Privacy Policy

Australian Privacy Principle 1 – Open and transparent management of personal information

Purposes for information collection, retention, use and disclosure

WAATA retains a record of personal information about all individuals with whom we undertake any form of business activity. WAATA must collect, hold, use and disclose information from our clients and stakeholders for a range of purposes, including but not limited to:

• Providing services to clients;
• Managing employee and contractor teams;
• Conducting internal business functions and activities; and
• Requirements of stakeholders.

As a Registered Training Organisation (RTO), WAATA is regulated by the Training Accreditation Council (TAC) and is required to collect, hold, use and disclose a wide range of personal and sensitive information on participants in nationally recognised training programs.

Unique Student Identifiers (USIs)

As a Registered Training Organisation (RTO), WAATA is required under the Student Identifiers Act 2014 to collect and verify a Unique Student Identifier (USI) for all students undertaking nationally recognised training and assessment, unless an exemption applies.

WAATA collects USIs to:

• Meet Commonwealth legislative requirements;
• Report nationally recognised training activity;
• Issue Statements of Attainment and Qualifications;
• Enable students to access and manage their training records through the national USI system; and
• Verify student identity where required for training administration purposes.

WAATA takes reasonable steps to protect USI information from unauthorised access, use, disclosure, modification or loss. Access to USI information is restricted to authorised personnel who require access to perform their duties.

WAATA may disclose USI information where authorised or required by law, including to:

• The Student Identifiers Registrar;
• The National Centre for Vocational Education Research (NCVER);
• Commonwealth and State Government departments and agencies;
• Regulatory authorities; and
• Other organisations authorised under the Student Identifiers Act 2014.

Further information regarding the collection, use and disclosure of USIs is available from the USI Office at https://www.usi.gov.au.

This information requirement is outlined in the National Vocational Education and Training Regulator Act 2011 and associated legislative instruments. In particular, the legislative instruments:

• Student Identifiers Act 2014;
• Standards for Registered Training Organisations (RTOs) 2025; and
• Data Provision Requirements 2012.

It is noted that WAATA is also bound by various State Government Acts requiring similar information collection, use and disclosure (particularly Education Act(s), Vocational Education & Training Act(s) and Traineeship & Apprenticeships Act(s) relevant to state jurisdictions of WAATA operations).

It is further noted that, aligned with these legislative requirements, WAATA delivers services through a range of Commonwealth and State Government funding contract agreement arrangements, which also include various information collection and disclosure requirements.

Disclosure of Training and Assessment Information

As a Registered Training Organisation, WAATA may be required to collect, use and disclose student information to meet its legislative, regulatory, contractual and reporting obligations.

Depending on the nature of the training being undertaken, personal information may be disclosed to:

• The National Centre for Vocational Education Research (NCVER);
• The Student Identifiers Registrar;
• The Training Accreditation Council (TAC);
• Commonwealth, State and Territory Government departments and agencies;
• Funding bodies and contract managers;
• Apprenticeship and Traineeship support organisations;
• Employers or workplace supervisors where authorised by the student or required by a training contract;
• WorkSafe Western Australia and other licensing authorities for the administration of High-Risk Work Licence training and assessment activities;
• Third-party service providers engaged to support training, assessment or student administration activities; and
• Other organisations where disclosure is authorised or required by law.

Such disclosures are undertaken only where reasonably necessary to deliver training services, comply with legislative or contractual obligations, issue qualifications or statements of attainment, maintain regulatory compliance, or support student outcomes.

Kinds of personal information collected and held

The following types of personal information are generally collected, depending on the need for service delivery:

• Contact details;
• Employment details;
• Educational background;
• Demographic Information;
• Course progress and achievement information; and
• Financial billing information;
• Unique Student Identifier (USI) information;
• CCTV images and recordings collected at WAATA facilities and training locations;

The following types of sensitive information may also be collected and held:

• Identity details;
• Employee details & HR information;
• Complaint or issue information;
• Disability status & other individual needs;
• Indigenous status;

Where WAATA collects personal information of more vulnerable segment of the community (such as children), additional practices and procedures are also followed. Please refer to WAATA’s Working with Children Policy and Procedures for further information.

How personal information is collected

WAATA’s usual approach to collecting personal information is to collect any required information directly from the individuals concerned. This may include the use of forms (such as registration forms, enrolment forms or service delivery records) and the use of web based systems (such as online enquiry forms, web portals or internal operating systems).

WAATA does receive solicited and unsolicited information from third party sources in undertaking service delivery activities. This may include information from such entities as:

• Governments (Commonwealth, State or Local);
• Australian Apprenticeships Centres;
• Employers (and their representatives), Job Network Providers, Schools, Guardians; and
• Service providers such as credit agencies and background check providers.

How personal information is held

WAATA’s usual approach to holding personal information includes robust storage and security measures at all times. Information on collection is:

• As soon as practical converted to electronic means;
• Stored in secure, password protected systems, such as financial system, student management system; file storage and
• Monitored for appropriate authorised use at all times.

Only authorised personnel are provided with login information to each system, with system access limited to only those relevant to their specific role. WAATA stores information using a combination of secure cloud-based and locally managed systems. Reasonable steps are taken to ensure all systems incorporate appropriate security controls including password protection, multi-factor authentication, encryption, access controls, monitoring and backup processes.

Destruction of paper-based records occurs as soon as practicable in every matter, through the use of secure shredding and destruction services at all WAATA sites.

Individual information held across systems is linked through a WAATA allocated identification number for each individual.

Retention and Destruction of Information

WA Advanced Training Academy (WAATA) retains personal information only for as long as necessary to fulfil its legal, regulatory, contractual and operational obligations.

Student information is primarily stored electronically within WAATA’s secure Student Management System (aXcelerate) and associated authorised business systems. Access to student records is restricted to authorised personnel and protected through appropriate security controls.

In accordance with the Standards for Registered Training Organisations (RTOs), student records relating to nationally recognised training, including Statements of Attainment and Qualifications issued, are retained for the period required by legislation and regulatory requirements. Certain records may be retained permanently where required to meet these obligations.

Where personal information is no longer required and there is no legal requirement to retain it, WAATA will take reasonable steps to securely destroy or de-identify the information in accordance with its records management and privacy procedures.

Paper-based records containing personal information are digitised where appropriate and securely stored or destroyed using approved secure disposal methods. Disposal of records is undertaken in a manner that protects the privacy and confidentiality of individuals.

In the event that WAATA ceases operations as a Registered Training Organisation, student records required by legislation will be transferred to the appropriate regulatory authority or designated repository in accordance with applicable legislative and regulatory requirements.

Accessing and seeking correction of personal information

WAATA confirms all individuals have a right to request access to their personal information held and to request its correction at any time. In order to request access to personal records, individuals are to make contact with:

WAATA Compliance Manager / Privacy Officer

08 92506022

admin@waata.com.au

The Compliance Manager acts as WAATA’s nominated Privacy Officer and is responsible for overseeing privacy compliance, data breach management and privacy-related enquiries.

A number of third parties, other than the individual, may request access to an individual’s personal information. Such third parties may include employers, parents or guardians, schools, Australian Apprenticeships Centres, Governments (Commonwealth, State or Local) and various other stakeholders.

In all cases where access is requested, WAATA will ensure that:

• Parties requesting access to personal information are robustly identified and vetted;
• Where legally possible, the individual to whom the information relates will be contacted to confirm consent (if consent not previously provided for the matter); and
• Only appropriately authorised parties, for valid purposes, will be provided access to the information.

Complaints about a breach of the APPs or a binding registered APP code

If an individual feels that WAATA may have breached one of the APPs or a binding registered APP Code, they should refer to the Privacy Complaints Procedure contained within this policy.

Likely overseas disclosures

Personal information may be stored, processed or backed up in overseas jurisdictions through approved cloud-based service providers. WAATA takes reasonable steps to ensure such providers maintain privacy, confidentiality and security protections consistent with Australian privacy requirements.

Making our APP Privacy Policy available

WAATA provides our APP Privacy Policy available free of charge, with all information being publicly available from the Privacy link on our website at www.waata.com.au/privacy. This website information is designed to be accessible as per web publishing accessibility guidelines, to ensure access is available to individuals with special needs (such as individuals with vision impairment).

In addition, this APP Privacy Policy is:

• Prominently displayed at WAATA’s premises;
• Included within our RTO Handbook;
• Noted within the text or instructions at all information collection points (such as informing individuals during a telephone call of how the policy may be accessed, in cases where information collection is occurring); and
• Available for distribution free of charge on request, as soon as possible after the request is received, including in any particular format requested by the individual as is reasonably practical.

If, in the unlikely event the APP Privacy Policy is not able to be provided in a particular format requested by an individual, we will explain the circumstances around this issue with the requester and seek to ensure that another appropriate method is provided.

Review and Update of this APP Privacy Policy

WAATA reviews this APP Privacy Policy:

• This policy will be formally reviewed at least annually and whenever legislative, regulatory or operational changes occur;
• As a part of any external audit of our operations that may be conducted by various government agencies as a part of our registration as an RTO or in normal business activities; and
• As a component of each and every complaint investigation process where the complaint is related to a privacy matter.

Where this policy is updated, changes to the policy are widely communicated to stakeholders through internal personnel communications, meetings, training and documentation, and externally through publishing of the policy on WAATA’s website and other relevant documentation (such as our RTO Handbook) for clients.