Delivered by Onshift Education (RTO 41304). Last updated 17 July 2026. DRAFT — under review before public launch.
Onshift Education operates this online learning platform. This policy explains what personal information we collect, why we collect it, how we protect it, and the rights you have over it — wherever you are in the world. It is written to meet the Australian Privacy Act 1988 (including the Australian Privacy Principles), the EU General Data Protection Regulation (GDPR), the UK GDPR, and applicable United States state privacy laws.
Account information: your name, email address, and sign-in identifiers.
Learning and assessment records: your course progress, saved responses, feedback you receive, declarations you make, and — where you study toward a nationally recognised outcome — the assessment evidence an assessor reviews.
Files you upload to your private portfolio (for example prior credentials), which are virus-scanned before staff can view them.
Payment records: our payment provider (Stripe) processes card payments; we never store your card number. We keep a payment reference for each purchase.
Support and communication records: support requests, messages in your inbox, and records of assistance we provide.
Technical data needed to run the service: session tokens and basic device/browser information.
To deliver your training and keep your learning record accurate (performance of our contract with you).
To meet legal obligations that apply to registered training organisations in Australia — including retaining assessment outcome records for up to 30 years and assessment work for at least 2 years where required (legal obligation).
To keep the platform safe, prevent misuse, and maintain the integrity of assessment (legitimate interests, balanced against your rights).
Where we rely on consent (for example optional communications), you can withdraw it at any time.
On the non-accredited, knowledge-only pathway, the platform generates study feedback automatically, including readiness indicators and writing-quality hints. These support your study; they are shown to you and, where relevant, to our staff. Every nationally recognised training outcome is decided by a qualified human assessor — never automatically.
Encryption in transit and at rest; least-privilege access controls for staff.
Your records are kept on an append-only basis — assessment history is never silently edited or deleted.
Portfolio uploads are stored privately, scanned before staff access, served only through short-lived links, and every staff access is logged.
Service providers who help us run the platform (hosting and database, payment processing, email delivery, and AI text services used to generate study feedback). Each processes only what it needs.
Regulators and government bodies where the law requires it (for example Australian VET regulators for accredited training records).
We do not sell your personal information.
Some service providers process data outside your country. Where that happens, we rely on recognised safeguards (such as standard contractual clauses for EU/UK data) and choose providers with strong security postures.
Accredited assessment outcomes: up to 30 years, as required of Australian RTOs. Assessment work and course records: at least 2 years. Account and support records: for the life of your account plus any legally required period. Where no legal retention applies, we keep data only as long as needed for the purposes above.
Wherever you live, you can ask us to: access the personal information we hold about you, correct it, delete it (where legal retention duties do not prevent deletion — some training records must be kept by law), restrict or object to processing, and receive a portable copy of data you provided.
EU/UK: you also have the right to lodge a complaint with your supervisory authority. Australia: you may complain to the Office of the Australian Information Commissioner (OAIC). US state residents: you may have rights to know, delete, correct, and opt out of sale/sharing (we do not sell data), without discrimination for exercising them.
For any privacy question, request, or complaint, contact us through the support page and mark it “Privacy”. We respond to verified requests within the timeframe your local law requires.