Privacy Policy

Who holds your information

Kestrel is a student information system published by Hoverpoint Pty Ltd (ABN [to be confirmed]), a company registered in Victoria, Australia. Schools use it to hold the records of the people connected to them.

Two organisations are involved in any record Kestrel holds, and they answer for different things. The school decides what to collect about a person and why. It is the organisation a family or a member of staff has a relationship with, and it owns the record. Hoverpoint Pty Ltd runs the software and holds that record on the school's behalf.

If you are a parent, a student or a member of staff, the school is usually the quickest place to start. The school knows who you are, and we do not. This policy covers what Hoverpoint does with the information while it is in Kestrel. All the ways to reach us directly are on this page.

We commit to the Australian Privacy Principles in everything set out below.

If your school is in England, the UK GDPR and the Data Protection Act 2018 apply as well. The section For a school in England sets out what that changes.

There is a shorter Privacy Policy for students, written for a child to read. It says the same things in simpler words.

What Kestrel holds

This is the whole of it. A school types some of it in and generates the rest by using the software.

A person on a school's record

Kestrel holds their name and any earlier name the school has recorded, and their date of birth and gender. It holds the date of death where the school has recorded one, and the language to write to them in. It holds each affiliation they have with the school: enquiry, applicant, student, staff, volunteer, contractor or board member. For each affiliation, it holds the dates it ran between and the reason it ended.

A member of staff who signs in

Kestrel holds their name and email address. It holds the public key of each passkey registered to the account, and the kind of device it came from. It holds a record of each sign-in session, which keeps them signed in from one page to the next. Each session record includes the network address and the browser it started from. While Kestrel is open in front of them, the session record also keeps the address of the page on screen and the time it was last reported, which an administrator at that school reads to see who is working in the console. Each identifier in that address is replaced with a marker before it is stored, so the record names the screen and never the person or the record on it. One report replaces the one before it, and the whole of it goes when the session ends. It stores the photo they add to their account as a copy 256 pixels square, and discards the image they uploaded.

A family member or student who signs in

Kestrel holds their name and email address. It holds the public key of each passkey registered to the account, and the kind of device it came from. It holds a record of each sign-in session, which keeps them signed in from one page to the next. Each session record includes the network address and the browser it started from.

No-one at all

No password is stored for anyone, because Kestrel has no password sign-in and so no password to leak, reuse or phish.

The list above is the record as it stands. If Kestrel starts to hold a new kind of information about a person, this policy changes first to describe it. The version and date at the top of the page change with it.

Why it is held

• To give a school a working record of the people connected to it, so the office can tell one person from another.
• To keep a former name with the person it belongs to, which is often the only thing connecting an adult to their own student record.
• To sign a member of staff, a family member or a student in and keep them signed in, and to let a member of staff remove a passkey from a device they no longer have.
• To show a school's administrators who is signed in at this moment and the page each of them has open, so the school knows who is working before it changes a setting everyone there relies on.
• To show the photo a member of staff adds to their account beside their name, to the staff at each school they work at.
• To write to a person in the language they read.
• To meet the record-keeping obligations a school is under, which set how long several kinds of record have to be kept.

What we do not do with it

• There is no advertising in Kestrel, and Kestrel contacts no advertising network of its own. A school may set its own Google Tag Manager container or Meta pixel for its public enrolment pages, the enquiry form and the tours page, and those are the only pages that can load them. A family is asked first, on the confirmation after they send an enquiry or book a tour, and the school's tags load only once they accept, and once for that confirmation. The family portal, the console, the application form and a form a student fills in never load them, and the Meta pixel runs with its automatic advanced matching switched off. Where the school shows one of these pages inside its own website, the page loads no tag and tells that website only that a family sent an enquiry, booked a tour or opened the application, with no answer and no name in it. What the school's tags and its website collect is the school's to answer for, under the school's own privacy policy.
• There is no third-party analytics and no session recording. Kestrel counts how often each screen of the console is opened, by day, by school and by the roles Kestrel ships that the person who opened it has, with each role a school defined for itself counted as one. A count names no person and keeps no account, session or network address, and the screen is kept as its address with each record's identifier taken out, so a count says which screen was opened and never whose record was on it. Seraco reads the counts to decide which screens to improve and which to retire, and sees a count only when enough people stand behind it: a school with too few staff is left out, and roles too few people have are merged into one figure or left out. Beyond those counts, nothing sends Kestrel what a person typed, clicked or read on a page. The content policy the browser enforces blocks each external origin a page has not named, so a script of that kind could not run even if one were added. Only a school's public enrolment pages name any: the hosts of the school's own logo, and on the confirmation, the hosts of the school's tags above.
• There is no tracking of where a member of staff is. The page an open console reports is the screen it has drawn, kept for as long as that screen is the current one, and Kestrel keeps no history of the screens any one person visited. The browser tab remembers the last few pages opened in it, by their titles, so its back button and its list of recent pages work. That list stays in the tab and is never sent to Kestrel. It is emptied at sign-out, and the browser discards it when the tab closes.
• There is no profiling, scoring or ranking of any person, with two exceptions. Next year's estimated mark gives the head of a department an estimate of each continuing student's mark in that department's subjects, calculated from the mean of their scaled results so far this year. Only the head of department reviewing their own department sees it, and they may give a different mark instead of the estimate, with the reason for it. A student's learner profile holds their academic strengths and knowledge and skills worked out afresh from their results and the curriculum, their work samples, and a teacher's dated observation of their leadership, character traits, unique potential, a preferred way of learning or their motivation, in the teacher's own words and kept under the teacher's name. Only the staff who teach or are responsible for the student see it, and so does a parent where the school has switched that on; it starts off. No-one is scored or ranked beyond those two records, and a person can ask the school to see either one and to have it corrected.
• There is no sale, rental or exchange of personal information with anyone.
• There is no model training. Kestrel runs no model: the question box on the enrolment board matches keywords against what the board shows.

Who else sees it

Everyone outside Hoverpoint Pty Ltd who handles any part of this information is listed below, with what reaches each of them. Nothing else receives anything. The security page shows the same list, because both pages read it from one place.

FlowVPS

Runs the virtual machine that hosts the application and its database.Organisation Alpha Layer Pty LtdContact admin@flowvps.comReceives All of it, as the operator of the host.Lawful basis The school's records are stored on the host to provide the service the school contracted for, which is the purpose they were collected for (APP 6.1). The host is in Australia, so APP 8 does not apply.In AustraliaFrom a school in England A school in England's records are stored on this host in Australia. The UK has no adequacy regulations for Australia, so the school and Hoverpoint sign the ICO's International Data Transfer Agreement, with a transfer risk assessment, before the school's records are loaded.

Let's Encrypt

Issues the TLS certificate that secures the connection to the site.Organisation Internet Security Research GroupContact privacy@abetterinternet.orgReceives The domain name. No personal information.Lawful basis No personal information reaches it, so no privacy-law basis is needed.In United StatesFrom a school in England No personal information reaches it, so no transfer rule applies.

Resend

Delivers the one-time code that signs a member of staff in by email.Organisation Plus Five Five, Inc.Contact support@resend.comReceives The email address the code goes to, and the code. No student information.Lawful basis The address is used to send the code the person asked for, which is the purpose it was collected for (APP 6.1). Resend is outside Australia, so Hoverpoint stays accountable for its handling under APP 8.1, and a data processing addendum with Resend binds it to protect the address.In United StatesFrom a school in England The address of a member of staff at a school in England reaches Resend in the United States. Resend's Data Processing Addendum covers that transfer with the UK standard contractual clauses and the EU-US Data Privacy Framework.

We disclose a school's records to no-one else. Where a court order, a warrant or a law compels us to hand something over, we tell the school before we do it, unless the order itself forbids us from telling them.

Where it is held, and what leaves Australia

All school records Kestrel holds are in Australia, on one virtual machine, in one PostgreSQL database. Each school's records are in their own schema inside it. The backups are encrypted and kept on that same machine, so they are in Australia too. The test environment contains invented data and no real person's record.

One thing leaves the country. When someone asks for a sign-in code by email, the address that code goes to reaches Resend in United States. No student information is in that message. Signing in with a passkey sends nothing to anyone: the key never leaves the device it was made on.

Government identifiers

Kestrel identifies a person by a random identifier its own database generates. It does not adopt a government-related identifier as its own way of identifying anyone, and it holds no such identifier for any person. That covers a tax file number, a Medicare number and a student number issued by a government.

Getting a copy of your information, correcting it, or asking us to delete it

You can ask for a copy of what is held about you. You can ask us to correct anything in it that is wrong, and you can ask us to delete it. The first two are rights you hold, and we answer the third as far as the law lets us. None of them costs anything.

Ask the school first. The school has the relationship with you and can answer most requests directly in Kestrel. If the school cannot, or if you would rather come to us, write to privacy@hoverpoint.io and tell us which school's record you are asking about.

Your request is recorded from the day it arrives, with a reference you can quote back to us and the two dates below on it. That way the school and we can both see what is owed to you, and when.

• We acknowledge your request within 5 business days, and we answer it within 30 days.
• We have to be sure who you are before we hand anything over, so we may ask you to confirm your identity through the school. If you are asking about a child, we check that you are entitled to their record.
• If we correct something, we tell you what changed. A correction keeps the earlier version on the record, with the dates it applied over. A school is often asked what it held on a date in the past.
• If we do not agree that a record is wrong, we tell you why in writing, and we tell you how to complain about that decision.
• Deletion is limited by how long records have to be kept. Where you ask us to delete something a school is obliged to hold, we take it out of everyday use, we tell you which parts are being kept, which obligation keeps them and when that period ends, and it is disposed of when the period ends. The section on how long it is kept sets out those periods.
• If we refuse a request, we give you our reason in writing. There are requests we have to refuse, such as one that would disclose another person's information or breach a court order about a child.

Making a complaint

Write to privacy@hoverpoint.io and say that you are making a privacy complaint. We acknowledge it within 5 business days and answer it within 30 days, in writing, with what we found and what we did about it.

If our answer does not satisfy you, you can take the complaint to the Office of the Australian Information Commissioner, the regulator for privacy in Australia. The OAIC takes complaints at oaic.gov.au and on 1300 363 992. You do not need our permission to go to them, and you can go to them at any point.

Questions and complaints says all of this in plain words, for a student or a child asking about their own information. It covers asking a question without giving your name, which you can do.

How long it is kept

A school record has a retention class rather than a delete button, because a student's file outlives their enrolment by decades and an attendance register is evidence. Child-safety records are kept for 45 years, counted from the child's date of birth. Attendance registers are kept for 7 years. A record under legal hold is kept whatever its age.

The record of a family who enquired or applied and never started is kept for a period the school sets, between 30 days and 7 years, and at most 3 years for an enquiry that never became an application. Until a school sets its own, the documents the family sent, the health and learning answers and the interview notes are kept for 90 days and the rest of the record for 2 years. A pass on the first of each month deletes the records whose period has run out, and that night's disposal removes them. A family can ask the school to destroy a child's information sooner, and the school answers with what it had to keep and why.

Taking a record out of the working set and disposing of it are two separate acts. The security page lists each class and the obligation behind it.

How it is protected

Each school's records are in their own database schema, reached through a database role with privileges on that schema and no other. PostgreSQL itself stops one school's role from reaching another school's schema, so that protection does not depend on our code getting a query right. Sign-in is by passkey, with a one-time email code as the fallback. Each route that serves student data checks the session on the server.

The security page sets out each protection and what it stops.

If something goes wrong

If we find that someone has reached a school's data without authorisation, we contact that school's nominated privacy contact directly, in writing, with what we know and what we do not. Australia's Notifiable Data Breaches scheme requires an assessment within 30 days, and notification to the people affected and to the OAIC where serious harm is likely. The school has the relationship with those families, so our job is to give it what it needs to make that assessment quickly.

For a school in England

A school in England is under the UK GDPR and the Data Protection Act 2018, and the Information Commissioner's Office regulates it. Everything above applies to its records too. This section adds what the UK law requires.

The controller and the processor

The school is the controller of the records it keeps in Kestrel: it decides what to collect about a person and why. Hoverpoint Pty Ltd is its processor under Article 28 of the UK GDPR. We act only on the school's written instructions, we keep the records confidential, and we help the school answer the requests and meet the duties the law places on it.

The lawful bases

The school decides the lawful basis for each record it keeps. Our privacy impact assessments name these for the records Kestrel keeps for a school in England alone:

Pre-employment checks on staff

Article 6(1)(c), the duty Keeping Children Safe in Education and the Independent School Standards place on the school.Condition A DBS certificate and a barred-list, prohibition or section 128 outcome are criminal offence data under Article 10. The conditions are paragraphs 1 and 18 of Schedule 1 to the Data Protection Act 2018, which paragraph 36 extends to that data.Assessment PIA-030

The SEND register

Article 6(1)(c) or (e), the school's duties under the Children and Families Act 2014 and the SEND Code of Practice.Condition A pupil's type of need is special category data. The condition is Article 9(2)(g), with paragraph 6 of Schedule 1 to the Data Protection Act 2018.Assessment PIA-031

A pupil's ethnicity and first language

Article 6(1)(c), the census return the Department for Education requires.Condition Ethnic origin is special category data. The condition is Article 9(2)(g), with paragraph 6 of Schedule 1 to the Data Protection Act 2018.Assessment PIA-032

Exam entries and results

Article 6(1)(e), the school's public task of educating the pupil, and its duty as an examination centre.Condition Entries and results are not special category data, so no condition is needed.Assessment PIA-034

Getting a copy of your information

You can ask the school for a copy of what it keeps about you, and for a correction or a deletion. The school answers within one month. Where a request is complex, or you have made several, it may take two more months, and the school tells you within the first month that it needs them and why. The month starts when the school has what it needs to confirm who you are, and it stops while the school waits for you to clarify a request that covers a large amount of information.

If you write to privacy@hoverpoint.io instead, we pass your request to the school, which answers it, and we help the school do so.

Making a complaint

Complain to the school first. If the school's answer does not satisfy you, you can complain to the Information Commissioner's Office, the regulator for data protection in the UK. The ICO takes complaints at ico.org.uk and on 0303 123 1113.

If something goes wrong

If someone reaches a school's data without authorisation, we tell the school without undue delay, with what we know. That lets the school report the breach to the ICO within 72 hours of becoming aware of it, as the UK GDPR requires.

Where the records are stored

A school in England's records are stored in Australia, on the same host as all other schools' records. The UK has no adequacy regulations for Australia, so sending the records there is a restricted transfer. Before the school's records are loaded, the school and Hoverpoint sign the ICO's International Data Transfer Agreement, with a transfer risk assessment.

A school in England's personal information reaches these processors:

• FlowVPS, in Australia. A school in England's records are stored on this host in Australia. The UK has no adequacy regulations for Australia, so the school and Hoverpoint sign the ICO's International Data Transfer Agreement, with a transfer risk assessment, before the school's records are loaded.
• Resend, in United States. The address of a member of staff at a school in England reaches Resend in the United States. Resend's Data Processing Addendum covers that transfer with the UK standard contractual clauses and the EU-US Data Privacy Framework.

Changes to this policy

The version and the date at the top of this page tell you which edition you are reading. The page also tells you when its review date has passed.

We write to each school before a change to this policy takes effect, and the letter tells them what changed. A change to what Kestrel holds about a person is published here before the software starts holding it.

How to reach us

The privacy officer for Hoverpoint Pty Ltd is Andrew Todd. Write to privacy@hoverpoint.io for anything on this page: a copy of your information, a correction, a complaint, or a question this policy does not answer.

To report a security vulnerability, write to security@hoverpoint.io instead, which reaches the same people faster.