Acceptable Use Policy

1. What this policy is

This Acceptable Use Policy ("this policy") sets out what the RTEO platform may and may not be used for. It is published by ROCKHAWK PTY LTD (ABN 17 673 537 123) trading as RTEO ("we", "us").

This policy forms part of the RTEO Terms of Service and is incorporated into them. Accepting those Terms is accepting this policy. Words defined in the Terms of Service have the same meaning here, including "the Customer", "you", "your Input", "AI Output" and "End User".

This policy applies to you and to every person who accesses RTEO under your workspace. You are responsible for their compliance with it.

Why it is a separate document. This policy protects the platform, other customers and End Users, and sometimes has to be tightened quickly, for example when a new kind of misuse appears. Keeping it outside the Terms of Service means it can be updated on its own terms under clause 4 below rather than waiting out the 28 days' notice that a material change to the Terms of Service requires.

2. General rules

You must not use RTEO to:

• break the law, or help anyone else break it;
• infringe anyone's intellectual property, privacy, confidentiality, moral or other rights;
• upload or process content you have no right to upload or process;
• do anything a regulator, a court or a law has told you not to do.

3. Platform integrity and security

You must not:

• upload or transmit malicious code, or anything designed to disrupt, damage or gain unauthorised access to a system;
• attempt to gain unauthorised access to RTEO, to another customer's workspace, to a workspace or account you were not given, or to any system RTEO connects to;
• probe, scan or test the vulnerability of the platform, or defeat or attempt to defeat any authentication, authorisation, rate limiting or other security measure, except under a written authorisation from RTEO;
• interfere with the operation of the platform, including by placing an unreasonable load on it, circumventing rate limits or usage limits, or scraping it in bulk;
• use the platform, its interfaces or its output to build, train or improve a competing product, or to benchmark it for publication without RTEO's prior written consent;
• resell, sublicense or provide the platform to a third party as a service, except to the extent your order expressly permits it;
• remove, obscure or alter a proprietary notice in the platform; or
• share a single account between multiple people, or give a credential to someone who is not entitled to it.

If you believe you have found a security vulnerability in RTEO, tell us through the support channels published in the application. Reporting a vulnerability in good faith, and not exploiting it or accessing anyone else's data, is not a breach of this policy.

4. Content rules

You must not use RTEO to create, store, publish or send content that:

• is unlawful, defamatory, harassing, threatening, or incites violence or hatred against a person or a group;
• is sexual material involving a minor, or is otherwise material RTEO would be required to report or remove;
• is deceptive about who you are, what you are registered to deliver, or what a qualification is;
• makes a claim about training outcomes, employment outcomes, funding eligibility, recognition or accreditation that you cannot substantiate;
• misrepresents the scope of your registration, the qualifications you are approved to issue, or your status as a Registered Training Organisation; or
• would breach the Australian Consumer Law, including by being misleading or deceptive or likely to mislead or deceive.

5. AI-specific rules

RTEO generates content, recommendations and analysis using AI models. You must not:

• present AI Output as something it is not, where doing so would mislead a student, an enquirer, a regulator, an auditor or the public. This includes presenting generated text as an independently verified statement, as a human assessor's judgement, or as evidence of a process that did not happen;
• use AI Output as evidence of compliance, of assessment validation, of a trainer's judgement, or of anything a standard requires a person to do, without the human review and sign-off those obligations require;
• publish AI Output about fees, funding, entry requirements, duration, delivery mode, work placement or qualification outcomes without checking it against your own approved information first;
• instruct the platform to generate content that impersonates a real person or organisation, or that passes itself off as another training organisation's material;
• deliberately route private-class data to a processing mode your own privacy obligations do not permit, or use a workspace setting to evade a commitment you have made to a student or a regulator; or
• attempt to extract, reverse-engineer or reconstruct RTEO's prompts, model routing, or another customer's data from AI Output.

Two things about AI Output are worth stating plainly, because they change what careful use looks like. AI Output can be wrong. And AI Output is not unique: the same platform generates work for organisations that compete with you, as clause 8.6 of the Terms of Service explains. Review before you publish.

6. Communications with students and enquirers

RTEO sends email and SMS to the people you tell it to. You must not use it to:

• send a commercial electronic message to a person who has not consented to receive it, where the Spam Act 2003 (Cth) requires consent;
• send a message without a clear and accurate sender identification and a working unsubscribe facility, where the Spam Act 2003 (Cth) requires one;
• continue contacting a person who has asked you to stop;
• upload a contact list you did not collect yourself, or that you are not permitted to use for the purpose you are using it for; or
• send a message that breaches the Do Not Call Register Act 2006 (Cth) or any other law about unsolicited contact that applies to you.

Consent, notice and record-keeping for these messages are yours, not RTEO's. RTEO is the means by which the message is sent, not the sender.

7. Personal information, student records and identifiers

You are the APP entity for the personal information in your workspace, and the Data Processing Agreement governs RTEO's role in processing it. In addition:

• do not upload personal information you have no lawful basis to hold, or that you collected for a purpose that does not extend to what you are now doing with it;
• do not put sensitive information, a Unique Student Identifier, a date of birth, a government identifier or an identity document into a free text field, a chat message, a support ticket, a brand or content prompt or any other part of the platform that is not the enrolment field built to hold it;
• do not use a Unique Student Identifier for any purpose other than one the Student Identifiers Act 2014 (Cth) permits, and do not disclose one to a person or system not entitled to receive it;
• do not upload an identity document, such as a passport or a driver licence, unless you need it for a purpose you have told the person about and you have their consent where the law requires it; and
• do not use RTEO to enrich, profile, resell or otherwise exploit personal information beyond the purpose for which the person gave it to you.

8. Third-party systems you connect

Where you connect a third-party system to your workspace, such as a student management system, a website, an advertising or analytics tag, or a search console property, your use of that system remains subject to your own agreement with its provider. You must not use RTEO to do anything through it that your agreement with that provider prohibits, and you must hold the rights and permissions the connection needs.

Tags you install are yours: what they collect, from whom, and on which pages is your decision and your disclosure to make, as clause 9.5 of the Terms of Service explains.

9. What happens if this policy is breached

Where RTEO reasonably believes this policy has been breached and the breach presents a risk to the platform, to another customer, or to a person, RTEO may suspend a workspace or an individual's access. Where we suspend, we will tell you why and, where the breach can be fixed, what would resolve it. A serious or repeated breach is a material breach of the Terms of Service and may lead to termination under clause 16.2 of those Terms.

Where a law requires RTEO to preserve, disclose or report something, RTEO will do what the law requires.

Nothing in this clause obliges RTEO to monitor your workspace, to review your content, or to detect a breach. RTEO does not do so as a matter of course, and the absence of action is not approval.

10. Changes to this policy

RTEO may update this policy. Each version carries a version number and an effective date at the top of this document. The version published at this address is the current version, and it is in force from its effective date.

Because this policy protects the platform, other customers and End Users, a change to it takes effect without the 28 days' notice that clause 4.1 of the Terms of Service requires for a material change to those Terms. Where a change would make something you are already doing unacceptable, RTEO will tell you and give you a reasonable period to stop doing it before treating it as a breach.

11. Questions

Raise a question about this policy through the support channels published in the application, or through RTEO's contact form.

This policy describes what RTEO requires of you. It is not legal advice, and it does not tell you whether you meet your own obligations under the Spam Act 2003 (Cth), the Privacy Act 1988 (Cth), the Student Identifiers Act 2014 (Cth), the Australian Consumer Law, the Standards for RTOs, or any other law that applies to you. Get your own advice on that.