Privacy Policy
Rosebank College has a zero-tolerance policy toward child abuse, promoting a safe, inclusive environment and using transparent, risk-based approaches to ensure child safeguarding.
The College recognises the critical importance of safeguarding personal data and information. It is committed to protecting the privacy of all individuals by ensuring that personal information is collected, used, stored, and disclosed responsibly and in accordance with applicable laws and best practices. The College actively promotes a culture of confidentiality, accountability, and respect for privacy in all its operations.
1. Purpose
This Privacy Policy (Policy) outlines Rosebank’s obligations under the Privacy Act 1988 (Cth) and the Health Records and Information Privacy Act 2002 (NSW), and the processes for ensuring compliance with those obligations and protecting the privacy of individuals.
The College is bound by the Australian Privacy Principles contained in the Commonwealth Privacy Act 1988. In relation to health records, the College is also bound by the Health Privacy Principles which are contained in the Health Records and Information Privacy Act 2002 (NSW).
2. Scope
This policy applies to all College employees who collect and maintain personal information about staff, students, parents, volunteers, contractors and alumnae.
3. Privacy Rights
Privacy is a fundamental human right, intended to protect information about a person’s identity, actions, associations, and beliefs, ensuring their dignity, safety, and self-determination. Failure to protect personal information may result in reputational damage, emotional distress, identity theft, intimidation, and financial loss.
4. Information
Rosebank is an independent Good Samaritan Benedictine Catholic co-educational school. Rosebank will only collect personal information that is reasonably necessary for its operations.
The College will notify or make the individual aware of the collection of personal information before the collection or as soon as reasonably practicable.
When collecting information, the College will inform the individual of:
- The name and contacts for the College, if the individual has a complaint, wishes to access, or modify their personal information.
- The collection and the circumstances of the collection, if the individual was not aware of the collection, e.g. collection through third-party.
- Whether the collection is required by law.
- The purposes of the collection and the consequences if the individual objects to the collection (if any).
- The parties to whom the College may disclose the information (if applicable), e.g. contractors and government agencies.
- This policy and the contents of this policy.
4.1. Type of Information
4.1.1. Personal Information
In its day-to-day activities, and to allow the College to perform its activities, Rosebank may collect personal information from:
Students and parents before, during and after the student’s enrolment at the College.
Job applicants, staff, volunteers, and contractors.
Any other people that might interact with the College.
Rosebank may collect personal information, including:
| For Students / Parents | Job Applicants, Staff |
|---|---|
|
|
Government identifiers such as Medicare numbers and Vehicle Registration are not adopted, used, and disclosed except as permitted by law.
4.1.2. Sensitive Information
Sensitive information in College context means information relating to a person’s racial or ethnic origin, political opinions, religion, philosophical beliefs, sexual orientation or practices, or criminal record, that is also personal information; health information and biometric information about an individual.
Sensitive information will be used and disclosed only for the purpose for which it was provided or a directly related secondary purpose, unless you agree otherwise, or the use or disclosure of the sensitive information is allowed by law.
The collection of sensitive information is subject to:
- Consent, except relating to information necessary to prevent or mitigate serious threat to the person
- Legal requirements
- Specific circumstances, e.g. health information
5. Sources for Collection of Information
Rosebank may collect personal information several ways, including use of the College’s website, email, supplier forms, enrolment forms and email.
a) Information provided by the individual
The College will collect personal information provided by the individual in writing or verbally, e.g. emails, enrolment forms, meetings and phone calls.
b) Information provided by third parties
In some circumstances, the College may collect personal information provided by third parties, e.g. school records, medical records, counselling reports and police checks.
c) Unsolicited Information
At times, the College may receive or collect personal information that it has not requested (Unsolicited Information). The College only holds, uses, and discloses unsolicited information if the College would or could have collected such information through its normal operations, e.g. enrolment.
Upon receiving unsolicited information, the College will determine if it could have received such information by other means through its normal operations. Otherwise, the College will destroy, permanently delete or de-identify the information.
d) Personal Information Generated by Artificial Intelligence (AI) Systems:
Rosebank College may also use AI systems to generate personal information, for instance, using academic and pastoral records for creating a student profile for the purpose of teaching and learning. The College has strict rules around the use of AI tools and has filters in place to ensure appropriate and controlled usage.
e) Surveillance
The College has surveillance systems, including CCTV and computer monitoring systems. The use of these systems may result in collection of personal information, according to the College’s Surveillance Policy.
Rosebank’s Acceptable Use of Information Technology Resources provides for the use and monitoring of the College’s technology resources and network. All staff, students and parents receive the College’s Acceptable Use of Information Technology Resources Policy and must sign Rosebank’s Acceptable Use of ICT Agreement.
6. Consent
Rosebank will request the individual’s consent for the collection and use of their personal information. The consent given by the Parent will be treated as a consent on behalf of the student. Individuals may withdraw their consent at any time.
7. Purpose of Collection of Information
The College collects personal information (including sensitive information such as health information) for the purposes set out below, where such collection is reasonably necessary for its functions and activities.
a) Students and Parents
Rosebank will collect information from parents and students for several purposes, including:
- Providing schooling to students
- Enrolment
- Collection of fees
- Day-to-day operations
- Communicating with parents about student and College activities
- Student wellbeing
- Donations and marketing
- Fundraising: The College may disclose personal information to organisations that assist with fundraising
- Insurance
- Legal requirements
If students or parents refuse to provide the requested information, the College might be unable to enrol, continue the enrolment of the student, or provide its services.
b) Applicants, Staff and Volunteers
Rosebank will collect information from applicants, staff and volunteers for several purposes, including:
- Recruitment
- Employment
- Insurance
- Legal requirements
c) Contractors and Vendors
Rosebank will collect information from contractors and vendors for several purposes, including:
- Tenders
- Services
- Payment
- College operations
8. How will the College use the Personal Information you provide?
The College will use personal information it collects for the primary purpose of collection, and for such other secondary purposes that are related to the primary purpose of collection and reasonably expected by you, or to which you have consented.
a) Students and Parents
In relation to personal information of students and parents, the College’s primary purpose of collection is to enable the College to provide schooling for the student. This includes satisfying the needs of parents, the needs of the student and the needs of the College during the whole period the student is enrolled at the College and beyond.
The purposes for which the College uses personal information of students and parents include:
- to keep parents informed about matters related to their child’s schooling, through correspondence, newsletters etc.
- day-to-day administration of the College
- looking after student educational, social and physical wellbeing
- donations and marketing for the College
- to satisfy the College’s legal obligations and discharge its duty of care
- to maintain and nurture the association between the College, the student and the parents.
In some cases where the College requests personal information about a student or Parent, if the information requested is not provided, the College may not be able to enrol or continue the enrolment of the student or permit the student to take part in a particular activity.
b) Job Applicants, Staff Members and Contractors
In relation to personal information of job applicants, staff members and contractors, the College’s primary purpose of collection is to assess and (if successful) to engage the applicant, staff member or contractor.
The purposes for which the College uses personal information of job applicants, staff members and contractors include:
- administering the individual’s employment or contract
- for insurance purposes
- donations and marketing for the College
- satisfying the College’s legal obligations, for example, in relation to child protection legislation.
c) Volunteers
Rosebank also obtains personal information about volunteers who assist the College in its functions, including at events, within Archives and through the Alumni Association.
d) Marketing and Fundraising
Rosebank treats marketing and seeking donations for the growth and development of the College, as an important part of ensuring that the College continues to provide a quality learning environment. Personal information held by the College may be disclosed to organisations that assist in the College’s fundraising initiatives.
Parents, students, staff, contractors and other members of the wider College community may, from time to time, receive fundraising information. College publications which include personal information may be used for marketing purposes.
Rosebank may, on occasion, wish to use the personal information of students, staff or others in respect to the promotion of the College through advertising. Prior to its use, the College will first obtain the authority of the person whose personal information identifies them for this purpose. This includes their photograph, voice recording, examination results or film.
In addition, the College may utilise third-party platforms (such as ticketing, fundraising and event management providers) to facilitate events, sell tickets and conduct fundraising activities including online auctions and raffles. These platforms may collect personal information directly from participants for the purpose of processing transactions and administering events.
The College takes reasonable steps to ensure that such providers handle personal information in accordance with applicable privacy laws; however, individuals are encouraged to review the privacy policies of these external organisations when engaging with these services.
9. Who Might the College Disclose Personal Information To?
Rosebank College may disclose personal information to:
- Other schools
- Government agencies
- Medical practitioners
- Persons and organisations providing services to the College, e.g. administrative, and financial services
- Students and parents
- Meet legal requirements
- People providing educational support and health services to the College including visiting teachers, sports coaches, study mentors, volunteers, and providers of learning and assessment tools
- Assessment and educational authorities, including the Australian Curriculum, Assessment and Reporting Authority and NAPLAN Test Administration
- Authorities (who will disclose it to the entity that manages the online platform for NAPLAN)
- Agencies and organisations to whom we are required to disclose personal information for education, funding and research purposes including faith related matters and relevant Catholic Church authorities
- Overseas schools and organisations, including to facilitate study and sports tours, immersions and pilgrimages.
The College will not send personal information about an individual outside Australia without obtaining the consent of the individual (in some cases this consent will be implied); or otherwise complying with the Australian Privacy Principles or other applicable privacy legislation.
Rosebank College may also store personal information on the cloud which may mean that it resides on servers which are situated outside Australia.
The College may disclose personal information where permitted or required by law. This includes information sharing under Chapter 16A of the Children and Young Persons (Care and Protection) Act 1998 (NSW), which enables prescribed bodies to exchange information relating to the safety, welfare or wellbeing of a child or young person.
Prescribed bodies include a range of government and non-government agencies such as NSW Government agencies and authorities (including the NSW Early Learning Commission, Department of Education and Department of Communities and Justice), the NSW Police Force, public and private schools and TAFE establishments, early childhood education and care services, public health organisations and private hospitals, as well as certain health professionals such as nurses, registered psychologists and speech pathologists.
10. Access to Information
Upon request, the College will provide the individual with access to their personal information held by Rosebank.
Requirements to access personal information:
- A written request indicating the information subject to the request.
- Proof of identity, e.g. parents’ request for access to their child’s information.
- Payment of access fees, if providing access to the information will subject the College to costs, e.g. high volume of documents, photocopy, costs associated with locating, retrieving or reviewing the information.
Exceptions to access may apply to situations where:
- Access may pose the risk of serious threat to the individual or public interest.
- Access would violate the privacy of others.
- The request is frivolous.
- The information is privileged or there is a legal requirement to deny access.
- The information could negatively affect negotiations with the person.
- Access is unlawful.
- The information would reveal commercially sensitive information.
The College will respond to a request for access within a reasonable timeframe and provide the information if it is reasonable to do so. If the College refuses access to information, the College will communicate the reasons for refusal to the individual.
Requests for access to information must be directed to the Principal (principal@rosebank.nsw.edu.au) or the Privacy Officer (privacy@rosebank.nsw.edu.au)
11. Updating information
Under the Commonwealth Privacy Act and the New South Wales Health Records Act, an individual has the right to obtain access to any personal information which the College holds about them and to advise the College of any perceived inaccuracy. Students will generally be able to access and update their personal information through their parents. There are some exceptions to these rights set out in the applicable legislation.
12. Security of Records
The College will take all reasonable and practicable measures to ensure the security of records, and prevent misuse, interference, loss, unauthorised access, or disclosure of personal information.
Records kept in hard copy are securely stored in locked cabinets or rooms with restricted access. Electronic records are kept in accordance with the College’s ICT Framework.
Records no longer necessary for the purpose collected will be destroyed or de-identified, unless otherwise required by law.
All staff must comply with this Policy and take all reasonable steps to protect personal information collected by the College.
13. Data Breach
A Data Breach might result from malicious third-party acts, human error, system failure or policy breach causing unauthorised access to or disclosure of personal information. Under the Notifiable Data Breach Scheme (NDB Scheme), in the event of a data breach, Rosebank must follow Rosebank’s Data Breach Response Plan to determine if it is an Eligible Data Breach i.e.
that is likely to result in risk of serious harm to the affected individual(s) – including physical, psychological, emotional, financial or reputational harm;
that Rosebank was unable to prevent the risk with remedial measures.
If determined as an Eligible Data Breach, Rosebank will notify affected individuals and the Office of the Australian Information Commissioner (OAIC).
14. Privacy Officer
Rosebank’s Privacy Officer is the Audit, Risk and Reporting Officer, responsible for privacy related issues at Rosebank. Any issues relating to privacy must be raised with the Privacy Officer at privacy@rosebank.nsw.edu.au or via telephone (02) 9713 3140.
15. Enquiries and Feedback
The College welcomes feedback including:
- Compliments and complaints
- Enquiries about how the College manages personal information
- Concerns around breach of the Australian Privacy Principles
Individuals may contact the College Privacy Officer by email on privacy@rosebank.nsw.edu.au or telephone (02) 9713 3140.
16. Record Management
Rosebank College takes all reasonable steps to ensure personal information is securely stored, and it does not keep personal information that is no longer necessary.
17. Compliance with this Policy
All staff must comply with this Policy. A breach of this Policy may result in disciplinary and legal consequences.
18. Availability of the Privacy Policy
The College’s Privacy Policy is readily accessible on the College website and through the internal staff portal.
Definitions
| Term | Definition |
|---|---|
| Data Breach | means unauthorised access or disclosure of personal information, or loss of personal information. |
| Parent(s) | means a parent of a student, including legal guardians. |
| Personal Information | means a range of information or opinions that could identify an individual. Personal information includes name, signature, address, phone number, date of birth, Sensitive Information, credit information, employment records, images, internet protocol (IP) address, biometrics and location history (e.g. mobile device tracking). Personal information does not include information publicity available. |
| Primary Purpose of Collection | means the main purpose for which personal information is collected. |
| Secondary Purpose of Collection | means the purpose that relates to the Primary Purpose of Collection which is reasonably expected by the individual. In the event of Sensitive Information, the Secondary Purpose of Collection must be directly related to the Primary Purpose of Collection. |
| Sensitive Information | means personal information that includes information or opinion about a person’s: • Race or ethnic origin • Political opinion or association • Religious or philosophical beliefs • Sexual orientation or practices • Criminal records • Health or genetic information |
| Health Information | means sensitive information relating to the health or disability of a person, including a person’s wishes about their preferences for treatment or health service provider(s). Includes information provided by a person to their health service provider. |
| Record(s) | means a document, electronic or other device containing personal information. |
| Rosebank or College | means Rosebank College. |
| Staff or Employee(s) | means all persons employed by Rosebank College, paid or unpaid, on a permanent or causal basis, including volunteers and contractors. |
| Student(s) | means a person of any age enrolled as a student at Rosebank. |
Related Legislation, Regulations and Standards
- Privacy Act 1988 (Cth)
- Australian Privacy Principles
- Privacy and personal information Protection Act 1998 (NSW)
- My Health Records Act 2012 (Cth)
- Health Records and Information Privacy Act 2002 (NSW)
- Children’s Guardian Act 2019 (NSW)
- Child Protection (Working with Children) Act 2012 (NSW)
- Child Protection (Working with Children) Regulation 2013 (NSW)
- Children and Young Persons (Care and Protection) Act 1998 (NSW)
- Crimes Act 1900 (NSW)
- Children and Young Persons (Care and Protection) Regulation 2012 (NSW)
- Children and Young Persons (Care and Protection) (Child Employment) Regulation 2015
- ISO 31000:2018
Rosebank Related Documents
- Staff Code of Conduct
- Surveillance Policy
- Data Breach Response Plan
- Employment Collection Notice
- Standard Collection Notice
- Records Management Policy and Procedure
- Record Retention Schedule
- Notifiable Data Breach Form
Review
The College will review this policy every 24 months or earlier if required due to legislative or organisational changes.
| Policy details | Date |
|---|---|
| Policy date | August 2026 |
| Next review date | August 2028 |
| Previous versions | May 2023 |