Data retention, export and deletion

#01Purpose and status

This page explains how long records in Academyship are kept, who decides, what brings each retention period to an end, how records can be exported, and what happens when information is deleted or an Institution stops using Academyship. It is published by ACADEMYSHIP PTY LTD (ACN 698 283 448, ABN 89 698 283 448) ("Academyship", "we", "us").

This page is an information schedule. It is not a contract and does not form part of the Terms of Service or the Data Processing Addendum unless a signed Order Form expressly says so. The contractual commitments on backups, export, termination and deletion are in section 22 and section 23 of the Terms of Service, and in section 20 and Annexes I and II of the Data Processing Addendum (DPA). This page explains those commitments in more detail. It does not reduce them, and if it ever appears to conflict with them, the Terms, the DPA or the applicable Order Form govern.

Capitalised terms such as Institution, User, Customer Data, Tenant, Sensitive Information, Regulated Identifiers, Fees and Order Form have the meanings given in the Terms, the DPA and the Privacy Policy. "Institution Charges" means amounts an Institution charges its students, payers or others (for example, tuition, instalments, canteen purchases, library fines or booking fees). Those are different from Academyship's own Fees.

Not every module described below is available to every Institution. Modules are available by plan and configuration, and a row applies only where the Institution uses that feature.

#02Key terms: deleting is not the same as archiving

Several actions can make information disappear from view. They have very different effects, so this page uses the following terms consistently.

#03Who decides how long records are kept

Records in an Institution's workspace. The Institution controls the records in its workspace and decides how long they are kept, subject to the laws that apply to it. Those can include education, vocational training, employment, tax, financial, health-records, child-safety and (for public bodies) public-records and state or territory privacy laws. Academyship stores and processes those records on the Institution's instructions under the DPA. Academyship does not decide, for example, how long a school keeps a behaviour record or how long a training organisation keeps assessment evidence.

Records Academyship controls. Academyship decides how long it keeps its own business records (for example, customer contacts, its own billing, contract and acceptance records, support tickets and complaints) and the technical records it needs to run and secure the service (for example, infrastructure and security logs and backups). Academyship also sets platform rules that apply across workspaces, such as how long sign-in events are kept and how long a generated download remains available.

Records held by others. Payment providers, banks, email and calendar services chosen by a User, Institution-selected Integrations and government recipients keep their own copies under their own obligations. See section 13.

Whoever decides, the same principles apply:

• keep information only for a clear purpose, and only for as long as that purpose or a legal obligation requires;
• do not keep detailed histories indefinitely simply because storage is inexpensive;
• prefer deletion or de-identification once a record is no longer needed, as Australian privacy law generally requires for personal information an organisation no longer needs, unless the law or a court or tribunal order requires it to be kept;
• keep sensitive records, such as welfare notes, identity-document images, dietary and health details and Regulated Identifiers, for shorter periods and with tighter access where the law allows; and
• do not confuse the end of an Academyship subscription with the end of an Institution's own legal duty to keep records.

#04How to read the schedule

Schedules A to E below group records by type. Each row states:

• Responsible decision-maker: who sets the retention period;
• Purpose and retention rule: why the record is kept and the rule that decides how long;
• What ends the period: the event that brings retention to an end, such as the Institution's own period expiring, a record being deleted, or the end of the export window after an Institution leaves;
• Export and access: how the record can be obtained;
• Deletion and backup exceptions: what can remain after deletion; and
• Contact and reference: where to go with a question.

A retention rule is different from a legal minimum period, from a period an Institution configures, from the event that triggers deletion, from how often a clean-up process runs, and from how long a copy can remain in a backup. This page states a fixed number only where Academyship has committed to that number: infrastructure and security logs are kept for 30 days; Customer Data remains available for authorised export for at least 60 days after termination or expiry; and platform backups keep 30 daily, 15 weekly and 7 monthly recovery points. Each of those numbers applies only to the records it describes. Where no number is stated, the rule, the decision-maker and the ending event are stated instead.

To keep the tables readable, they use these short forms:

• "Standard exceptions" means: information under a legal hold (section 12); copies in platform backups until the recovery points that contain them expire (section 10); and copies outside Academyship's control (section 13).
• "Workspace export" means: authorised Institution administrators can export the record through Academyship's export functions during the subscription and during the export window after termination. When an Institution leaves, it can export all of its records, including attachments, audit trails and signing evidence (section 14). Students, staff, guardians and other individuals ask the Institution for access.

#05Schedule A: admissions, academic and credential records

#06Schedule B: student services and operations

#07Schedule C: money, payroll and signing

#08Schedule D: accounts, messages, logs and technical records

The 30-day rule applies to infrastructure and security logs. It does not apply to business audit trails kept inside an Institution's workspace, such as the history of changes to a record, signing evidence or the record of who viewed or exported a sensitive field. Those trails are part of the Institution's records and follow the row for the record they relate to.

#09Schedule E: Academyship's own records

Academyship is the responsible entity for these records under the Privacy Policy. Where they contain Customer Data (for example, a screenshot attached to a support ticket), Academyship also handles that Customer Data under the DPA.

#10Deletion, backups and restoration

What deletion covers

When information is permanently deleted, Academyship removes it from its active systems. Deletion includes associated uploaded files, derived previews, search indexes and AI-related indexes where applicable. Academyship's deletion process also covers the other copies Academyship controls, including copies held for it by the infrastructure providers it appoints: stored versions of uploaded files, generated documents and exports, temporary processing copies such as queues and caches, and copies made for support. Where a feature first places a record into a recoverable deleted state (soft deletion), that record remains stored until it is permanently deleted.

During the subscription, authorised Institution Users delete workspace records using the platform's deletion functions, within the permissions the Institution assigns. Academyship deletes Customer Data on the Institution's documented instructions, subject to the DPA.

Backups

Academyship maintains daily backups of the platform in Sydney, Australia (ap-southeast-2), with 30 daily recovery points, 15 weekly recovery points and 7 monthly recovery points, together with recovery procedures and a defined backup-expiry lifecycle. Backups exist to recover the platform after an incident. They are not used for ordinary access to records, and they are not a substitute for an Institution's own records management.

Deleting information from active systems does not immediately remove it from backups. A deleted item can remain in a backup recovery point taken before the deletion until that recovery point expires in the ordinary backup cycle. Backup expiry is not the same as deletion from active systems, and the backup cycle is not a retention period for active records.

Restoring from a backup

Where an Institution asks Academyship to help recover records it deleted by mistake, the Institution decides what is restored, and the restored records become part of its workspace again.

Confirmation of deletion

On written request, Academyship will provide confirmation of deletion. A specific certified-deletion process or a shorter timeframe may be agreed in an Order Form.

#11De-identification and small groups

Academyship does not use identifiable Customer Data outside the Institution's instructions. Under the DPA, Academyship may use Aggregated or De-identified Data, meaning data that does not identify an Institution or an individual and is not reasonably capable of re-identification by Academyship, for purposes such as service improvement, security and benchmarking.

Removing names is not enough. In education settings, small classes, small schools, rare courses, rare combinations of attributes (such as a disability, a language background and a year level), free-text notes and dates can identify a person even without a name. Before Academyship treats information derived from Customer Data as de-identified or aggregated, it applies these safeguards:

• direct identifiers, Regulated Identifiers and free-text fields are removed;
• detailed values are grouped into broader categories where detail is not needed;
• results are produced only for groups above a minimum size, and small counts are suppressed or combined;
• an Institution is not identified, directly or by reference to features that point to it;
• de-identified information is not combined with other information in a way that could re-identify people;
• access to de-identified datasets is restricted, and Academyship personnel and any recipient are prohibited from attempting re-identification; and
• the re-identification risk is reassessed before de-identified information is shared outside Academyship or used for a new purpose.

If information that was treated as de-identified turns out to be reasonably identifiable, Academyship treats it as personal information again, deals with it under the DPA and the Privacy Policy, and handles any resulting risk under its incident process. De-identification is not a way to keep an Institution's records after it leaves: identifiable Customer Data is deleted under section 14.

#12Legal holds

A legal hold preserves specified information that would otherwise be deleted, because a law, a court or tribunal, a regulator, a valid preservation request from law enforcement, an actual or reasonably anticipated legal claim, a complaint or dispute being handled, or an open security investigation requires it.

• Who can authorise a hold. An Institution can ask Academyship to preserve Customer Data in its workspace. Academyship applies a hold on its own initiative only where it is required or permitted by law, responding to valid legal process, investigating a security incident, handling a complaint or dispute, or establishing or defending a legal claim. Each hold is approved by a designated Academyship decision-maker and recorded.
• Telling the Institution. Academyship will tell an affected Institution about a hold over its Customer Data unless the law or the terms of the request prevent it.
• Scope and access. A hold covers only the information needed for its purpose. Held information is kept with restricted access and is not used for any other purpose.
• Review and release. Holds are reviewed periodically. When a hold is no longer required it is released, and ordinary deletion then resumes, including deletion that was postponed because of the hold.

A legal hold does not give Academyship any broader right to use the held information.

#13Copies outside Academyship's control

Some copies of information leave Academyship's systems in the ordinary course of using the platform. Academyship cannot delete them, and deleting the original in Academyship does not recall them. They include:

• files exported or downloaded by an Institution or its Users, and printouts or screenshots;
• emails, SMS messages and notifications already delivered to recipients;
• entries a User has added to an external calendar such as Google, Outlook or Yahoo, or through a calendar file, which send selected event details to that calendar provider;
• certificates, letters, signed documents and other files delivered to holders, signers or other recipients;
• records held by payment providers, banks and superannuation funds about payments and authorities;
• information an Institution sends to government agencies, regulators or other bodies;
• information shared with services an Institution chooses to connect (Integrations); and
• information stored in a person's own browser or device.

To ask for one of these copies to be deleted, contact the organisation or person holding it. The Institution can often help with recipients it chose.

This does not reduce Academyship's own obligations. Academyship deletes the copies it controls, including copies held for it by the subprocessors it appoints, in line with this page, the Terms and the DPA.

#14Leaving Academyship: export and exit

When an Institution stops using Academyship, its records do not simply disappear, and its own legal duties to keep records do not end. The exit process works as follows.

1. Plan early. Before the subscription ends, the Institution should identify the records it must keep under the laws that apply to it, such as academic, assessment, credential, payroll, financial and safeguarding records, and plan how it will keep them after it leaves. Academyship is not the Institution's long-term archive unless an Order Form provides for separately agreed hosting.
2. Authorised request. Cancellation, non-renewal or termination is given by an authorised representative, as described in section 9 and section 30 of the Terms of Service and the Order Form. Academyship may confirm a person's authority before giving exit-period access or acting on a deletion request.
3. What can be exported. The Institution can export all of its records, including attachments, audit trails and signing evidence, in commonly used formats. Authorised administrators do this through Academyship's export functions. Additional migration or transition help is available where agreed in writing, at agreed charges.
4. Secure delivery. Exports are delivered through the authenticated export functions in the platform, or by another secure method agreed in writing. They are not sent as ordinary email attachments.
5. Checking the export. The Institution should check that its exports are complete and readable (for example, by comparing record counts and opening a sample of files) while the export window is still open. If an export fails or appears incomplete, Academyship will investigate and help the Institution obtain the records it still holds.
6. Time to download. Following termination or expiry, Academyship makes Customer Data available for authorised export for at least 60 days, unless a different period is stated in an Order Form or required by law. During that period, access may be limited to export and transition functions.
7. Reminder. Academyship will notify the Institution's account contacts before the export window closes.
8. Billing disputes. Academyship will not withhold access to an otherwise available Customer Data export solely because of a good-faith billing dispute.
9. Deletion. After the export window, Academyship deletes Customer Data from active systems in the ordinary course, and backup copies expire through the backup lifecycle described in section 10. Legal holds and legal retention requirements override deletion.
10. Confirmation. On written request, Academyship will confirm deletion.

If an account is suspended, terminated for non-payment, or trial access expires, export and deletion rights follow the Terms, the Order Form and applicable law.

What ending the subscription does not do

• It does not cancel a payer's payment authority (such as a PayTo mandate) or any Institution Charge that is owed. Those are matters between the payer, the Institution and the payer's bank. See Payments and Wallets.
• It does not settle wallet balances. These are dealt with as explained in Payments and Wallets.
• It does not end the Institution's own legal obligations to keep records.
• It does not delete copies outside Academyship's control (section 13).

After exit, Academyship keeps its own records about the relationship (such as contract, acceptance, billing, support and complaint records) under Schedule E.

#15Requests about your own information

Records in an Institution's workspace. If you are a student, guardian, staff member or other person whose information is held in an Institution's workspace, ask that Institution to see, correct or delete it. The Institution decides, because it controls those records and may be legally required to keep some of them. Academyship assists the Institution as described in the DPA.

Records Academyship controls. For information Academyship holds in its own right, contact privacy@academyship.com.au. Academyship will check your identity in a way that is proportionate to the request, will not ask for more identity information than it needs, and will explain its decision.

Australian privacy law does not give an unconditional right to have every record erased. It does require organisations to take reasonable steps to destroy or de-identify personal information they no longer need for a permitted purpose, unless the law or a court or tribunal order requires it to be kept. Academyship applies that rule to the records it controls.

#16Keeping this schedule accurate

Academyship reviews this schedule at least annually, and whenever a module, a retention rule, a clean-up process, the backup lifecycle or an export function changes. A rule is published here only when Academyship can operate it. Earlier versions of this page are kept, and changes are listed in the change history below.

If you think a record has been kept longer than this page describes, or deleted when it should have been kept, contact privacy@academyship.com.au or make a complaint as described on the Complaints page.

#17Contact, related documents and change history

Questions about retention, export or deletion: privacy@academyship.com.au. Technical help with an export: support@academyship.com.au. Complaints: complaints@academyship.com.au. If you need this page in another format, contact accessibility@academyship.com.au.

Terms of Service Data Processing Addendum Privacy Policy Cookie Policy Responsible AI Support Child Safety Complaints Payments and Wallets Electronic Signatures Education Operations