At Pilates ITC, we value your privacy and are committed to handling your personal information responsibly, securely and transparently.

Throughout your relationship with Pilates ITC, we need to collect and manage information about you so we can process your enrolment, deliver your training and assessment, provide Student Services, maintain required records and meet our obligations as a Registered Training Organisation (RTO).

This policy explains:

• what information we may collect;

• why we collect and use it;

• the systems and service providers we may use to manage it;

• when information may be disclosed;

• how records are protected and retained; and

• your rights in relation to the personal information we hold.

Pilates ITC manages personal information in accordance with applicable requirements, including the Privacy Act 1988 (Cth), the Australian Privacy Principles (APPs) and our regulatory obligations as an RTO.

• Personal Information: Information or an opinion about an identified individual, or an individual who is reasonably identifiable.

• Sensitive Information: Certain categories of personal information that receive additional protection under privacy law, such as health information.

• Student Data: Personal, enrolment, academic, assessment, Work Placement, communication, financial or other information collected or generated in connection with your relationship with Pilates ITC.

• Student Management System (SMS): Ready Student by ReadyTech, the system Pilates ITC uses to manage enrolment, Student records, course administration, compliance and other aspects of the Student lifecycle.

• Learning Management System (LMS): aNewSpring, the digital learning platform used by Pilates ITC to deliver course content, learning activities, resources and assessment-related activities.

• Student Portal: The Student-facing portal connected with Pilates ITC's Student management systems and used to access applicable enrolment, scheduling and administrative information.

• Third-Party Provider: An external service provider used by Pilates ITC to support functions such as Student management, learning delivery, communications, payments, technology or regulatory reporting.

• USI: Unique Student Identifier used within Australia's nationally recognised training system.

This policy applies to:

• all prospective, current and former Pilates ITC Students;

• undergraduate and postgraduate Students;

• Pilates ITC staff, Educators, Assessors and contractors who may access Student information as part of their role; and

• third-party service providers that process information on behalf of Pilates ITC.

The information we collect depends on your relationship with Pilates ITC and the course or service you are accessing.

This may include:

• full name;

• date of birth;

• residential and postal address;

• email address;

• telephone number;

• emergency contact details; and

• identification information where required.

This may include:

• Unique Student Identifier (USI);

• enrolment information;

• previous education or training information;

• eligibility information;

• course and pathway details;

• study mode;

• commencement and completion information; and

• information required for government or regulatory reporting.

As you progress through your course, we may collect and maintain information such as:

• LMS activity and course progress;

• completed learning activities;

• assessment submissions;

• assessment outcomes;

• Educator or Assessor feedback;

• Practical Assessment evidence;

• Work Placement records and Logbooks;

• attendance and participation records where applicable;

• correspondence relating to your studies; and

• records relating to your academic progression and completion.

This applies to both undergraduate and postgraduate Students, with the particular records collected depending on the requirements of your course or pathway.

Where relevant and reasonably necessary, we may collect sensitive information such as:

• health or medical information relevant to safe participation;

• information provided in support of a Reasonable Adjustment;

• information relevant to an extension, deferment, complaint or other Student request; or

• other sensitive information required to appropriately support your participation or meet our legal obligations.

Sensitive information is handled with additional care and only collected, used or disclosed where permitted by law.

We may collect information required to manage:

• tuition fees;

• payment plans;

• invoices;

• refunds;

• payment status; and

• other financial transactions associated with your enrolment.

Where payments are processed through an external payment provider, payment card or bank information may be collected and securely processed by that provider rather than being stored directly within Pilates ITC's Student systems.

Pilates ITC uses a number of digital systems and trusted service providers to deliver and administer your course.

Ready Student by ReadyTech is Pilates ITC's Student Management System.

It is used to manage information relating to areas such as:

• enrolment and Student records;

• course and training information;

• Student administration;

• progression and outcomes;

• compliance and reporting;

• certification; and

• other aspects of the Student lifecycle.

ReadyTech states that Ready Student data is stored and processed within Australia using the AWS Sydney region and that the customer retains ownership of its data. ReadyTech also describes its information security management system as aligned with ISO 27000 standards and independently audited.

ReadyTech Privacy Policy

aNewSpring is Pilates ITC's Learning Management System.

When you're registered within aNewSpring, information required to provide and manage your learning experience may be processed through the platform.

Depending on your course and how the LMS is configured, this may include information such as:

• your name and contact information;

• course enrolment and access;

• learning activity;

• course progress;

• assessment-related information;

• submissions and responses;

• completion information; and

• other information generated through your use of the LMS.

aNewSpring states that it is ISO 27001 certified and uses secure connections to protect information transmitted through its services.

aNewSpring Privacy Information

Pilates ITC may use external payment providers to process tuition fees, payment plans and other transactions.

These may include:

• Debit Success Australia — for applicable Australian Student payment arrangements;

• Stripe — for applicable one-off and international payments; and

• Ezidebit — for some legacy enrolments where this payment arrangement remains active.

Your payment provider may collect and process information according to its own privacy policy and terms.

Pilates ITC takes reasonable steps to protect the personal information we hold from misuse, interference, loss and unauthorised access, modification or disclosure.

Depending on the type of information and system, safeguards may include:

• password-protected systems;

• role-based or authorised access;

• limiting access to staff and contractors who require the information to perform their role;

• secure digital storage;

• appropriate security controls within third-party platforms;

• secure handling of assessment and Student records;

• physical security for any records retained in hard copy; and

• internal privacy, security and record-management procedures.

Our third-party technology providers also maintain their own security measures for information processed within their systems.

We collect, use and manage Student information where reasonably necessary to administer your relationship with Pilates ITC and meet our legal and regulatory responsibilities.

This may include:

• processing enquiries and applications;

• managing your enrolment;

• establishing and maintaining your Student account;

• providing access to Ready Student, your Student Portal and aNewSpring;

• delivering coursework, learning resources and Student Services;

• monitoring course progress;

• administering Work Placement;

• receiving and assessing assessment evidence;

• providing assessment feedback;

• managing fees and payments;

• communicating with you about your course;

• verifying your USI;

• managing extensions, deferments, withdrawals and other enrolment changes;

• responding to complaints, appeals or Student support matters;

• determining course completion;

• issuing Certificates, Records of Results and Statements of Attainment where applicable;

• maintaining required Student and training records; and

• completing required regulatory and government reporting.

We only use or disclose personal information for purposes permitted under applicable privacy law.

To deliver nationally recognised training and administer your enrolment, Pilates ITC may need to disclose relevant information to authorised third parties.

These may include:

• the Australian Skills Quality Authority (ASQA);

• the National Centre for Vocational Education Research (NCVER);

• government departments and agencies;

• the USI Registrar;

• regulators or authorities where disclosure is required or authorised by law;

• ReadyTech;

• aNewSpring;

• payment providers;

• technology and service providers supporting course administration or delivery; and

• other parties where you have authorised the disclosure or it is otherwise permitted by law.

We aim to limit disclosures to the information reasonably required for the relevant purpose.

The Australian Privacy Principles govern how covered organisations collect, use, disclose, secure and provide access to personal information.

Australian Privacy Principles information from the OAIC

Protecting Student information is a shared responsibility.

When accessing Pilates ITC systems, you're responsible for:

• keeping your login details and passwords secure;

• not sharing your LMS or Student Portal access with another person;

• using secure devices and internet connections where reasonably possible;

• protecting confidential Client information contained within Work Placement or assessment materials;

• following assessment authenticity requirements;

• ensuring information you provide to Pilates ITC is accurate and current; and

• notifying us if you believe your account or personal information may have been compromised.

This is particularly important where assessment or Work Placement evidence contains information about Clients or other third parties. Only include personal or sensitive Client information where required, and follow the privacy and confidentiality requirements contained within your course and Work Placement guidance.

Pilates ITC retains Student and training records for the periods required by applicable legislation, regulatory requirements and our record-management obligations.

Different types of records may have different retention periods. This includes:

• training and qualification records required to demonstrate nationally recognised training outcomes;

• assessment and course records;

• financial and transaction records;

• enrolment and administrative records; and

• records associated with regulatory or legal requirements.

Where long-term records of nationally recognised training outcomes are required to be retained, Pilates ITC maintains these in accordance with applicable RTO record-retention requirements.

Financial records are generally retained for the applicable statutory record-keeping period.

Once information is no longer required to be retained, Pilates ITC will take reasonable steps to securely destroy or de-identify it where appropriate and permitted by law.

Pilates ITC takes suspected privacy and data breaches seriously.

If we become aware of a suspected breach, we will take appropriate steps to:

• identify and contain the incident;

• assess what information may have been affected;

• investigate the cause and potential impact;

• take steps to reduce the likelihood of further harm;

• determine whether notification obligations apply; and

• implement appropriate corrective or preventative action.

Where a breach is likely to result in serious harm and meets the requirements of the Notifiable Data Breaches scheme, Pilates ITC will notify affected individuals and the Office of the Australian Information Commissioner as required.

Notifiable Data Breaches scheme – OAIC

You can request access to personal information Pilates ITC holds about you or ask us to correct information you believe is inaccurate, incomplete or out of date.

To make a request:

1. Contact Student Support in writing.

2. Clearly identify the information you would like to access or correct.

3. Complete any reasonable identity verification requested by Pilates ITC.

We will respond within a reasonable timeframe and in accordance with applicable privacy requirements.

In some circumstances, there may be legal reasons why access to particular information cannot be provided. If this applies, we'll explain this to you where required.

If you believe your personal information has not been handled appropriately, please contact Pilates ITC so we have the opportunity to review and respond to your concern.

You can also raise a formal concern through our Complaints and Appeals Policy.

Privacy concerns will be handled sensitively and in accordance with applicable privacy and regulatory requirements.

Where applicable, you may also have the right to make a complaint to the Office of the Australian Information Commissioner (OAIC).

Office of the Australian Information Commissioner

If you have questions about your personal information, would like to request access or correction, or have a privacy concern, please contact our Student Support Team.

Visit our Contact Us page for current contact details.

This policy complies with:

Clause 8.5 of the Standards for RTOs 2025: Ensuring all RTOs meet their legislative and regulatory obligations, including in data privacy.

Australian Privacy Principles (APPs): Governing how your personal data is collected, used, and protected.

Privacy Act 1988 (Cth): The national law that ensures privacy rights are respected across education and business.

 Disclaimer: This Policy / Procedure when printed, this becomes an uncontrolled document. 

Policy# P-COU-027 

Version Control Table