Atrium Privacy Policy

This policy explains how ZentumTech handles personal information in Atrium, the software tutoring centres use to run their centre. We handle that information for each centre, and we also use it for our own purposes set out below. The "In short" box is a summary. The full sections below govern.

In short

Each centre decides what it keeps in Atrium and is responsible for it. We handle it for the centre, and also use it for our own purposes.
We use it to provide, secure, support and improve Atrium and our other products.
Each centre tells its families, in its own privacy policy, how their information is used.
We never sell it or use it for advertising.
Atrium sets cookies only to keep you signed in.
To see, correct or delete your details, start with your centre. You can also reach us at support@zentumtech.com.

Who is responsible

Your centre decides what it collects. We handle it for the centre and use it for our own purposes.

Tutoring centres use Atrium to manage their students, families, staff, classes and invoices. Each centre decides what personal information it keeps in Atrium and why, and is responsible for it under its own privacy policy.

ZentumTech provides Atrium. We handle the information in Atrium on behalf of each centre, under our terms with that centre and this policy, and we also use it for our own purposes set out in this policy. In this policy, "we" means ZentumTech, "your centre" means the centre that holds your details, and "you" means anyone whose information is in Atrium.

We handle personal information in line with the Australian Privacy Principles in the Privacy Act 1988 (Cth).

This policy adds the detail for Atrium to the ZentumTech privacy policy, which covers our website, its forms and our other products.

Read the ZentumTech privacy policy

What Atrium holds

What a centre needs to run its classes, billing and team.

Depending on what a centre records, Atrium holds:

Students: name, preferred name, student number, date of birth, school and year level, contact details where the centre records them, enrolments, attendance and absences, tutor feedback and progress notes, and staff notes.
Parents and guardians: name, email, phone, address and billing email, their link to each student (such as billing, primary or emergency contact), their message preferences, invoices, payments and credits, and when they accepted the centre's enrolment terms.
Staff and tutors: name, contact details, role, date of birth, address, Working With Children Check number and expiry, emergency contact, subjects, availability, pay rates, timesheets and pay runs.
Trial and job enquiries: what people send through a centre's trial request and tutor application forms, such as a child's and parent's names and contact details, or an applicant's experience and resume. A trial request also records the IP address and browser it was sent from.
Accounts and activity: sign-in details, when you last signed in, your settings, and a log of changes made in Atrium and who made them.
Messages: the messages a centre sends through Atrium, and who received them.

Information needing extra care

Learning needs, health details and emergency contacts. Atrium limits who sees them.

Atrium has no separate field for health or medical information. Staff can write notes about a student, and a centre may use them to record what tutors need to know, such as a learning need. Health details in a note are sensitive information under the law.

Emergency contact details for students and staff are kept so the centre can reach someone quickly.

To limit this information:

only people whose role at the centre allows it can open a student's record;
a centre can stop a particular parent or guardian receiving messages about a student where a child's safety needs it;
centres should record only what staff need to teach and look after a student.

Children's information

Most students are school-age children. Their details come from parents and staff.

Most of the people Atrium holds records about are school-age students. A centre collects a student's details from their parent or guardian at enrolment, and from its tutors and staff as lessons happen, such as attendance and progress notes.

We use children's information to provide our products to their centre, and for the other purposes in this policy, including those in "Improvement, AI training and research". Training uses de-identified information, linked to a student code instead of a name. We never use children's information for advertising or marketing.

Where the law requires consent before we use a child's information for these purposes, we will ask for it, through the centre or from a parent or guardian, before we use it.

A parent or guardian can opt their child out of training and research at any time with the opt-out form, and can ask the centre to see, correct or delete their child's information.

Open the opt-out form

How we use it

To run Atrium, keep it secure, support centres and improve our products.

To provide Atrium. So your centre can run enrolments, timetables, attendance, invoicing, payroll and its messages.
To keep it secure. To control who can see what, record changes, and find and stop misuse.
To support your centre. When your centre asks us for help, we may look at its records to solve the problem.
To analyse and improve. To analyse learning, develop and improve our products and services, including future ones, train our own AI models and do research, as "Improvement, AI training and research" below sets out.

Beyond these, we use it only where your centre asks us to or the law requires or allows it.

What we never do

No sale and no advertising.

We never sell personal information.
We never use it for advertising, or to market our products to families or students.

Overseas disclosure

Where Atrium is hosted, and how we protect information that leaves Australia.

Where Atrium stores personal information:

Atrium app hosting: Australia and other locations listed in this policy.

Before we disclose personal information to a provider outside Australia, we take reasonable steps to make sure it handles the information in line with the Australian Privacy Principles.

The ZentumTech privacy policy sets out where our website and its forms are hosted.

Cookies and browser storage

Only what Atrium needs to keep you signed in.

Atrium sets cookies only to keep you signed in and your session secure. Scripts on the page cannot read them.

Atrium also keeps a few settings in your browser so pages open the way you left them, such as your colour theme and the records you opened recently. These stay in your browser.

Atrium uses no advertising cookies and no outside tracking tools.

Usage events

Events about how Atrium is used, without names or records.

Atrium records events about how it is used, such as which page or feature was used, whether an action completed or failed, and roughly how long it took.

These events use a fixed list of categories and carry no names, no free text and no student records.

Events sent while you are signed in carry a key made from your sign-in session and a value that changes each day, along with your centre and your role. They are linked to a sign-in session for that day, not to your name. Events from pages used without signing in, such as a centre's trial request form, carry no key.

We keep these events for 13 months after the end of the month they were recorded in, then delete them.

We process these events ourselves, and use them to run and secure Atrium, analyse how our products are used, develop and improve our products and services, including future ones, and train our own AI models.

Keeping it safe

Role-based access, separate centres and protected sign-in.

We take reasonable steps to protect personal information in Atrium from misuse, loss and unauthorised access, change or disclosure. They include:

Role-based access. Each person sees and does only what their role at their centre allows.
Separate centres. Each centre's records are kept apart from other centres' records.
A record of changes. Atrium logs important changes and who made them.
Protected sign-in. Sessions are held in secure cookies, and repeated sign-in attempts are slowed down.

No system is completely secure, so we cannot promise that information is safe from all risks.

Data breaches

We follow the Notifiable Data Breaches scheme.

We follow the Notifiable Data Breaches scheme in the Privacy Act 1988 (Cth).

If we suspect a data breach, we act quickly to contain it and assess it. If it is likely to result in serious harm to anyone whose information is involved, we make sure the people affected are told, by us or by the centre that holds their information, or publish a statement where telling them is not practicable. We also notify the Office of the Australian Information Commissioner (OAIC).

Where a breach involves information we hold for a centre, we tell the centre and work with it.

Improvement, AI training and research

We use information from our products to improve them, build learning analytics, train our own AI models and do research, with the safeguards below.

We use information in our products, including how people use them and work students create or submit, to analyse learning, develop and improve our products and services, including future ones, and train our own AI models. We also use it for research, and we may publish what that research finds.

This includes information about students who are children, and the work they create or submit. It comes from the records centres keep in our products, from how people use our products, and from work students create or submit in them.

This section covers Atrium, Aperium and our other products and add-ons, including ones we offer later, such as a diagnostics add-on that works with Atrium, Aperium and other products. It sets the rules for this use whenever it happens. It does not mean that a given product or add-on uses information this way today.

Student work is analysed only where a centre uses a feature that analyses it, such as diagnostics. The analysis and the training run in a separate ZentumTech service, set apart from the products themselves.

The safeguards we apply:

Names and contact details come out. We remove names and contact details before information is used for training.
A student code, not a name. Information is linked to a student code instead of a name, and is de-identified as far as reasonably practicable.
Still personal information. We can link a student code back to the student, so we still treat this information as personal information, and this policy applies to it in full.
The key stays out. The table that links student codes to names is kept out of the systems that analyse information and train our models.
In-house only. These models are ours. We use them to provide and improve our products and services. We do not sell this information or these models, we do not share the information for others to train their own models, and we never use it for advertising.
Published research. We publish research results only in aggregated or de-identified form, never information about an identifiable person, and only with approval from a human research ethics committee where that applies.

Where the law requires consent before we use a child's information for these purposes, we will ask for it, through the centre or from a parent or guardian, before we use it.

Each centre decides what it keeps in our products, and is responsible for telling its families, through its own privacy policy, that their information is used this way. Centres tell families through their enrolment packs.

A centre, a parent or guardian, or a student aged 18 or over can opt a student out with our opt-out form. From then on, information carrying that student code is left out of training and research.

An opt-out does not undo what has already happened. AI models already trained stay as they are, and aggregated results already published stay published. To have information deleted as well, ask for deletion, as this policy sets out.

Open the opt-out form

Deleting information

Ask your centre, or us. We delete it, and keep no de-identified copy instead.

To have your information deleted, ask your centre. Your centre can remove records in Atrium, and its owner can permanently remove a former parent's or guardian's personal details. If you cannot reach your centre, contact us and we will pass your request on.

When information is deleted on request, we also delete any copy carrying that person's student code that we hold for training and research. We do not keep a de-identified copy in place of deleting it.

Some records cannot be deleted straight away, because the law requires them to be kept or because they are needed to protect children, such as financial and attendance records. Where that applies, we keep them only for as long as needed.

Deleting records leaves AI models already trained on them unchanged, and the results of analysis already done.

Email support@zentumtech.com

How long we keep it

While your centre uses Atrium, then we delete it.

We keep a centre's records while the centre uses Atrium.

Before it leaves, a centre can ask us for a copy of its records. After a centre stops using Atrium, we delete its records within a reasonable time. We keep only what the law requires us to keep, and information already de-identified for training and research, which carries a student code and no name or contact details, unless someone has asked us to delete their information.

Deleting records leaves AI models already trained on them unchanged, and the results of analysis already done.

Access, correction and complaints

Start with your centre. You can also reach us by email or the contact page.

Your centre holds your information, so ask your centre first to see it, correct it or delete it. Your centre can update most details in Atrium directly.

You can also contact us at support@zentumtech.com or through the contact page. If your request is about a centre's records, we will pass it to that centre, because the centre decides what happens to them. Making a request costs nothing.

If you think your information has been mishandled, tell your centre, or tell us at support@zentumtech.com. We will look into it and reply to you in writing within a reasonable time.

If you are not satisfied with our answer, you can complain to the Office of the Australian Information Commissioner (OAIC) at oaic.gov.au or on 1300 363 992.