Child safety at Academyship

#01Purpose, scope and audience

This statement describes the commitments of ACADEMYSHIP PTY LTD (ACN 698 283 448, ABN 89 698 283 448) ("Academyship", "we", "us") to the safety, wellbeing and online safety of children and young people, in our role as the technology provider of a multi-tenant student management and education administration platform (the "platform" or "Services").

It is written for Institutions and their staff, parents and guardians, students, procurement and safeguarding teams, regulators and the public. Academyship's customers ("Institutions") include universities, colleges, registered training organisations, vocational and workforce-development providers, schools and other education and training organisations. Some Institutions serve children and young people (people under 18); others serve only adult learners. Where this statement refers to "children and young people", it means learners who are minors; where it refers to "learners" or "Users", it includes adults.

This statement explains Academyship's child-safety approach and the respective roles of Academyship and Institutions. Contractual obligations are contained in the applicable Order Form, Terms of Service, Data Processing Addendum, Acceptable Use Policy and any other agreement entered into with Academyship. It does not replace an Institution's own child-safety, safeguarding or duty-of-care policies, or any legal obligation an Institution or individual has.

#02Definitions used in this statement

Defined terms used here — including Customer, Institution, User, Authorised User, Customer Data, Student Data, Sensitive Information, Integration, Subprocessor and AI Features — have the meanings given in our Terms of Service, Privacy Policy and DPA. In addition, in this statement:

• Child or young person means a person under 18 years of age.
• Child sexual abuse material (CSAM) means material that depicts or describes the sexual abuse or exploitation of a child, including simulated, altered or artificially generated material.
• Grooming means conduct intended to build a relationship, trust or emotional connection with a child, or with a person who has care of a child, in order to enable sexual abuse, exploitation or another form of harm.
• Safeguarding means the arrangements an organisation puts in place to protect children from harm, including policies, screening, training, supervision, reporting and response.
• Reporting channel means Academyship's designated child-safety and online-safety reporting address, safety@academyship.com.au.

#03Our child-safety principles

Academyship places the safety, wellbeing, dignity, privacy and rights of children and young people at the centre of how we design, build, operate and support the platform. We hold zero tolerance for child sexual abuse, child sexual exploitation, grooming and child sexual abuse material. We are committed to reducing the risk that our technology is used to harm a child, and to responding appropriately when a concern involving the platform is raised with us.

We seek to align our practices, as a technology vendor supporting Institutions, with the National Principles for Child Safe Organisations and with the principles of Safety by Design published by the eSafety Commissioner — service provider responsibility, user empowerment and autonomy, and transparency and accountability — to the extent those principles apply to an organisation in our role.

We do not claim any child-safety certification, accreditation, audit result or regulator endorsement, and this statement should not be read as one. Our role complements — it does not replace — the safeguarding responsibilities of the Institutions that use the platform.

#04Shared responsibility model

Child safety on the platform depends on both parties doing their part. Academyship builds, operates, secures and supports the software. The Institution operates the educational service and decides who has an account, what roles and permissions those accounts have, which features are enabled, how communication and safeguarding processes work, and what information is collected and kept within its tenant.

White-label configuration must not hide or prevent access to required child-safety, reporting, privacy, accessibility or emergency information. Institutions that apply their own branding must ensure Users can still locate their safeguarding contacts and Academyship's platform-related reporting channel, consistent with section 7A of our Terms of Service.

#05Institution responsibilities

Governance and policies

The Institution must:

• maintain its own child-safety, safeguarding and student-welfare policies;
• maintain codes of conduct for staff and contractors;
• establish clear professional-boundary requirements;
• define who is responsible for receiving and escalating child-safety concerns;
• maintain appropriate internal complaint and investigation procedures;
• review its safeguarding procedures periodically; and
• ensure its Academyship configuration supports its safeguarding model.

Screening and suitability

The Institution must:

• determine which staff, contractors and volunteers perform child-related work;
• complete Working with Children Checks or equivalent screening where legally required for the role and jurisdiction;
• perform appropriate identity, qualification, reference and suitability checks;
• prevent unauthorised or unsuitable personnel from accessing student information;
• remove or change access when a person's role changes; and
• disable access promptly when employment, engagement or enrolment ends, where appropriate.

Screening requirements are not universal. Whether a person requires a Working with Children Check or another clearance depends on the nature of the role and the law of the relevant state or territory. The Institution — not Academyship — determines which of its roles require screening.

Training and awareness

The Institution must:

• provide safeguarding and child-safety training appropriate to staff roles;
• train staff on professional communications with students;
• explain mandatory-reporting and escalation pathways to those who need them;
• provide students and families with age-appropriate safety information;
• explain how a concern can be raised; and
• ensure staff understand the difference between a technical support request to Academyship, an institutional safeguarding response, and a report to an authority.

Accounts and access

The Institution must:

• approve users before granting access, and verify identity where appropriate;
• assign minimum-necessary permissions;
• prevent account sharing;
• review administrative access periodically and monitor privileged accounts;
• remove inactive or unauthorised accounts;
• supervise temporary workers and contractors;
• configure parent, guardian and student access appropriately;
• restrict access to sensitive student information; and
• review Integrations and exported information.

Communications

The Institution must:

• establish rules for staff-to-student communications;
• decide when one-to-one communication is permitted;
• establish rules for out-of-hours communication;
• require professional language and conduct;
• determine when a parent, guardian or additional staff member should be included;
• prohibit requests for secrecy and inappropriate personal contact;
• prevent Users from moving safeguarding-sensitive communication to unapproved private services;
• supervise messaging functions appropriately; and
• determine suitable record-retention practices for communications.

Consent and transparency

The Institution must:

• provide the privacy collection notices required of it;
• obtain parental, guardian or student consent where legally required;
• explain how the Institution uses Academyship;
• explain which external services or Integrations receive information;
• explain how images, recordings and student work may be used;
• respect lawful withdrawal, correction and deletion requests; and
• avoid collecting unnecessary information about children.

Incident response

The Institution must:

• maintain emergency escalation procedures;
• identify the relevant police, child-protection and regulatory channels for its jurisdiction;
• determine which of its people are mandatory reporters;
• avoid delaying a statutory or emergency report;
• preserve relevant institutional records;
• protect reporters from retaliation;
• support affected students;
• cooperate with lawful investigations; and
• avoid any action that may endanger a child or compromise an official investigation.

Configuration responsibility

Each Institution must configure Academyship in a manner appropriate to the age, maturity, vulnerability, location and circumstances of its students and the Institution's legal and safeguarding obligations. Accepting default platform settings is not, by itself, sufficient to satisfy an Institution's safeguarding obligations. Where the Institution's risk assessment requires a feature to be restricted or disabled, it is the Institution's responsibility to make that change.

#06Academyship's role and limits

Academyship operates and maintains the platform and provides it to Institutions under the Terms of Service. We provide administrator controls, role-based permissions, tenant isolation, auditability of key actions, and a channel through which platform-related child-safety concerns can be raised with us.

Academyship is not a school, registered training organisation, educator, carer, guardian, counsellor, emergency service, child-protection authority or live monitoring service. We do not supervise learners, do not provide pastoral or clinical care, and do not continuously monitor, pre-screen or moderate Institution communications or content in real time. We do not confirm that harmful conduct or harmful content will be detected or prevented.

Responsibility for supervision, safeguarding decisions, mandatory reporting by the Institution, and the day-to-day care of students rests with the Institution and its staff, consistent with the role allocation in our Terms and DPA. Nothing in this statement transfers an Institution's safeguarding function to Academyship, and nothing in it suggests that Academyship has no responsibility for the platform it provides.

#07Safety by design in the platform

The platform is built as an institution-controlled system rather than an open social network. Depending on how an Institution configures it, safety-relevant controls can include:

• institution-controlled accounts and enrolment, so access is authorised rather than open to the public;
• role-based permissions that limit what each account can see and do;
• tenant isolation, so one Institution's data and users are logically separated from another's;
• administrator controls for enabling, restricting or disabling features;
• auditability of key actions to support accountability and later review;
• restrictions on who can communicate with whom; and
• the ability to restrict or remove access to content or accounts where required for safety, security or law.

We describe controls at a general level and do not publish implementation detail that could help someone misuse the platform. Not every control listed is enabled in every Institution or module; availability depends on the Institution's plan, configuration and the features it has turned on.

Student access is authorised and managed by the Institution, and accounts operate within the Institution's tenant rather than being open to the general public. Where guardian or parent access is available, the Institution decides whether it is enabled and what it can see.

#08Accessible and child-friendly reporting

Children and young people should be able to raise a concern in a way they can understand and use. Institutions are responsible for making this possible within their own services; Academyship supports it through plain-language materials such as the Student Privacy Guide and the Student Guide to Acceptable Use.

The following principles should apply wherever a child may need to speak up:

• Children should be listened to and taken seriously.
• A child should not be punished for raising a concern in good faith.
• Reports should be handled respectfully and without retaliation.
• Information should be provided in age-appropriate language.
• Reporting information should be available in accessible formats where reasonably possible.
• Institutions should provide alternative reporting methods for children who cannot use a standard online form or written process.
• Institutions should consider disability, language, cultural background, literacy, digital access and communication needs.
• Children should be told what may happen after they make a report, subject to safety and confidentiality requirements.
• Parents or guardians should be involved where lawful, appropriate and safe.
• A parent or guardian should not automatically be contacted where doing so may place the child or another person at greater risk.
• Institutions should obtain professional or authority guidance where disclosure decisions are sensitive.
• A child's report should not be dismissed only because it is incomplete, delayed, unclear or made through an informal channel.
• Good-faith reports must be protected even where an allegation is not ultimately substantiated.

Some children face additional barriers to reporting safely, or additional risk if a report is mishandled. Circumstances that may create such barriers include disability, limited English proficiency, low digital literacy, cultural or linguistic barriers, trauma history, out-of-home-care experience, geographic isolation and limited family support. No child should be labelled as inherently vulnerable; what matters is that the individual circumstances and barriers in front of you are considered, and that reporting is adjusted so the child can actually use it.

#09Prohibited conduct

The following conduct is prohibited on the platform. These prohibitions apply to every User, are consistent with our Acceptable Use Policy, and apply in addition to the law and to an Institution's own rules.

Sexual exploitation and abuse

• Child sexual abuse and child sexual exploitation.
• Grooming, sexual solicitation and sextortion.
• Requests for sexual images or recordings.
• Sharing, or threatening to share, intimate images.
• Sexualised communication with a child.
• Child sexual abuse material, including simulated, altered or AI-generated exploitative material involving children.
• Facilitating access to exploitative material, or encouraging another person to exploit a child.
• Trafficking or attempted trafficking.
• Arranging or attempting to arrange unlawful in-person contact with a child.

Coercion and manipulation

• Blackmail, coercion, intimidation, threats, manipulation or bribery.
• Requests for secrecy.
• Attempts to isolate a child from trusted adults.
• Attempts to move a child to an unapproved private communication service.
• Requests for personal contact details for an inappropriate purpose.
• Requests for live location or private location information.
• Attempts to arrange private meetings without lawful authority and appropriate safeguards.

Harassment and harmful behaviour

• Bullying, cyberbullying, harassment and stalking.
• Hate-based abuse, humiliation and doxxing.
• Threats of violence.
• Encouragement of self-harm or suicide.
• Deliberately exposing children to violent, sexual, exploitative or degrading content.
• Retaliation against a child, a reporter, a witness or a support person.

Account and access misuse

• Creating fake student, parent, guardian or staff accounts.
• Impersonating another person.
• Accessing student information without authority.
• Sharing credentials, or using another person's account to contact a child.
• Circumventing supervision or access controls.
• Using hidden, misleading or unauthorised communication channels.
• Exporting student information for an unauthorised purpose.
• Sharing a child's personal or sensitive information without authority.

Interference with reporting or investigations

• Concealing evidence or destroying relevant records.
• Pressuring a person not to report, or threatening a reporter.
• Providing knowingly false information to obstruct a genuine investigation.
• Alerting a suspected offender where doing so may create danger or compromise an investigation.
• Interfering with an Institution, police, regulator or child-protection investigation.

Attempting, encouraging, assisting, facilitating, planning or conspiring to engage in prohibited conduct may itself violate this policy, even where the intended conduct is not completed.

#10Communications involving children

Communication features, where offered, are configured by the Institution. The Institution decides whether a feature is available, who may use it and which audiences it applies to, and can restrict or disable it. Where a communication involves a child:

• the communication must have a legitimate educational, administrative, welfare or support purpose;
• Users must maintain professional boundaries;
• staff must use Institution-approved accounts and channels;
• Users must not request secrecy from a child;
• Users must not pressure a child to move communication to private email, personal messaging, social media or another unapproved platform;
• personal contact details must not be requested or shared for an inappropriate purpose;
• one-to-one communication must comply with Institution policy and applicable law, and the Institution should determine whether another staff member, parent or guardian must be included;
• out-of-hours communication is governed by the Institution's rules;
• attachments, images, audio, video and links must be appropriate and authorised;
• unnecessary images, recordings, identification documents or location information must not be requested; and
• staff must not use Academyship to pursue a personal, romantic, sexual or exploitative relationship.

Institutions must decide how communication records are reviewed, retained and escalated. Academyship does not continuously monitor or moderate the content of messages and is not responsible for supervising an Institution's staff-to-student communications. The fact that the platform technically permits a communication does not mean Academyship has reviewed or approved it. Learners should follow their Institution's rules and the plain-language Student Guide to Acceptable Use.

#11Images, recordings and student content

Images, audio, video and student work involving children are handled by the Institution under its own consent, photography, recording and record-keeping policies. The Institution is responsible for obtaining any consent required, for explaining how images, recordings and student work may be used, and for honouring a lawful withdrawal of that consent.

The non-consensual or harmful sharing of images, recordings or personal information is prohibited, as is the making of unauthorised recordings or photographs. Where content of this kind is identified or reported to us, Academyship may — depending on the circumstances and the available technical controls — restrict access to an account, feature or item of content while the concern is assessed, preserve available records where reasonably necessary and permitted or required by law, and make a referral where required by law. We do not scan or pre-screen all content proactively, and we do not publish the operational detail of how content is assessed.

#12Privacy and access controls for children

Academyship does not sell Student Data, does not use Student Data for advertising, and does not use Customer Personal Data to train general-purpose AI models. Academyship hosts its core production platform and Customer Data in Sydney, Australia; the limited circumstances in which processing may occur outside Australia are described in our Privacy Policy, DPA and Subprocessor Register.

Within the platform, access to information is limited by role and by the principle of least privilege, and sensitive information is subject to additional controls where the Institution configures them. Institutions should collect the minimum information about a child that their purpose actually requires, and should restrict access to welfare, health, disability, behaviour and other sensitive records to the people who genuinely need it.

Institutions are responsible for providing privacy notices to students, parents and guardians, and for obtaining any consents required for their collection and use of Student Data. How we handle personal information is described in our Privacy Policy and, for children specifically, in plain language in the Student Privacy Guide. Handling of Customer Personal Data on behalf of Institutions is governed by our DPA.

#13Third-party services and integrations

Institutions may connect third-party services (Integrations) to Academyship. The Institution — not Academyship — selects, authorises and is responsible for those services and for the resulting data flows. An Integration does not automatically gain the ability to contact students; it operates according to the access the Institution grants it and its own terms.

Before connecting an Integration that may touch information about children, the Institution should consider:

• whether the service is suitable for children, and its minimum-age requirements;
• whether parent or guardian consent is required;
• what student information is transferred, and whether the transfer is necessary;
• where the data is stored, and whether cross-border disclosure occurs;
• the service's privacy terms and security controls;
• whether the service uses advertising, creates user profiles, or uses information for AI training;
• whether the service permits direct messaging or exposes students to public content;
• how accounts are created and deleted, and how permissions are revoked;
• how data is exported or removed;
• how safety complaints are handled; and
• whether Institution staff retain appropriate oversight.

Once information is transferred to an Institution-selected third-party service, that service's separate terms, privacy practices and security arrangements may apply. Academyship does not control the independent conduct of an external service.

Institutions must not connect unnecessary or unsuitable services, must disable Integrations that are no longer required, and must review Integration permissions periodically. Academyship's own subprocessor arrangements are described separately in the DPA and the Subprocessor Register; an Institution-selected Integration is not an Academyship Subprocessor and must not be described as one.

#14AI Features and children

AI Features are available from Academyship's launch on 12 September 2026, and each Institution may enable, disable or restrict them through its configuration and role permissions. Academyship's currently approved production AI Features are intended for authorised Institution personnel and are not provided as unrestricted student-facing generative AI tools. Access is limited to the Tenant and to the requesting User's permissions.

Where AI Features are used with information about children:

• the Institution controls availability, role-based access and age-appropriate use;
• outputs are decision support subject to authorised human review;
• an AI Feature must not autonomously make, and must not be the sole basis for, a decision with a legal or similarly significant effect on a child;
• Users should avoid placing unnecessary Sensitive Information about a child into a request;
• the Institution is responsible for reviewing AI-assisted content before it is relied on or placed into an official record;
• AI Features must not be used to groom, exploit, harass, deceive or unlawfully profile a child; and
• incorrect, unsafe or inappropriate AI output should be reported (see section 16).

Academyship does not use AI for biometric identification, emotion inference, or automated wellbeing, health or behavioural scoring of children. Customer Personal Data, including information about children, is not used to train general-purpose models.

AI output may be inaccurate, incomplete or unsuitable for its intended context. It must not be treated as professional welfare, medical, psychological, counselling or legal advice about a child. Full detail of Academyship's AI governance, the production feature inventory, the AI provider arrangements and the processing locations is set out in the Responsible AI Statement, with the corresponding privacy and contractual detail in the Privacy Policy, DPA and Subprocessor Register.

#15Academyship personnel and support access

Academyship personnel and contractors are subject to confidentiality obligations and access information only on a least-privilege, need-to-know basis for an authorised purpose, such as providing support, operating the service or meeting a legal obligation. Support access is authorised, limited to the minimum necessary scope and logged.

Support involving a student is mediated through the Institution rather than conducted privately with the student. Academyship personnel must not form a private, off-platform relationship with a student, and must not use their access for any purpose other than the authorised one.

Academyship assesses whether particular roles require screening, suitability checks or legally required clearances based on the nature of the role and applicable law. We do not claim that every member of personnel holds a Working with Children Check; requirements depend on the role and the applicable state or territory law. Where a check is obtained, the record is treated as sensitive and held with restricted access. Academyship may provide relevant personnel with guidance or training appropriate to their responsibilities, including how to recognise and escalate a child-safety concern.

#16Reporting a concern to Academyship

Reports submitted through Academyship's designated reporting channel are reviewed through Academyship's applicable support, safety and legal processes. The reporting channel is not an emergency service, and reports may not be reviewed immediately. It does not replace an Institution's safeguarding, duty-of-care or mandatory-reporting obligations.

Where it is safe and lawful to do so, it helps to include:

• the Institution's name;
• your name and contact details;
• the affected account or user, and the account or user you are concerned about;
• a description of the concern;
• the date and time;
• the relevant page, account, message identifier or feature;
• whether a child is in immediate danger;
• whether police, a child-protection authority or another authority has been contacted; and
• any non-illegal supporting records.

You do not need to provide every item before we will accept a report. Anonymous or incomplete reports may still be assessed, although limited information can affect our ability to identify the accounts involved or to investigate.

Do not confront a suspected offender where doing so may increase risk, do not alert a suspected offender that a report has been made, and do not conduct your own unlawful investigation. For ordinary evidence of bullying, threats, harassment or a policy breach — which is not illegal material — an Institution may instruct authorised personnel to preserve relevant records or screenshots in accordance with its own procedures.

Concerns that also involve a privacy issue or a security vulnerability can additionally be sent to privacy@academyship.com.au or security@academyship.com.au; see our security disclosure page for vulnerabilities.

#17Immediate danger and official reporting pathways

Depending on the nature of the concern, the following official Australian services may be appropriate. Academyship is not affiliated with these agencies and does not control their processes.

eSafety Commissioner

Reports can be made through the eSafety Commissioner's Report online harm service (esafety.gov.au). Depending on eligibility, eSafety may accept reports about matters such as serious cyberbullying involving an Australian child, image-based abuse, and illegal or restricted online content, along with certain other online-safety complaints within its jurisdiction. A guide to what can be reported is published at What you can report to eSafety. eSafety does not handle every child-protection matter, and for many concerns eSafety asks that the content first be reported to the service on which it appeared.

Australian Centre to Counter Child Exploitation

Reports can be made through the ACCCE Report abuse service (accce.gov.au). This may be appropriate for suspected online grooming, inappropriate sexual contact involving a child, online child sexual exploitation, child sexual abuse material, and sextortion involving a child.

Police, child protection and other authorities

Depending on the circumstances and the jurisdiction, you may also need to contact:

• state or territory police;
• the state or territory child-protection agency;
• the relevant education regulator;
• a relevant professional regulator; and
• any other authority required by applicable law.

Institutions should identify the correct contacts for their own jurisdiction in advance, as part of their escalation procedures, rather than searching for them during an incident.

#18Mandatory reporting and statutory notifications

Mandatory-reporting laws differ between Australian states and territories. Requirements may also differ according to profession, role, Institution type, student age and the circumstances of the matter. A person who is a mandatory reporter in one state or role may not be in another.

Academyship does not determine whether an Institution or an individual is a mandatory reporter. Institutions and Users must understand and comply with their own obligations, and Institutions should identify which of their people carry them.

Reporting a concern to Academyship does not satisfy a legal obligation to report to police, a child-protection authority, a regulator or another government body. Reporting internally to an Institution may also not replace an external statutory report. No person should delay an emergency or statutory report while waiting for Academyship to respond.

Academyship may make or assist with a report where required or permitted by law. Academyship does not provide individual legal advice about mandatory-reporting obligations; where an obligation is unclear, obtain advice from the relevant authority or a qualified adviser — and, where a child may be at risk, report first.

#19How Academyship may respond

Our response to a platform-related child-safety report depends on the nature of the report, the immediate safety risk, the information available to us, our technical capability, our contractual rights, our privacy obligations, legal restrictions, preservation requirements, any direction from law enforcement or a regulator, and the Institution's own role in the matter.

Depending on those circumstances, we may:

• acknowledge and assess a report;
• request additional non-illegal information;
• contact the Institution;
• restrict access to an account, feature or item of content while the concern is assessed;
• disable access where appropriate;
• preserve available account, system or activity records where reasonably necessary and permitted or required by law;
• remove or restrict content where technically possible and lawful;
• refer the matter internally for a decision;
• refer the matter to police, a regulator or another authority;
• respond to valid legal process; and
• suspend or terminate access for serious or repeated misuse.

We do not promise a fixed response time or a particular outcome, immediate review, the removal of all copies of content, the recovery of information outside our control, notification to every person involved, or the disclosure of confidential investigative details. Appropriate timeframes and actions depend on the nature and seriousness of the matter.

Academyship may be unable to provide detailed updates where doing so could compromise safety, privacy, legal obligations, an investigation or another person's rights.

#20Evidence, confidentiality and good-faith reporting

We treat reports about children with care and respect, and we recognise that a child or young person may find it hard to raise a concern. Academyship will not retaliate against a person for making a good-faith report about child safety on the platform. Institutions must not punish a child for raising a safety concern in good faith, and must protect reporters, witnesses and support people from retaliation.

There is an important difference between a knowingly false or malicious report and a report that simply cannot be substantiated. A person will not be treated as having made a false report merely because the available evidence is insufficient, because the report was incomplete or delayed, because a reasonable mistake was made, or because it was made by a frightened or distressed child. Deliberate misuse of the reporting process — for example, a knowingly false report made to harass another person or to obstruct an investigation — may result in action under our Acceptable Use Policy or by the Institution.

We handle these matters on a need-to-know basis and limit information to the people who reasonably need it. Confidentiality cannot be guaranteed: disclosure may be required to protect a person, to investigate a concern, to respond to an Institution's lawful request, or to comply with the law or valid legal process.

On evidence, follow section 16. Do not duplicate or circulate suspected illegal material. For ordinary bullying, threats, harassment or policy-breach records, the Institution's own preservation procedures apply.

#21Cooperation with Institutions and authorities

The Institution typically leads the response for its own students, and we cooperate with it. Where a concern is about an Institution or its staff rather than the platform, we will, where appropriate, direct you to the Institution's own complaints process or to the relevant authority — and, where the matter involves platform misuse, we may still act under our Acceptable Use Policy.

Academyship cannot control the conduct of an Institution or its staff and has no authority over how an Institution handles its own safeguarding matters. We cooperate with police, child-protection authorities, regulators and other authorities where required or permitted by law, and we respond to valid legal process. If you are not satisfied with how we have handled a platform-related concern, you can escalate to complaints@academyship.com.au, or to legal@academyship.com.au where the complaint concerns the person who handled it.

#22Enforcement

Where we reasonably believe the platform has been misused in a way that affects child safety, we may investigate, take proportionate action and cooperate with the Institution, consistent with sections 17 and 19 of the Acceptable Use Policy and sections 29 and 30 of the Terms of Service. Action may include warning, restricting or suspending access to a feature or an account, removing or restricting content, or terminating services for serious or repeated violations.

Enforcement is proportionate to the seriousness of the conduct, and we prefer to work with the Institution to resolve an issue. Where urgent action is necessary to protect a person, data or systems, or to meet a legal obligation, we may act with or without prior notice and will inform the affected Institution as soon as reasonably practicable. We do not continuously monitor every User or proactively moderate all content.

#23Records and retention

Where we handle a platform-related child-safety matter, we keep records of it with restricted access and retain them in accordance with the law and our retention arrangements. We may preserve available account, system or activity records where reasonably necessary and permitted or required by law, including where an authority or valid legal process requires it.

We do not publish details of individual matters. Personal information involved is handled in accordance with our Privacy Policy and, where it is Customer Personal Data, our DPA, including the deletion and return arrangements described there. Institutions are responsible for the retention of their own safeguarding records.

#24Online-safety and children's privacy regulation

Australian online-safety requirements — including the Online Safety Act 2021 (Cth), the Basic Online Safety Expectations and eSafety's Safety by Design guidance — may apply differently depending on the nature and functionality of a service. We do not claim that every provision applies to every Academyship feature, and we make no blanket claim of full compliance with every requirement of that framework.

Academyship considers relevant online-safety expectations in the design and operation of applicable platform features, and may review its obligations as messaging, file-sharing, community, AI or other interactive functionality changes. Institutions remain responsible for their own use and configuration of the platform, and Academyship may take action against unlawful or seriously harmful platform misuse.

Children's privacy regulation in Australia continues to develop, including through the Office of the Australian Information Commissioner's work on a Children's Online Privacy Code. Academyship monitors relevant developments in children's privacy and online-safety regulation and may update its services and policies where new obligations apply. We do not claim compliance with a code that is not yet in force.

#25Review and changes to this statement

We review this statement at least annually, and may also review it following a serious incident, a material service change, or a relevant legal or regulatory development. Accountability for this statement, for the handling of platform-related child-safety reports and for its review sits with Academyship's management.

We welcome feedback from Institutions, students, families and affected Users, and we use it — together with what we learn from incidents — to improve our controls and this statement. Where we change this statement we will update the effective date and the change history below; prior versions can be requested from legal@academyship.com.au.

#26Contact details

Use the channel that matches the concern so that it reaches the right people:

Post: Child Safety, ACADEMYSHIP PTY LTD, Unit 44, 3-7 Fetherstone Street, Bankstown NSW 2200, Australia.

#27Related policies

This statement sits alongside the following documents, which continue to apply:

Terms of Service Acceptable Use Policy Student Guide to Acceptable Use Privacy Policy Student Privacy Guide Data Processing Addendum Subprocessor Register Responsible AI Statement Accessibility Statement Security Disclosure Support Trust & Security

#28Change history