top of page

Privacy Policy

Effective Date: 1 July 2025

Last Updated: 13 Aug 2026 

​

BACKGROUND

Atlantis Timetabling Pty Ltd (ABN 18 681 076 666) ("Atlantis", "we", "us", "our") is committed to protecting the privacy of individuals who interact with our website and our cloud-based timetabling platform and services.

​

This Privacy Policy explains how we collect, hold, use, and disclose personal information in accordance with the Privacy Act 1988 (Cth) ("Privacy Act") and the Australian Privacy Principles ("APPs") contained in Schedule 1 of that Act.

​

We are committed to handling personal information in accordance with applicable privacy legislations including:

  • the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs);

  • the New Zealand Privacy Act 2020;

  • where applicable, the European Union General Data Protection Regulation (EU GDPR);

  • the United Kingdom General Data Protection Regulation (UK GDPR); and

  • other applicable privacy and data protection laws.​

​

This Policy applies to:

  • visitors to our website at www.atlantis.education ("Website"); and

  • users of our SaaS timetabling platform and associated services ("Platform"), including administrators, staff, and other authorised users at educational institutions that have contracted with us ("Clients").

​

By using our Website or Platform, you acknowledge that you have read and understood this Policy.

​

  1. ABOUT THIS POLICY

    1. ​This Policy is our APP privacy policy for the purposes of APP 1.3 of the Privacy Act.

    2. We review and update this Policy periodically to reflect changes in our practices, technology, legal requirements, and other factors. The current version is always available on our Website and within the Platform.

    3. If you have any questions about this Policy or our privacy practices, please contact our Privacy Officer using the details set out in clause 13.

  2. KINDS OF PERSONAL INFORMATION WE COLLECT AND HOLD

    1. Website users. When you visit our Website, we may collect:

      • contact information you voluntarily provide, such as your name, email address, phone number, and organisation name (for example, when you submit an enquiry or request a demonstration);

      • technical and usage data collected automatically, including your IP address, browser type and version, operating system, referring URLs, pages visited, and time spent on pages; and

      • any other information you choose to provide to us through forms, chat functions, or correspondence.

    2. Platform users (administrators, teachers and staff). When you use the Platform as an authorised user of a Client institution, we may collect:

      • identity and contact information, including your full name, work email address, job title, and role within the institution;

      • account credentials (username and encrypted password);

      • timetabling and scheduling data you create, upload, or manage within the Platform, including classroom allocations, staff assignments, and resource bookings;

      • usage and activity logs, including login timestamps, feature interactions, and audit trail data; and

      • technical data, including device identifiers, IP addresses, and browser or application information

    3. Student and third-party data processed on behalf of Clients. Where a Client institution uploads or inputs data relating to students or other third parties into the Platform, Atlantis processes that data as a data processor on behalf of the Client. Such data may include student names, year levels, class groupings, and scheduling preferences. We do not use this data for our own purposes beyond providing the Platform services.

    4. Sensitive information. We do not collect sensitive information (as defined in the Privacy Act, including health information, racial or ethnic origin, or biometric data) through the Website or Platform. If you believe sensitive information has been inadvertently provided, please contact our Privacy Officer immediately.

  3. ​HOW WE COLLECT AND HOLD PERSONAL INFORMATION

    1. Direct collection. We collect personal information directly from you when you:

      • visit or interact with our Website;

      • register for or log in to the Platform;

      • contact us by email, phone, or through our Website contact forms;

      • request a product demonstration or trial;

      • enter into a contract with us or correspond with us in connection with our services; or

      • respond to surveys or provide feedback.

    2. Automated collection. We collect certain technical and usage data automatically through cookies, web beacons, log files, and similar tracking technologies when you use our Website or Platform. Please refer to our Cookie Policy (available on our Website) for further details.

    3. Collection from third parties. We may receive personal information about you from:

      • your employer or institution (for example, when a Client administrator creates your Platform account); or

      • third-party identity verification or authentication providers where single sign-on (SSO) is enabled.

    4. We hold personal information:

      • in secure cloud-based systems hosted on infrastructure provided by trusted service providers. Our list of sub processors are listed here.

      • in encrypted databases with access controls restricted to authorised personnel; and

      • in accordance with our Information Security Policy, which includes technical and organisational measures to protect personal information from misuse, interference, loss, and unauthorised access, modification, or disclosure.

    5. We retain personal information only for as long as necessary to fulfil the purposes described in this Policy, or as required by law. When personal information is no longer required, we take reasonable steps to destroy or de-identify it.

  4. PURPOSES FOR WHICH WE COLLECT, HOLD, USE, AND DISCLOSE PERSONAL INFORMATION

    1. Website users. We collect and use personal information from Website visitors to

      • respond to your enquiries and provide information about our products and services;

      • process demonstration or trial requests;

      • improve our Website content, functionality, and user experience;

      • send you marketing communications where you have consented or where we are otherwise permitted to do so; and

      • comply with our legal obligations.

    2. Platform users. We collect and use personal information from Platform users to:

      • create and manage your Platform account;

      • provide, operate, maintain, and improve the Platform and associated services;

      • authenticate your identity and manage access controls;

      • generate audit logs and activity records for security and compliance purposes;

      • provide technical support and respond to service requests;

      • send you service-related communications, including updates, security alerts, and administrative notices;

      • conduct analytics to understand how the Platform is used and to improve its features; and

      • comply with our legal and contractual obligations.

    3. Marketing. We may use your contact information to send you information about our products, services, and events where you have consented or where we are otherwise permitted to do so under applicable law. You may opt out of marketing communications at any time by following the unsubscribe instructions in any marketing email or by contacting our Privacy Officer.

    4. Legal and compliance purposes. We may use or disclose personal information where required or authorised by law, including to respond to lawful requests from government agencies or regulators, to enforce our agreements, or to protect the rights, property, or safety of Atlantis, our Clients, or others.

  5. INTENDED RECIPIENTS OF PERSONAL INFORMATION

    1. We may disclose personal information to the following categories of recipients:

      • Client institutions: where you are a Platform user, your institution (as our Client) has access to your account information and activity data within the Platform in accordance with our agreement with that institution;

      • Service providers and subprocessors: third-party providers who assist us in operating the Website and Platform, including cloud hosting providers, email delivery services, analytics providers, customer support tools, and payment processors — these parties are contractually required to handle personal information only on our instructions and in accordance with applicable privacy laws;

      • Identity and authentication providers: where SSO or third-party authentication is used;

      • Professional advisors: including lawyers, accountants, and auditors, under obligations of confidentiality;

      • Regulators and government agencies: where required or authorised by law; and

      • Successors in business: in the event of a merger, acquisition, or sale of all or part of our business, personal information may be transferred to the relevant successor entity, subject to equivalent privacy protections.

    2. We do not sell personal information to third parties.

  6. CONSEQUENCES OF NOT PROVIDING PERSONAL INFORMATION

    1. You are not required by law to provide personal information to us. However, if you choose not to provide certain information, the following consequences may apply:

      • Website enquiries: we may be unable to respond to your enquiry or process your demonstration request;

      • Platform account creation: we will be unable to create your account or grant you access to the Platform;

      • Platform functionality: certain features of the Platform may be unavailable or may not function correctly if required information is not provided; and

      • Support requests: we may be unable to verify your identity or provide technical support.

    2. Where information is optional, we will indicate this at the point of collection.

  7. ACCESS TO AND CORRECTION OF PERSONAL INFORMATION

    1. You have the right to request access to personal information that we hold about you, and to request that we correct any information that is inaccurate, out of date, incomplete, irrelevant, or misleading.

    2. To make an access or correction request, please contact our Privacy Officer using the details in clause 13. We will respond to your request within a reasonable time and, in any event, within 30 days of receipt.

    3. We will provide access to personal information in the manner you request, where it is reasonable and practicable to do so. We may charge a reasonable fee to cover the cost of providing access, but we will not charge a fee for making the request itself.

    4. We may decline to provide access or make a correction in circumstances permitted by the Privacy Act, including where:

      • providing access would have an unreasonable impact on the privacy of other individuals; the request is frivolous or vexatious;

      • the information relates to existing or anticipated legal proceedings; or providing access would be unlawful.

    5. If we decline to provide access or make a correction, we will give you written reasons for our decision and inform you of the mechanisms available to you to complain about our decision.

    6. Platform users: you may also be able to access and update certain personal information directly through your Platform account settings. Please contact your institution's administrator in the first instance for account-level changes.

  8. PRIVACY COMPLAINTS

    1. If you believe that we have breached the APPs or otherwise mishandled your personal information, you may lodge a complaint with our Privacy Officer using the contact details in clause 13.

    2. How to make a complaint. Your complaint should be made in writing and should include:

      • your name and contact details;

      • a description of the privacy concern or alleged breach; and

      • any supporting information you consider relevant.

    3. How we handle complaints. Upon receiving your complaint, we will:

      • acknowledge receipt of your complaint within 5 business days;

      • investigate the complaint and gather relevant information;

      • keep you informed of the progress of our investigation; and

      • provide you with a written response setting out our findings and any proposed remedial action within 30 days of receiving your complaint, or such longer period as we may notify you of if the matter is complex.

    4. External complaints. If you are not satisfied with our response, or if we fail to respond within the timeframes above, you may lodge a complaint with the Office of the Australian Information Commissioner ("OAIC"):

      • Online: www.oaic.gov.au

      • Phone: 1300 363 992

      • Post: GPO Box 5218, Sydney NSW 2001

  9. AUTOMATED DECISION-MAKING

    1. Atlantis uses automated processes within the Platform to assist in generating timetabling and scheduling outputs. These processes use personal information (including staff names, roles, and availability) to produce scheduling recommendations and allocations.

    2. From 10 December 2026, new transparency obligations under the Privacy and Other Legislation Amendment Act 2024 (Cth) will require APP entities to disclose in their privacy policy where personal information is used in automated decision-making that could reasonably be expected to significantly affect an individual's rights or interests.

    3. To the extent that our automated timetabling processes constitute automated decision-making for the purposes of APP 1.7, we disclose the following:

      • Kinds of personal information used: staff names, roles, qualifications, availability, and scheduling preferences;

      • Kinds of decisions: timetable allocations, classroom assignments, and resource scheduling recommendations; and

      • Significant effect: these decisions may affect staff work schedules and classroom assignments. Final decisions remain with the Client institution's administrators, who retain the ability to review, override, and finalise all outputs generated by the Platform.

      • We will update this clause as our automated decision-making practices evolve and as further guidance from the OAIC becomes available.

  10. COOKIES AND TRACKING TECHNOLOGIES

    1. Our Website uses cookies and similar tracking technologies to improve your browsing experience, analyse Website traffic, and support our marketing activities.

    2. You can control the use of cookies through your browser settings. Disabling certain cookies may affect the functionality of our Website.

    3. For full details of the cookies we use and how to manage them, please refer to our Cookie Policy available on our Website.

  11. CHILDREN'S PRIVACY

    1. Our Platform is designed for use by educational institutions and their authorised staff. We do not knowingly collect personal information directly from children under the age of 18 through our Website or Platform registration processes.

    2. Where a Client institution uploads or inputs data relating to students (including minors) into the Platform, the Client is responsible for ensuring that it has obtained all necessary consents and authorisations required under applicable law, including the Privacy Act 1988 (Cth) and any applicable state or territory legislation.

    3. Atlantis processes student data solely on behalf of and under the instructions of the Client institution, and does not use student data for any purpose other than providing the Platform services.

    4. We are monitoring the development of the Children's Online Privacy Code currently being developed under the Online Safety Act 2021 (Cth) and will update our practices and this Policy as required when that Code comes into effect.

  12. CONTACT DETAILS FOR PRIVACY CONCERNS

    1. For all privacy enquiries, access and correction requests, and complaints, please contact our Privacy Officer:

    2. We aim to acknowledge all privacy enquiries within 5 business days.

  13. LINKS TO THIRD-PARTY WEBSITES

    1. Our Website and Platform may contain links to third-party websites or services. This Policy does not apply to those third-party sites, and we are not responsible for their privacy practices. We encourage you to review the privacy policies of any third-party sites you visit.

  14. CHANGES TO THIS POLICY

    1. We may update this Policy from time to time to reflect changes in our practices, technology, or legal obligations.

    2. We will notify you of material changes by posting the updated Policy on our Website and, where appropriate, by sending a notification to Platform users via email or within the Platform.

  15. SUBPROCESSORS

    1. For information about our Sub-Processors, click here.

Ready to Streamline Your Timetabling?

bottom of page