Data security and child safety

1 Our five rules

1. Identifying information stays secure. Names, emails, Year levels, results, permissions and photos are only seen by signed-in people whose role needs them. None of it is public facing.
2. Student names are never put with images of students. Not in titles, captions, descriptions, tags or file names, and never on a public page.
3. A student's location is never revealed publicly. Location data is removed from photos, and there is no live location, check-in or tracking feature.
4. Students only communicate with adults through services and email accounts approved by the Department of Education WA (DoE WA).
5. Messaging services are never used with students. There is no chat or direct messaging with students in any portal.

These rules apply to the team portal, the public website and the Blue Tongues Academy, and to everyone who uses them: students, parents, mentors, coaches and Team Admins.

2 Identifying information stays secure

• Each role sees only what it needs (see the Privacy and collection notice). Parents see only their own child.
• The public website is built from pages a Team Admin approves. The portal refuses to save a public page that contains a student's full name, and asks the editor to check when a student's first name or surname appears on its own.
• Public certificate checks never show the holder's name. A person can type the name printed on the certificate to confirm it matches.
• Passwords are stored encrypted. Data backups for the school server leave out passwords, sign-in sessions and links, and only Team Admins can make them.
• The portal's data is kept in Australia. Copies go only to the school's own server.

3 Photos and names

• A student is only shown in a public photo when their parent or guardian has given permission, as the Department's Students Online in Public Schools procedures require.
• Every photo or video waits for a Team Admin to approve it before it is public. The Team Admin checks for faces without permission, names, uniforms with names, and anything that shows where a student lives.
• The portal refuses a student's full name in a photo's title, caption, description, tags or event, and asks for a check when a first name or surname appears on its own.
• A file name that contains a student's name is replaced when it is uploaded.
• The portal never shows who uploaded a photo next to it, so a photo is never linked to a student's name.

4 Locations

• Location (GPS) and camera data is removed from JPEG and PNG photos as soon as they are uploaded, including photos already in the library.
• Some files (videos, WebP and HEIC photos) can still hold location data. They can't go on the public website until a Team Admin ticks that they have checked them.
• The portals have no live location, check-in or tracking features. The public website only lists public events, such as competitions, without saying which students attend.
• Travel permissions and home details are only seen by the Team Admin and the student's own parent.

5 How students and adults communicate

• Student accounts must use a DoE WA email address (for example firstname.lastname@student.education.wa.edu.au). Southern River College's own srczone.net addresses count as DoE-approved. The portal refuses any other address for a student.
• The portal only emails a student from a DoE-approved sending address. If the portal is set up to send from any other account, emails to students are held back, and the Team Admin is warned.
• When an adult sends a group email, a student's reply can only go to a DoE-approved address. A personal reply-to address is removed.
• There is no chat or direct messaging with students. Adults must not contact students through social media, messaging apps or personal email or phone.
• Parent messages are between adults only (parents, Coaches and Team Admins). The Team Admin can turn them off; parents then email the team's DoE addresses.
• Replies to students' feedback follow the Team Admin's setting: by DoE email only, in the portal where every Coach and Team Admin can also see them, or not at all.

6 Warnings in the portal

The Team Admin sees warnings on the dashboard and on Admin > Data security, for example:

• a student account whose email isn't a DoE address;
• the portal sending email from an address that isn't DoE-approved;
• emails held back because of these rules;
• a photo, video or public page that names a student;
• a public file that may still hold location data.

7 State and Federal law and Department policy

These rules are written to follow:

• Western Australia: the Privacy and Responsible Information Sharing Act 2024 (most parts in force from 1 July 2026; serious data breach notification from 1 January 2027), the School Education Act 1999, the Children and Community Services Act 2004 (including mandatory reporting) and the Working with Children (Criminal Record Checking) Act 2004.
• Department of Education WA: the Students Online in Public Schools policy and procedures (parent permission for online services and for publishing students' images and work), and the Department's child protection, records and staff conduct requirements.
• Commonwealth: the Privacy Act 1988 and the Australian Privacy Principles, the Online Safety Act 2021, and the National Principles for Child Safe Organisations.

This is a plain-language summary, not legal advice. Where the Department's policies say more, they apply. This notice is a draft for review with the school.

8 Raising a concern

• If a child is in immediate danger, call 000.
• Tell the school principal and the Team Admin (use Contact us or the Send feedback box in the portal) about any concern for a student's safety, or anything in the portal that breaks these rules.
• Serious online abuse can be reported to the eSafety Commissioner.

This notice is next reviewed in October 2027, or sooner if the law or Department policy changes.