Privacy Policy

2 What Information We Collect

We collect personal information that is reasonably necessary to provide our services. The categories of information we collect include:

3 How We Collect Information

We collect personal information through the following channels:

3.1 Directly from you

• Enrolment forms on our website or shared via WhatsApp
• Enquiry forms, contact forms and consultation booking forms
• Phone calls and WhatsApp conversations with our team
• In-person registration at our Melbourne campuses
• Account creation on MockMaster.ai or the NAATI Ninja app
• Survey responses, testimonial submissions and review requests

3.2 Automatically through technology

• Website cookies and tracking technologies (see Section 9)
• MockMaster.ai platform — practice session data, scores, usage patterns
• NAATI Ninja app analytics
• Google Analytics (anonymised traffic data)
• Meta Pixel (website visitor data for advertising purposes — you can opt out via your browser or Meta settings)

3.3 From third parties

• Referrals from existing students or education agents
• Payment processors (Stripe, Afterpay) — transaction confirmation data only
• Google, Instagram and Facebook if you interact with our ads or social content and then contact us

4 Why We Collect Your Information

We use personal information for the following purposes:

5 Legal Basis for Processing

One Australia Group processes personal information on the following legal bases under the Australian Privacy Act 1988 and the 13 Australian Privacy Principles (APPs):

• Performance of a contract: Processing is necessary to deliver the coaching services you have enrolled in and paid for
• Consent: Where you have explicitly consented, including to receive marketing communications
• Legitimate interests: Where we have a genuine business interest (such as improving our services, preventing fraud or protecting our legal rights) and that interest is not outweighed by your privacy rights
• Legal obligation: Where processing is required to comply with Australian law, a court order or a request from a law enforcement authority

6 How We Store and Protect Your Data

6.1 Storage locations

Your personal data is stored in the following systems:

• Google Workspace — emails, documents and drive files (data centres in Australia and the US)
• AWS (Amazon Web Services) — MockMaster.ai platform data (Sydney region — Australia)
• Stripe — payment transaction records (PCI DSS Level 1 compliant)
• Afterpay — Afterpay transaction records (Afterpay's own privacy policy applies)
• Zoom — class recordings where applicable (Zoom's privacy policy applies)
• Internal CRM systems — enrolment records, coaching notes, attendance (hosted on secure Australian or AWS infrastructure)

6.2 Security measures

We implement the following security measures to protect your personal information:

• SSL/TLS encryption for all data transmitted between your device and our website and platforms
• Two-factor authentication (2FA) for all staff accessing student records
• Role-based access controls — staff only access data relevant to their function
• Regular security reviews of third-party processors and platform configurations
• Secure destruction of physical documents containing personal information
• Staff training on privacy obligations and data handling procedures

6.3 Data retention

7 Who We Share Your Data With

We share personal data only with the following categories of recipients, and only to the extent necessary:

7.1 Service providers (data processors)

These companies process data on our behalf under strict contractual obligations:

7.2 Legal and regulatory disclosure

We may disclose your personal information to government authorities, law enforcement agencies or courts where we are required to do so by law, a court order or a legitimate regulatory request. We will notify you of any such disclosure where legally permitted to do so.

7.3 Business transfers

In the event of a merger, acquisition, or sale of all or part of One Australia Group's business, personal data may be transferred to the acquiring entity as part of the transaction. We will notify affected individuals before such a transfer and provide the opportunity to request deletion of their data.

8 International Data Transfers

Some of our service providers (including Zoom, Stripe, Meta and Google) store or process data in countries outside Australia, primarily the United States. When we transfer personal information internationally, we take the following steps to ensure it remains protected:

• We only transfer data to countries or providers with adequate data protection standards
• All international processors are bound by contractual data processing agreements that require them to maintain the same standards of protection as required under the Australian Privacy Act
• We do not transfer data to providers in countries with no adequate privacy framework without your explicit consent

9 Cookies and Tracking Technologies

9.1 What cookies we use

Our website (oneaustraliagroup.com) and MockMaster.ai use cookies and similar tracking technologies. The types of cookies we use are:

9.2 Managing cookies

You can control cookies through your browser settings. Most browsers allow you to refuse new cookies, delete existing cookies, or notify you when a new cookie is set. Disabling essential cookies may affect the functionality of our website and platforms.

To opt out of Google Analytics tracking across all websites, visit tools.google.com/dlpage/gaoptout.

To manage your Meta advertising preferences, visit facebook.com/adpreferences.

10 Children's Privacy

Our coaching services are intended for individuals aged 18 and over. We do not knowingly collect personal information from children under the age of 18 without verifiable parental or guardian consent.

MockMaster.ai and the NAATI Ninja app are intended for adult users. If you are under 18 and wish to use our services, a parent or legal guardian must complete the enrolment process and consent to the collection and use of your information.

If we become aware that we have inadvertently collected personal information from a child under 18 without proper consent, we will take immediate steps to delete that information from our systems.

11 Your Privacy Rights

Under the Australian Privacy Act 1988, you have the following rights in relation to your personal information:

12 Data Deletion Requests

You may request deletion of your personal data at any time. We honour deletion requests as follows:

12.1 How to submit a deletion request

1. Email contact@oneaustraliagroup.com with the subject line "Data Deletion Request"
2. Provide your full name, email address and mobile number so we can identify your records
3. Specify whether you want full deletion or deletion of a specific category of data
4. We will confirm receipt within 5 business days and action your request within 30 calendar days

12.2 What will be deleted

Upon a valid deletion request, we will delete or anonymise your identity, contact, education and performance data. We will confirm in writing when deletion is complete and identify any data we are required to retain by law.

12.3 What cannot be deleted

Certain records cannot be deleted immediately due to our legal obligations:

• Financial and payment records — retained for 7 years per ATO requirements
• Records subject to an active legal dispute or regulatory investigation
• Anonymised, aggregated data that cannot be linked back to you as an individual

13 Data Breach Notification

One Australia Group is subject to the Notifiable Data Breaches (NDB) scheme under the Privacy Act 1988. In the event of a data breach that is likely to result in serious harm to any individual whose data is affected, we will:

1. Contain the breach and assess the risk of serious harm within 30 days of becoming aware
2. Notify the Office of the Australian Information Commissioner (OAIC) as required by law
3. Notify all affected individuals as soon as reasonably practicable after the OAIC notification
4. Provide affected individuals with a clear description of the breach, the data involved, and the steps taken to address it
5. Implement remediation measures to prevent recurrence

14 Changes to This Privacy Policy

One Australia Group may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements or business operations. When we make material changes, we will:

• Update the "Effective date" at the top of this policy
• Publish the updated policy on our website at oneaustraliagroup.com/privacy-policy/
• Notify current students and platform users via email or in-app notification for significant changes

We encourage you to review this policy periodically. Continued use of our services following any update to this policy constitutes your acceptance of the updated terms.

15 Who We Are

A One Australia Education Group (trading as One Australia Group) is a private English proficiency coaching institute registered in Victoria, Australia. We operate at:

• Head office: Melbourne CBD, Victoria, Australia
• Clayton campus: Clayton, Victoria
• Truganina campus: Truganina, Victoria

We provide English proficiency coaching for PTE Academic, IELTS Academic, NAATI CCL, LanguageCert, OET and CELPIP. We also operate MockMaster.ai (web and mobile AI practice platform) and the NAATI Ninja mobile application.

This Privacy Policy applies to all personal information collected by One Australia Group through our website, coaching programs, mobile applications, digital platforms, enquiry forms, WhatsApp communications and any other channel through which we interact with students, enquirers and clients.

For privacy enquiries, contact us at: contact@oneaustraliagroup.com or +61 401 616 524.

16 Contact and Complaints

15.1 Privacy enquiries

15.2 How to lodge a complaint

If you believe One Australia Group has mishandled your personal information or breached an Australian Privacy Principle, please contact our privacy officer at the details above. We will acknowledge your complaint within 5 business days and work to resolve it within 30 calendar days.

15.3 Escalation to the OAIC

If you are not satisfied with our response to your complaint, you may lodge a complaint with the Office of the Australian Information Commissioner (OAIC):

17 Definitions

In this Privacy Policy, the following definitions apply: