Privacy Policy

This Privacy Policy outlines how we collect, use, disclose, and protect your personal information when you access or use our services. It also explains your rights under applicable privacy laws and how those laws safeguard your data.

By using our services, you acknowledge and agree to the collection and use of your personal information as described in this Privacy Policy. We process your data solely to deliver, maintain, and improve our services.

Interpretation and Definitions

Interpretation

In this Privacy Policy, certain terms are used to describe how we handle personal information. These definitions apply consistently throughout the document to ensure clarity and transparency.

Definitions

For the purposes of this Privacy Policy:

• Account means a unique account created for you to access our Service or parts of our Service.
• Company (referred to as either “Acenci”, “We”, “Us” or “Our” in this Agreement) refers to Acenci.
• Cookies are small files that are placed on your computer, mobile device or any other device by a website, containing the details of your browsing history on that website among its many uses.
• Country refers to: the jurisdiction of Australia
• Device means any device that can access the service including but not limited to desktop or laptop computer, cellphone, digital tablet or other mobile device.
• Personal Data is any information that relates to an identified or identifiable individual.
• Service refers to those services provided by Acenci via its website or affiliated Service Providers, as defined in this policy.
• Service Provider means any natural or legal person who processes data on behalf of Acenci. This includes third-party companies or individuals employed by Acenci to facilitate the Service, to provide the Service on behalf of Acenci, to perform services related to the Service or to assist Acenci in analyzing how the Service is used.
• Usage Data refers to data collected automatically, either by the use of the Service or from the Service infrastructure itself (for example, the duration of a page visit).
• Website includes the Acenci website accessible from www.acenci.com, and any other domain over which Acenci has direct control.
• You means any natural or legal person accessing or using the Service, or any other legal entity on behalf of which such individual is accessing or using the Service, as applicable.

Collecting and Using Your Personal Data

Types of Data Collected

Acenci provides a range of cloud-based software services as part of Acenci SaaS Platform. The types of personal information we collect may vary depending on the specific service you use and how you interact with it. In general, we collect data to enable secure access, deliver functionality, and improve user experience.

We only collect data that is necessary for the operation and improvement of our services, and we do so in accordance with applicable privacy laws.

All Acenci Services

• Full name
• Email address
• Organisation and role (if provided)
• Usage data (e.g., IP address, browser type, device information, interactions)

PointDash

• Student data (e.g. names, performance metrics, behaviour, engagement indicators)
• Student class data
• Student year level
• Student participation in school initiatives or activities

Types of Information

The Privacy Act 1998 (Cth) (Privacy Act) defines types of information, including Personal Information and Sensitive Information.

What is Personal Information?

Personal Information means information or an opinion about an identified individual or an individual who is reasonably identifiable:

1. whether the information or opinion is true or not; and
2. whether the information or opinion is recorded in a material form or not.

If the information does not disclose your identity or enable your identity to be ascertained, it will in most cases not be classified as “Personal Information” and will not be subject to this privacy policy.

This may include, but is not limited to:

• Names and email addresses
• Usernames or account identifiers
• Contact details provided during registration or support
• Any other information that relates to an identifiable person

The specific types of personal information we collect may vary depending on the services you use.

What is Sensitive Information?

Sensitive Information is defined in the Privacy Act as including information or opinion about such things as an individual's racial or ethnic origin, political opinions, membership of a political association, religious or philosophical beliefs, membership of a trade union or other professional body, criminal record or health information.

Sensitive Information will be used by us only:

1. for the primary purpose for which it was obtained;
2. for a secondary purpose that is directly related to the primary purpose; and
3. with your consent or where required or authorised by law.

What is Usage Data?

Usage data is information collected automatically when you interact with our services. It helps us understand how our systems are used and improve performance, security, and user experience. This may include:

• IP addresses and browser types
• Device information (e.g. operating system, screen resolution)
• Pages visited and time spent on each page
• Clickstream data and navigation patterns
• Error logs and diagnostic information

Usage data is typically aggregated and does not directly identify individuals, but it may be linked to user accounts in some cases for support or security purposes.

Cookies and Tracking Technologies

We use cookies and similar tracking technologies to support the functionality, security, and performance of our services. These technologies help us understand how our systems are used, maintain secure sessions, and improve the overall user experience.

We are committed to keeping tracking to a minimum. We only use what is necessary to operate our services effectively and to protect your data and our infrastructure.

Cookies are small text files stored on your device when you visit our websites. They may be used to:

• Maintain secure login sessions
• Remember user preferences
• Monitor system performance and detect issues
• Prevent fraudulent or unauthorised activity

We may also use other technologies such as web beacons, pixels, or local storage for similar purposes.

You can manage or disable cookies through your browser settings. However, please note that some features of our services may not function properly without them.

This applies to all websites operated by Acenci, including www.acenci.com, and any other domains we control.

How we collect Your Data

We may collect Personal Information from you whenever you input such information into the Website, related app or provide it to Us in any other way.

This could include:

• From schools and organisations that use Acenci services (e.g., student and class data provided by the school for PointDash).
• Directly from individuals when they register, sign in, or contact support.
• Automatically through service logs, diagnostic data, cookies and similar technologies.
• We generally don’t collect Sensitive Information, but when we do, we will comply with the preceding Sensitive Information clause (under Types of Information).
• Where reasonable and practicable we collect your Personal Information from you only. However, sometimes we may be given information from a third party, in cases like this we will take steps to make you aware of the information that was provided by a third party.

Use of Your Personal Data

We use personal data solely to deliver, maintain, and improve the services we provide. The specific ways in which your data is used may vary depending on the service you access, but generally include:

• To provide and maintain our service, including to monitor the usage of our service.
• To manage your account: to manage your registration as a user of the service. The personal data you provide can enable access to different functionalities of the service that are available to you as a registered user.
• For the performance of a contract: the development, compliance and undertaking of the purchase contract for the products, items or services you have purchased or of any other contract with us through the Service.
• To contact you: To contact you by email, telephone calls, SMS, or other equivalent forms of electronic communication, such as a mobile application’s push notifications regarding updates or informative communications related to the functionalities, products or contracted services, including the security updates, when necessary or reasonable for their implementation.
• To manage your requests: To attend and manage your requests to us.
• For business transfers: We may use your information to evaluate or conduct a merger, divestiture, restructuring, reorganisation, dissolution, or other sale or transfer of some or all of our assets, whether as a going concern or as part of bankruptcy, liquidation, or similar proceeding, in which personal data held by us about our service users is among the assets transferred.
• For other purposes: We may use Your information for other purposes, such as data analysis, identifying usage trends and to evaluate and improve our services, products and your experience. We do not use personal data for advertising, promotional campaigns, or profiling. All data is handled with strict confidentiality and in accordance with applicable privacy laws.

Acenci does not use customer data (including de‑identified or aggregated forms) for commercial purposes (e.g. advertising, market research), or training/developing AI or machine‑learning models.

We may share personal information only in the following limited circumstances:

• With sub-processors and service providers: We engage trusted third-party providers to help us deliver and support our services. These sub-processors may access limited personal data solely for the purpose of performing their contracted functions (e.g. hosting, infrastructure, security, analytics, payment processing). All sub-processors are bound by strict data protection obligations and are listed in our List of Data Sub-processors.
• With your organisation: If you access our services through an organisation, certain data may be shared with authorised administrators or privileged users within that organisation to support functionality and meet the requirements of that organisation.
• For legal compliance: We may disclose personal information if required to do so by law, regulation, or legal process, or to protect the rights, property, or safety of Acenci, our users, or others.
• In the event of a business transaction: If Acenci is involved in a merger, acquisition, or asset sale, personal information may be transferred as part of that transaction. We will notify affected users where required by law.

We take care to ensure that any sharing of personal information is limited, secure, and compliant with applicable privacy laws.

Multi-organisation accounts and data boundaries

Acenci Accounts may be associated with multiple organisations. While users can access data from each organisation they belong to, the data remains strictly segregated within each organisation's environment. Each organisation retains full control over its own data. If a user is associated with more than one organisation, and is not a personal account, the user's primary organisation governs their core identity details (such as name and email). Identity details for personal Acenci Accounts are governed by the individual user.

Users can join other organisations on invite only. Invites can be sent from Acenci Account Administrators. When inviting a user to your organisation, user information is not disclosed until the invited user accepts the invitation to join the organisation. User invitation is by user email only.

Organisations must enable multi-organisation functionality (disabled by default) before users can start joining additional organisations.

Retention of Your Personal Data

Acenci retains personal data only for as long as necessary to fulfil the purposes outlined in this Privacy Policy. This includes providing our services, maintaining account records, ensuring system integrity, and complying with legal obligations.

We may retain your personal data:

• To comply with applicable laws and regulations (e.g. financial or record keeping)
• To resolve disputes or enforce our legal agreements and policies
• To maintain service continuity and support
• Usage data, such as system logs and analytics, is generally retained for a shorter period. However, we may retain it longer when required to improve service functionality, strengthen security, or meet legal requirements.

Once personal data is no longer needed, we securely delete or anonymise it in accordance with industry best practices and applicable laws.

Transfer of Your Personal Data

Your personal information may be processed at Acenci’s operating offices and in other locations where our sub-processors or service providers are based. This means your data may be transferred to—and stored or processed on—servers located outside of your state, province, or country, including jurisdictions where data protection laws may differ from those in your own.

Primary Storage Location

Acenci primarily stores and processes personal information in Australia on secure cloud infrastructure (AWS Sydney region). We do not store user data outside Australia.

Limited Overseas Processing

In limited cases, certain technical processes involve:

• United States: Scanning of files by CrowdStrike for security purposes; payment processing by Stripe.
• Global: Network traffic routing and security services provided by Cloudflare (data in transit only).

Data Residency Options

Where supported, Acenci allows customers to choose the country in which their data is stored. This option is available to help meet organisational, regulatory, or jurisdictional requirements. If you have selected a preferred data residency location, we will take all reasonable steps to ensure your data remains within that jurisdiction.

Safeguards for Transfers

By using our services and submitting your personal information, you consent to this transfer, subject to the safeguards outlined in this Privacy Policy.

Acenci ensures that any transfer of personal data is secure and compliant with applicable privacy laws. We only transfer data to countries or organisations with adequate data protection measures in place, including contractual safeguards (where possible), encryption, and access controls.

Where data is processed outside Australia—such as files scanned for security purposes in the United States—we ensure that no personal information or file contents are retained beyond the scope of the scanning process.

If we add or relocate hosting or access to a new country, we will provide prior notice (minimum 30 days) to affected customers and update our sub‑processor and locations pages

Disclosure of Your Personal Data

We do not disclose your personal data except in limited circumstances where it is necessary, lawful, and aligned with our commitment to privacy.

Business transactions

If Acenci is involved in a merger, acquisition, or sale of assets, your personal data may be transferred as part of that transaction. Where required, we will provide notice before your data is transferred and becomes subject to a different privacy policy.

Law enforcement

Under certain circumstances, Acenci may be required to disclose personal data in response to lawful requests by public authorities, such as court orders, subpoenas, or government investigations.

Other legal requirements

We may disclose personal data in good faith when such action is necessary to:

• Comply with a legal obligation
• Protect and defend the rights or property of Acenci
• Investigate or prevent potential wrongdoing related to our services
• Protect the safety of users or the public
• Defend against legal claims or liability

All disclosures are made with careful consideration of applicable laws and the privacy rights of individuals.

Security of Your Personal Data

At Acenci, the security of your personal data is one of our highest priorities. We implement a range of technical and organisational measures to protect your information from unauthorised access, disclosure, alteration, or destruction. These include encryption, access controls, secure infrastructure, and regular monitoring.

However, no method of transmission over the internet or electronic storage is completely secure. While we strive to use commercially acceptable practices to safeguard your data, we cannot guarantee absolute security.

By using our services and consenting to this Privacy Policy, you acknowledge and agree to take reasonable steps to protect any personal data you share with Acenci, including safeguarding your account credentials and using secure networks when accessing our services.

We continuously review and improve our security practices to ensure your data remains protected in accordance with industry standards and applicable laws.

Personal data is stored in Australia on secure cloud infrastructure (AWS Sydney region). We do not store user data outside Australia.

Accessing and Correcting Your Personal Information

You have the right to request access to the personal information we hold about you and to ask us to correct it if you believe it is inaccurate, out of date, incomplete, irrelevant, or misleading. Requests to access, correct, or delete personal information are handled free of charge, unless a law permits us to charge a reasonable fee (we will notify you in advance if this applies).

To make a request, contact us at [email protected] or by mail (see “How You Can Contact Us”). We will:

• Acknowledge your request within 7 days
• Respond within 30 days (or let you know if more time is needed)

If we refuse your request, we will explain why and outline your options for further action.

How to Make a Privacy Complaint

If you have concerns about how we handle your personal information, please contact our Privacy Officer at [email protected].

We will:

• Acknowledge your complaint within 7 days
• Aim to resolve it within 30 days
• If you are not satisfied with our response, you can lodge a complaint with the Office of the Australian Information Commissioner (OAIC)

Australian Information Commissioner (OAIC)
Website: www.oaic.gov.au
Phone: 1300 363 992

Children’s Data and Parental Consent

Acenci is committed to protecting the privacy of minors who may use our services, particularly when accessed through educational institutions.

We do not knowingly collect personal information from individuals under the age of 13 without verified parental or guardian consent. If a user is a minor and is accessing our services as part of an educational institution, it is the responsibility of that institution to obtain appropriate consent from the child’s parent or guardian before submitting any personal data to Acenci.

By using our services in such contexts, institutions agree that they have secured all necessary consents in accordance with applicable laws. Acenci does not assume responsibility for obtaining or verifying this consent.

Parental Rights and Requests

If you are a parent or guardian and believe that your child’s personal information has been submitted to us without your consent, please contact us at [email protected]. We will investigate and, where appropriate, remove the data from our systems.

In jurisdictions where parental consent is required for processing a child’s personal data, we may request confirmation of that consent before collecting or using such information. We may also take reasonable steps to verify that the individual providing consent is the child’s parent or legal guardian.

Links and Third-Party Integrations

Our Services may include links to third-party websites or resources that are not operated or controlled by us. These links are provided for your convenience, but we do not endorse and are not responsible for the content, privacy practices, or security of those third-party sites.

In addition, our platform may integrate with third-party services (such as learning management systems, video conferencing tools, or payment processors) to provide certain features or functionality. When you choose to use these integrations, your information may be shared with or collected by those third parties in accordance with their own privacy policies. We encourage you to review the privacy policies of any third-party services you connect to or interact with through our platform.

As part of our commitment to data security and privacy, we apply data minimization principles to ensure that we only share the information that is strictly necessary for the integration to function properly.

Please note that we have no control over and assume no responsibility for how these third parties handle your information.

Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, services, or legal requirements. When we make material changes, we will notify you by:

• Posting the updated Privacy Policy on this page, and
• Providing a prominent notice within our Services and/or sending an email notification (where appropriate).

You will be notified of any changes to this Privacy Policy or our Terms of Service at least 28 days prior to the changes coming into effect. We require users to accept these changes. Continued use of the service after the effective date of the new version will be deemed acceptance of the updated policy.

The “Last Updated” date at the top of this page will indicate when the latest revisions were made. We encourage you to review this Privacy Policy periodically to stay informed about how we protect your information.

Any changes will become effective on the date specified in the notice, unless otherwise stated.

How You Can Contact Us

If you have any questions, concerns, or requests regarding this Privacy Policy or how we handle your personal information, you can reach us using the following details:

Email: [email protected]
Attention: Privacy Officer

For security and verification purposes, we may need to confirm your identity before responding to certain requests. We aim to respond to all inquiries within a reasonable timeframe and in accordance with applicable data protection laws.