How Orca collects, uses, stores and handles personal information in connection with the Orca activity planning platform and website.
Lennix Pty Ltd (ABN 36 156 631 631) (“Orca”, “we”, “us”, “our”) operates the Orca activity planning platform (“Platform”) and website at orca.school (“Website”). We are committed to handling personal information responsibly and in accordance with the Australian Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs).
This policy explains what personal information we collect, why we collect it, how we use and protect it, and what rights you have in relation to it. It applies to schools and educational organisations that subscribe to Orca (“Schools”), as well as to school staff, students, parents and guardians whose information is managed within the Platform, and to visitors to our Website.
Orca is primarily a business-to-business service. Much of the personal information we hold is provided to us by Schools as part of setting up and operating the Platform, for example, staff and student records uploaded by a school administrator. However, Orca also enables Schools to collect information directly from users (including staff, students and parents) through event forms. In these cases, the personal information is submitted directly by the individual. In all cases, the School determines what information is collected and for what purpose. The School is the data controller for that information. We act as a data processor, handling personal information only to deliver the service the School has contracted us to provide.
The Platform includes optional AI-assisted features. Where a School enables them, limited information is transmitted to Microsoft’s Azure OpenAI service for processing in Australia. This is summarised in Sections 4 to 8 below. A detailed AI Data Processing Fact Sheet is available to Schools on request.
If you have questions about this policy or how we handle your information, please contact us at hello@orca.school.
The personal information we hold falls into the following categories, depending on how the Platform is configured by each School.
When a School subscribes to Orca, we collect information about the organisation and its nominated administrators, including:
Schools provide us with information about staff who will use the Platform, which may include:
Schools provide us with information about students in connection with activity planning and management. This may include:
Schools provide us with information about parents in connection with activity planning and management. This may include:
Orca allows schools to associate alerts with individual students to support safe and informed activity management. Alerts may include:
These alerts are entered and managed entirely by the School. We store and display this information within the Platform solely to support the School’s activity management and duty of care responsibilities. Alert information is not used by us for any other purpose and is not shared with third parties other than our infrastructure sub-processors for storage purposes. Access to alert data by Orca staff is limited to what is necessary for the operation, maintenance and troubleshooting of the Platform, as described in Section 4.
Because alerts may include health information and other sensitive information (see Section 7), schools are responsible for ensuring appropriate consents have been obtained from parents or guardians before entering this type of information into the Platform.
Where a School provides contact details for parents or guardians in connection with student activities, this may include name, email address and phone number. This information is used only for the purposes configured by the School within the Platform.
Orca allows teachers and coordinators to attach forms to events as a way of collecting information from staff, students or parents. Forms may be used for a range of purposes at the School’s discretion, for example, collecting permission responses, dietary preferences, emergency contact details, or any other information relevant to an activity or excursion.
Form responses may include:
Because form content is determined entirely by the School, we cannot predict or limit what categories of information may be submitted through forms. It is possible that form responses will contain sensitive information, for example, health details, dietary requirements or other personal circumstances, depending on the questions a teacher chooses to ask.
Form responses are stored within the Platform and are accessible only to authorised staff at the relevant School. We store this information solely to deliver the forms feature and do not use form response data for any other purpose. Schools are responsible for ensuring that any form questions are appropriate, that respondents have been informed about how their answers will be used, and that any necessary consents have been obtained, particularly where questions may elicit sensitive information or where forms are directed at minors.
Where a School has enabled AI features, we hold a record of the interaction, which may include:
Where an AI call fails, our diagnostic logs may retain limited content from the request or the response for a short period so that we can investigate the fault. These logs are subject to the operational log retention described in Section 9.
Because staff type this text themselves, it may contain personal information where a staff member includes it. See Sections 7 and 8.
When you access the Website or Platform, we automatically collect certain technical information including IP address, browser type and version, pages visited and timestamps. This information is used for security monitoring, access logging and improving the performance of the Platform. Our Website also uses an analytics service, described in Section 12.
Personal information enters the Platform through two main channels.
The first is information provided by Schools. Schools configure the Platform and upload staff and student records as part of administering the service. This includes account setup, student enrolments, alert information and other administrative data. In these cases the School is providing information on behalf of individuals, and the School is responsible for ensuring it has a lawful basis for doing so.
The second is information submitted directly by users. When a School attaches a form to an event, staff, students or parents may submit responses directly through the Platform. These responses (which may include free text, uploaded files or any other content a respondent provides) are collected directly from the individual completing the form. The content of these forms is determined by the School, not by us.
We also collect information:
Where a School provides information about individuals (including students who are minors), that School is responsible for ensuring it has obtained all necessary consents and has a lawful basis for sharing that information with us.
Where a School creates a form that will be completed by minors or that asks questions likely to elicit sensitive information, the School is responsible for ensuring appropriate consent has been obtained from parents or guardians before the form is issued.
We use the personal information we hold for the following purposes:
We do not use personal information, and in particular we do not use student information, for advertising, marketing to students, commercial profiling or any purpose unrelated to delivering the Platform to Schools.
We do not sell personal information to any third party under any circumstances.
Where we send marketing communications to school administrators about Orca features or updates, we do so in accordance with the Spam Act 2003 (Cth) and provide an opt-out mechanism in every communication.
The following third-party providers process personal information on our behalf as part of delivering the Platform. All Platform data is stored and processed in Australia, including the contents of AI requests where a School has enabled AI features. Section 8 sets out the one narrow circumstance in which AI request content may be accessed from outside Australia.
| Provider | Location | Purpose | Data processed |
|---|---|---|---|
| Amazon Web Services | Australia (Sydney) | Underlying cloud compute and storage infrastructure | All data stored on the Platform |
| SMTP2GO | Australia (Sydney) | Transactional email delivery (account notifications, system alerts, service emails) | Name and email address of recipients only |
| Microsoft Corporation (Azure OpenAI Service) | Australia (Australia East) | AI processing for the Platform’s optional AI-assisted planning, compliance analysis, venue research, insights and venue-matching features | The contents of individual AI requests only. Microsoft has no access to the Platform database or to uploaded files. Applies only where a School has enabled AI features. |
The sub-processors above are the third parties that process personal information on our behalf. Copies of our providers’ security certifications are available to Schools on request as part of security due diligence. A detailed AI Data Processing Fact Sheet, setting out what an AI request may and may not contain, is also available to Schools on request.
We will provide Schools with at least 30 days’ notice of any changes to our sub-processors.
Sensitive information, as defined under the Privacy Act 1988 (Cth), may be collected through the Platform in three ways.
Through student alerts: Schools may associate alerts with individual students to support duty of care and safe activity management. Alerts may include health information such as medical conditions, allergies or medication requirements, as well as behavioural or wellbeing notes. This information is entered and managed entirely by the School.
Through event forms: Because form content is determined by the School, it is possible that form responses submitted directly by staff, students or parents will contain sensitive information. For example, a teacher may ask about dietary requirements, health conditions, cultural considerations or other personal circumstances relevant to an activity. We cannot predict or control what sensitive information may be submitted through forms, as this depends entirely on the questions the School chooses to ask.
Through free text entered into AI features: Where a School has enabled AI features, staff may type free text into an AI chat, or into activity fields such as descriptions and hazard notes that AI features read. If a staff member includes sensitive information in that text, it is transmitted to Microsoft as part of the AI request and processed in Australia. We do not filter free text: personal information typed into it, including names, is transmitted as written, and sensitive information expressed as an ordinary sentence cannot be detected. Student alert content and incident narratives are not transmitted to Microsoft, and no file is transmitted — though where a School has asked us in writing to enable it, the text extracted from an uploaded risk assessment is sent as one document. This is explained in full in our AI Data Processing Fact Sheet, available to Schools on request.
In each case, we store sensitive information only because it has been provided through the Platform for the purpose of supporting the School’s activity management. We do not use sensitive information for any other purpose. We do not share it with any party other than our infrastructure sub-processors for storage, except where sensitive information is contained in free text entered into AI features, as described above.
Schools are responsible for:
If you wish to withdraw consent for sensitive information to be held, please contact your School administrator in the first instance. The School may then contact us to action the request.
All personal information collected through Orca is stored in Australia, on infrastructure located in Sydney.
Where a School has enabled the Platform’s optional AI features, the contents of individual AI requests are transmitted to Microsoft’s Azure OpenAI service for processing. That service runs in Microsoft’s Australia East region, so prompts and responses are processed within the Australian geography and are not transferred outside Australia in the ordinary course of processing.
Under Microsoft’s terms as at the date of this policy, where its monitoring flags something, Microsoft may retain a sample of AI requests and responses for a limited period — currently up to 30 days — solely to detect misuse of its service, after which it is deleted. That data is held by Microsoft in Australia. We have no access to it and cannot read or delete its contents. Microsoft’s current published terms govern this, and Schools should refer to Microsoft’s data, privacy and security documentation for Azure OpenAI for the position at any given time.
There remains one circumstance in which a cross-border disclosure can occur. Where the abuse-monitoring system flags content, that flagged content may be accessed and reviewed by authorised Microsoft personnel, who may be located outside Australia. Review is limited to content the system has already flagged and to the purpose of detecting misuse. We remain accountable to your School for personal information disclosed in this way under our Data Processing Agreement, which applies the standard set by Australian Privacy Principle 8.
Under Microsoft’s terms, prompts and responses are not used to train or improve Microsoft’s, OpenAI’s or any third party’s models, and are not made available to OpenAI. Student, staff and parent records, student alert content, form responses and files themselves are not transmitted to Microsoft. Activity and risk-assessment content is sent only as a fixed, limited list of fields per feature, never as a whole record — the one exception being an uploaded risk assessment, where a School has asked us in writing to enable it, which is sent as one document (see Section 7). What an AI request may and may not contain is described in our AI Data Processing Fact Sheet, available to Schools on request.
AI features are disabled by default. Where a School has not enabled them, no personal information is disclosed outside Australia in the ordinary course of operating the Platform. Schools may ask us in writing to disable AI features at any time by contacting hello@orca.school.
We take reasonable technical and organisational steps to protect personal information from misuse, interference, unauthorised access, modification, disclosure and loss. These measures include:
Our cloud infrastructure is provided by Amazon Web Services, which holds independently audited security certifications including SOC 2 Type II and ISO 27001. Full details are available on our Security page.
While we work hard to protect your personal information, no method of electronic storage or internet transmission is completely secure. We cannot guarantee absolute security, but we are committed to managing and minimising security risks on an ongoing basis.
We retain different categories of information for different periods, based on the legal, safety and operational purpose each category serves.
Order Forms, invoices, contracts and support correspondence are retained for 7 years from account closure, in line with ATO requirements and standard Australian record-keeping obligations.
All information stored within the Platform (including student and staff profiles, parent-student relationships, cohort membership, profile photos, activity records, attendance, risk assessments, student alerts, permission form responses, approval trails, AI conversation transcripts and stored AI responses, and any other data entered or submitted through the Platform) is retained for the life of the School’s subscription. Following account closure, it is retained for a further 90 days to allow the School to request a full export, after which it is permanently deleted.
We hold platform data only for as long as we need it to deliver the Platform to the School. Where a School has record-keeping obligations that extend beyond its subscription, for example in relation to safety, attendance or duty of care records, those obligations rest with the School. The export described below is provided so that the School can meet them from its own records.
Login records, authentication events and IP address logs are retained for 12 months on a rolling basis, after which they are deleted or anonymised.
Application logs, error logs and performance data are retained for 30 to 90 days on a rolling basis, after which they are deleted. These logs are not intended to hold personal information, but may contain it incidentally, for example in the diagnostic record of a failed AI call described in Section 2.
Schools may request a full export of their Platform data at any time during their subscription, and within 90 days of account closure, by contacting hello@orca.school.
Schools may submit deletion requests at any time by contacting hello@orca.school. We handle deletion requests as follows, depending on the nature of the record.
Permanent deletion (hard delete): Where a record has no associated activity history (for example, an account created in error, a duplicate profile, or a record that was never linked to any event), we will permanently delete it from our systems within 10 business days of a written request from the School, with residual copies in secure encrypted backups purged in line with the backup retention schedule.
Removal from active use (soft delete): Where an individual has associated activity records within the Platform, we will soft-delete their profile within 10 business days of a written request. A soft-deleted record is immediately and permanently removed from active use; it no longer appears anywhere in the Platform and is invisible to all school users. The underlying data is retained in our database for the remainder of the School’s subscription so that the integrity of activity, attendance and approval records is preserved, and is permanently deleted with all other platform data at the end of the retention period described above.
Where a soft deletion is applied, we will inform the School in writing and explain what this means. If an individual asks whether their data has been deleted, the honest and accurate response is: “Your personal information has been removed from active use in the platform and is no longer visible to any user. A record of your participation in school activities is retained for the remainder of your school’s subscription to Orca, and is permanently deleted 90 days after that subscription ends.”
When a School’s subscription ends, Platform data is retained for 90 days from the account closure date to allow the School to request a full export. At the end of that 90-day period, all platform data is permanently deleted. Written confirmation of deletion is available to Schools on request.
You can ask us for access to the personal information we hold about you, and ask us to correct anything inaccurate, incomplete or out of date. Where your information is held on behalf of a School, your rights under the Privacy Act 1988 (Cth) are exercised against that School as the entity responsible for the information; our Data Processing Agreement commits us to assisting the School to meet them, to the standard set by the Australian Privacy Principles.
Because Orca is a school-administered platform, personal information about staff and students is held on behalf of the School as data controller. We recommend that individuals contact their School administrator in the first instance. Schools can then contact us to action requests on their users’ behalf.
To make a request directly to us, please contact hello@orca.school with your name and contact details. We may need to verify your identity before actioning a request. We will respond within a reasonable timeframe and in any event within 30 days.
There is no charge for making an access or correction request. In some circumstances we may be unable to provide access to all information we hold (for example, where doing so would unreasonably impact the privacy of another person), and we will explain our reasons if this occurs.
We take data breaches seriously. If we become aware of a data breach involving personal information that is likely to result in serious harm, we will:
Schools, as data controllers, are responsible for determining whether to make notifications to individuals under the NDB scheme, and we will cooperate fully with Schools in that process.
If there is a change of control in our business, or a sale or transfer of our business or assets, personal information held in our systems may form part of the assets transferred. Any such transfer would be made subject to confidentiality obligations and the incoming party would be required to handle personal information in a manner consistent with this policy and applicable Australian privacy law. We would notify affected Schools of any such change to the extent that we are legally able to do so.
Our Website may contain links to third-party websites that we do not operate or control. We are not responsible for the privacy practices of those websites and encourage you to review their privacy policies before providing any personal information to them.
We may update this privacy policy from time to time to reflect changes to the Platform, our practices, or applicable law. When we make material changes, we will notify Schools by email and update the date at the top of this page. We encourage you to review this policy periodically.
If you have a concern about how we have handled your personal information, please contact us in the first instance using the details below. We will acknowledge your complaint promptly and work to resolve it within a reasonable timeframe.
If you remain unsatisfied after contacting us, you may lodge a complaint with the Office of the Australian Information Commissioner (OAIC):
Website: www.oaic.gov.au
Phone: 1300 363 992
For questions about this privacy policy, to exercise your privacy rights, or to make a complaint, please contact:
Privacy Officer
Lennix Pty Ltd
ABN 36 156 631 631
9 Dalman Cres, O'Malley, Australian Capital Territory 2606
Email: hello@orca.school
See how Orca transforms activity management at your school. Book a personalised demo and we’ll walk you through exactly how Orca fits your workflows.