, for high-level trend and course-planning reporting using unnamed, segmented cohorts (for example, by region or sector), rather than named schools. Outputs below a minimum cohort threshold are suppressed or merged into an "Other" category before being shown, to reduce the risk of re-identification.

Dashboards made available to universities, TAFEs and other education partners may draw on Aggregated Data derived from both students who access the Platform through a participating school (Institutional/B2B users) and students who register and purchase access to the Platform directly (Direct/B2C users), once that information has been aggregated and de-identified in accordance with this clause. No individual school, individual student, or the B2C/B2B source of any reported output is identified to a university, TAFE or other education partner.

CourseMatch stores Platform data in Australia using Amazon Web Services (AWS) infrastructure located in Sydney. However, selected assessment responses may be processed through OpenAI's systems in the United States for the purpose of generating AI-assisted written outputs and recommendations.

Before disclosing personal information overseas, CourseMatch takes reasonable steps to satisfy itself that the overseas recipient's handling of the information provides protections substantially similar to those required under the Australian Privacy Principles, or otherwise relies on a permitted basis for the disclosure under the Privacy Act 1988 (Cth).

CourseMatch takes reasonable steps to protect personal information from misuse, interference, loss and unauthorised access, modification or disclosure. Those measures include, at the date of this policy:

• encryption in transit and at rest;
• access controls and role-based restrictions;
• authentication controls;
• infrastructure hosted within Amazon Web Services (AWS);
• monitoring and logging; and
• reasonable service provider safeguards appropriate to the nature of the information held.

Retention Principles

CourseMatch retains personal information for as long as the relevant account remains active, and for up to 5 years from the user's last active use of the Platform, unless a longer period is required or authorised by law. Where an account has been inactive for a prolonged period, CourseMatch may contact the user before taking steps to delete or anonymise the account.

Student Accounts

For a school-referred or school-purchased student, the school's identifiable access to that student's information ends once the student is recorded as having left the school — either on 31 December of the year the student leaves, or when the school marks the student as having left — following which the student's information converts from identifiable school-level visibility to aggregate, de-identified treatment.

School Trial Data

Student Information collected during a school trial is retained on the same basis as other Student Information collected through the Platform, and remains subject to the Data Processing Agreement (CM-02) entered into with the relevant school.

Legal Retention

CourseMatch may retain personal information for longer than the periods described above where required or authorised by law, including for the purposes of legal claims, audits or regulatory compliance.

A user may delete an account at any time from within the Platform or by contacting contact@coursematch.au. CourseMatch will process deletion requests within 30 days, subject to any lawful basis for retention.

Where a student deletes their account, CourseMatch removes the student's personal information and assessment data from CourseMatch's systems and, correspondingly, from any school portal to which that data had been made accessible.

CourseMatch uses cookies only for essential session management and Platform functionality, as described in the Cookie Policy (CM-07).

CourseMatch does not use personal information for marketing or advertising without separate, explicit consent. Where consent to receive marketing communications has been given, it may be withdrawn at any time by using any unsubscribe facility provided in the communication, or by contacting contact@coursematch.au. CourseMatch may still send non-marketing communications, including account, security and service-related notices.

Intended Users

CourseMatch is intended for secondary school students aged 15 years and over.

School Participation

Where the Platform is accessed through a school, the school is responsible for managing access and for obtaining any parental or guardian consents required under its own policies. CourseMatch provides supporting documentation, including the Collection Notice and the Parent and Guardian Notice, to assist schools in satisfying their own governance requirements.

Parent and Guardian Information

Where a student under 18 seeks to purchase direct access to the Platform, the student must provide a parent or guardian's email address. The parent or guardian is presented with a notice, including information about AI-assisted processing and payment, and must provide consent before the account is activated. CourseMatch maintains a consent record showing the parent or guardian's email address, the notice presented, the consent action taken, and the date and time of activation.

Requests for access to, or correction of, personal information held by CourseMatch may be made to:

CourseMatch aims to respond within 30 days.

Privacy complaints may be made using the contact details set out in clause 17 above. CourseMatch aims to respond within 30 days. If a person is not satisfied with CourseMatch's response, that person may contact the Office of the Australian Information Commissioner at www.oaic.gov.au.

CourseMatch may update this Privacy Policy from time to time, including to reflect changes in law, regulatory guidance, technology, AI practices, service features or business operations. If a material change is made, notice may be given by email, a Platform notice or website update.

If you have any questions about this Privacy Policy, please contact us:

This Privacy Policy operates alongside the other documents in the CourseMatch document suite. In the event of any inconsistency:

• the Collection Notice (CM-05) governs point-of-collection disclosures and prevails over this Privacy Policy for that purpose;
• this Privacy Policy (CM-04) governs broader handling, storage, access, correction, complaints and retention practices, and prevails over the Terms of Use (CM-06) and the Cookie Policy (CM-07);
• the Data Processing Agreement (CM-02) and School Trial Agreement (CM-01) govern the contractual relationship between CourseMatch and a school, with the Data Processing Agreement prevailing over the School Trial Agreement for privacy, security, breach-response and Student Information handling matters; and
• the Parent and Guardian Notice (CM-08) supplements this Privacy Policy where a student's access is facilitated by a school.