Privacy Policy

Who holds your information

Kestrel is a student information system published by Hoverpoint Pty Ltd (ABN [to be confirmed]), a company registered in Victoria, Australia. Schools use it to hold the records of the people connected to them.

Two organisations are involved in any record Kestrel holds, and they answer for different things. The school decides what to collect about a person and why. It is the organisation a family or a member of staff has a relationship with, and it owns the record. Hoverpoint Pty Ltd runs the software and holds that record on the school's behalf.

If you are a parent, a student or a member of staff, the school is usually the quickest place to start. The school knows who you are, and we do not. This policy covers what Hoverpoint does with the information while it is in Kestrel. All the ways to reach us directly are on this page.

We commit to the Australian Privacy Principles in everything set out below.

If your school is in England, the UK GDPR and the Data Protection Act 2018 apply as well. The section For a school in England sets out what that changes.

There is a shorter Privacy Policy for students, written for a child to read. It says the same things in simpler words.

What Kestrel holds

These are the kinds of personal information Kestrel stores, set out by who they are about. A school types some of it in, and the rest is made as the school uses the software. What a school records depends on which parts of Kestrel it uses.

Anyone on a school's record

A person on a school's record

Kestrel stores their name and any earlier name the school has recorded, and their date of birth and gender. It stores the date of death where the school has recorded one, and the language to write to them in. It stores each affiliation they have with the school: enquiry, applicant, student, staff, volunteer, contractor or board member. For each affiliation, it stores the dates it ran between and the reason it ended. It stores the numbers other systems give them, such as a government student number or the number in the school's previous system, as described under government identifiers.

The census details a school reports

Kestrel stores a person's sex, country of birth, ethnicity at a school in England, Aboriginal and Torres Strait Islander status, the language spoken at home and residency status, where the school records them. It stores the subclass of a visa and the dates it was granted and expires.

How to reach them

Kestrel stores each email address, phone number and postal address a person gives the school, with the dates each was in use and the order to try them in.

A school's own fields

A school can define fields of its own and record a value in each for a person. The school sets how sensitive each field is before it stores a value, and Kestrel protects the value at that level.

Messages the school sends

Kestrel stores the title and text of each message a school sends through it, encrypted. It stores who each message went to, the student it was about, and whether it was delivered. Where the school's rules meant a person was not told, it stores the reason, encrypted.

Who accessed a record

Kestrel keeps an audit trail naming the person who accessed a record, their roles, the action and its time, the records involved and whether access was allowed or refused. It records the reason where one is required.

Answers on a form

A school builds its own forms, and Kestrel stores the answers given on each one, linked to the person a form is about. A form that asks for a signature stores a fingerprint of the answers that were signed, with who signed and when, and no image of the signature.

A student, or a child who enquires or applies

Enquiries and applications

Kestrel stores an enquiry and the message that came with it, the application and its answers, including the health and learning answers a school asks for. It stores each step an application goes through with its date: a tour or open day booked, an interview with the interviewer's notes, an offer, the deposit, the acceptance and its signatures, and a place on the waiting list. It stores the documents a school asks for and whether each has arrived or been waived. It stores a referee's name and email address, their reference or specialist report, the signed name and reply date, and for a student from overseas, their enrolment confirmation references and their homestay and welfare arrangements.

Attendance

Kestrel stores each mark on the roll, and each late arrival and early departure with its time and whether the office or the kiosk recorded it. It stores each absence, its reason, encrypted, and who gave the reason. Where a school lets a student find their own name at the kiosk by a PIN or a card number, it stores that number as one the school records for the student.

Family, home and court orders

Kestrel stores the homes a child lives in and who lives there, and how they are related to others on the record. For each adult connected to a student, it stores whether they have parental responsibility, whether the child lives with them, and whether they receive reports and messages. It stores each court order about a child with its kind, the court and its dates, and the order's reference and terms, encrypted. It stores a mark where a person's whereabouts are protected.

Boarding

Kestrel stores the boarding house and room a boarder is in during term.

Health

Kestrel stores a student's medical conditions, with the kind and severity and a notice for staff, and the activities each one restricts. The detail of a condition and what triggers it are encrypted, and only staff the school allows read them. It stores the medication a student takes, each dose given, action plans, immunisation records, consents, and each visit to the sick bay with its treatment and follow-up.

Wellbeing and behaviour

Kestrel stores merit and demerit entries, detentions, sanctions and awards, pastoral notes and alerts, and pastoral cases. It stores child-safety concerns, which may name an adult a concern is about, counselling notes, individual plans and their progress, meetings and their outcomes. It stores the adjustments a school makes for a student with disability, with the evidence and the consultations behind them, and the provisions a student has in exams. The notes and descriptions written in them are encrypted.

Learning and results

Kestrel stores a student's classes and house, each assessment task and the result and feedback for it, and the reason a teacher gave for changing a calculated result. It stores report comments, NAPLAN scale scores and bands, exam entries with their candidate numbers, results from external exams, and results from a school the student came from. Next year's estimated mark and the learner profile are described under what we do not do.

Excursions, sport and music

Kestrel stores the activities and teams a student is in, the consents given for an excursion and the reason for a withdrawal, an incident on an activity and what was done about it, music lessons, and sport trials and selection. It stores the instruments and equipment lent to a student, the due and return dates, and their condition.

A family member, or another adult connected to the school

A family member or student who signs in

Kestrel stores their name and email address. It stores the public key of each passkey registered to the account, and the kind of device it came from. It stores a record of each sign-in session, which keeps them signed in from one page to the next. Each session record includes the network address and the browser it started from. Where a phone registers for notifications, it stores the kind of phone and the token that addresses it, encrypted.

Fees and who pays them

Kestrel stores who pays a student's fees and each payer's share of each kind of charge, any concession with its kind and reference, and each invoice with the payer's name and address as they stood on the day it was issued. It stores no card or bank account number.

Signing an offer

When a parent signs a school's offer, Kestrel stores the name they signed with, the time, the network address and device they signed from, and their email address.

Donors and former students

Kestrel stores the gifts a person gives the school, pledges and regular gifts, an intention to leave a bequest, a declaration for Gift Aid at a school in England, and the events a person attends with any dietary or access need they tell the school. It stores a proposed gift and the school's steps in asking for it. It stores a former student's alumni directory listing and the choices they made about it.

A member of staff

A member of staff who signs in

Kestrel stores their name and email address. It stores the public key of each passkey registered to the account, and the kind of device it came from. It stores a record of each sign-in session, which keeps them signed in from one page to the next. Each session record includes the network address and the browser it started from. While Kestrel is open in front of them, the session record also keeps the address of the page on screen and the time it was last reported, which an administrator at that school reads to see who is working in the console. Each identifier in that address is replaced with a marker before it is stored, so the record names the screen and never the person or the record on it. One report replaces the one before it, and the whole of it goes when the session ends. It stores the photo they add to their account as a copy 256 pixels square, and discards the image they uploaded.

Sign-in through the school's own directory

Where a school signs its staff in through its own directory, over OpenID Connect or SAML, Kestrel stores the name and email address the directory sends and the directory's own identifier for the account. It stores which of a person's roles came from the directory's groups. It reads the groups at each sign-in and stores none of them, and it stores none of the directory's tokens.

Employment and compliance checks

Kestrel stores the kind of employment, the campus and the position a member of staff holds and its duties. It stores each compliance check, such as a Working with Children Check or a teacher registration, with its kind, the state or territory, the check number, the outcome, the dates it was issued and expires, and who verified it. It stores a check a member of staff submits for themselves before the school verifies it.

A visitor, or anyone without an account

A visitor who signs in at the kiosk

Kestrel stores the visitor's name and organisation, encrypted, the member of staff they came to see, the times they arrived and left, and their badge. The kiosk is a device the school sets up, and it signs no-one in to an account.

Someone who fills in a public form

A school can publish a form that anyone can fill in without an account, such as an enquiry. Kestrel stores the answers the form asks for and nothing else about the person who gave them.

No-one at all

A password

No password is stored for anyone, because Kestrel has no password sign-in and so no password to leak, reuse or phish.

The list above is the record as it stands. If Kestrel starts to hold a new kind of information about a person, this policy changes first to describe it. The version and date at the top of the page change with it.

Why it is held

Each kind of information above is kept for the purpose listed with its name.

• A person on a school's record. To give a school a working record of each person connected to it, so the office can tell one person from another. A former name stays with the person it belongs to, because it is often the only thing connecting an adult to their own student record.
• The census details a school reports. To answer the census and the returns a school is required to make to government, which ask for these details by name.
• How to reach them. To reach a person at the address or number they gave the school.
• A school's own fields. To let a school record what its own work needs beyond Kestrel's own record, at the protection the school chose for it.
• Messages the school sends. To tell families and staff what they need to know, and to show the school later who was told what, and when.
• Who accessed a record. To let the school check who used its records and investigate access that should not have happened.
• Answers on a form. To collect what a school asks a family, a student or a member of staff for, such as a consent, a change of details or a request, and to show what was signed.
• Enquiries and applications. To let a school answer an enquiry, decide an application, offer a place and keep track of what is still owed.
• Attendance. To keep the attendance register a school is required to keep, to follow up an absence no-one has explained, and to let a student sign in late or out early at the front desk.
• Family, home and court orders. To know who may be told about a child and who may collect them, and to keep a protected child's whereabouts from anyone the protection does not name.
• Boarding. To know where a boarder lives during term, which the census and an evacuation both ask.
• Health. To keep a student safe at school, so that staff know what to do in an emergency and the nurse has the history.
• Wellbeing and behaviour. To support a student's wellbeing and behaviour, to keep the child-safety records the law requires, and to report the adjustments a school makes for a student with disability.
• Learning and results. To teach, assess and report on a student's learning, and to enter them for exams.
• Excursions, sport and music. To run excursions, sport and music with the consents and the care they need, to account for what happened on one, and to track equipment lent and returned.
• A family member or student who signs in. To sign a family member or a student in to the portal and keep them signed in, and to show them only the children they have standing for.
• Fees and who pays them. To bill the right person for the right share of a student's fees.
• Signing an offer. To show that the parents who accepted a place agreed to its terms.
• Donors and former students. To manage a proposed gift, receipt a gift and thank the person who gave it, to run a school's events, and to keep the alumni directory a former student chose to join.
• A member of staff who signs in. To sign a member of staff in and keep them signed in, and to let them remove a passkey from a device they no longer have. To show a school's administrators who is signed in at this moment and the page each of them has open, so the school knows who is working before it changes a setting everyone there relies on. To show the photo a member of staff adds to their account beside their name, to the staff at each school they work at.
• Sign-in through the school's own directory. To sign a member of staff in with the account their school already gives them, and to give them the standing and roles their school maps to its groups.
• Employment and compliance checks. To keep the register of checks a school is required to keep, and to know before a check expires that it needs renewing.
• A visitor who signs in at the kiosk. To know who is on site at a campus, which a school needs for the safety of its students and in an evacuation.
• Someone who fills in a public form. To let someone who has no account ask a school something or give it what it asked for.

For all of it:

• To write to each person in the language they read.
• To meet the record-keeping obligations a school is under, which set how long several kinds of record have to be kept.

What we do not do with it

• There is no advertising in Kestrel, and Kestrel contacts no advertising network of its own. A school may set its own Google Tag Manager container or Meta pixel for its public enrolment pages, the enquiry form and the tours page, and those are the only pages that can load them. A family is asked first, on the confirmation after they send an enquiry or book a tour, and the school's tags load only once they accept, and once for that confirmation. The family portal, the console, the application form and a form a student fills in never load them, and the Meta pixel runs with its automatic advanced matching switched off. Where the school shows one of these pages inside its own website, the page loads no tag and tells that website only that a family sent an enquiry, booked a tour or opened the application, with no answer and no name in it. What the school's tags and its website collect is the school's to answer for, under the school's own privacy policy.
• There is no third-party analytics and no session recording. Kestrel counts how often each screen of the console is opened, by day, by school and by the roles Kestrel ships that the person who opened it has, with each role a school defined for itself counted as one. A count names no person and keeps no account, session or network address, and the screen is kept as its address with each record's identifier taken out, so a count says which screen was opened and never whose record was on it. Seraco reads the counts to decide which screens to improve and which to retire, and sees a count only when enough people stand behind it: a school with too few staff is left out, and roles too few people have are merged into one figure or left out. Beyond those counts, nothing sends Kestrel what a person typed, clicked or read on a page. The content policy the browser enforces blocks each external origin a page has not named, so a script of that kind could not run even if one were added. Only a school's public enrolment pages name any: the hosts of the school's own logo, and on the confirmation, the hosts of the school's tags above.
• There is no tracking of where a member of staff is. The page an open console reports is the screen it has drawn, kept for as long as that screen is the current one, and Kestrel keeps no history of the screens any one person visited. The browser tab remembers the last few pages opened in it, by their titles, so its back button and its list of recent pages work. That list stays in the tab and is never sent to Kestrel. It is emptied at sign-out, and the browser discards it when the tab closes.
• There is no profiling, scoring or ranking of any person, with two exceptions. Next year's estimated mark gives the head of a department an estimate of each continuing student's mark in that department's subjects, calculated from the mean of their scaled results so far this year. Only the head of department reviewing their own department sees it, and they may give a different mark instead of the estimate, with the reason for it. A student's learner profile holds their academic strengths and knowledge and skills worked out afresh from their results and the curriculum, their work samples, and a teacher's dated observation of their leadership, character traits, unique potential, a preferred way of learning or their motivation, in the teacher's own words and kept under the teacher's name. Only the staff who teach or are responsible for the student see it, and so does a parent where the school has switched that on; it starts off. No-one is scored or ranked beyond those two records, and a person can ask the school to see either one and to have it corrected.
• There is no sale, rental or exchange of personal information with anyone.
• There is no model training. Kestrel runs no model: the question box on the enrolment board matches keywords against what the board shows.

Who else sees it

The service providers who handle information for Hoverpoint Pty Ltd are listed below, with what reaches each of them. The security page shows the same list, because both pages read it from one place.

FlowVPS

Runs the virtual machine that hosts the application and its database.Organisation Alpha Layer Pty LtdContact admin@flowvps.comReceives All of it, as the operator of the host.Lawful basis The school's records are stored on the host to provide the service the school contracted for, which is the purpose they were collected for (APP 6.1). The host is in Australia, so APP 8 does not apply.In AustraliaFrom a school in England A school in England's records are stored on this host in Australia. The UK has no adequacy regulations for Australia, so the school and Hoverpoint sign the ICO's International Data Transfer Agreement, with a transfer risk assessment, before the school's records are loaded.

Let's Encrypt

Issues the TLS certificate that secures the connection to the site.Organisation Internet Security Research GroupContact privacy@abetterinternet.orgReceives The domain name. No personal information.Lawful basis No personal information reaches it, so no privacy-law basis is needed.In United StatesFrom a school in England No personal information reaches it, so no transfer rule applies.

AgentMail

Delivers service email and school messages sent from the school's address: the one-time code that signs a person in, and the notices, reminders and follow-ups a school sends to families and staff. A connected Microsoft 365 mailbox sends through Microsoft instead; AgentMail is the fallback if that delivery fails.Organisation AgentMail, Inc.Contact contact@agentmail.ccReceives The address each email goes to, its subject and its text. A sign-in code's email has the code and nothing else. A school's message can name the person it is written to and a student it is about. Delivery identifiers name the school and contact point for delivery reports.Lawful basis Each email is sent to tell the person what the school, or their own sign-in, needs them to know, which is the purpose the address was collected for (APP 6.1). AgentMail is outside Australia, so Hoverpoint stays accountable for its handling under APP 8.1, and a data processing addendum with AgentMail binds it to protect each email it delivers.In United StatesFrom a school in England Email delivered through AgentMail to a family or a member of staff at a school in England reaches the United States. AgentMail names the EU standard contractual clauses as its safeguard for a transfer from the UK.

Amazon Web Services

Runs Claude on Amazon Bedrock, the model that answers a question a member of staff asks in Ask the record, for a school that turns it on.Organisation Amazon Web Services Australia Pty LtdContact aws-EU-privacy@amazon.comReceives The question as it was typed, the list of reads the asker may make, and the rows those reads returned, which can name a student.Lawful basis Each question is sent to answer the member of staff who asked it from the school's own records, which is a purpose the records were collected for (APP 6.1). Kestrel sends it to Bedrock in Sydney and processing stays in Sydney and Melbourne, so APP 8 does not apply. AWS does not use the inputs or outputs to train a model and does not share them with the model's provider.In AustraliaFrom a school in England A question asked at a school in England is processed in Australia. The UK has no adequacy regulations for Australia, so it is covered by the International Data Transfer Agreement and transfer risk assessment the school signs with Hoverpoint for the host.

Apart from the access a school grants and the voluntary alumni directory described below, we disclose a school's records to no-one else. Where a court order, a warrant or a law compels us to hand something over, we tell the school before we do it, unless the order itself forbids us from telling them.

A school can connect services of its own to Kestrel: its own directory to sign its staff in, its Microsoft 365 so that a member of staff sends a message from their own mailbox, and an AI tool a member of staff connects to their account. What reaches one of those services is what the school chose to send it, under the school's own agreement with that provider.

The alumni directory

The directory is off until your school switches it on. You are listed only if you opt in, and you choose separately whether classmates see your name, leaving year, house, city, occupation, employer and a short note. Your address, phone number and date of birth are never listed. You can change your choices or opt out at any time; opting out removes your listing from the next search.

Only former students matched by the school to their records can search. Protected people, people under 18, people whose date of birth is not recorded, deceased people and unmatched people are never listed. Each search is audited, returns at most fifty people and is limited to ten searches a minute. There is no export or bulk list, and a search matches only fields a person chose to share.

A message to a listed classmate is delivered through Kestrel's send path, subject to the recipient's consent. Sending a message shares your name, as the message form explains, but your email address stays hidden unless you choose to include an address for replies. A recipient can block a sender. You or the school office can raise a concern and take a listing down immediately, pending the office's review.

Where it is held, and what leaves Australia

All school records Kestrel holds are in Australia, on one virtual machine, in one PostgreSQL database. Each school's records are in their own schema inside it. The backups are encrypted and kept on that same machine, so they are in Australia too. The test environment contains invented data and no real person's record.

Email leaves the country. Sign-in emails and school messages sent from the school's address go through AgentMail in United States. That includes a sign-in code someone asks for, and messages a school sends by email: a notice, a reminder, or a follow-up about an absence or a visit to the sick bay. What reaches it is the address each email goes to, the subject and the text. A message from a school can name the person it is written to and a student it is about, and it says what the school wrote about them. Delivery identifiers also tell the provider which school and contact point a delivery report belongs to.

A message sent from a member of staff's connected Microsoft 365 mailbox goes through the school's Microsoft 365 instead. If that delivery fails, Kestrel tries AgentMail. The school's agreement with Microsoft governs where Microsoft processes that message.

Kestrel sends no text message and no push notification. Signing in with a passkey sends nothing to anyone: the key never leaves the device it was made on.

Government identifiers

Kestrel identifies a person by a random identifier its own database generates. It does not adopt a government-related identifier as its own way of identifying anyone.

A school can record the student numbers a government or an awarding body issues to a student, such as a Victorian Student Number, a Unique Student Identifier or a Unique Pupil Number, because the school reports to that body with them. Each is stored against the person as a fact the school recorded. Kestrel shows it to the school's staff and includes it in the returns and results exchanges that ask for it. It stores the subclass of a visa where the school records one for the census. It stores no tax file number and no Medicare number for anyone.

Getting a copy of your information, correcting it, or asking us to delete it

You can ask for a copy of what is held about you. You can ask us to correct anything in it that is wrong, and you can ask us to delete it. The first two are rights you hold, and we answer the third as far as the law lets us. None of them costs anything.

Ask the school first. The school has the relationship with you and can answer most requests directly in Kestrel. If the school cannot, or if you would rather come to us, write to privacy@hoverpoint.io and tell us which school's record you are asking about.

Your request is recorded from the day it arrives, with a reference you can quote back to us and the two dates below on it. That way the school and we can both see what is owed to you, and when.

• We acknowledge your request within 5 business days, and we answer it within 30 days.
• We have to be sure who you are before we hand anything over, so we may ask you to confirm your identity through the school. If you are asking about a child, we check that you are entitled to their record.
• If we correct something, we tell you what changed. A correction keeps the earlier version on the record, with the dates it applied over. A school is often asked what it held on a date in the past.
• If we do not agree that a record is wrong, we tell you why in writing, and we tell you how to complain about that decision.
• Deletion is limited by how long records have to be kept. Where you ask us to delete something a school is obliged to hold, we take it out of everyday use, we tell you which parts are being kept, which obligation keeps them and when that period ends, and it is disposed of when the period ends. The section on how long it is kept sets out those periods.
• If we refuse a request, we give you our reason in writing. There are requests we have to refuse, such as one that would disclose another person's information or breach a court order about a child.

Making a complaint

Write to privacy@hoverpoint.io and say that you are making a privacy complaint. We acknowledge it within 5 business days and answer it within 30 days, in writing, with what we found and what we did about it.

If our answer does not satisfy you, you can take the complaint to the Office of the Australian Information Commissioner, the regulator for privacy in Australia. The OAIC takes complaints at oaic.gov.au and on 1300 363 992. You do not need our permission to go to them, and you can go to them at any point.

Questions and complaints says all of this in plain words, for a student or a child asking about their own information. It covers asking a question without giving your name, which you can do.

How long it is kept

A school record has a retention class rather than a delete button, because a student's file outlives their enrolment by decades and an attendance register is evidence. Child-safety records are kept for 45 years, counted from the child's date of birth. Attendance registers are kept for 7 years. A record under legal hold is kept whatever its age.

The record of a family who enquired or applied and never started is kept for a period the school sets, between 30 days and 7 years, and at most 3 years for an enquiry that never became an application. Until a school sets its own, the documents the family sent, the health and learning answers and the interview notes are kept for 90 days and the rest of the record for 2 years. A pass on the first of each month deletes the records whose period has run out, and that night's disposal removes them. A family can ask the school to destroy a child's information sooner, and the school answers with what it had to keep and why.

Taking a record out of the working set and disposing of it are two separate acts. The security page lists each class and the obligation behind it.

How it is protected

Each school's records are in their own database schema, reached through a database role with privileges on that schema and no other. PostgreSQL itself stops one school's role from reaching another school's schema, so that protection does not depend on our code getting a query right. Sign-in is by passkey, with a one-time email code as the fallback. Each route that serves student data checks the session on the server.

The security page sets out each protection and what it stops.

If something goes wrong

If we find that someone has reached a school's data without authorisation, we contact that school's nominated privacy contact directly, in writing, with what we know and what we do not. Australia's Notifiable Data Breaches scheme requires an assessment within 30 days, and notification to the people affected and to the OAIC where serious harm is likely. The school has the relationship with those families, so our job is to give it what it needs to make that assessment quickly.

For a school in England

A school in England is under the UK GDPR and the Data Protection Act 2018, and the Information Commissioner's Office regulates it. Everything above applies to its records too. This section adds what the UK law requires.

The controller and the processor

The school is the controller of the records it keeps in Kestrel: it decides what to collect about a person and why. Hoverpoint Pty Ltd is its processor under Article 28 of the UK GDPR. We act only on the school's written instructions, we keep the records confidential, and we help the school answer the requests and meet the duties the law places on it.

The lawful bases

The school decides the lawful basis for each record it keeps. Our privacy impact assessments name these for the records Kestrel keeps for a school in England alone:

Pre-employment checks on staff

Article 6(1)(c), the duty Keeping Children Safe in Education and the Independent School Standards place on the school.Condition A DBS certificate and a barred-list, prohibition or section 128 outcome are criminal offence data under Article 10. The conditions are paragraphs 1 and 18 of Schedule 1 to the Data Protection Act 2018, which paragraph 36 extends to that data.Assessment PIA-030

The SEND register

Article 6(1)(c) or (e), the school's duties under the Children and Families Act 2014 and the SEND Code of Practice.Condition A pupil's type of need is special category data. The condition is Article 9(2)(g), with paragraph 6 of Schedule 1 to the Data Protection Act 2018.Assessment PIA-031

A pupil's ethnicity and first language

Article 6(1)(c), the census return the Department for Education requires.Condition Ethnic origin is special category data. The condition is Article 9(2)(g), with paragraph 6 of Schedule 1 to the Data Protection Act 2018.Assessment PIA-032

Exam entries and results

Article 6(1)(e), the school's public task of educating the pupil, and its duty as an examination centre.Condition Entries and results are not special category data, so no condition is needed.Assessment PIA-034

Getting a copy of your information

You can ask the school for a copy of what it keeps about you, and for a correction or a deletion. The school answers within one month. Where a request is complex, or you have made several, it may take two more months, and the school tells you within the first month that it needs them and why. The month starts when the school has what it needs to confirm who you are, and it stops while the school waits for you to clarify a request that covers a large amount of information.

If you write to privacy@hoverpoint.io instead, we pass your request to the school, which answers it, and we help the school do so.

Making a complaint

Complain to the school first. If the school's answer does not satisfy you, you can complain to the Information Commissioner's Office, the regulator for data protection in the UK. The ICO takes complaints at ico.org.uk and on 0303 123 1113.

If something goes wrong

If someone reaches a school's data without authorisation, we tell the school without undue delay, with what we know. That lets the school report the breach to the ICO within 72 hours of becoming aware of it, as the UK GDPR requires.

Where the records are stored

A school in England's records are stored in Australia, on the same host as all other schools' records. The UK has no adequacy regulations for Australia, so sending the records there is a restricted transfer. Before the school's records are loaded, the school and Hoverpoint sign the ICO's International Data Transfer Agreement, with a transfer risk assessment.

A school in England's personal information reaches these processors:

• FlowVPS, in Australia. A school in England's records are stored on this host in Australia. The UK has no adequacy regulations for Australia, so the school and Hoverpoint sign the ICO's International Data Transfer Agreement, with a transfer risk assessment, before the school's records are loaded.
• AgentMail, in United States. Email delivered through AgentMail to a family or a member of staff at a school in England reaches the United States. AgentMail names the EU standard contractual clauses as its safeguard for a transfer from the UK.
• Amazon Web Services, in Australia. A question asked at a school in England is processed in Australia. The UK has no adequacy regulations for Australia, so it is covered by the International Data Transfer Agreement and transfer risk assessment the school signs with Hoverpoint for the host.

Changes to this policy

The version and the date at the top of this page tell you which edition you are reading. The page also tells you when its review date has passed.

We write to each school before a change to this policy takes effect, and the letter tells them what changed. A change to what Kestrel holds about a person is published here before the software starts holding it.

How to reach us

The privacy officer for Hoverpoint Pty Ltd is Andrew Todd. Write to privacy@hoverpoint.io for anything on this page: a copy of your information, a correction, a complaint, or a question this policy does not answer.

To report a security vulnerability, write to security@hoverpoint.io instead, which reaches the same people faster.