Privacy Policy

This Privacy Policy explains how [Legal entity name] (ABN [ABN]) (“Attainly”, “we”, “us”) handles personal information in connection with the Attainly platform (the “Service”). We handle personal information in accordance with the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs).

Attainly is used by Registered Training Organisations (RTOs) to recognise prior learning, build course content, and maintain training materials. When an RTO uses the Service, the RTO is responsible for the personal information of its students, and Attainly processes that information on the RTO’s behalf. For questions about how a particular RTO uses your information, contact that RTO.

Information we collect

Depending on your role, we may collect:

• RTO account information — organisation name, ABN, RTO number, contact details, and the names, email addresses, and roles of RTO staff (admins, assessors, enrolment officers).
• Student information — full name, date of birth, email, phone, Unique Student Identifier (USI), Victorian Student Number (VSN) where applicable, employer and job title.
• Evidence and assessment information — documents uploaded as evidence (certificates, transcripts, references, portfolios, images), text extracted from those documents, self-assessment responses, free-text descriptions, assessor decisions and notes, and generated RPL documents.
• Billing information — subscription plan and status. Card and payment details are collected and stored by our payment processor, not by Attainly.
• Technical information — log data and audit records of actions taken in the Service (used for security and to meet ASQA audit requirements).

How we collect it

We collect most information directly from the RTO and its staff when they create records and upload materials, and from students when they submit evidence or complete a self-assessment. Some information (such as qualification structures) is drawn from training.gov.au.

Why we use it

• To provide the Service — creating student records and RPL cases, producing AI-assisted mapping recommendations, generating gap analyses, assessment plans, and formal RPL documents.
• To support the assessor — recommendations are advisory only; a qualified assessor makes every final assessment decision.
• To maintain a complete, tamper-evident audit trail required for ASQA compliance.
• To administer subscriptions and provide support.
• To keep the Service secure and prevent misuse.

AI processing

To produce mapping recommendations and draft content, evidence text and qualification data are processed by a third-party artificial-intelligence provider. Recommendations are a decision-support tool only; they do not constitute an assessment decision. We do not permit this information to be used to train third-party AI models beyond what is necessary to return a result. [Confirm the AI provider’s data-handling terms and name them here].

When we disclose information

We do not sell personal information. We disclose it only:

• To service providers who help us operate the Service — hosting and database, payment processing, and email delivery — under obligations of confidentiality and security.
• To the RTO that owns the relevant records.
• To regulators, auditors, or law-enforcement bodies where required or authorised by law (for example, an ASQA audit).
• Where you have consented, or as otherwise permitted under the Privacy Act.

Storage, security, and overseas processing

Information is stored in our hosted database and file storage. Data is encrypted in transit, access is restricted, tenant data is isolated at the database level, and administrative actions are logged. Some service providers may store or process information outside Australia (for example, in [hosting region(s)]). We take reasonable steps to ensure overseas recipients handle information consistently with the APPs.

How long we keep it

Assessment records must be retained to meet VET regulatory requirements — generally at least 30 years for records that evidence a qualification outcome, and otherwise as required by ASQA and applicable law. Where a student withdraws consent, the RTO can permanently delete that student’s evidence, extracted text, self-assessment, mapping output, and generated documents through the Service; the procedural audit trail (who did what, and when — without evidence content) is retained.

Accessing and correcting your information

You can ask to access or correct the personal information we hold about you. Students should contact their RTO in the first instance. Other requests can be directed to us at [privacy contact email]. We will respond within a reasonable period.

Complaints

If you believe we have mishandled your personal information, contact us at [privacy contact email]. If you are not satisfied with our response, you can contact the Office of the Australian Information Commissioner (OAIC) at oaic.gov.au.

Changes to this policy

We may update this policy from time to time. The “last updated” date above shows when it last changed.

Contact

[Legal entity name], [registered address], [privacy contact email].