Privacy & Data Collection Policy
Effective date: 8 October 2026
Our commitment: SportsOrganised is built for schools. Student personal information security is our top priority. We collect only what is needed to run your carnivals, we never sell or share student data, and we never use it to train artificial intelligence models. Your school remains the owner and controller of its data; we act solely as a processor on your instructions.
What Data We Collect
The list below covers the personal information the Platform holds. Fields described as optional are stored only where your school chooses to supply them.
School & Account Data
School name, contact email address and, optionally, a postal address, contact phone number and internal account notes recorded by our team. We also hold your subscription plan, student allowance and account status.
Staff User Accounts
Name, email address, assigned role and house (where a user manages a single house), together with the details needed to protect the account: a hashed password, two-factor authentication status, an encrypted two-factor secret and recovery codes, records of devices marked as trusted, and the date and time of the last sign-in. Where your school uses Microsoft Entra ID (Azure AD) single sign-on, we also store the Microsoft object identifier that links the account.
Staff Records & Rostering
Staff records used for carnival rostering hold a first name, last name, a staff code and an optional house. The staff code is your school’s own employee or payroll identifier where your roll export supplies one, and otherwise a code the Platform generates. They carry no email address or other contact details. Alongside them we hold the rostering information you enter: which staff are attached to a carnival, the team, location and time period they are working, and any periods they are marked unavailable or absent.
Student Data
First name, last name, year level, age group, gender, house allocation and a student code (your school’s own student or SIS identifier where your roll export supplies one, and otherwise a code the Platform generates). Date of birth is never stored: if your roll export includes one, it is used only to work out each student's age group during the import and is then discarded. The following are optional and held only where your school records them: a class or roll-group name, a second age-group value where a school runs two schemes, an email address (used only to send self-nomination invitations where a school enables that feature), and a Microsoft object identifier where student records are matched to Microsoft Entra ID.
We do not collect home addresses, phone numbers, parent or guardian contact details, medical, health, dietary or disability information, photographs, behavioural records, academic results, government identifiers, or payment card details.
Carnival, Event & Performance Data
Carnival and event configuration, schedules and locations, nominations and lane allocations, and the performance data produced on the day: times, distances, heights, attempts, places, points, disqualifications, performance-standard awards, records and champion calculations. This also covers house sports fixtures and match scores, house results boards, squad and team-sheet selections, and PE trial classes, sessions and trial results where your plan includes them.
Shared Carnival-Day Logins
Carnival day runs on shared logins: one per marshal post for the pool of iPads, and one per house for student house captains. These are not personal accounts. They hold only the post or house name and a shared password, with no mailbox and no individual's details. Each is limited to a single carnival, works only inside a defined access window around the carnival day, and can be signed out remotely by your administrator.
Audit & Security Logs
Timestamped records of significant actions, including data imports, results changes, exports, access-token generation and administrative events. Each record holds the action, the user who performed it, the record affected and the originating IP address. These exist for accountability, incident investigation and compliance.
Outbound Email Records
Messages the Platform sends, such as account invitations and password resets, are logged so delivery problems can be diagnosed. The log holds the recipient addresses, subject, delivery status and, for a limited period, the message content. Because that content can contain temporary passwords and setup links, message bodies are deleted after 30 days while the delivery record is kept for 180. Attachment filenames and sizes are recorded; attachment contents are not.
Enquiry Data
If you contact us through the website, we hold the name, school, email address and optional phone number you supply, along with our correspondence with you, so that we can respond.
Why We Collect It
All data is used solely to provide, secure and support the SportsOrganised platform: to manage carnivals, determine which events a student is eligible for, record and display results, calculate scores, champions and records, roster staff, and support your school in running a successful carnival day. Security and audit data exists to protect accounts and give your school a traceable history. We do not sell, rent, share or mine your data, we do not use it for advertising or profiling, and we do not use it to train artificial intelligence models.
How We Store and Secure It
Each school's data is logically isolated: every record is tagged to your school and every query is automatically restricted, so one school's data can never be reached by another. Data is encrypted in transit using TLS, HTTPS is enforced, and sensitive credentials (passwords, two-factor secrets and recovery codes) are hashed or encrypted at rest. Access is restricted to authenticated, authorised users within your school's account, with role-based permissions limiting what each user can see, and student personal information is never placed in a web address.
Data residency: the Platform and its database run in an Australian data centre, and backups are encrypted and stored in an Australian region. Student data is not transferred offshore.
Who Has Access
Only staff members invited by your school's administrator can access your school's data, and only to the extent their role allows. SportsOrganised staff may access data for the purpose of providing technical support, and only with prior notification to your administrator; any such access is logged. Student data is never accessible by other schools or the general public, except through a public results or self-nomination link that your school chooses to publish and can revoke at any time.
We rely on a small number of service providers to operate the Platform: an Australian hosting provider for the server and database, Australian-region storage for encrypted backups, and an email delivery provider for outbound messages such as password resets. Where your school enables single sign-on, sign-in is handled by Microsoft Entra ID under your own tenancy. These providers process data only to deliver those services. A current list is available on request.
Cookies & Tracking
We use an essential session cookie to keep you signed in and, where you choose it, a cookie recording that a device is trusted for two-factor authentication. Interface preferences, such as whether the sidebar is collapsed, are stored in your own browser and never sent to us. We run no third-party analytics, advertising or tracking scripts, and we do not track users across other websites.
Data Retention
Your school's data is retained for as long as your account remains active. Upon account closure, data will be deleted within 90 days unless a longer retention period is required by law. You may request an export of your data at any time, and results, nominations and student rolls can also be exported from within the Platform whenever you need them.
Some records follow their own schedule: audit logs remain available in the Platform for 24 months and are then moved to an archive retained for breach investigation and compliance; outbound email bodies are deleted after 30 days and the delivery record after 180; uploaded import files are cleared from temporary storage within 24 hours; and encrypted backups are kept on a rolling schedule (every backup for the first week, thinning to daily, weekly, monthly and finally yearly copies retained for two years), after which they are destroyed.
Your Rights under the Australian Privacy Act 1988
Under the Privacy Act 1988 (Cth) and the Australian Privacy Principles, your school is the APP entity responsible for the personal information it holds, and SportsOrganised acts as its processor. Notifying students and families about the collection of their information, and obtaining any consent required, therefore rests with your school.
You have the right to access, correct and request deletion of personal data held in the Platform, and SportsOrganised will cooperate fully with any such request. Individual students, families and staff should contact their school administrator in the first instance, as your school controls the data. If you are unhappy with how we have handled a privacy matter you may complain to us using the contact details below; if you remain dissatisfied you may refer the matter to the Office of the Australian Information Commissioner (oaic.gov.au).
Changes to This Policy
We review this policy as the Platform changes. The effective date above records the most recent revision, and material changes to how personal information is collected or used will be notified to school administrators.
Contact
SportsOrganised is operated by Matthew Smart, ABN 25 154 832 997. For privacy or data collection enquiries, contact our privacy team at support@sportsorganised.com.