Privacy Policy

1. Introduction

RTOBASE PTY LTD (ABN 95 698 088 201) ("RTObase", "we", "us", or "our") operates the RTObase platform at rtobase.com.au. We are committed to protecting the privacy and security of your personal information.

This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our platform. It applies to all users of RTObase, including RTO administrators, staff, trainers, and students who interact with the platform.

We are bound by the Australian Privacy Principles (APPs) contained in the Privacy Act 1988 (Cth). We take our obligations under these principles seriously and have designed our platform with privacy in mind.

2. Information We Collect

2.1 Account Information

When you create an RTObase account, we collect:

• Full name and email address
• Phone number (optional)
• Organisation details, RTO name, trading name, RTO code, ABN
• Business address
• Role within the organisation (admin, staff, trainer)

2.2 Student Information

RTOs use RTObase to manage student records. The information stored on behalf of RTOs may include:

• Personal details, name, date of birth, gender, contact details
• Unique Student Identifier (USI)
• Enrolment and course completion records
• Assessment submissions and results
• Uploaded documents (e.g. ID, certificates, LLN results)
• AVETMISS statistical data (disability, prior education, employment status)

For student data, the RTO is the data controller and RTObase acts as a data processor. RTOs are responsible for obtaining appropriate consent from their students.

2.3 Payment Information

Payment processing is handled by a PCI DSS-compliant third-party payment processor. We do not store credit card numbers or full payment card details on our servers. We store transaction records (amounts, dates, and status) for invoicing and reporting purposes.

2.4 Technical Information

When you use RTObase, we automatically collect:

• IP address and approximate location
• Browser type, version, and operating system
• Pages visited and features used
• Session duration and interaction patterns
• Referring website or source

3. How We Use Your Information

We use the information we collect to:

• Provide, operate, and maintain the RTObase platform
• Process payments, generate invoices, and manage subscriptions
• Send service-related communications (account verification, security alerts, system updates)
• Generate AVETMISS NAT files and compliance reports on behalf of RTOs
• Verify Unique Student Identifiers (USIs) against the national USI Registry on behalf of RTOs
• Verify RTO registration details via training.gov.au during account creation
• Provide customer support and respond to enquiries
• Analyse usage patterns to improve features and performance
• Detect, prevent, and address security issues and fraud
• Comply with legal obligations, including regulatory requirements applicable to RTOs

We will not use your personal information for direct marketing without your consent. You may opt out of marketing communications at any time.

4. Data Sharing and Disclosure

We do not sell, rent, or trade your personal information. We may share information with the following categories of recipients:

4.1 Service Providers

We use trusted third-party service providers to operate the platform, including providers for:

• Database hosting and authentication (Australian data centre)
• Payment processing (PCI DSS-compliant)
• Transactional email delivery
• SMS delivery and communications tooling
• AI-assisted content, deidentified insights, support, optional identity-document OCR, and assessment document import
• Automatic subtitles for submitted assessment videos (speech recognition)
• Product analytics (anonymised where possible)

These providers are contractually obligated to protect your information and may only use it to provide services to us. Primary application data is stored in Australia. Some providers process limited data overseas, principally in the United States (for example AI assistance, payment processing, communications, and analytics), and some are delivered from global content-delivery networks. Where personal information is disclosed overseas, we take reasonable steps under Australian Privacy Principle 8 to ensure the recipient handles it consistently with the Australian Privacy Principles, including through contractual data-processing terms and security controls.

AI identity-document OCR, assessment document import, the Admin Agent, and AI support chats are disabled by default and require an explicit organisation administrator opt-in because they can process personal information. Assessment document import sends rendered pages and extracted text for conversion but does not store the source PDF in RTObase. Enrolment Insights remains available without this opt-in because the provider receives only a fixed allowlist of deidentified operational signals, with no names, contact details, dates of birth, USIs, database identifiers, free-text notes, or raw person records. AI content-generation tools do not read person records or automatically send the organisation's email, phone number, or street address. They may process organisation locality, course details, public authoring context and the prompt supplied by the user, so users should not put personal information into authoring prompts or page copy. We do not permit AI providers to use submitted data to train their models.

Separately from that opt-in, audio from a submitted practical assessment video is always sent to Cloudflare's speech-recognition model to generate subtitles, because learners with hearing loss or low literacy need captions to access the evidence they submitted. Only the audio is sent, it is processed on Cloudflare's global network, it is not used to train the model, and learners are told this before they record. Organisations that do not want speech recognition applied should not collect video evidence.

4.2 Government Services

RTObase communicates with the following Australian Government services on behalf of RTOs:

• USI Registry: to verify student Unique Student Identifiers, we transmit the student's first name, last name, date of birth, and USI to the national USI Registry operated by the Australian Government. This data is used solely for verification purposes.
• training.gov.au: during account creation, we look up the RTO's registration details (organisation name and website domain) from the national register to verify identity. No personal information is transmitted.

4.3 Regulatory Bodies

When RTOs use RTObase to generate AVETMISS files or compliance exports, RTObase prepares the relevant files and records for the RTO to download, review, and submit through the applicable regulator or authority process. RTObase does not independently report AVETMISS or funded-delivery data to regulators.

4.4 Legal Requirements

We may disclose information if required by law, court order, or government request, or if we believe disclosure is necessary to protect our rights, your safety, or the safety of others.

5. Data Storage and Security

We take the security of your data seriously and implement industry-standard measures to protect it:

• Australian primary data hosting: primary application data is stored in Australian data centres
• Encryption: data is encrypted in transit (TLS 1.2+) and at rest (AES-256)
• Access controls: role-based access, MFA support, and audit logging
• Regular backups: automated backups with point-in-time recovery
• Row-level security: database-level isolation ensures organisations can only access their own data

RTO compliance records may be retained for up to 30 years in accordance with ASQA record-keeping requirements. Account data is retained for the duration of your subscription and a reasonable period thereafter.

6. Your Rights

Under the Australian Privacy Principles, you have the right to:

• Access (APP 12), request a copy of the personal information we hold about you
• Correction (APP 13), request correction of inaccurate, incomplete, or out-of-date information
• Deletion: request deletion of your personal information, subject to our legal obligations (e.g. RTO record-keeping requirements)
• Opt-out: unsubscribe from marketing communications at any time
• Complaint: lodge a complaint with the Office of the Australian Information Commissioner (OAIC) if you believe we have breached the APPs

To exercise any of these rights, contact us at hello@rtobase.com.au. We will respond to your request within 30 days.

Students whose data is managed by an RTO through RTObase should contact the RTO directly in the first instance, as the RTO is the data controller.

7. Cookies and Tracking

RTObase uses cookies and similar technologies for the following purposes:

• Essential cookies: required for authentication, session management, and security. These cannot be disabled.
• Analytics cookies: used to understand how users interact with the platform so we can improve it. These are anonymised where possible.
• Advertising measurement cookies: used on our public website to understand whether a Google Ads click results in a submitted enquiry. We do not send contact-form contents to Google or use this tag for personalised advertising.

Public websites hosted by RTObase also use cookieless first-party site analytics. For each counted public page view, the visitor's network address and browser string are used transiently to derive a daily pseudonymous visitor key and a short-lived abuse-limit key, then discarded. The retained record contains a sanitised path and bounded traffic context, not the visitor's IP address, name or full browser string. Page-view records are kept for up to 400 days and organisation administrators receive aggregate reporting.

Google Ads conversion measurement may store or access identifiers associated with an advertising click. We do not sell data to advertisers or ad networks.

You can manage cookie preferences through your browser settings. Disabling essential cookies may prevent you from using the platform.

8. Third-Party Services

RTObase integrates with third-party services for database hosting, authentication, payment processing, email, SMS, AI assistance, analytics, error monitoring, maps, accounting integrations, and government verification services (USI Registry, training.gov.au). Each of these services has its own privacy and security terms governing how it handles data.

Current provider categories include Supabase, Cloudflare, OpenAI, Resend, Twilio, Slack, Stripe or eWAY, customer relationship management providers such as HubSpot, analytics and advertising measurement providers such as PostHog, Google Analytics, or Google Ads, error monitoring, Mapbox, and accounting integrations such as Xero where enabled. Provider availability and configuration can vary by customer plan and feature use.

We select providers that meet appropriate security and privacy standards and are contractually obligated to protect your information. For details on specific providers or cross-border processing, contact us at hello@rtobase.com.au.

9. Student Data

RTObase processes student data on behalf of RTOs. In this relationship:

• The RTO is the data controller: they determine what student data is collected and how it is used
• RTObase is the data processor: we store and process student data only as instructed by the RTO
• RTOs are responsible for obtaining appropriate consent from their students for data collection and use
• RTOs are responsible for complying with privacy obligations related to student data, including AVETMISS statistical information

Custom plan customers may request a Data Processing Agreement that formally documents these responsibilities. Contact us for details.

10. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, or legal requirements. If we make material changes, we will notify you by email or by posting a prominent notice on our platform.

Your continued use of RTObase after any changes constitutes acceptance of the updated policy. We encourage you to review this page periodically.

11. Contact Us

If you have questions about this Privacy Policy or wish to exercise your privacy rights, please contact us: