Privacy policy

Retento provides a student engagement and retention platform to universities, vocational education and training providers, and other education institutions. This policy applies to personal information Retento handles through its platform, website, business operations and support channels.

An education institution will usually decide why and how its student information is handled. In that setting, Retento acts as its contracted service provider and follows the institution's lawful instructions. Students should also read their institution's privacy notices, which explain the institution's own handling practices.

We seek to handle personal information consistently with the Australian Privacy Principles in the Privacy Act 1988 (Cth). Where we are bound as a contracted service provider to a Queensland public sector entity, we also comply with applicable contractual obligations under the Information Privacy Act 2009 (Qld) and the Queensland Privacy Principles.

Depending on how an institution configures Retento, we may handle:

• student names, identifiers, contact details and enrolment or cohort information;
• SMS and other communications, response selections and delivery records;
• support needs, referrals, case notes and engagement outcomes;
• staff names, work contact details, roles, sign-in records and activity logs;
• technical information such as device, browser, network, security and usage data; and
• information sent to us in enquiries, demonstrations, support requests or complaints.

Communications may reveal sensitive information, including health, disability, financial hardship or personal circumstances. We only handle sensitive information where consent has been obtained or another lawful basis applies, and only for the purposes authorised by the relevant institution and applicable law.

We may receive information from an education institution, directly from a student or staff member, through interactions with the platform, or from our service providers. Institutions are responsible for providing appropriate collection notices and obtaining any consent required for the information they provide to Retento.

We use personal information to:

• deliver check-ins, receive responses and connect students with appropriate human support;
• operate, secure, monitor and improve the platform;
• provide account access, technical support and service communications;
• produce authorised reporting for institutions, including aggregated insights;
• meet contractual, legal, audit and incident-response obligations; and
• respond to enquiries, privacy requests and complaints.

If required information is not provided, Retento or the institution may be unable to provide the relevant communication, support pathway or platform function. We do not sell personal information.

Retento uses AI to assist with triage and prepare draft responses. Student message content is minimised before processing. Drafts and escalations are reviewed by authorised staff: Retento's AI does not independently make final decisions about a student's eligibility, enrolment, academic standing, support outcome or legal rights.

Institutions determine the support actions taken in response to Retento's signals. Retento applies access controls and configured geographic restrictions to AI processing as described in the subprocessor table below.

We disclose personal information only where needed to provide the service, on an institution's instructions, with consent, or where required or authorised by law. This may include disclosure to the relevant institution and its authorised staff, the subprocessors below, professional advisers, insurers, regulators, courts or law enforcement where lawfully required.

We review our subprocessor arrangements and may update this list when providers, services or locations change. Material changes will be reflected in this policy.

Retento configures its core platform hosting, authentication, transactional email, SMS processing and AI inference for Australia. Google Workspace may process or store Retento staff and support information in countries outside Australia. The particular countries may vary according to Google's infrastructure and service terms and may not be practicable for Retento to specify in advance.

Before disclosing personal information to an overseas recipient, we take reasonable steps required by Australian Privacy Principle 8, including contractual, technical and organisational safeguards where appropriate. When acting for a Queensland public sector customer, we also apply any overseas-transfer restrictions required by contract and the Information Privacy Act 2009 (Qld).

We use safeguards appropriate to the nature of the information we handle, including access controls, encryption, logging, monitoring, multi-factor authentication, data minimisation and Australian-region controls for core platform services. No method of storage or transmission is completely secure.

We retain personal information only for as long as needed for the purposes described in this policy, the relevant institution's instructions, contractual obligations and legal requirements. We then delete or de-identify it where required and practicable.

We assess suspected data breaches and notify affected institutions, individuals and regulators where required, including under the Notifiable Data Breaches scheme in the Privacy Act 1988 (Cth) and applicable Queensland requirements.

You may request access to, or correction of, personal information Retento holds about you. If the information was provided by or is controlled by your education institution, we may refer the request to that institution or work with it to respond. We may need to verify your identity before acting and may refuse a request where permitted by law. If we refuse, we will generally explain why and the available complaint options.

Send requests to admin@retento.com.au. There is no charge for making a request. If a lawful access charge applies, we will tell you before proceeding.

Contact our Privacy Officer at admin@retento.com.au with a privacy question or complaint. Please describe the issue and include enough information for us to investigate. We will acknowledge the matter and aim to provide a substantive response within 30 days. If the matter relates to information controlled by an education institution, we may coordinate with or refer you to that institution.

If you are not satisfied with our response, you may contact the Office of the Australian Information Commissioner. For a matter governed by Queensland public sector privacy law, you may also be able to contact the Office of the Information Commissioner Queensland, subject to its complaint requirements.