Last updated: 14 October 2026 

1. About this policy

Who we are 

In this policy, Campion, we, us or our means Campion Education (Aust) Pty Ltd ABN 33 074 318 602. Campion supplies educational resources and education technology services to Australian schools, families and other customers. Schools may contract with Campion as organisational customers for booklists, ordering services, digital resources, subscriptions and CuratED education products used by their authorised teachers, support staff and students. Campion also supplies resources directly to parents, guardians, students and other retail or online customers. 

Our privacy commitment and legal obligations 

We are committed to managing personal information openly and transparently. We handle personal information in accordance with the Privacy Act 1988 (Cth), the Australian Privacy Principles (APPs), the Privacy (Tax File Number) Rule 2015 and other laws that apply to our activities, including spam, consumer, employment, work health and safety, taxation and recordkeeping laws. Because much of the information we handle is about school students, we hold ourselves to the standards expected of suppliers to Australian schools, including the transparency standards of the Safer Technologies 4 Schools (ST4S) program. 

Who this policy applies to 

This policy explains how we usually handle personal information about: 

• Teachers, support staff, school administrators and other school representatives, in connection with school booklists, ordering, account administration, digital resources, subscriptions and CuratED education products. 
• Students, including students whose accounts or access are arranged by their school, parent or guardian. 
• Parents, guardians and individual customers who order, purchase or enquire in store, online or by phone. 
• People who use our websites, subscribe to communications, respond to surveys or contact our support teams. 
• Job applicants, employees and other members of our workforce. 

Because teaching/support staff, student, customer and workforce information are handled in different systems, for different purposes and under different legal settings, this policy deals with each group in its own section. 

How this policy and collection notices work together 

This is Campion’s main privacy policy. It may be supplemented by a collection notice or other information provided for a particular service or interaction, and by the Sub-processors and Third Parties page described in section 10. Any such notice should be read with this policy. 

Terms used in this policy 

Personal information means information or an opinion about an identified individual, or an individual who is reasonably identifiable, whether or not it is true or recorded in a material form. 

Sensitive information is personal information that attracts additional protection, such as health information. We collect sensitive information only with consent where it is reasonably necessary for our functions or activities, or as otherwise permitted by law. 

 

2. Teacher, School Customer, Support staff Information

This section explains how we handle personal information about people who represent, administer or participate in a school’s relationship with Campion, including school leaders, procurement and finance contacts, digital-learning staff, system administrators, teachers and support staff. Most teacher and support staff information we hold relates to the provision of educational resources, digital resources and subscription-based online services. 

What we collect 

We may collect: 

• name, role, school, business contact details and authority to act for the school; 
• school email address, used for account creation, authentication and single sign-on; 
• subscription, trial, licence and service selections; 
• account, access, support, implementation and training records; 
• billing, purchase-order and payment-status information connected with the school account; 
• communications, feedback, complaints, and records of decisions or instructions given for the school; 
• digital access details, including accounts, credentials, licence entitlements and records of access to digital resources and services; 
• where a school’s configuration requires it, class or subject information; and 
• where a teacher or support staff member uses an education product described in section 9, information collected through that product, such as work submitted for feedback or service–related interactions. 

We do not collect teachers’, or support staff members dates of birth, home addresses or personal phone numbers, and we do not ask for more personal information than is reasonably required to provide the relevant services. 

How we collect it 

We collect this information from: 

• the individual concerned; 
• the school; 
• authorised school systems and integrations; 
• persons nominated by the school; and 
• secure import, synchronisation and integration channels controlled by the school. 

Where information is provided by a school, the school remains responsible for the notices, permissions and consent arrangements applicable to that information, and we support schools in meeting those obligations. 

Why we collect and use it 

We use this information to: 

• establish, manage and administer our relationship with schools; 
• enter, perform and manage agreements with schools; 
• prepare and deliver educational resources and services; 
• provision, manage and support access to digital resources, subscriptions and online services; 
• manage licences, renewals, implementations and training activities; 
• issue invoices and administer billing processes; 
• provide customer support and respond to enquiries, feedback and complaints; 
• communicate service, product, operational and security notices; 
• maintain records for legal, audit, compliance and recordkeeping purposes; and support the operation of education products described in section 9. 

Disclosure 

We may disclose this information where reasonably necessary for the purposes described above: 

• to the relevant school and its authorised representatives; 
• to educational publishers and education product providers so that purchased, licensed or provisioned resources can be made available to the relevant users. The information typically shared includes first name, surname and school email address and, where applicable, class or class-code information; 
• to operators of education products described in section 9 where a school or family chooses to use those products; 
• to technology, implementation, hosting and support providers engaged by us; 
• to professional advisers, auditors, insurers and regulators; and 
• where otherwise required or authorised by law. 

Any disclosure is limited to information reasonably necessary for the relevant service, product or legal purpose. 

Our commitments for teacher/support staff information 

• We do not sell personal information of the school representatives, teachers or support staff. 
• We do not use personal information for advertising unless the individual has consented, or another lawful basis applies. 
• We do not use identifiable personal information to train artificial intelligence models. Where an education product uses AI, the safeguards applicable to that product are described in section 9. 
• We do not use or disclose personal information for purposes beyond those described in this policy without consent, unless required or authorised by law. 

 

3. Student information

This section explains how we handle personal information about students. Most students we hold information about are children, and we treat that information with particular care. 

What we collect 

• identity and school details: name, school, year level and, where a school’s configuration requires it, class or subject; 
• school email address, used for account creation and single sign on; 
• ordering details: the resources ordered for a student and related delivery references; 
• digital access details: accounts, credentials and licence entitlements for digital resources/subscriptions, and records of resource access; and 
• where a student uses an education product described in section 9, the information that product collects, such as written work submitted for feedback. 

Campion does not normally require a student date of birth, home address or personal phone number for school resource provisioning. A parent or guardian’s delivery and contact details may be collected for order of fulfilment. 

How we collect it 

We usually collect student information from the student’s school, through secure import and integration channels that the school controls, under our agreement with the school. We also collect it from a parent or guardian when they place an order naming a student, and from the student or their family when a student account is registered or used. Schools remain responsible for the notice and consent settings that apply to the information they provide to us, and we support schools in meeting those responsibilities. 

Why we collect, use and disclose it 

We use student information to prepare and fulfil booklist orders, match orders and payments to the right student, deliver resources, provision access to digital resources, provide support, and administer our agreements with schools. We disclose student information only where it is necessary for those purposes: 

• to the student’s school, in connection with its resource and ordering program; 
• to educational publishers/providers, so that a purchased digital resource and subscriptions can be made available to the student it was bought for. The standard information shared is the student’s first name, surname, school email address and year level. Where we set up classes for a school, class codes are also shared. The disclosure is tied to the resources purchased and is not a broadcast of student lists; 
• to delivery providers, limited to the details needed to deliver an order; and 
• to the operators of education products described in section 9, where a school or family takes up that product. 

Our commitments for student information 

• We do not sell student personal information. 
• We do not use student personal information for advertising, and we do not show advertising to students in our platforms. 
• We do not use identifiable student information to train artificial intelligence models. Where an education product uses AI, section 9 explains the safeguards that apply. 

We do not use or disclose student information for purposes beyond those described in this policy without consent, unless required or authorised by law. 

 

4. Individual customer, parent and guardian information

This section explains how we handle personal information about parents, guardians and other customers, including website visitors and people who contact us. 

What we collect 

• identity and contact details: name, email address, phone number and communication preferences; 
• billing and delivery addresses, orders and purchase history, and payment status. Card payments are processed by our payment gateway; we do not hold full card numbers in our ordering systems; 
• account details, where you create an account, secured with one-time codes rather than stored passwords in our ordering platforms; 
• enquiry, feedback, survey and complaint content, and records of our communications with you, including calls to our support centre; and 
• website, device and usage information described in section 7. 

How we collect and use it 

We collect this information directly from you when you order, register, enquire, respond to a survey or deal with us in store, online or by phone. We use it to process and deliver orders, take payment and manage refunds, verify addresses, operate customer accounts, respond to enquiries and complaints, improve our services, maintain safety and security in our stores and premises, prevent fraud, and send communications as described in section 6. Our retail counters and premises may use CCTV for safety and security; where CCTV operates, signage is displayed. 

Buying without providing your details 

You can deal with us anonymously where it is practicable. Over-the-counter purchases that do not require delivery or an account can be made without providing personal details, and staff will offer that option. For orders that must be matched to a student, delivered, or managed through an account, we need the information reasonably required for that purpose, and without it we may be unable to provide the service. 

 

5. Employee and applicant information

This section explains how we handle personal information about job applicants, employees and other members of our workforce. It focuses on the categories of workforce information that matter most: pay, tax, superannuation, health and recruitment records. 

Job applicants 

To assess applications we collect identity and contact details, employment history, qualifications and application information, interview and reference information and, where relevant and permitted, background and police check information. We collect this from you and, where relevant, from recruitment platforms, referees and screening providers. If you do not provide information that is reasonably required, we may be unable to assess your application. 

Employees and other workforce members 

During employment we also collect and hold employment, remuneration, payroll, taxation, superannuation, banking and benefit information; emergency contact details; attendance, leave, training and performance information; and health information where relevant, such as medical certificates, injury reports and workers compensation information. We use this information to manage the employment relationship, pay wages and entitlements, meet tax, superannuation and reporting obligations, manage health, safety, incidents and claims, and provide training. External recipients include our payroll, superannuation, timekeeping, training and recruitment providers, government agencies, insurers and professional advisers. 

Tax file numbers 

Tax file number information is collected and used only as authorised by taxation, superannuation and related laws, and is handled in accordance with the Privacy (Tax File Number) Rule 2015. It is disclosed only to the Australian Taxation Office, superannuation funds and our payroll provider as required to administer those obligations.  

The employee records exemption 

The Privacy Act contains an employee records exemption for some acts and practices of private sector employers directly related to a current or former employment relationship. The Privacy Act continues to apply to information and activities outside the scope of that exemption, including job applicant information and tax file number information, and this policy describes our usual handling in any event. 

 

6. Direct marketing

Where permitted, we use customer contact details and preferences to send news, product, offer and back-to-school communications by email or SMS. We comply with applicable privacy and spam requirements. Marketing lists are separate from the service messages we must send to manage an order, such as order confirmations, payment and delivery updates and reminders about an incomplete order. 

You can opt out of marketing at any time using the unsubscribe facility in the message or by contacting us, and we maintain suppression records so that an opt-out sticks. We do not send marketing to students, and we do not use student information for marketing. You may also ask us to stop using or disclosing your personal information to facilitate direct marketing and, where we obtained marketing information from another source, ask us to identify that source as required by law. 

 

7. Websites, cookies and digital tracking

When you use our websites, systems may record your IP address, device and browser information and information about how and when you use the service. Our customer facing websites use cookies and similar technologies, including analytics tags and, on some pages, an advertising pixel, for essential and functional purposes, to measure use and performance, and to measure campaigns. Where hashed contact details are used to create advertising audiences, that use is limited to customer information; we do not build advertising audiences from student information and ordering journeys used by students are not used for advertising. 

You can delete or block cookies in your browser and adjust platform advertising settings. Blocking strictly necessary technologies may prevent a service from working. Our sites may link to services operated by others, whose privacy policies apply to their independent handling. 

 

8. Automated decision-making

We use computer programs in the following context where the program may make a decision solely or do something substantially and directly related to making a decision, that could reasonably be expected to significantly affect an individual’s rights or interests. 

Payment and fraud screening. Payment systems, including systems operated by our payment gateway, may automatically decline or block a payment based on suspected fraud or unlawful activity; these are decisions made solely by the program. For a human-made decision, a system may generate a fraud or risk indicator that is substantially and directly related to deciding whether to approve, decline or hold a payment. The kinds of personal information used include identity and contact details, payment and transaction information, device and IP address information and fraud or risk indicators. 

 

9. Education products and artificial intelligence

Campion distributes and supports a range of education products to schools, including products offered through the CuratED portfolio. A school may purchase, subscribe to or trial a product as Campion’s customer and authorise teachers, support staff, administrators and students to use it. The information provisioned depends on the selected product and school configuration. It may include a user’s first name, surname, school email address, school name, role, year level, class or subject, licence entitlement and single sign-on identifier. Product-specific data fields, purposes, operators, locations, retention periods and subprocessors are described in the applicable agreement, collection notice and the Sub-processors and Third Parties page. Information is not to be provided merely because it is available; only the fields reasonably necessary to provision, secure, support and administer the selected service are used or disclosed. 

Not every CuratED product uses artificial intelligence. Where a product does not use AI, Campion and the product operator must not use identifiable school-user information, student work or School Materials to train, test, validate, fine-tune or improve an AI model unless the specific use has first been disclosed and approved through the applicable contractual and privacy process. 

For a third-party education product, the applicable agreement and Sub-processors and Third Parties page identify whether Campion or the product operator hosts or otherwise processes the information. Campion remains responsible for its own collection, provisioning, access and support activities. The product operator is responsible for its independent handling after provisioning to the extent described in its terms and privacy notice. Nothing in this policy reduces any stronger obligation Campion has accepted in a school subscription agreement. 

For AI features, the following applies and is reflected in each product’s own terms: 

• Campion Write provides AI assisted feedback on student writing. Student written work is anonymised before it is sent to the language model that generates feedback, the product is hosted in Australia, and model training is limited to irreversibly de-identified, aggregated data. 
• Lessonate is Campion’s own product for generating teaching resources. Student information is stored in Australia, no external third parties receive or process it, only de-identified or aggregated data is used for model improvement, and no student generated work is stored other than chat logs. 
• Identifiable student information is not used to train or improve AI models in any Campion operated product. 

You can exercise the access, correction and deletion rights described in section 13, or ask to withdraw consent to a product’s use of information, by contacting our Privacy Officer using the details in section 14. Product-specific retention periods and sub-processors are set out on the Sub-processors and Third Parties page. 

 

10. Who we disclose information to

Sections 2 to 5 describe handling and recipients specific to each group. Across our activities, personal information may also be disclosed to: 

• our technology service providers, including hosting, platform, communications, support and analytics providers; 
• payment providers and delivery providers; 
• educational publishers and education-product operators, for the school, teacher, support-staff, administrator and student provisioning, hosting, operation and support purposes described in sections 2, 3, 4 and 9, subject to the applicable agreement and product-specific disclosures; 
• government agencies, regulators, courts and law enforcement where required or authorised by law. 

A current list of the service providers and sub-processors we use, the data types and purpose for each, the systems they connect to and the countries where data is stored or processed is published at campion.com.au/sub-processors. We update that page at least 30 days before a change takes effect, and you can subscribe to be notified of updates. We do not otherwise share personal information with third parties except with consent or where required or authorised by law. 

 

11. Overseas disclosure

We host our core ordering and student platforms in Australia, and we prefer Australian hosting for the services we use. Some providers and education products involve overseas storage, access or processing. Countries to which personal information may be disclosed include the United Kingdom, the European Union, New Zealand, Switzerland and the United States. The Sub-processors and Third Parties page identify the country position for each provider. Australian hosting may still involve overseas support access, and overseas disclosures are handled in accordance with applicable legal requirements. We will update the Sub-processors and Third Parties page and notify subscribers at least 30 days before data moves to a different country. 

Where a school subscription agreement or Order Form requires specified information to remain in Australia, Campion will apply that stronger contractual requirement to the relevant service. A general statement in this policy about possible overseas processing does not override an Australian-only commitment in an executed agreement. 

 

12. Storage, security, quality and retention

How we hold and protect information 

We hold personal information in electronic systems, cloud services, provider platforms and, where needed, physical records. We take reasonable steps to protect personal information from misuse, interference, loss and unauthorised access, modification or disclosure. 

Data breaches 

Suspected data breaches are investigated under our data breach response plan. Where a breach is likely to result in serious harm, we notify affected individuals and the Office of the Australian Information Commissioner as required by the Notifiable Data Breaches scheme. Where information held for a school is affected, we notify the school as soon as possible after discovery with the relevant details. 

Quality 

We take reasonable steps to keep personal information accurate, complete and up to date, having regard to how it is used or disclosed. Please tell us when your details change or if you believe information is incorrect. 

Retention and disposal 

Student and teacher accounts that become inactive are disabled and are deleted or de-identified in accordance with the applicable product retention period, school agreement and legal requirements. Product-specific periods, including treatment of submitted work, support records, logs and backups, are stated in the applicable agreement, collection notice or Sub-processors and Third Parties page. Campion must not retain School Materials or identifiable school-user information indefinitely merely because an account is inactive. 

Unsolicited information 

If we receive personal information we did not request, we assess whether we could have collected it under the APPs. If not, and it is lawful and reasonable to do so, we destroy or de-identify it. 

 

13. Access, correction and deletion

You may ask us for access to personal information we hold about you or, for a parent or guardian, about your child, and ask us to correct information that is inaccurate, out of date, incomplete, irrelevant or misleading. You may also ask us to delete personal information. Requests are free of charge. We aim to respond within 30 days, and we may need to verify your identity or authority. If an exception applies, we will give written reasons where required and explain available review or complaint options. Schools may also direct requests about their students’ information under our agreements with them. 

 

14. Privacy questions and complaints

If you have a question, an access, correction or deletion request, or believe Campion has breached the Privacy Act, the APPs or a binding registered APP code, contact our Privacy Officer. Please describe what happened, the information involved, the outcome you seek and how we can contact you. We may ask for further information and consult the relevant business area or service provider when considering a complaint. We will communicate the outcome and any available review options. 

Privacy Officer contact details 

Privacy Officer, Campion Education 

Street address: Unit 1, 170-180 Rooks Road, Nunawading VIC 3131 

Postal address: Unit 1, 170-180 Rooks Road, Nunawading VIC 3131 

Email: privacyofficer@campion.com.au  

Telephone: 1300 433 982 

If you are not satisfied with our response, or we have not responded within a reasonable time, you may complain to the Office of the Australian Information Commissioner. The OAIC generally expects you to complain to us first. Information and the online complaint form are available at www.oaic.gov.au, or you may call the OAIC Enquiries Line on 1300 363 992. 

 

15. Availability and policy updates

This policy is available free of charge at www.campion.com.au/privacy and, on request, from our offices and stores. If you ask, we will take reasonable steps to provide it in another form, including an accessible or printed form. 

We may update this policy from time to time. Material changes are published at least 30 days before they take effect, and you can subscribe on our website to be notified of updates to this policy and to the Sub-processors and Third Parties page. The current version, its last updated date and superseded versions are available from the address above.  

 

Last updated: 14 October 2026.