Purpose and Policy Statement

The purpose of the Policy is to outline the Privacy policy and expectations of all Toorak College staff and families[cite: 8]. The policy covers Toorak College and its related entities “the School” which includes all of our School, Foundation and representative associations[cite: 8].

Toorak College is bound by the Australian Privacy Principles contained in the Commonwealth Privacy Act[cite: 10]. In relation to health records, the School is also bound by the Victorian Health Privacy Principles which are contained in the Health Records Act 2001 (Vic)[cite: 11].

The School may review and update this policy to take account of new laws, technology, and changes to School operations[cite: 12]. We will notify you of changes by communication on the School website[cite: 13].

Collection of Information

The School collects personal information, including health and other sensitive information, about[cite: 14, 15]:

• Students and parents and/or guardians (‘Parents’) before, during and after the course of a student’s enrolment at the School[cite: 16];
• Job applicants, staff members, volunteers and contractors[cite: 17]; and
• Other people who come into contact with the School[cite: 18].

Personal Information You Provide

The School will generally collect personal information directly from you unless it is unreasonable or impracticable to do so[cite: 20]. This occurs via forms, face-to-face meetings, interviews, telephone calls, SMS, emails, and online activity on the School website or social media[cite: 21].

Information Provided by Other People

In some circumstances, the School may collect information from a third party[cite: 24]. Examples include[cite: 25]:

• Reports provided by medical professionals[cite: 27];
• References from other Schools[cite: 28];
• Security checks through public registers[cite: 29];
• Requests through associated professional advisors[cite: 30].

Child Information Sharing Scheme (CISS) & Family Violence Information Sharing (FVIS)

Under the Child Wellbeing and Safety Act (2005) and related regulations, the School enables the sharing of confidential information between authorised organisations to promote a child’s wellbeing or safety[cite: 35, 36].

As an information sharing identity (ISE), Toorak College can share or seek information from another ISE without the consent of the child or their family where it is relevant to safety and wellbeing[cite: 37, 38]. Wherever appropriate and safe, the views of the child and/or parents will be sought[cite: 39].

Website Activity & Cookies

The School utilizes cookies to help your browser navigate the website and deliver a more user-friendly service[cite: 42, 45]. Cookies remember preferences, such as language and region, and allow you to rate pages[cite: 49, 50]. Most browsers accept cookies by default, but you can adjust settings to reject them[cite: 51].

The School also uses Google Analytics to identify and store anonymous statistics such as IP address, browser version, and operating system[cite: 53, 54, 57]. This is used for system administration and research only[cite: 58].

Use of Personal Information

The School uses personal information for the primary purpose of collection, or related secondary purposes you would reasonably expect[cite: 64, 65].

Students and Parents

The primary purpose is to enable the School to provide schooling for the student[cite: 67]. This includes[cite: 69]:

• Keeping parents informed about schooling matters via correspondence and newsletters[cite: 70];
• Day-to-day administration[cite: 71];
• Looking after educational, social, and medical well-being[cite: 72];
• Seeking donations and marketing[cite: 73];
• Satisfying legal obligations and duty of care[cite: 74].

Staff, Job Applicants, and Contractors

The primary purpose is to assess and engage the individual[cite: 79]. This includes administering employment, insurance/WorkCover purposes, and satisfying legal obligations such as child protection legislation[cite: 80, 81, 83].

Disclosure of Information

The School may disclose personal information to[cite: 94, 95]:

• Other Schools and government departments[cite: 96, 97];
• Medical practitioners[cite: 98];
• Specialist visiting teachers, counsellors, and sports coaches[cite: 101];
• Recipients of School publications[cite: 104];
• Anyone you authorise or as required by law[cite: 105].

Management and Security

The School stores personal information in paper and electronic form[cite: 110]. We protect information from misuse, interference, loss, and unauthorised access via locked storage and password access rights[cite: 112]. Information may be stored with third-party cloud providers[cite: 113]. Some information may be stored overseas, and the School will use contractual arrangements to ensure providers take appropriate protective measures[cite: 114, 116, 118].

Access, Updating, and Rights

Individuals have the right to obtain access to personal information held by the School and advise of any perceived inaccuracy[cite: 126]. To make a request, please contact the School in writing[cite: 129]. The School may charge a fee to cover the cost of verifying your application and retrieving material[cite: 131].

Consent given by parents/guardians will be treated as consent on behalf of the student[cite: 137]. Access may be denied where it would have an unreasonable impact on the privacy of others or result in a breach of the School’s duty of care[cite: 139].