Privacy Policy

1. About this policy

ROCKHAWK PTY LTD (ABN 17 673 537 123) trading as RTEO ("we", "us") provides websites, online enrolment technology and related services to Australian training organisations. This policy explains how we handle personal information when you visit our website, contact us, register interest in an offer, make a payment, or use our services.

We handle personal information in two different roles, and which one applies changes what this policy means for you:

• Our own. Where we collect information about our own customers, enquirers, website visitors and contacts, we are the entity responsible for it. This policy describes that.
• On a training provider's behalf. Where a training provider uses RTEO to run its enrolments, its website or its contact records, that provider decides what information it needs and how it is used, and it is the entity responsible for it. We process that information on the provider's instructions. Our Data Processing Agreement describes that arrangement, and the provider has its own privacy policy that governs it.

If you submitted information to a training provider through its enrolment form, that provider's privacy policy applies to it, and that provider is who to contact first.

2. Information we collect

Depending on how you interact with us, we collect:

• Contact details, including your name, email address and telephone number.
• Organisation details, position, business name and ABN where supplied or selected from the Australian Business Register.
• Enquiry and campaign responses, such as your current student management system, enrolment volumes, migration plans, preferred start date and messages.
• Account, workspace, support and correspondence records.
• Billing information, transaction references, payment status and subscription details. Card and bank account details entered in Stripe Checkout are handled by Stripe; we do not store your full card number or bank account number.
• Technical information such as IP address, browser and device details, security logs and interactions with our website.

When providing services to a training organisation, we also process the learner, booking and other information that organisation supplies or asks us to collect. That is described in clauses 3 and 4 and in the Data Processing Agreement. Avoid including sensitive information in a general enquiry message.

3. Sensitive information

Some information has extra protection under the Privacy Act 1988 (Cth), including information about health, disability, racial or ethnic origin, religious beliefs, political opinions, sexual orientation and criminal record. The Act generally requires consent before it is collected, under Australian Privacy Principle 3.3.

We do not seek sensitive information about you for our own purposes. We do not ask for it on our website, in an enquiry form or in a consultation booking, and we ask you not to send it to us that way.

We do process sensitive information on behalf of training providers. Where a training provider runs its enrolments on RTEO, the fields its form can collect include Aboriginal or Torres Strait Islander status, disability status and disability type. Health information can reach us where the provider has built its own question or declaration that asks for it. Identity documents a student uploads may also reveal sensitive information.

In every one of those cases the training provider is the entity collecting the information. Obtaining the student's consent, or identifying the exception the provider relies on under APP 3.3, is the provider's responsibility, as is telling the student what is collected and why. We store and process it on the provider's instructions, treat it as private-class data throughout, and never use it for our own purposes.

4. Unique Student Identifiers and student records

Where a training provider runs its enrolments on RTEO, the information we process on its behalf includes the Unique Student Identifier (USI) and the student fields an RTO collects for its AVETMISS reporting, such as date of birth, gender, country of birth, Aboriginal or Torres Strait Islander status, citizenship or residency status, disability status, language spoken at home, prior educational achievement and labour force status. It may also include an identity document the student uploads.

How we handle a USI. A USI is personal information, and the Student Identifiers Act 2014 (Cth) restricts how it may be collected, used and disclosed. We handle a USI only on the training provider's behalf and on its instructions: we receive it as an answer on the provider's enrolment form, hold it as part of that enrolment record, and pass it to the provider's own student management system where the provider has connected one. We do not keep a separate register of student identifiers, do not use a USI for any purpose of our own, and do not disclose it to anyone other than systems the provider has connected.

We check the format of a USI. We do not verify it. We check that what has been typed has the shape of a USI: ten characters from the restricted alphabet the USI scheme uses. That is the whole of the check. We do not connect to the USI Registry, do not verify a USI against it, and do not confirm that a USI has been issued or that it belongs to the person who entered it. Verification with the Registry is the training provider's own responsibility.

Reporting is the provider's. We do not produce AVETMISS files, do not submit data to NCVER or to any state or territory training authority, and do not connect to any NCVER system. Where the provider's enrolment form shows the student privacy notice from the National VET Data Policy, we reproduce the published notice with the provider named as the collecting RTO; the provider completes the parts that are its own to write.

5. How we collect information

We collect information from you through forms, account settings, enquiries, support requests and payment interactions. We may receive information from an authorised representative of your organisation, connected systems you authorise, our payment provider and public business registers.

Our website uses cookies and similar technologies for functions such as maintaining sessions and preferences. On public marketing pages, if you choose to allow analytics, we use Google Analytics 4 for aggregate page views and closed-set funnel events such as form steps and successful enquiries. This installation does not send form values, names, email addresses, telephone numbers or submission receipts to Google. If you reject or later withdraw analytics consent, this installation is disabled and its analytics cookies are removed where we can identify them. Browser controls can restrict or remove cookies, although doing so may affect sign-in and other features. Our Cookie Policy describes this in full.

A training provider's own tags are not ours. A provider using RTEO may install its own measurement and advertising tags, such as Google Tag Manager, Google Analytics 4, Google Ads, a Meta Pixel or a Bing UET tag, and may choose to fire them on its enrolment pages. Those tags are the provider's own collection, sent to the vendor the provider chose. We do not control, receive or store what they collect. If you are a student and you want to know what tracking runs on an enrolment form, ask the training provider whose form it is.

6. Why we use information

We use information to respond to enquiries, assess and prepare requested services, maintain customer records, administer offers, process payments, provide support, secure the service and meet legal obligations.

A campaign submission preserves your answers at the time of your enquiry. Relevant information may also be recorded against your contact record to support follow-up. Payment status is linked to the relevant onboarding or service record.

Where you request or consent to updates, we may contact you about relevant services. You can ask us to stop promotional contact at any time using the contact details below or an unsubscribe option where provided. Essential service and payment communications may still be necessary.

We do not train AI models on your information. We do not use personal information, customer content or enrolment data to train, fine-tune or otherwise alter the weights of any AI model, whether our own or a third party's, and we do not permit our providers to. We do keep de-identified operational records about how the platform is used, such as event logs, counts, timings, error records and performance metrics, to run, secure and improve the service. Those records do not contain personal information, and clause 8 of the Data Processing Agreement describes them and their limits.

7. Automated decision-making

From 10 December 2026, Australian Privacy Principles 1.7 to 1.9, introduced by the Privacy and Other Legislation Amendment Act 2024, require a privacy policy to describe automated decision-making where personal information is used in a computer program to make, or to do something substantially and directly related to making, a decision that could reasonably be expected to significantly affect an individual's rights or interests.

For our own purposes, we do not do this. We do not use a computer program to make a decision about you that significantly affects your rights or interests. We do not profile or score enquirers, we do not automatically decide whether to offer or refuse a service, and we do not make automated decisions about credit, employment or eligibility for anything.

The platform does run automated rules for training providers, and those rules are the provider's. Where a training provider builds an enrolment form on RTEO, the form can apply rules the provider configures, which use what a person enters to decide what happens next. In particular:

• a minimum age check compares the date of birth entered against the minimum age the provider has set, and can prevent an enrolment from proceeding;
• conditional rules the provider writes can determine which questions are asked, which declarations appear, whether a person is treated as eligible for a funded place, and whether a payment is required.

These rules are configured by the training provider, run on the provider's form, and produce a result the provider is responsible for. We supply the mechanism; we do not set the rule, and we do not decide who may enrol. The training provider is the entity accountable for those decisions and for describing them in its own privacy policy. If a decision of this kind has affected you, ask the training provider whose form you used to explain it and to review it.

AI features do not decide anything about a person. Our AI features generate drafts of marketing and course content and make suggestions to a customer's staff. They do not assess, rank, score or decide anything about an individual, and their output is a draft a person reviews.

We will update this clause if this changes, and in any event we will review it before 10 December 2026.

8. Who receives information

We share information where needed with personnel and service providers supporting hosting, data storage, communications, payment processing, security and the services you request. Stripe processes payments. If you choose to book a consultation, Calendly processes the details you enter there.

For customer workspaces, authorised integrations may exchange information with the customer's student management system or other connected services. AI features may process information according to the customer's configuration and the applicable Data Processing Agreement. The DPA subprocessor schedule identifies every provider we use for workspace services, what it receives and where it processes it.

We do not sell personal information, and we do not disclose it for another organisation's own marketing.

We may also disclose information where required or permitted by law, or to investigate misuse and protect people, systems and legal rights.

9. Overseas disclosure, and the countries involved

Some of the providers we use operate outside Australia. Under Australian Privacy Principle 1.4, we tell you where they are likely to be located.

Australia. The primary database, file storage and authentication (Supabase, on Amazon Web Services), our application servers (Vercel, pinned to Sydney), and the AI models used in Australia-only processing mode are all in Australia. Those models are reached by calling AWS Bedrock in Sydney through an Australian geographic inference profile. Because our calls are made from an Australian region, that profile can serve them only from Sydney or Melbourne and from nowhere else. AWS states that prompts and outputs may also be stored in the region that served them, for abuse detection; for our calls that region is Australian either way. A workspace's database region is fixed at Australia and cannot be moved.

The United States. The overseas country our providers are most likely to be located in is the United States. Providers whose published location is the United States include Anthropic, OpenAI, Google and Perplexity for AI processing reached through Vercel AI Gateway, and our error monitoring provider. Stripe processes payments from Australia and the United States, as it publishes.

Other countries. Some providers, including our AI gateway, our SMS delivery provider, our keyword and search data providers, and our consultation booking provider, operate from multiple locations and publish the regions they use rather than a single country. Where that is so we rely on the location the provider publishes, and it is not practicable for us to specify a single country. Our email delivery provider holds message content and delivery logs outside Australia, including in the United States, whichever sending region is used, and we do not claim otherwise. Schedule 2 of the Data Processing Agreement names each provider and states what it publishes, and we update it when a location changes.

What this means for a workspace. A training organisation using RTEO chooses an AI processing mode for its workspace. In Australia only mode, information about students and contacts is processed by AI models in Australia and a call that cannot be served from Australia is refused rather than sent overseas. In Global mode, that information may also be processed by the providers named above in the United States. That choice is the training organisation's, and clause 5 of the DPA explains it, including what Australia only mode turns off.

An Australian hosting location does not mean every connected service processes information only in Australia. Contact us if you need details about a particular service before submitting information.

10. Security and retention

We use access controls and other technical and organisational safeguards to protect personal information, described in Schedule 3 of the Data Processing Agreement. Files containing personal information, including identity documents, are held in private storage that is not publicly readable. We do not hold a formal security certification such as ISO 27001 or SOC 2, and we do not claim one. No internet service can guarantee absolute security.

We retain information for the purposes described in this policy, including service delivery, support, accounting, legal obligations and dispute handling. Retention depends on the type of record and the applicable requirements. When information is no longer needed and retention is not required, we delete or de-identify it. Customer workspace retention and deletion arrangements, including what a deletion actually removes and what it does not, are set out in Schedule 4 of the Data Processing Agreement.

11. Access and correction

You can contact us to request access to, or correction of, personal information we hold about you. We may need to verify your identity and clarify your request. Where access or correction is restricted by law, we will explain the reason where permitted.

For learner information controlled by a training provider, contact that provider first. We do not answer the substance of a student's request about a provider's workspace: we will tell you who the responsible organisation is and pass the request to them promptly. We can assist the provider with requests relating to information processed through our service.

12. Privacy questions and complaints

Use our contact form, call 1800 697 836, or write to RTEO, 53 Barry Rd, Campbellfield VIC 3061. Please identify your request as a privacy enquiry and describe the information or event concerned.

We will assess your complaint and respond within a reasonable period. If you are not satisfied with our response, you may contact the Office of the Australian Information Commissioner, where it has jurisdiction. The OAIC generally asks you to raise your complaint with the organisation first.

13. Updates and related documents

We may update this policy as our services or obligations change. Each version carries a version number and an effective date at the top of this document, and the version published at this address is the version in force. Material changes affecting existing services will be communicated where required.

Read our Terms of Service, Acceptable Use Policy, Data Processing Agreement, Cookie Policy and Website Terms of Use alongside this policy.

This policy describes what we do. It is not legal advice, and it does not tell a training organisation whether it meets its own obligations under the Privacy Act 1988 (Cth), the Student Identifiers Act 2014 (Cth) or any other law that applies to it.