Privacy policy

[PLACEHOLDER: effective date]

1. About this policy

TrackEd Pty Ltd (PLACEHOLDER) (ABN 00 000 000 000) operates TrackEd ("TrackEd", "we", "us"). We are bound by the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs). This policy explains what personal information we collect, why, who we share it with, and how you can access, correct or delete it.

2. Whose information we collect

• students who join a group and order a garment
• school admins, who are school staff that TrackEd adds to run their school's group orders
• TrackEd sales reps, who look after schools for us
• parents or guardians who pay using a payment link
• staff of the suppliers who make our garments and use our supplier portal
• anyone who contacts us

3. What we collect

Students

• name and display name
• email address
• school and group
• garment size
• personalisation text, such as a nickname, surname, initials or number
• order and payment status, and order history

We do not collect dates of birth, phone numbers, home addresses or photos of students. Delivery is always to the school, so we only hold the school's address.

School admins and sales reps

Name, email address, the school they work with and the changes they make to group orders.

Payments

Payments are processed by Stripe. Card details are entered directly with Stripe and are never sent to or stored by TrackEd. We receive confirmation of payment, the amount, and limited details Stripe provides to identify the payment.

Supplier staff

Name and business email address, so they can sign in to the supplier portal.

Contact form

Your name, email address and message. Messages are emailed to our inbox and are not stored in the TrackEd database.

Technical information

We use a cookie to keep you signed in. Our servers record basic technical information for security, such as request times and errors. To limit abuse we count requests per IP address, but we store only a one-way hash of the address, not the address itself. Sign-in and contact forms may use Cloudflare Turnstile, which processes information about your browser and device to check that a person, not a bot, is using the form.

[PLACEHOLDER: confirm analytics provider, if any, and whether it sets cookies.]

4. How we collect it

Mostly directly from you, when you sign in, join a group, place an order or contact us. Some information comes from other people: TrackEd or a sales rep enters a school admin's name and email, and Stripe tells us when a payment succeeds.

5. Why we collect and use it

• to run group orders: designs, voting, ordering, approval and submission
• to have garments made with the correct size and personalisation, and delivered to the school
• to take payments, issue tax invoices and process refunds
• to send service emails such as sign-in links, receipts, reminders and delivery updates
• to check personalisation for offensive content before it is made
• to handle issues, remakes, refunds and credits
• to keep the service secure and meet our legal obligations

We do not sell personal information and we do not use it for advertising.

6. Who we disclose it to

• Your school's admins see members' names, sizes, personalisation and order and payment status.
• Your school's TrackEd sales rep sees the design and how many people have joined and ordered, not names or orders.
• Suppliers who make the garments receive only each student's display name, personalisation, the design and the size. They do not receive email addresses, prices paid or payment information.
• Service providers who help us run TrackEd, including Stripe (payments), our email delivery provider, our hosting and storage provider, and Cloudflare (bot protection). They may only use the information to provide their service to us.
• Authorities, where the law requires or allows it.

7. Overseas disclosure

We store data in Australia (Sydney).

Some garments are made by suppliers outside Australia. At the date shown on this page, we disclose personal information to suppliers in Pakistan. Only the details listed above for suppliers (display name, personalisation, design and size) are sent, and only for groups that order a product made there. We take reasonable steps, including contract terms, to make sure overseas suppliers handle this information in line with the APPs.

[PLACEHOLDER: confirm where Stripe, the email provider and Cloudflare process data, and list those countries.]

8. How we protect it

Access is limited by role: students see their own orders, school admins see their own school's groups, sales reps see order counts for their schools, and suppliers see only what they need to make the garments. Data is encrypted in transit. Files such as logos and order packs are kept in private storage and shared only through short-lived links.

If we have a data breach that is likely to cause serious harm, we will notify affected people and the Office of the Australian Information Commissioner (OAIC) under the Notifiable Data Breaches scheme.

9. How long we keep it

We keep student personal information while an order is in progress and for 12 months after delivery, so we can deal with any issues. After that it is anonymised. Tax records are kept for 5 years, as Australian tax law requires, and contain only what an invoice needs.

10. Access, correction and deletion

You can download a copy of your data and request deletion from your account page. You can change your size and personalisation until your group's order locks. To ask for access to or correction of anything else, contact us. We may need to confirm your identity first, and some information must be kept to finish an order in progress or to meet tax law.

11. Young people

TrackEd is built for school groups, so many of the people using it are under 18. We collect only what is needed to make and deliver an order, and our collection notice is written so students can understand it.

[PLACEHOLDER: confirm with legal review how consent works for students under 18.]

12. Complaints

If you think we have mishandled your personal information, contact us first at platform@agentum.com.au. We aim to respond within 30 days. If you are not satisfied, you can complain to the OAIC at oaic.gov.au.

13. Contact

Privacy Officer, TrackEd Pty Ltd (PLACEHOLDER)
PLACEHOLDER address, Sydney NSW 2000
platform@agentum.com.au

14. Changes to this policy

We will update this policy when our practices change, including when we add suppliers in new countries. The current version is always on this page.