Privacy Policy
How St Mary's College collects, uses, stores and discloses personal information about students, families and staff, and how you can access or correct your information or make a privacy complaint.
Families trust St Mary's College with a great deal of personal information, from health details to photographs and results. This policy explains what we collect, why, how we protect it, and your rights over your information.
Purpose
To describe how the College handles personal, sensitive and health information in line with the Privacy Act 1988 (Cth), the Australian Privacy Principles (APPs), and the Melbourne Archdiocese Catholic Schools (MACS) Privacy Policy and Standard Collection Notice.
Scope
Applies to personal information about students, parents and carers, prospective families, volunteers, contractors and job applicants, held on paper or in College systems including the Parent Portal, Learning Hub and approved third-party applications. Staff information is covered by MACS employee privacy arrangements.
Policy statement
The College collects only the information it reasonably needs to enrol and educate students, keep them safe and well, communicate with families, meet legal obligations and run the College. We use and disclose information only for those purposes or where the law requires or permits, we store it securely, and we give individuals access to and correction of their information on request.
Procedures
What we collect and why
- At enrolment: names, dates of birth, addresses, contact details, baptism and parish details, previous schooling, court orders and parenting arrangements, collected through the Registrar, Mrs Kate O'Brien.
- Health and wellbeing: medical conditions, allergies, medication, immunisation history, counselling and specialist reports, collected via Parent Portal medical forms and the College Counsellors.
- Images and recordings: photographs and video for teaching, newsletters, the website and social media, subject to the Photography & Media Consent Policy.
- CCTV: cameras operate in car parks, entrances and public areas of the campus for safety and security. Footage is kept for 30 days unless required for an investigation.
How we use and disclose information
Information is shared within the College on a need-to-know basis. We disclose it outside the College where necessary to:
- MACS, the Catholic Education Commission of Victoria, the VCAA and the Victorian and Commonwealth Departments of Education (for funding, census, NAPLAN and VCE administration);
- health professionals, hospitals and emergency services in an emergency or with consent;
- camp providers, excursion venues and bus operators (names, medical and dietary needs only);
- approved providers who host the Parent Portal, Learning Hub, lunch orders and learning applications, chosen to store data in Australia wherever possible and bound by contractual privacy obligations;
- police, Child Protection or courts where required or authorised by law, including mandatory reporting.
Storage and security
Paper records are kept in locked storage. Electronic records are held in password-protected systems with role-based access and multi-factor authentication for staff. Records are retained under the MACS retention schedule and destroyed securely when no longer required.
Access and correction
- Requests to access or correct information are made in writing to the Privacy Officer at office@stmaryswc.vic.edu.au.
- We respond within 30 days. In limited cases access may be refused (for example where it would unreasonably affect another person's privacy) and we will explain why.
- Parents may update contact and medical details at any time through the Parent Portal.
- Where parents are separated, both parents are entitled to information about their child unless a court order provides otherwise. Please give the Registrar a copy of any relevant orders.
Data breaches
Suspected breaches are reported immediately to the Privacy Officer, who leads containment and assessment. Where a breach is likely to result in serious harm, affected individuals and the Office of the Australian Information Commissioner (OAIC) are notified under the Notifiable Data Breaches scheme.
Complaints
Privacy complaints are made in writing to the Privacy Officer and handled under the Complaints & Grievances Policy. If you are not satisfied, you may contact MACS or the OAIC at oaic.gov.au.
Responsibilities
Parents and carers
- Provide accurate information and keep it up to date on the Parent Portal.
- Respect other families' privacy, including not sharing photographs of other children without permission.
Students
- Keep passwords private and use College systems only for their own learning.
- Respect classmates' privacy online and offline.
Staff
- Access only information needed for their role, store it securely and never discuss family matters in public.
- Report suspected breaches immediately to the Privacy Officer.
Related documents
- Photography & Media Consent Policy
- ICT Acceptable Use Policy
- Child Safety Policy
- Complaints & Grievances Policy
- Enrolment Policy
- Parent Portal Guide
Review
Policy owner: Business Manager (College Privacy Officer). Approved by the College Leadership Team March 2026; ratified by the College Advisory Council; next review March 2028.
Frequently asked questions
Can I see my child's school file?
Yes. Write to the Privacy Officer at office@stmaryswc.vic.edu.au and we will respond within 30 days. Most academic and attendance information is already available to you on the Parent Portal and Learning Hub.
Who can see my child's medical information?
The class or Homeroom teacher, first-aid staff, the Year Level Coordinator and, for camps and excursions, the staff attending. It is shared with camp providers only as far as needed to keep your child safe.
Does the College share information with the other parent after separation?
Both parents remain entitled to information and reports about their child unless a court order says otherwise. Please provide the Registrar with a copy of any current orders so we can follow them.
Can I ask for my child's photo to be removed from the website?
Yes. Update your consent in the Parent Portal or email office@stmaryswc.vic.edu.au. Images are removed from the website and social media within five school days; printed material already distributed cannot be recalled.
What happens if there is a data breach?
The Privacy Officer contains and assesses the breach. If it is likely to cause serious harm, we notify affected families directly, report to the OAIC and tell you what steps to take.