Privacy Policy

1. Overview

This Privacy Policy explains how personal information is collected, used, stored and protected when schools, staff, students and other authorised users access and use the StudyGrid platform (“Platform”).

StudyGrid is provided to schools on a licensed, white-label basis. Schools control how the Platform is used within their organisation.

2. Roles and Responsibilities

• Schools are the Data Controllers and determine how personal data is used.
• TutorsGrid is the Data Processor and processes personal data only on documented instructions from schools.

3. Personal Information We Process

Depending on how a school configures the Platform, we may process:

• User identification details (name, email address, role)
• School-related information (year group, subjects, availability)
• Authentication identifiers (SSO identifiers)
• Usage and audit logs

StudyGrid does not collect unnecessary personal information and does not intentionally collect sensitive information unless required by the school.

4. How Personal Information Is Collected

Personal information is collected:

• Directly from schools or authorised users
• Via secure authentication systems such as Microsoft Entra ID (SSO)
• Through normal use of the Platform

5. How Personal Information Is Used

Personal information is processed solely to:

• Provide and operate the Platform
• Authenticate users and manage access
• Support school administration and tutoring workflows
• Maintain security, audit and compliance records

Personal information is not used for advertising or marketing purposes.

6. Data Storage and Location

• All production data is hosted in Australian data centres.
• Data is stored in secure cloud infrastructure operated by approved providers.
• Access is restricted to authorised personnel only.

7. Data Security

We implement appropriate technical and organisational measures, including:

• Encryption of data in transit
• Role-based access controls
• Secure authentication and logging
• Regular security reviews

8. Data Sharing and Sub-processors

We may engage trusted third-party service providers (sub-processors), including:

• Cloud hosting providers
• Authentication services (e.g. Microsoft Entra ID)

All sub-processors are subject to contractual data protection obligations.

9. Data Retention

Personal information is retained only for as long as required to provide the Platform and meet legal obligations. Upon termination of a school’s licence, data is returned or securely deleted in accordance with the Data Processing Agreement.

10. Data Subject Rights

Data subject rights (including access, correction and deletion) are typically exercised through the school. Requests received directly by TutorsGrid will be referred to the relevant school unless otherwise required by law.

11. Changes to This Policy

This Privacy Policy may be updated from time to time. Material changes will be communicated to schools.

12. Contact

For privacy-related enquiries:
Email: admin@tutorsgrid.com