Your Privacy Matters

1. About This Policy

Sky Network Pty Ltd ("we", "us", "our") operates SchoolWeb ("the Service"), a platform that provides school websites, content management, and operational tools for Australian schools.

This Privacy Policy explains how we collect, use, disclose, and safeguard personal information in accordance with the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs).

2. Information We Collect

2.1 School and Staff Data

When schools register and use SchoolWeb, we collect:

• School profile and configuration details (school name, branding, domain)
• Staff and administrator identity data (name, email, role)
• Account credentials (passwords are securely hashed and never stored in plain text)
• Billing information (processed securely via Stripe)

2.2 Website Content

Content created and managed by school staff through the platform includes:

• Pages, posts, events, newsletters, and media uploads
• Documents uploaded to the document hub
• Canteen menus, theme and navigation configuration data

2.3 Student and Parent Data

Schools may store student and parent information as part of their day-to-day operations. The data categories collected are determined by each school's configuration and policies.

• Identity and contact information entered by authorised school users
• Participation data from enabled modules (events, canteen, house points)
• Parent and student portal account credentials

Important: We do not collect sensitive information such as health records, religious beliefs, or government identifiers unless a school explicitly configures a module to do so. Schools are responsible for ensuring appropriate consent is obtained before entering sensitive data.

2.4 Usage Information

We automatically collect limited technical information to operate and secure the Service:

• Device type and browser information
• IP address (used for security purposes and anonymised for analytics)
• Pages visited and features used within the platform

3. How We Use Your Information

We use collected information to:

• Provide, operate, and maintain SchoolWeb services for each school
• Authenticate users and enforce role-based access controls
• Process subscription payments and manage billing
• Send essential service communications (account updates, security notices)
• Detect and investigate suspicious activity and secure platform operations
• Improve product reliability, performance, and features
• Comply with legal obligations under Australian law

We do not sell, rent, or trade personal information to third parties for marketing purposes. We do not serve advertisements to school users. We do not use school or student data to build advertising profiles.

4. AI Features

SchoolWeb includes optional AI-assisted features (content writing, AI chatbot, page generation). When AI features are used:

• Student personal information is excluded from AI provider requests
• No student records are stored on external AI platforms
• AI processing is configured so school data is not used for provider model training
• AI outputs are assistive only — school staff are responsible for reviewing and approving all AI-generated content before publication

Schools can disable AI features entirely through their administrator settings.

4.1 Self-Hosted AI Infrastructure

SchoolWeb is a self-hosted platform. When schools deploy SchoolWeb on their own infrastructure, the school is responsible for configuring AI provider connections, API credentials, and any associated data processing arrangements.

Schools that enable AI features are responsible for:

• Selecting AI providers that meet their data processing and privacy requirements
• Configuring AI provider settings in accordance with school and education department policies
• Ensuring any required data processing agreements are in place with their chosen AI providers
• Reviewing AI provider data retention and training policies
• Communicating AI use to staff, students, and parents as required by school policy

SchoolWeb's software is designed to minimise the data sent to AI providers — student personally identifiable information is excluded from AI requests where possible, and only the content necessary to generate the requested response is transmitted. However, the school's choice of AI provider and infrastructure determines the ultimate data processing and retention behaviour.

4.2 Automated Decision-Making

SchoolWeb does not use automated decision-making to make significant decisions about individuals. AI features are assistive tools that generate suggestions for staff review — no content is published, and no decisions about students are made, without human approval. SchoolWeb will comply with the automated decision-making transparency requirements under the Privacy and Other Legislation Amendment Act 2024 as they take effect.

5. Cross-Border Data Processing

SchoolWeb is hosted in Australia. Some third-party services we use (such as AI providers and payment processors) may process limited data outside Australia. Where this occurs:

• Student personal information is excluded from overseas processing
• We select service providers with strong privacy, security, and contractual commitments
• Data shared with overseas providers is limited to the minimum necessary to deliver the specific service

6. Data Security

We implement layered, industry-standard security measures to protect your data:

• Encryption in Transit: All connections to SchoolWeb use HTTPS/TLS
• Encryption at Rest: Stored data is encrypted using industry-standard controls
• Access Controls: Role-based permissions limit data access to authorised users only
• Secure Authentication: Passwords are stored as salted cryptographic hashes and are never recoverable in plain text
• Regular Backups: Automated backups are maintained to support data recovery in the event of an incident

For detailed information about our security controls, see our Security Policy.

7. Data Storage and Location

Your data is stored on secure servers located in Australia. By keeping primary data within Australia, we support compliance with Australian privacy laws and education department data residency requirements.

8. Data Sharing and Disclosure

We may share information only in the following circumstances:

• School Staff: Data is accessible to authorised school administrators and staff based on their assigned roles
• Service Providers: Trusted third parties who help us operate the Service (payment processing via Stripe, transactional email delivery, hosting infrastructure). These providers are bound by confidentiality obligations and are not permitted to use data for their own purposes
• Legal Requirements: When required by applicable law, court order, or government authority request

We do not sell, rent, or trade personal information to any third party for commercial or marketing purposes, under any circumstances.

9. Data Breach Notification

In accordance with the Notifiable Data Breaches (NDB) scheme under Part IIIC of the Privacy Act 1988, we will:

• Notify affected schools as soon as practicable after becoming aware of an eligible data breach, and no later than 30 days after the breach is identified
• Provide details of the breach including the types of information involved, what happened, and recommended steps individuals should take
• Notify the Office of the Australian Information Commissioner (OAIC) where required
• Cooperate with affected schools so they can meet their own notification obligations to students, parents, and staff

Schools are encouraged to report suspected data incidents to [email protected] as soon as possible.

10. Data Retention and Export

• Active Subscriptions: Data is retained and accessible while the school subscription remains active
• After Cancellation: School data is retained for 90 days after cancellation to allow for data export and recovery, then securely and permanently deleted
• Billing Records: Transaction and billing records are retained for 7 years as required by Australian taxation law

Data Export and Portability

Schools can request a full export of their data at any time. Exports include:

• All page, post, event, and document content in standard formats (JSON, CSV)
• Media files and uploaded documents
• Student and parent records, canteen transaction history, and house point data
• User accounts and role assignments

Export requests are fulfilled within 30 days. Schools can also contact us at [email protected] to request early deletion or to discuss specific export requirements.

11. Your Rights

Under the Australian Privacy Principles, individuals have the right to:

• Access: Request a copy of personal information we hold about you
• Correction: Request that inaccurate or incomplete information be corrected
• Deletion: Request deletion of your personal information (subject to any legal retention requirements)
• Complaint: Lodge a complaint with us directly, or with the Office of the Australian Information Commissioner (OAIC)

For school-managed data — such as student and parent records entered by school staff — the school is the first point of contact, as they are the controller of that data. We will cooperate fully with schools to fulfil individual rights requests.

12. Children's Privacy

SchoolWeb is provided to schools as an institutional platform. We do not knowingly collect personal information directly from children. Student data is entered and managed solely by authorised school staff.

Parental Consent

Schools are responsible for:

• Obtaining informed parental or guardian consent before entering student personal information into SchoolWeb, in accordance with the Privacy Act 1988 and any applicable state or territory education privacy frameworks
• Ensuring parents are informed about what data is collected, how it is used, and who can access it before student accounts are created
• Obtaining explicit opt-in consent before publishing identifiable student content (such as photos, names, or work samples) on public-facing pages of the school website
• Providing parents with the ability to withdraw consent and request deletion of their child's data through the school

Parents and guardians may contact their school directly to exercise rights relating to their child's data. We will cooperate fully with schools to fulfil these requests.

A downloadable consent template is available for schools at Consent Declaration Template.

Children's Online Privacy Code

We are monitoring the development of the OAIC Children's Online Privacy Code, which is expected to be registered by December 2026. SchoolWeb will update its practices to comply with the Code's requirements when it takes effect.

Child Safe Standards

SchoolWeb is designed to support schools in meeting their obligations under the National Principles for Child Safe Organisations and applicable state and territory Child Safe Standards. The platform incorporates safeguards including role-based access controls, explicit opt-in consent for publishing identifiable student content, no advertising or social features, and school-controlled AI settings.

13. Cookies

We use cookies and similar technologies for the following purposes only:

• Authentication — to keep you signed in securely across sessions
• Session management — to maintain your state while using the platform
• Interface preferences — to remember display settings

We do not use cookies for advertising, cross-site tracking, or behavioural profiling. No data collected via cookies is sold or shared with advertising networks.

14. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, legal requirements, or service features. Material changes will be published on this page with a revised "last updated" date. Where changes materially affect how we handle school or student data, we will notify affected schools directly.

15. Contact Us

For privacy enquiries, access requests, or complaints, please contact us at:

If you are not satisfied with our response to a privacy complaint, you may contact the Office of the Australian Information Commissioner (OAIC):

Terms of Service | Security Policy