Privacy Statement

Kinds of personal information we may collect

The types of information the School may collect includes (but is not limited to) personal information, including health and other sensitive information, about:

• Students and parents and/or guardians (Parents) before, during and after the course of a student's enrolment at the school, including;
  
  • name, contact details (including next of kin), date of birth, gender, language background, previous school and religion;
  • parents' education, occupation, language spoken at home, nationality and country of birth;
  • health information (e.g., details of disability and/or allergies, dietary requirements, absence notes, immunisation details, medical reports and names of doctors);
  • results of assignments, tests and examinations;
  • conduct and complaint records, or other behaviour notes, and School reports;
  • information about referrals to government welfare agencies;
  • counselling reports;
  • health fund detail and Medicare number
  • any Family Court orders;
  • criminal records;
  • volunteering information;
  • photos and videos at School events;
  • records or logs about student use of IT systems, devices and tools and student use of artificial intelligence AI systems and AI tools (AI Systems) including Microsoft Copilot;
  • biometric information e.g. fingerprints and facial recognition, and
  • other information that the School is required to collect by law or to exercise its duty of care, or that the student or parent provides to the School, or that is otherwise necessary for the School's dealings with the student or parent.
    
    
• Job applicants, volunteers and contractors, including:

• name, contact details (including next of kin), date of birth, and religion;
• information on job application;
• professional development history;
• salary and payment information, including superannuation details;
• health information (e.g. details of disability and/or allergies, and medical certificates);
• complaint records and investigation reports;
• leave details;
• photos and videos at School events;
• workplace surveillance information; and
• work emails and private emails (when using work email address) and Internet browsing history; and

Other people who come into contact with the School, including name and contact details and any other information necessary for the particular contact with the School.

How we collect personal information

Personal information you provide: The School will generally collect personal information about an individual directly from the individual (or their Parent in the case of students). This includes by way of forms, face-to-face meetings and interviews, emails and telephone calls. On occasions people other than Parents and students provide personal information.

The School also collects personal information when a student uses their issued Student ID Card (which records the use of library and some ICT services).

Enrolment applications within the diocese: If an enrolment application is made to two (or more) schools in the same diocese, the personal information provided during the application stage may be shared between the schools. This personal information may include health information and is used for the purpose of considering and administering the enrolment of the student within the diocese.

Personal information provided by other people: In some circumstances the School may be provided with personal information about an individual from a third party, for example a report provided by a medical professional, a reference from another school or a referee for a job applicant. If a student transfers to a new school, the new school may collect personal information about the student from the student’s previous school to facilitate the transfer of the student and to enable the new school to exercise its duty of care.

Personal information generated by AI Systems: The School may collect personal information through the use of AI Systems, including Microsoft Copilot. These AI systems may generate or infer personal information based on existing data inputs. This may include behavioural insights and other data relevant to educational or administrative functions. This information is treated as personal information under the Privacy Act and includes the types of information listed under the heading ‘Kinds of personal information we collect.'

Personal information from other sources: We may also collect personal information through surveillance activities (such as CCTV security cameras), and student email monitoring.

Sensitive information: Sensitive information (including health information) will be collected by the School where it is reasonably necessary for one or more of the School’s functions or activities. It will only be collected with consent or where it is reasonably necessary for the School to do so to enable it to carry out its services or functions, unless one of the exceptions under the Privacy Act applies.

 

Purposes for which we collect, use and disclose personal information

The purposes for which the School collects, uses and discloses personal information depends on our relationship with you and includes, but is not limited to, the purposes set out below.

Students and Parents

In relation to personal information of students and Parents, the School’s primary purpose of collection is to enable the School to provide a quality Catholic education to the student, exercise its duty of care and perform necessary associated administrative activities, which will enable students to take part in all the activities of the School. This includes satisfying the needs of the Parents, the student, BCE and the School throughout the whole period the student is enrolled at the School. The other purposes for which the School uses personal information of students and Parents include (but are not limited to):

• providing schooling and school activities;
• satisfying the needs of Parents, the needs of students and the needs of the School; throughout the whole period a student is enrolled at the school;
• making required reports to government authorities;
• keeping Parents informed about matters related to their child's schooling, through correspondence, apps, newsletters and magazines;
• day-to-day administration, including seeking the payment of fees for schools within the same diocese when a student transfers between such schools;
• looking after students' educational, social, spiritual and health wellbeing;
• seeking donations for the School (see the 'Fundraising' section of this Privacy Statement);
• ensuring safe and appropriate use of school IT systems and devices and AI Systems; and
• to satisfy the School's legal obligations and allow the School to discharge its duty of care.

Volunteers:

The School also obtains personal information about volunteers who assist the School in its functions or conduct associated activities, such as alumni associations, to enable the School and the volunteers to work together. This may include:

• to contact you about, and administer, the volunteer position;
• for insurance purposes; and
• to satisfy the School's legal obligations, for example, in relation to child protection legislation.

Job applicants and contractors:

In relation to the personal information of job applicants, staff members and contractors, BCE and a school's primary purpose of collection is to assess and (if successful) engage the applicant, staff member or contractor, as the case may be.

The purposes for which a School uses and discloses personal information of job applicants, staff members and contractors include:

• assessing and (if successful) engaging the applicant or contractor;
• administering the individual's employment or contract;
• seeking donations for the relevant school (see the 'Fundraising' section of this Privacy Statement);
• for insurance purposes; and
• satisfying the School's legal obligations, for example, in relation to child protection legislation.

Who we disclose personal information to

The School may disclose personal information, including sensitive information, for educational, care and administrative purposes, to seek support and advice, or for other purposes that are related and reasonably expected, or that the individual consented to. This may include a disclosure to:

• other BCE schools and BCE personnel at those schools, including a new school to which a student transfers to facilitate the transfer of the student, and schools within the same diocese where concurrent applications for enrolment are made to those schools, schools within BCE that a relative of the individual attends (such as a family member, household member, kin or cultural relation and where the information is relevant to that relative) or for any other reasons the information is relevant to another BCE school;
• government departments (including for policy and funding purposes);
• the CEO, the Brisbane Catholic Education Office, the school's Archdiocese and the parish, other related church agencies/entities;
• the School's local parish;
• medical practitioners;
• people providing educational, support and health services to the School, including specialist visiting teachers, sports coaches, volunteers, and counsellors;
• organisations that assist us with fundraising (see the 'Fundraising' section of this Privacy Statement);
• providers of specialist advisory services and assistance to the School, including in the area of Human Resources, child protection and students with additional needs;
• providers of learning and assessment tools;
• assessment and educational authorities, including the Australian Curriculum, Assessment and Reporting Authority (ACARA) and NAPLAN Test Administration Authorities (who will disclose it to the entity that manages the online platform for NAPLAN);
• agencies and organisations to whom we are required to disclose personal information for education and research purposes;
• people and organisations providing administrative, technology and financial services to the School;
• providers of our information management and storage system and other information technology services;
• recipients of School publications, such as newsletters and magazines;
• students' parents or guardians;
• anyone you authorise the School to disclose information to;
• anyone to whom we are required or authorised to disclose the information by law, including child protection laws, or to exercise a duty of care or defend our legal interests; and
• third party providers of the AI Systems used by Schools. 

Exception in relation to related schools: The Privacy Act allows each school, being part of the same legal entity conducted by BCE to share personal information with other BCE schools. Other BCE schools may then only use this personal information for the purpose for which it was originally collected by BCE, a reasonably expected purpose that is related to the purpose for which it was originally collected by BCE or another purpose that is permitted by the Privacy Act. This allows schools to transfer information between them, for example, when a student transfers from a BCE school to another school conducted by BCE. Sensitive information may be shared within BCE where it is necessary for the purpose for which it was provided, for a directly related secondary purpose that the individual would reasonably expect, where the individual has provided consent, or where otherwise required or authorised by law.

How we store personal information

The School may store your personal information in hard copy and electronically.

Storage and access as part of centralised information systems: The School uses centralised information management and storage systems (Systems) provided by third party service providers. Personal information is stored with and accessible by the third party service providers for the purpose of providing services to the School in connection with the Systems. The School may use online or ‘cloud’ service providers to store personal information and to provide services to the School that involve the use of personal information. See further the section below ‘Sending and storing information overseas.'

Sending and storing information overseas

The School may disclose personal information about an individual to overseas recipients in certain circumstances, for instance, to facilitate a school exchange, or to certain service providers who may be located overseas.

The School may use other online or ‘cloud’ service providers to store personal information and to provide online or other services to the School that involve the use of personal information, such as services relating to email, instant messaging and education and assessment applications, document management and storage, personnel/contractor management, or other software and service providers.

Some limited personal information may also be provided to these service providers to enable them to authenticate users that access their services and provide technical support. This personal information may be stored in the ‘cloud’ which means that it may reside on a cloud service provider’s servers which may be situated outside Australia (for example, some personal information relating to our contractors is held on a third party service provider’s server in the USA). Another example of such a cloud service provider is Microsoft. Microsoft provides Microsoft 356 (365) including Outlook and Teams, which stores and process personal information for this purpose. School personnel, BCE, BCEO and their service providers may have the ability to access, monitor, use or disclose emails, communications (e.g. instant messaging), documents and associated administrative data for the purposes of administering 365 and ensuring its proper use.

The School uses AI Systems that are provided by third parties including Microsoft Copilot. These third parties may store or have access to personal information input into, and/or generated by, these AI Systems. These third parties may be located outside of Australia, including in the Asia Pacific region.

Fundraising and marketing

The School treats seeking donations for the future growth and development of the School as an important part of ensuring that the School continues to be a quality learning environment in which both students and staff thrive. Your personal information may be used to make an appeal to you. It may also be disclosed to an organisation that assists in the School’s fundraising activities, for example, the school’s Foundation or alumni organisation and, on occasions, external fundraising organisations. Parents, staff, contractors and other members of the wider school community may from time to time receive fundraising information. School publications, like newsletters and magazines, which include personal information, may be used for marketing purposes. If you do not want to receive fundraising communications from the School, please contact your school. 

Security of personal information

Each School has in place steps to protect the personal information the School holds from misuse, interference and loss, unauthorised access, modification or disclosure by use of various methods including locked storage of paper records and password access rights to computerised records that are appropriate to the sensitivity of the information and how it is held, accessed and used. These steps include:

• Restricting access to information on the School databases on a need to know basis with different levels of security being allocated to staff based on their roles and responsibilities and security profile.
• Ensuring all staff are aware that they are not to reveal or share personal passwords.
• Ensuring where personal and health information is stored in hard copy files that these files are stored in lockable filing cabinets in lockable rooms. Access to these records is restricted to staff on a need to know basis.
• Implementing physical security measures around the School buildings and grounds to prevent break-ins.
• Implementing ICT security systems, policies and procedures, designed to protect personal information storage on our computer networks.
• Implementing human resources policies and procedures, such as email and internet usage, confidentiality and document security policies, designed to ensure that staff follow correct protocols when handling personal information.
• Undertaking due diligence with respect to third party service providers who may have access to personal information, including cloud service providers, to ensure as far as practicable that they are compliant with the Australian Privacy Principles or a similar privacy regime.

Access and correction of personal information

Under the Privacy Act, an individual has the right to seek access to, and/or correction of, any personal information which the School holds about them including information that has been generated or inferred through the use of AI Systems and to advise BCE or the school of any perceived inaccuracies in that information There are some exceptions to this right set out in the Privacy Act.

Students will generally be able to access and update their personal information through their Parents, but older students may seek access and correction themselves.

There  are some exceptions to these rights set out in the applicable legislation. To make a request to access, update or correct any personal information the BCE or a school holds about you or your child, please contact the school’s Principal by email, post or telephone.

The School may require you to verify your identity and specify what information you require. The School may charge a reasonable fee for giving access to your personal information (but will not charge for the making of the request or to correct your personal information). If the information sought is extensive, the School will advise the likely cost in advance.

If we decide to refuse your request, we will provide you with written notice explaining the reasons for refusal (unless given the grounds for refusal, it would be unreasonable to provide reasons) and how to complain.

Parents can also log on to the BCE Connect app and Parent Portal and correct and update some of their or their child’s personal information at any time.

Consent and rights of access to the personal information of students

BCE respects every Parent’s right to make decisions concerning their child’s education. Generally, the School will refer any requests for consent and notices in relation to the personal information of a student to the student’s Parents. Generally, the School will treat consent given by Parents as consent given on behalf of the student and notice to Parents will act as notice given to the student.

Parents may seek access to personal information held by the School about them or their child by contacting the school’s Principal. However, there may be occasions when access is denied. Such occasions may include (but are not limited to) where the School believes the student has capacity to consent and the School is not permitted to disclose the information to the Parent without the student’s consent, where release of the information would have an unreasonable impact on the privacy of others, or where the release may result in a breach of the School’s duty of care to the student.

The School may, at its discretion, on the request of a student grant that student access to information held by the School about them or allow a student to give or withhold consent to the use of their personal information, independently of their Parents. This would normally be done only when the maturity of the student and/or the student’s personal circumstances warrant it.

Enquiries and complaints

If you would like further information about the way the School manages the personal information it holds, or wish to make a complaint that you believe that BCE or a school has breached the Australian Privacy Principles, please complete the Form. The School will investigate any complaint and will notify you of a decision in relation to your complaint as soon as is practicable after it has been made.

If you are not satisfied with our response, you may complain to the Office of the Australian Information Commissioner (OAIC) via the OAIC website https://www.oaic.gov.au.

 

Approver: BCE Legal Counsel
Issue date: 22/12/2025
Review date: 22/12/2027