Privacy Policy

Klasmate is a web-based student and centre management platform operated by IT Paradise Digital Solutions ("we", "us", or "our"). This Privacy Policy explains how we collect, use, store, disclose, and protect personal information in connection with the Klasmate platform ("Service").

We are committed to handling personal information in accordance with the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs). Because our Service stores information about students who may be minors, we apply a higher standard of care to all data we hold.

This policy applies to:

Klasmate operates as a data processor on behalf of Centres, who are the data controllers responsible for obtaining appropriate consent from students and guardians before entering their information into the platform.

• Education centre operators and their authorised staff ("Centres") who subscribe to and use the Klasmate platform.
• Students enrolled at those Centres whose records are entered into the platform.
• Guardians and parents whose contact information is stored in connection with a student record.

We use personal information solely to deliver and operate the Klasmate Service. Specific uses include:

We do not use student or guardian data for marketing, profiling, advertising, or any purpose beyond operating the Service. We do not sell, rent, or trade any personal information to third parties.

• Displaying student and guardian records to authorised Centre staff.
• Generating class timetables and managing enrolment capacity.
• Sending SMS notifications to guardians on behalf of Centres (pickup alerts, absence notifications).
• Authenticating Centre staff and maintaining access security.
• Investigating and resolving technical issues or support requests.

We limit disclosure of personal information to the following:

We may disclose personal information if required to do so by law, court order, or a regulatory authority, or if we believe in good faith that disclosure is necessary to protect the safety of any person.

We implement appropriate technical and organisational measures to protect personal information against unauthorised access, alteration, disclosure, or destruction. These include:

While we take reasonable steps to protect personal information, no system is completely secure. We encourage Centres to use strong passwords and to report any suspected unauthorised access promptly.

• Encrypted data transmission (HTTPS/TLS) for all platform communications.
• Firebase Authentication for access control, with password hashing enforced.
• Role-based access control: Centre staff can only access records belonging to their own Centre.
• Audit logging of administrative actions within the platform.

We retain personal information for as long as a Centre's subscription is active. Upon termination or cancellation of a subscription:

Centres may request early deletion of their data at any time by contacting us in writing.

• The Centre's data remains accessible for 30 days following the termination date to allow for data export.
• After 30 days, all student, guardian, and Centre data is permanently deleted from our systems.
• Backup copies may persist for up to a further 30 days before being purged from backup storage.

The Klasmate platform stores records relating to students who may be under 18 years of age. We treat this data with additional care:

Centres are responsible for ensuring they have obtained appropriate consents from guardians before uploading student information to the platform.

• We do not collect any more information about students than is necessary to operate the class scheduling and notification features.
• We do not display student records to any party other than the authorised staff of the Centre that enrolled them.
• We do not conduct any profiling, behavioural analysis, or data aggregation involving student records.
• We do not transfer student data to any third party other than the SMS gateway (first name and guardian phone number only) as described in Section 5.1.

Guardians and students who wish to access, correct, or request deletion of their personal information held within the platform should contact the Centre directly. Centres are the data controllers and are responsible for managing these requests.

Centres who wish to access, correct, or delete their own account data or their students' records may do so through the platform interface or by contacting us at the details below. We will respond to verified requests within 30 days.

In the event of a data breach that is likely to result in serious harm, we will:

• Notify affected Centres as soon as practicable, and no later than 72 hours after becoming aware of the breach.
• Notify the Office of the Australian Information Commissioner (OAIC) where required under the Notifiable Data Breaches scheme.
• Provide guidance on steps Centres and guardians can take to protect themselves.

By using Klasmate, Centres acknowledge that data stored on Google Firebase may be processed in data centres located outside Australia as part of Google's global infrastructure.

We have taken steps to ensure that such transfers comply with the requirements of the Privacy Act 1988 (Cth), including by relying on Google's standard contractual obligations and data processing commitments.

We may update this Privacy Policy from time to time. Where changes are material, we will notify Centres by email or through the platform at least 14 days before the changes take effect.

Continued use of the Service after that date constitutes acceptance of the updated policy.

If you have any questions, concerns, or complaints about this Privacy Policy or our handling of personal information, please contact:

IT Paradise Digital Solutions

Platform: Klasmate

Email: it@mobile360.cc

If you are not satisfied with our response, you may contact the Office of the Australian Information Commissioner (OAIC) at www.oaic.gov.au.