Privacy policy

XPortal is built and operated by Aberdeen & Associates in Australia. In this policy, “we” and “us” mean Aberdeen & Associates, and “organisation” means a training organisation that uses XPortal.

We handle personal information in line with the Australian Privacy Principles in the Privacy Act 1988 (Cth).

If you are a student or an applicant, your training organisation is the right first contact for questions about your record.

• Students and applicants. A training organisation enters and manages their records in XPortal. The organisation decides what is collected and why; we handle it on the organisation’s behalf and on its instructions.
• Staff, trainers and agents of an organisation who have an XPortal account.
• Visitors to this website, and people who ask us for a demo or for support.

Depending on how an organisation uses XPortal, records can include:

• Identity and contact details: name, date of birth, gender, email address, phone numbers, street and postal address, and emergency contact and guardian details.
• Government and education identifiers: Unique Student Identifier (USI), Victorian Student Number (VSN), passport number and visa number.
• Background information: citizenship, country of birth and language spoken at home, plus sensitive information about disability and Indigenous status. Australian vocational education reporting (AVETMISS) requires organisations to ask for these.
• International student details: visa and passport details, English test results, previous study in Australia, health cover, and welfare arrangements for students under 18.
• Education and enrolment records: programs, subjects, attendance, results, prior education, documents an organisation uploads, and certificates.
• Financial records: payment plans, invoices, payments, refunds and agent commissions. Card details are entered with our payment provider and are never stored in XPortal.
• Account information for staff: sign-in details, role, authenticator status, and an audit log of changes made in XPortal.
• Website information: the pages you visit, collected without advertising cookies, and anything you send us in a demo or support request.

We do not sell personal information, and we do not use student records for advertising or to train AI models.

• To provide XPortal to organisations: admissions, enrolment, learning, finance, communications, and compliance reporting such as AVETMISS and CRICOS.
• To keep accounts and data secure, including sign-in checks and audit logs.
• To support organisations and fix problems.
• To improve XPortal and understand how this website is used.
• To meet our legal obligations.

We share personal information only as needed to run XPortal. Some of the providers below operate outside Australia, including in the United States.

• The organisation that holds the record, and the staff it authorises.
• Service providers that host and run XPortal for us: cloud hosting, database and file storage, and email delivery.
• Services an organisation chooses to connect, such as accounting, payments, messaging, file storage and AI assistants. Information goes to these only when the organisation turns the connection on.
• Government systems an organisation reports to or checks against through XPortal, such as the USI Registry and training.gov.au.
• Authorities, when the law requires it.

Staff of an organisation can connect their XPortal account to ChatGPT to lodge student applications by conversation. Connecting requires signing in to XPortal and approving the connection.

When staff use the plugin, what they type and what XPortal returns pass through OpenAI, which provides ChatGPT. That can include any of the applicant details listed above, including identifiers and sensitive information, if staff choose to enter them in ChatGPT instead of in XPortal. OpenAI handles that information under its own terms and privacy policy and the ChatGPT settings of the staff member or their organisation. We do not control how long OpenAI keeps it.

The plugin can read and save application drafts, and submit an application after the staff member confirms. It works only within the organisation and the permissions of the account that connected it, and it returns only what the task needs. XPortal records changes made through the plugin in its audit log.

An organisation can choose not to use the plugin. Staff can enter identifiers and sensitive answers in XPortal instead of ChatGPT, and can disconnect at any time from ChatGPT’s settings.

XPortal’s database and files are stored in Sydney, Australia.

Information is encrypted in transit and at rest. Each organisation’s data is kept separate from every other organisation’s. Staff accounts need an authenticator app as a second sign-in step, access is limited by role, and changes are recorded in an audit log.

We keep an organisation’s data for as long as it uses XPortal. Australian regulators require training organisations to keep some student records for many years, so the organisation, not XPortal, decides when a student’s record is removed.

When an organisation stops using XPortal, we return or delete its data at its request, apart from backups that expire on their normal schedule and anything the law requires us to keep.

Demo and support requests are kept while we are in contact with you, and afterwards in our business records.

You can ask to see or correct the personal information held about you. Students and applicants should ask their training organisation, which controls the record; we will help the organisation respond. Staff and website visitors can ask us directly.

You can ask us to delete information we hold in our own right, such as a demo request.

Email us and we aim to respond within 30 days. If you are not satisfied with our response, you can contact the Office of the Australian Information Commissioner at oaic.gov.au.

We may update this policy. The date at the top shows the latest version, and we will tell organisations about significant changes.