DiscoverWorthy — Privacy & Security Pack

A managed website and content platform: the school's public site, its notices, calendar and published articles, plus staff logins to maintain them. Optionally, a member register for the school community.

Not by default, and it is not required. A school can run entirely on staff and business information.

The member register can hold records for students if the school chooses to use it, including a junior indicator, documents attached to a named person, and guardian access. Nothing enables this automatically and nothing populates it without the school entering the data. If you intend to use it that way, assess sections 4 and 5.

Australia. Production database, file storage, application servers and the AI service that processes member content all run in Microsoft Azure, Australia East (Sydney).

Yes, in one defined case, stated here so it is not discovered later. Generating website copy and illustrations uses services hosted in the United States (see section 3). These receive the business information the school publishes about itself — the kind of material intended for the public site. They do not receive member records, member documents, or member portal activity.

At rest: the database uses Azure SQL Transparent Data Encryption, and file storage is encrypted by the platform. In transit: HTTPS throughout, with a TLS 1.2 minimum.

Staff access is per-account with role-based permissions. Member portal access is separate and gives a person sight of their own records only.

Documents attached to a person are not public links. Each request is authorised against the person asking, and a request for something you are not entitled to returns nothing rather than an error that confirms it exists. Downloads are recorded.

The student, and any adult the school has explicitly authorised. A parent cannot grant themselves access, and a guardian cannot grant it to someone else. The record retains who granted access and when; withdrawal is recorded rather than erased, so the school can answer who had access between which dates.

Yes — continuous automated health checks across the application, database and dependencies, with alerting on failure rather than reliance on someone noticing.

Backups are Azure's managed database backups with point-in-time restore. We will confirm the current retention window and recovery objectives in writing against your template rather than publish figures your assessment would then need to verify.

School and staff details needed to operate the account (names, work contact details, sign-in records), the content the school creates, and — only if the school uses the member register — the member details it enters, which may include documents.

For as long as the account is active, and for as long as the school asks us to keep it. We do not impose a retention period on your content.

Yes. On request we delete the records and the files behind them. That distinction is deliberate: a document about a named child is destroyed, not merely unlinked from the record describing it. Files are removed as part of the same request rather than left in storage.

Yes — your content is yours, and we will export it on request.

No. We do not sell data, do not share it with advertisers, and do not use it to train third-party models.

Australian data residency, collection limited to operating the service, access controls and audit trails on personal records, correction and export on request, and deletion on request — the technical measures the Information Privacy Principles expect a supplier to provide.

The school remains the responsible entity. Our role is to ensure the technical controls support the school's policy: access granted by the school rather than shared between families, consent recorded and bound to the exact content it approves, and an audit trail that answers who could see what.

We are a software supplier and do not attend school sites or work directly with students, so a WWCC is not applicable to the service. If an engagement ever changed that, we would raise it before it did.

We notify the school promptly with what we know, what was affected and the steps taken, so the school can meet its own notification obligations under the Notifiable Data Breaches scheme and Victorian requirements.

This is a documented plan rather than an intention — AU Notifiable Data Breach Plan. Report a suspected incident to security@discoverworthy.com.

Privacy and data-protection enquiries: dpo@discoverworthy.com. Security incidents: security@discoverworthy.com. General support: support@discoverworthy.com.

DiscoverWorthy — ABN 74 694 878 594 — 140 Keller Road, Essendon North, VIC 3041, Australia. An Australian entity, with agreements governed by Australian law and data held in Australia.

These are the binding versions, published and kept current:

• Privacy Policy
• AU Privacy Collection Notice
• AU Notifiable Data Breach Plan
• Terms of Service