Policy and Procedure: Privacy Policy
This Privacy Policy and Procedure sets out how Presbyterian Ladies College (hereafter named “The College”) manages personal information provided to or collected by it. It is based on the advice provided in the Privacy Compliance Manual, published by the National Catholic Education Commission and Independent Schools Australia, 2025.
The College is bound by the Australian Privacy Principles (APP) contained in the Commonwealth Privacy Act 1988. In relation to health records, the College is also bound by the New South Wales Health Privacy Principles, which are contained in the Health Records and Information Privacy Act 2002 (Health Records Act).
This Privacy Policy does not apply to the College's treatment of an employee record held by the College, where the treatment is directly related to a current or former employment relationship between the College and the employee
The College may, from time to time, review and update this Privacy Policy to take account of new laws and technology, changes to the College’s operations and practices, and to make sure it remains appropriate to the changing College environment. The current version of this Privacy Policy is published on our website
Policy and Procedure Owner:
Executive Team
Kinds of Personal Information Collected
1. Personal information means any information or opinion, whether true or not, and whether recorded in material form or not, about an identified individual or an individual who is reasonably identifiable. Personal information does not include information that is properly de-identified Personal information includes health information and sensitive information.
2. Sensitive information is a subset of personal information. Sensitive information includes information or an opinion about an individual's race, gender diversity, sexual orientation or practices, disability, ethnic origin, political opinions, religious or philosophical beliefs and affiliations, and criminal record, in circumstances where that information is also personal information. Sensitive information includes health information about an individual, genetic information and biometric information or templates. Sensitive information is generally given a higher level of privacy protection than other types of personal information
3. Health information means any personal information that is also information or an opinion about, or in relation to, an individual's health (including an illness or injury) or disability, or health services provided to an individual, and includes an individual's expressed wishes regarding the future provision of health services. Health information includes information about an individual's genetic information that is, or could be, predictive of the future health of the individual or their genetic relative, and also includes health identifiers
4. The type of personal information we collect about you will depend on the dealings you have with us.
Students
5. Before, during and after the course of a student’s enrolment at the College, the College may collect the following personal information about a student from the student or their parent and/or guardian (Parents), or from another individual who the Parent has authorised to provide information to us:
○ name, contact details (including next of kin), date of birth, gender, language background, previous education and religion
○ language spoken at home, nationality and country of birth
○ health information (e.g. details of disabilities and/or allergies, dietary requirements, absence notes, immunisation details, medical reports and names of doctors)
○ data needed to identify a student
Page 3 of 14
○ student reports, certificates, results of assignments, tests and examinations
○ conduct and complaints records, or other behaviour notes, and College reports
○ information about referrals to government welfare agencies
○ counselling reports
○ health fund details, government identifiers (such as health identifiers) and Medicare number
○ any court orders
○ volunteering information
○ photos and videos at or in connection with College events.
6. We may also collect the following information about Parents, from Parents:
○ contact details
○ education history
○ occupation
7 We may also collect the following information from individuals who apply for paid or volunteer positions with or in connection with the College, and contractors, including:
○ name, contact details (including next of kin), date of birth, and religion
○ information provided in the individual's job application and any interview or related conversation
○ professional development history
○ salary and payment information, including superannuation details and tax file number
○ health information (e.g. details of disability and /or allergies, and medical certificates)
○ complaint records and investigation reports
○ criminal history, Working with Children Checks
○ leave details
○ photos and videos at College events
○ workplace surveillance information
○ work emails and private emails (when using a work email address), and internet browsing history
8 We collect personal information of other people who come into contact with the College, including name and contact details and any other information necessary for the particular contact with the College
Page 4 of 14
How We Collect Personal Information
Personal Information You Provide
9. The College will generally collect personal information held about an individual directly from the individual (or their Parent in the case of students). This includes, by way of forms filled out by Parents or students, face-to-face meetings and interviews, emails, in-person or online interactions and telephone calls.
Personal Information Provided by Other People
10. In some circumstances, the College may collect personal information about an individual from a third party, for example, a report provided by a medical professional, a reference from another school or a referee for a job applicant. If a student transfers to the College from a previous school, the College may collect personal information about the student from the student’s previous school to facilitate the transfer of the student
Personal Information from Other Sources
11 We may also collect personal information through surveillance activities (such as CCTV security cameras), monitoring of student emails and staff emails (using work email addresses), and internet browsing history on devices supplied by the College and/or using the College's WiFi network.
12 When you visit our website, we may also use 'cookies' or other similar tracking technologies. A cookie is a small file placed in your web browser that collects information about your web browsing behaviour. The use of cookies allows a website to tailor its configuration to your needs and preferences. Cookies do not access information stored on your computer or any personal information (e.g. name, address, email address or telephone number) Most web browsers automatically accept cookies, but you can choose to reject cookies by changing your browser settings. This may, however, prevent you from taking full advantage of our website
13. We may also use software such as JavaScript on our website. JavaScript may collect information about the pages you view on our website, how you navigated to the page and how long you remain on the page. While you may disable the software through your internet browser, it can change the formatting and layout of the website, making it difficult to read.
14. Whilst we do not use this type of browsing information to identify you personally, we may record certain information about your use of our website, such as which pages
Page 5 of 14
you visit, the time and date of your visit, search engine referrals and the internet protocol address assigned to your computer
15. Our web pages may contain electronic images, known as web beacons. These electronic images enable us to count users who have visited certain pages on our website. Web beacons are not used by us to access your personal information; they are simply a tool we use to analyse which web pages are viewed, in an aggregate number.
Personal Information we collect from Artificial Intelligence (AI) systems
16. AI system means a machine-based system that, for explicit or implicit objectives, infers, from the input it receives, how to generate outputs such as predictions, content, recommendations, or decisions that can influence physical or virtual environments. Different AI systems vary in their levels of autonomy and adaptiveness after deployment. An AI system may include generative AI, but not all AI is generative. An AI system may be the ensemble of several components, including one or more AI models, that is designed to be particularly useful to humans in some way
17. We may collect personal information from AI systems if these systems generate or infer personal information about you, and the particular AI system has been assessed and approved by us as meeting the security standards required for handling and managing Personal Information in accordance with Australian Privacy Principles
18. If AI systems are used to generate or infer personal information about you, we will only generate or infer personal information about you that is reasonably necessary for our functions or activities, and only by lawful and fair means The College will manage your personal information obtained by this method in accordance with the APPs and this Privacy Policy
Purposes for Which We Collect, Use and Disclose Personal Information
19 We will use and/or disclose your personal information for the purpose for which we collected it (the primary purpose). We may also use and/or disclose your personal information for a different purpose if:
● the different purpose is related (or for sensitive information, directly related) to the purpose for which we collected the information, and you would reasonably expect us to use/disclose the information in this way
● you have provided consent, or
● we are required or authorised by law to use/disclose your personal information in this way. Page 6
Students and Parents
20 In relation to personal information of students and Parents, the College's primary purpose of collection is to enable the College to provide education to the students. This includes satisfying the needs of parents, the needs of the student and the needs of the College throughout the whole period the student is enrolled at the College.
21. The purposes for which the College uses personal information of students and Parents include:
● providing education and education-related activities, including using personal information in AI systems for educational purposes
● to meet government funding reporting requirements
● satisfying the needs of Parents, the needs of students and the needs of the College throughout the whole period a student is enrolled at the College
● making mandatory reports to government authorities
● recording student attendance and participation in activities
● keeping Parents and the College community informed about matters related to the relevant student's education and performance, through correspondence, apps, newsletters and magazines
● day-to-day administration of the College
● looking after students' educational, physical, social, spiritual and health wellbeing
● satisfying the College's legal obligations and allowing the College to discharge its duty of care
● providing first aid to students and related care
● updating and maintaining our class or year group list, sporting list, activity list or College directory
● maintaining the safety of the College campus and online environment
● ensuring compliance with College policies and procedures
● investigating incidents or complaints.
22. We may also use the information we collect in aggregated and de-identified forms to improve our services, including:
● quality assurance activities
● administering our website, or
● producing reports and analytics.
Page 7 of 14
Job Applicants And Contractors
23 In relation to personal information of job applicants and contractors, the College's primary purpose of collection is to assess and (if successful) engage the applicant or contractor, as the case may be
24. The purposes for which the College uses personal information of job applicants and contractors include:
● administering the individual's employment or contract, as the case may be
● for insurance purposes
● seeking donations for the College, and
● to satisfy the College's legal obligations, for example, in relation to child protection legislation
Volunteers
25. The College obtains personal information about volunteers who assist the College in its functions or conduct associated activities for the following purposes:
● to contact you about, and administer, the volunteer position
● for insurance purposes, and
● satisfying the College's legal obligations, for example, in relation to child protection legislation.
AI Systems
26 The College will not use any personal information you provide to train, develop, or improve any artificial intelligence (AI) or machine learning systems. Your data is not and will not be used in this way
Marketing And Fundraising
27 The College treats marketing and seeking donations for the future growth and development of the College as an important part of ensuring that the College continues to provide a quality learning environment in which both students and staff thrive. Personal information held by the College may be disclosed to organisations that assist in the College's fundraising, for example, the College's Foundation or alumni organisation or, on occasions, external fundraising organisations.
28. Parents, staff, contractors, and other members of the wider College community may, from time to time, receive fundraising information
29. College publications, like newsletters and magazines, which include personal information, may be used for promotional and marketing purposes
30. The College ensures that all direct marketing communications set out clear ‘opt-out' provisions.
31. On occasions, information such as academic and sporting achievement, student activities and similar news may be published in College newsletters and magazines and on our website and social media sites, such as Facebook and Instagram This may include photographs and videos of activities such as sporting events and achievements, concerts and plays, College camps and College excursions The College will obtain consent from the student’s parents or guardians prior to publication of such material However, the College Year Book and Aurora Australis will contain the name and image of each student, and it is not possible to exempt any student from these printed publications
To Whom We Disclose Personal Information
32 We do not, and will not, sell your personal information to third parties
33. The College may disclose personal information for educational, care and administrative purposes, and to seek support, services and advice. This may include disclosure to:
● other schools and teachers at those schools, to facilitate the transfer of a student or their participation in an exchange program
● government departments (including for funding and policy purposes)
● medical practitioners
● people providing educational, support, health services and related services to the College, including specialist visiting teachers, counsellors, volunteers and coaches
● providers of specialist advisory services and assistance to the College, including in the area of Human Resources, child protection, students with additional needs and for the purpose of administering Google Apps for Education and ensuring its proper use
● providers of learning and assessment tools
● artificial intelligence systems, in accordance with paragraph 27
● assessment and educational authorities, including the Australian Curriculum, Assessment and Reporting Authority (ACARA) and National Assessment Program – Literacy and Numeracy (NAPLAN) test Administration Authorities (who will disclose it to the entity that manages the online platform for NAPLAN)
● agencies and organisations to whom we are required to disclose personal information for education, funding and research purposes
Page 9 of 14
● people providing administrative and financial services to the College
● the provider of our information management and storage system and other information technology services
● recipients of College publications, such as newsletters and magazines
● anyone to whom you authorise the College to disclose information, and
● anyone to whom we are required to disclose the information by law, including child protection laws.
What Happens If You Do Not Provide Us with Your Personal Information
34. If you choose not to provide us with some or any of your personal information, we may not be able to provide our services to you, provide you with access to our latest technology, facilitate your full engagement with the College, or offer you employment or volunteer opportunities (as applicable)
35. A student's enrolment may be delayed or prevented if the College cannot collect certain personal information. This is particularly so where the information is relevant to the health and safety of the student, other students and/or staff.
Dealing With Us Anonymously Or Using A Pseudonym
36. Where practical and lawful, you may interact with us anonymously or by using a pseudonym For example, if you contact us with a general question or wish to make an anonymous complaint.
37. However, for many of our functions and activities, we usually need your name, contact information and other details as notified from time to time. We need to be able to properly identify our students and staff.
How We Store Personal Information
38 We store your personal information in hard copy and electronically We use information management and storage systems provided by third-party service providers. Personal information is stored with and accessible by the third-party service providers for the purpose of providing services to the College in connection with the systems.
39 The College may use online or ‘cloud’ service providers to store personal information and to provide services to the School that involve the use of personal information. See further the section below ‘Sending and storing information overseas ’
40. We retain your personal information for as long as needed to provide services to you and as otherwise necessary to comply with our legal obligations, resolve disputes and enforce our agreements.
10 of 14
Sending and Storing Information Overseas
41. The College may disclose personal information about an individual to overseas recipients, for instance, to facilitate a student exchange
42. The College may also use online or ‘cloud’ third-party service providers to store personal information and to provide services to the College that involve the use of personal information, such as services relating to email, instant messaging and education and assessment applications. Some limited personal information may be provided to these service providers to enable them to authenticate users who access their services and provide technical support. This personal information may be stored in the ‘cloud’, which means that it may reside on a cloud service provider’s server, which may be situated outside Australia, including in the USA and other countries where privacy protections may be less stringent than in Australia
43. An example of such a cloud service provider is Google. Google provides the Google Apps for Education (GAFE) service, including Gmail, and stores and processes limited personal information for this purpose. It holds information in a number of countries outside of Australia, including the USA and other countries where privacy protections may be less stringent than in Australia College personnel and the Association of Independent Schools (AIS) and its service providers may have the ability to access, monitor, use or disclose emails, communications (e g instant messaging), documents and associated administrative data for the purposes of administering GAFE and ensuring its proper use
44. The College uses AI systems that are provided by third parties. These third parties may store or have access to personal information input into, and/or generated by, these AI systems. These third parties may be located outside Australia.
Management and Security of Personal Information
45. The College's staff are required to respect the confidentiality of students’ and Parents’ personal information and the privacy of individuals.
46 The College has in place steps to protect the personal information the College receives from misuse, interference and loss, unauthorised access, modification or disclosure by use of various methods, including locked storage of paper records and password access rights to computerised records.
Data Breach
11 of 14
47 In the event we discover there has been actual or suspected unauthorised access to, disclosure, or use of your personal information (a Data Breach), we will investigate and take reasonable steps to mitigate the consequences of the breach
48. We are required under the Privacy Act to notify the Office of the Australian Information Commissioner and impacted individuals about certain data breaches
Access And Correction Of Personal Information
49 We endeavour to ensure the personal information we collect from or about you is up-to-date, accurate and complete.
50. Under the Commonwealth Privacy Act (and the Health Records Act), an individual has the right to seek access to, and/or correction of, any personal information which the College holds about them. Students will generally be able to access and update their personal information through their Parents, but students over the age of 15 with the capacity and maturity to understand and make privacy decisions may seek access and correction themselves
51. There are some exceptions to these rights set out in the applicable legislation.
52. To make a request to access or update any personal information the College holds about you or your child, you may contact the Privacy Officer by emailing: privacyofficer@plc.nsw.edu.au.
53 The College may require you to verify your identity and specify what information you require. The College may charge a reasonable fee to cover the cost of verifying your application and locating, retrieving, reviewing and copying any material requested If the information sought is extensive, the College will advise the likely cost in advance. Subject to any applicable exceptions or requirements, we will provide you with access to the personal information you request within a reasonable time, and usually within 28 days.
54 If we decide to refuse your request, we will provide you with written notice explaining the reasons for refusal (unless, in light of the grounds for refusing, it would be unreasonable to provide reasons) and how to complain
55. The College may, at its discretion, on the request of a student, grant that student access to information held by the College about them, or allow a student to give or withhold consent to the use of their personal information, independently of their Parents. This would normally be done only when the maturity of the student and/or the student's personal circumstances warrant it.
Page 12 of 14
Date of Change
September 2025
Reason for Change
AIS Privacy Compliance Manual updated and AI included
Page 14 of 14