Privacy Policy.

Operator: EduX Pty Ltd, ABN 13 697 958 777, Melbourne, Australia (“EduX”, “we”, “us”, “our”)

1. Purpose and scope

This Privacy Policy explains how EduX collects, holds, uses, discloses, secures and otherwise handles personal information in connection with the EduX website, provider portals, assessments, surveys, pre-enrolment reviews, learning services, compliance and quality-assurance tools, professional-development services and related support.

EduX is designed primarily as a business-to-business platform used by education and training providers, professional bodies and other organisations. In many cases, the subscribing organisation determines which individuals use the service and why their information is entered into EduX.

2. Key terms

3. Information we may collect

Depending on the service used, EduX may collect or hold:

• name, email address, telephone number and other contact details;
• organisation, role, job title, campus or location details;
• student, learner or candidate identification numbers;
• course, qualification, enrolment and provider information;
• assessment questions, responses, scores, outcomes and support indicators;
• pre-enrolment review responses and related course-suitability information;
• survey responses and quality-indicator information;
• written work, uploaded evidence and supporting documents;
• assessor, reviewer or provider notes, declarations and professional judgements;
• learning enrolment, progress, completion and professional-development records;
• billing, subscription and transaction information;
• login, audit, device, browser, IP address and security-event information;
• communications with EduX, including enquiries and support requests; and
• other information a Provider or User chooses to submit for the relevant service.

4. How information is collected

• directly from Users through forms, assessments, surveys, uploads and account activity;
• from Providers that create accounts, add Users or issue assessment and review links;
• from authorised assessors, reviewers and administrators;
• through EduX systems and security logs;
• from connected services selected by the Provider, such as email delivery or learning platforms; and
• from publicly available or authorised sources where lawful and relevant.

5. Purposes of collection and use

EduX may use personal information to:

• provide, administer and support the requested EduX services;
• create and manage accounts, permissions and organisation records;
• deliver assessments, reviews, surveys, learning and reporting;
• apply configured scoring, evidence and interpretation rules;
• support AI-assisted analysis within the boundaries described below;
• generate reports, dashboards, audit trails and provider records;
• process payments and manage subscriptions;
• communicate with Providers and Users about the service;
• maintain security, prevent misuse and investigate incidents;
• improve reliability, accessibility and service quality;
• comply with legal, regulatory and contractual obligations; and
• protect the rights, safety and legitimate interests of EduX, Providers and Users.

6. Provider portals and Provider responsibilities

When a Provider uses EduX to administer assessments, surveys, reviews, learning or reporting, the Provider ordinarily determines the purposes for which the information is collected and entered into EduX. EduX handles Provider Data to provide the contracted services and in accordance with the Provider's documented instructions, except where otherwise required by law.

The Provider is responsible for giving students, learners, staff and other Users any collection notice required for the Provider's use of EduX and for obtaining any consent required by law.

7. EEPT Speaking Assessments

The EEPT Speaking component uses recorded spoken responses. With the candidate's explicit consent, the candidate records short audio responses to approved speaking tasks inside the EduX portal. Video is never recorded.

Before any recording is made, the candidate is shown a consent notice explaining that their responses will be recorded, who can listen to them and when they are deleted, and must actively agree. If the candidate does not consent, no recording is made, the speaking section is skipped, and the candidate's report notes that speaking was not assessed in that sitting. Declining does not affect any other part of the assessment.

Speaking recordings are held solely so that an authorised assessor engaged by the candidate's Provider can assess the candidate's spoken English against the approved assessment matrix. Within the EduX application, playback access is restricted to the Provider's authorised assessor through an authenticated playback function. EduX personnel do not have routine playback access to candidate speaking recordings, and every access through the application is logged.

A speaking recording is personal information and is handled with heightened safeguards because it captures a person's voice. EduX does not treat it as biometric information: it is not used for biometric identification or verification, and no voiceprint, voice template or other biometric template is created from it.

Recordings are deleted automatically when the speaking result is finalised, and in any case no later than 30 days after they were made. Deletions are logged.

Recordings are never used for any other purpose. EduX does not transcribe recordings, does not analyse them with automated or AI speech-scoring tools, and does not create voiceprints, voice templates, facial-recognition templates or any other biometric identification or verification data. The speaking level is determined from the assessor's matrix scores by a deterministic calculation.

For the Speaking component, EduX also stores:

• the assessor's identity, qualification or authorised role;
• the speaking task set used;
• rubric scores and brief evidence notes;
• assessor confidence and review status;
• the assessor declaration;
• the consent record (the candidate's answer, the wording version shown and the time); and
• the resulting speaking outcome.

This structured information is retained with the assessment record after the recordings themselves are deleted.

8. Artificial intelligence and automated analysis

EduX may use approved AI services to assist with:

• analysis of written responses;
• classification and mapping of submitted evidence;
• identification of possible support needs, gaps or inconsistencies;
• draft narrative generation and reporting; and
• quality, integrity and review flags.

AI does not independently make final admission, competency, regulatory-compliance or professional-recognition decisions. Formal outcomes are produced through configured rules, approved frameworks and, where required, professional review.

EduX will take contractual and technical steps designed to prevent Provider Data from being used to train public or general-purpose AI models.

9. Disclosure to service providers

EduX may disclose personal information to approved hosting, cloud, security, email, payment, support, analytics, document-processing and AI service providers where reasonably required to deliver the service.

EduX will take reasonable steps to require those providers to:

• use the information only for authorised service purposes;
• apply appropriate security and confidentiality controls;
• not sell the information or use it for unrelated purposes;
• not use Provider Data to train public or general-purpose AI models; and
• delete, return or place information beyond use when no longer required, subject to lawful retention and backup cycles.

10. Overseas processing

Some approved technology providers may store or process information outside Australia. Where this occurs, EduX will take reasonable contractual and technical steps appropriate to the nature of the information and the service. The countries involved may vary according to the service provider and configuration used. Current information may be requested by contacting EduX.

11. Security

EduX uses reasonable technical and organisational measures that may include:

• encryption in transit and, where appropriate, at rest;
• role-based access and organisation-level data separation;
• authentication and multifactor-authentication controls;
• audit logging and administrative-access controls;
• secure backups and recovery procedures;
• malware and vulnerability controls;
• incident-response and breach-management procedures; and
• review of relevant third-party providers.

No online service can guarantee absolute security. Providers and Users must also protect their credentials, devices, exported reports and locally stored information.

12. Data breaches

EduX maintains a process for responding to suspected or confirmed data breaches. Where a breach affects Provider Data, EduX will take reasonable steps to contain and investigate the incident and will notify the affected Provider without unreasonable delay. EduX and the Provider will cooperate in assessing whether notification to individuals, the Office of the Australian Information Commissioner or another regulator is required.

13. Retention and deletion

EduX retains personal information only for as long as reasonably required to provide the services, maintain agreed assessment and audit records, resolve disputes, support security and comply with legal or contractual obligations.

When information is no longer required, EduX will take reasonable steps to delete or de-identify it, subject to lawful retention requirements, technical backup cycles and limited records required to maintain transaction, audit or suppression obligations.

Unless a different contractual or legal period applies, cancelled-account data may be retained for up to six months to allow export, recovery or account resolution, after which it will be deleted or de-identified in accordance with EduX processes. Deleted data may remain in database backups held in Australia for up to 90 days, after which it is permanently removed.

14. Access and correction

Individuals may request access to or correction of personal information held by EduX. Where the information is controlled by a Provider, EduX may refer the request to that Provider or require Provider authorisation before taking action.

Requests may be subject to identity verification and any lawful exceptions. Contact: contact@edux.com.au.

15. Marketing and communications

EduX may send service communications required to administer an account. Marketing communications will be sent only where permitted and will include a way to unsubscribe or manage preferences.

16. Cookies and analytics

EduX may use cookies and similar technologies for authentication, security, preferences, service performance and analytics. Information about optional analytics and preference controls should be displayed through the website's cookie or privacy settings where applicable.

17. Complaints

Privacy questions or complaints should first be directed to EduX at support@edux.com.au, GPO Box 280, Melbourne VIC 3001, Australia. EduX will investigate and respond within a reasonable period. If a person is not satisfied, they may be entitled to contact the Office of the Australian Information Commissioner.

18. Changes to this Policy

EduX may update this Policy to reflect changes in services, law or information-handling practices. The current version will be published on the EduX website with its effective date.

19. Contact

EduX Pty Ltd
ABN 13 697 958 777
GPO Box 280, Melbourne VIC 3001, Australia
Privacy email: contact@edux.com.au
Website: https://edux.com.au/