How EduSwap handles personal information
1. Introduction
EduSwap Pty Ltd is committed to protecting the privacy of schools, school staff, authorised representatives, and approved organisation users of the Platform.
This Privacy Policy explains how personal information is collected, used, stored, disclosed, and managed through EduSwap.
This Policy is intended to align with the Privacy Act 1988 (Cth), the Australian Privacy Principles, and the Notifiable Data Breaches Scheme, alongside school-sector privacy expectations where applicable.
2. Scope
This Policy applies to schools, school staff, authorised representatives, and approved organisations using EduSwap.
EduSwap is designed for school-based users and not for students or the general public.
EduSwap does not knowingly seek to collect student personal information and schools must not intentionally upload student personal information unless clearly required, lawful, and expressly permitted.
3. Information we collect
User and school information such as name, school name, school email, school contact number, suburb or state, and role.
Technical and security information such as authentication data, IP address, browser information, login attempts, device or session metadata, and account activity records.
Listing and transaction information such as items listed, viewed, requested, purchased, swapped, donated, leased, or discussed through the Platform.
Billing and finance-related information such as billing contact details, invoice records, payment confirmation records, and Premium subscription administration details.
Support and operational information provided when a user contacts EduSwap for help, troubleshooting, access requests, or complaints.
4. What we do not intentionally collect
EduSwap is not designed to collect student personal information as part of normal platform use.
EduSwap does not intentionally request sensitive information under APP 3, such as health, biometric, religious, or political information.
EduSwap does not intentionally collect personal information unrelated to legitimate school or platform operations.
If information outside the intended scope of the Platform is uploaded or submitted, EduSwap may remove, restrict, or delete that information where appropriate.
5. How we collect information
Directly from users during registration, login, school claiming, profile updates, listing creation, messaging, checkout, billing, and support requests.
Automatically through platform usage, security logs, cookies, technical monitoring, and service telemetry.
From school-related account actions and transaction workflows carried out through the Platform.
From communications sent to EduSwap for onboarding, support, privacy, billing, moderation, or compliance purposes.
6. Why we collect information
Verifying authorised school users and maintaining secure access to the Platform.
Operating listings, messaging, school-to-school coordination, transactions, invoicing, and Premium billing workflows.
Preventing fraud, misuse, unauthorised access, prohibited activity, and platform abuse.
Maintaining platform performance, diagnosing issues, improving reliability, and monitoring service health.
Responding to user support requests, moderation concerns, privacy requests, and compliance obligations.
Meeting legal, accounting, security, and record-keeping obligations relevant to operation of the Platform.
7. Disclosure of personal information
EduSwap may disclose information to other authorised school users where needed for legitimate platform interactions such as listings, messaging, transactions, claims, swaps, donations, leasing, invoicing, and billing workflows.
EduSwap may disclose information to service providers, hosting providers, infrastructure providers, payment providers, email or communications providers, security partners, and professional advisers where reasonably required to operate the Platform.
EduSwap may disclose information to regulators, law enforcement, courts, insurers, or other authorities where required by law or where reasonably necessary to protect the Platform, users, schools, or the public.
EduSwap does not sell personal information to advertising networks or data brokers.
8. Australian hosting and overseas disclosure
EduSwap aims to use Australian-hosted infrastructure and Australian-region services where practical and commercially reasonable.
Some suppliers, service providers, technical support functions, software tools, or integrated services may involve overseas access, support, routing, storage, or processing from time to time.
Where overseas disclosure may occur, EduSwap aims to keep that disclosure limited, appropriate to the service being used, and subject to contractual, technical, and security controls where available.
Schools using EduSwap acknowledge that modern cloud services can involve cross-border infrastructure, support, redundancy, or operational access even where Australian hosting is preferred.
9. Data security measures
EduSwap uses technical and organisational safeguards designed to protect personal information against misuse, interference, loss, unauthorised access, modification, or disclosure.
Security controls may include encryption in transit, access restrictions, role-based permissions, secure authentication controls, logging, monitoring, backups, and supplier controls.
Administrative and elevated access is restricted and protected with stronger security controls, with multi-factor authentication applied where enabled and supported.
EduSwap undertakes security reviews, monitoring, and operational hardening and may engage additional testing, audits, or external review over time as the platform matures.
No online system can be guaranteed to be completely secure, and users remain responsible for protecting their own credentials and devices.
10. Data retention and deletion
EduSwap retains personal information only for as long as reasonably necessary to operate the Platform, provide services, maintain records, resolve disputes, prevent fraud, and meet legal, tax, accounting, security, and compliance obligations.
Schools and authorised users may request deletion of personal information or account data, subject to identity verification and any lawful retention requirements.
EduSwap aims to process valid deletion requests promptly and ordinarily within 30 days, although some information may need to be retained for legal, financial, fraud-prevention, audit, backup, or dispute-resolution reasons.
Deletion from live systems does not always mean immediate removal from secure backups, archives, logs, or disaster recovery systems, which may be overwritten or aged out according to operational retention cycles.
Inactive accounts or unused records may be removed, archived, anonymised, or deleted over time where operationally appropriate.
11. Access and correction rights
Users may request access to personal information EduSwap holds about them, subject to lawful limitations and identity verification.
Users may request corrections to inaccurate, incomplete, out-of-date, or misleading information.
Where a user is acting on behalf of a school, EduSwap may require requests to come through an authorised school contact.
Requests should be sent to support@eduswap.com.au.
13. Third-party services
EduSwap relies on selected third-party service providers to support hosting, authentication, storage, email delivery, infrastructure, payments, monitoring, and security functions.
Those providers are expected to handle data only for authorised purposes and under appropriate contractual, technical, and operational controls where available.
Use of third-party services may affect where data is processed, supported, routed, backed up, or stored.
14. Data breach response
EduSwap maintains incident response processes designed to identify, contain, assess, and respond to privacy and security incidents.
Where an eligible data breach occurs, EduSwap aims to comply with the Notifiable Data Breaches Scheme and take appropriate remediation, communication, and containment steps.
This may include notifying affected users, schools, regulators, insurers, suppliers, or advisers where appropriate.
15. Children’s privacy
EduSwap is not intended for use by students or minors acting in a personal capacity.
If EduSwap becomes aware that student personal information has been provided contrary to the intended use of the Platform, EduSwap may restrict access to it and take reasonable steps to remove or delete it where appropriate.
16. Contact
For privacy queries, access requests, correction requests, complaints, or deletion requests, contact support@eduswap.com.au.