Privacy Policy

STUDY WORK GROW Pty Ltd
ACN 626 075 018
Trading as Ponder (ponder.careers)
Unit 6/149 English Street
Cairns, QLD 4870
Australia

1. Australian Privacy Principles

1.1 Study Work Grow Pty Ltd (ACN 626 075 018), trading as Ponder (“we”, “our”), is committed to maintaining the privacy and confidentiality of personal information. We believe that the responsible use of personal information collected is critical to our business objectives and reputation.
1.2 We have elected to follow the Commonwealth Privacy Act 1988 and accordingly will adhere to the Australian Privacy Principles (APPs) when collecting, using, disclosing, securing, and providing access to personal information.
1.3 As part of our commitment to privacy, we have adopted this Privacy Policy which deals with the management of personal information.
1.4 By engaging with us, you consent to the collection, use, and disclosure of your personal information in accordance with this Privacy Policy.
1.5 The contents of this Privacy Policy are subject to change and are not intended to create a contract between us and any individual or entity that provides us with personal information.

2. Personal Information Collection

2.1 Personal information is any information, including any opinion, about an identified individual, or an individual who is reasonably identifiable, whether the information or opinion is true or not, and whether the information or opinion is recorded in material form or not.
2.2 Sensitive information is personal information which is given a greater level of protection under the Australian Privacy Principles, such as information about your health, criminal records, your religious beliefs or affiliations, or political opinions. We only collect such information where we are permitted to do so under the Australian Privacy Principles and if such information is necessary to provide our services to you or where we are required to collect this information by law.
2.3 We may invite you to provide information about yourself so that we are able to provide our services to you. We may also collect information about you from your school, university, or organisation. We do not collect information about you from other external sources.
2.4 The extent and type of personal information we receive from you depends on the information you provide to us through our platform, website, email, telephone, or when you request services.
2.5 In order for us to provide you with our services or otherwise to deal with you, we generally require:
- For school or organisation officials — name, email address, contact numbers;
- For student and community users — email address (which may be an address provided by your school or organisation);
- Information about your school or organisation and education records;
- Any information that relates to you, that you provide to us directly through our website, email, questionnaires, and phone conversations.
2.6 Where it is lawful and reasonable to do so, you can remain anonymous or use a pseudonym for general platform use; however, accurate legal information is required for billing and payment purposes. Use of pseudonyms may reduce the type and quality of services we will be able to provide.
2.7 Users under the age of 15 are required to obtain consent from a parent or guardian before providing personal information through the platform. Where a school or organisation provides access, that organisation is responsible for obtaining parental or guardian consents through its usual processes. See our Terms & Conditions (ponder.careers/terms) for full details.

3. Use and Disclosure of Personal Information

3.1 We use the personal information which you provide to deliver services most suited to your needs.
3.2 We use your personal information to:
- communicate with you and respond to your requests;
- provide you with information about our services;
- provide you with services;
- administer and manage those services (including billing);
- consult with your school or organisation;
- let you know about new Study Work Grow and Ponder tools, resources, and services (only where you have opted in to receive communications from us);
- gather feedback on our services or our platform;
- comply with any legal or regulatory obligations.
3.3 We only send marketing communications where you have opted in. You can opt out at any time via unsubscribe links in our messages or by contacting us directly.
3.4 The personal information you provide to us will be retained only for as long as necessary to fulfil the purposes for which the information was collected or as required by law.
3.5 Dormant accounts and associated personal data are deleted after 24 months of inactivity unless we are required to retain it by law.
3.6 We do not share personal information with third parties except:
- where you have given your consent;
- to contracted service providers (sub-processors) who are bound by confidentiality, privacy, and security obligations and who only process information on our instructions; or
- where required by law or a valid legal process.
3.7 We will release specific information about you or your account to comply with any valid legal inquiry or process such as a search warrant, subpoena, statute, or court order. We will also release specific information in special cases, such as if there is an attempted breach of the security of our systems, or a physical or property threat to you or others.
3.8 Information you enter when subscribing or making a purchase will be shared with payment processors and financial gateways to authorise payments. Such information may also be shared with necessary third parties solely for the purpose of carrying out the transactions.
3.9 By submitting information online through a website or questionnaire, you acknowledge that we cannot guarantee the security of such information.

4. Anonymous Research Data

4.1 We collect anonymous assessment and tool usage data for the purposes of labour market intelligence, improving career guidance for young people, generating reports, and advocating for young people’s career outcomes. This data collection is a core part of our social mission — by contributing responses, users help build a resource that benefits others in the future.
4.2 Assessment responses are collected and stored separately from any personally identifiable information. Your name, email address, and other identifying details are never attached to your assessment responses. Each response is identified only by a randomly generated anonymous identifier that cannot be traced back to you. There are no open text fields stored as part of assessment data.
4.3 We use this anonymous data only in aggregate form. We never publish, share, or analyse individual responses. Where response numbers for a particular category (for example, a specific occupation or region) are small enough that individual responses could potentially be identifiable, we apply minimum threshold limits to prevent this.
4.4 Anonymous aggregate data may be shared with researchers, educational institutions, government bodies, and other organisations where doing so supports our social mission of improving career guidance and outcomes for young people. This data is shared either in aggregate statistical form or as de-identified datasets and never includes any information that could be used to identify an individual.
4.5 Because this data is anonymous and cannot be linked back to you, it is retained independently of your personal account. If you delete your account, any anonymous research data already contributed cannot be extracted from aggregate datasets or snapshots because it was never connected to your identity in the first place.
4.6 If you would prefer not to contribute anonymous assessment data to our research dataset, you may opt out by contacting us at [email protected]. Opting out will not affect your ability to use Assessments or receive your personal results.

5. Automated Decision-Making

5.1 Some of our services, including Assessments and Online Tools, use algorithmic processing to generate general suggestions or provide potential indications about career pathways, interests, or areas for exploration. These results are informational only — they do not constitute professional advice, determine access to services, or make decisions that produce legal effects concerning you.
5.2 You are always free to disregard any suggestions generated by our tools. We recommend consulting with a qualified career practitioner, educator, or relevant professional before making any decisions based on your results.

6. Data Access, Quality, and Portability

6.1 We take reasonable steps to ensure that the personal information we collect, use, or disclose is accurate, complete, and up-to-date.
6.2 You can request a copy of your personal data in a structured, commonly used, machine-readable format. If we are unable to provide you with access, we will explain why. We reserve our right to charge a reasonable fee for searching for and providing access to your information.
6.3 You can contact us at any time to update your information and we recommend you do so as and when required. You can also advise us of changes by email using the details on our website.

7. Cookies and Analytics

7.1 “Cookies” (small text files placed on your computer when you first visit our website) may be used on some parts of our platform.
7.2 We use cookies for the following purposes:
- Essential cookies: To maintain your session when you are logged in and to remember your preferences;
- Functional cookies: To help you use our online tools and resources when you are not logged in, such as saving progress or preferences during a session;
- Internal analytics: To understand how our platform is used, including which pages and tools are most popular, so we can improve the experience. This data is collected internally and is not connected to any third-party advertising, marketing, or tracking services.
7.3 We do not use any third-party tracking cookies. We do not use services such as Google Analytics, Facebook Pixel, or similar third-party analytics or advertising tools. No data collected through cookies is shared with any external party.
7.4 Most browsers allow you to refuse or manage cookies. If you choose to disable cookies, some features of the platform may not function as intended.

8. Overseas Transfer

8.1 All personal information is stored and processed in Australia. Our primary hosting, database, email, and backup infrastructure is located in Australian data centres.
8.2 Certain internal operational tools we use (such as documentation and billing systems that do not hold student data) may process data in other jurisdictions. Details of these services and their locations are set out in the Sub-Processors section below.
8.3 In a genuine emergency — such as catastrophic failure of our Australian data centres — we may temporarily process data in another jurisdiction, but only where equivalent privacy protections are in place and with notification to affected Users as soon as practicable. We would only do this as a last resort where no alternative Australian option is available.
8.4 Apart from the above, we will only transfer your personal information overseas if:
- we are required to do so by law;
- we reasonably believe that the recipient will be required to uphold privacy principles which are similar to the Australian Privacy Principles;
- you have consented to the transfer;
- the transfer is necessary for the performance of a contract between you and us; or
- we have taken reasonable steps to ensure that your personal information will not be held, used, or disclosed by the overseas recipient in a way which does not comply with the Privacy Act and/or the APPs.

9. GDPR Compliance

9.1 If you are in the European Economic Area (EEA), we treat your information in accordance with European laws and regulations including the GDPR which governs how we may collect and process your information, and the rights you have in relation to it.
9.2 Without limitation, if you are in the EEA we will collect and use your information only where:
- We need it to provide you with our services and fulfil our obligations to you;
- It is justified because of a legitimate interest such as for internal research (using only de-identified or aggregated data) or to improve our services, but only where our legitimate interest is not overridden by your interest in protecting your data;
- You consent to us using your information in a certain way; or
- It is necessary for compliance with our legal obligations.
9.3 Where we transfer your information to a third party provider that is not located in the EEA, and is not subject to an adequacy decision by the EU Commission, we will require those third party providers to enter into an appropriate data processing agreement.
9.4 You will be asked to consent to the use of your information for the purposes set out in this Privacy Policy and our applicable Terms & Conditions at the time of engaging with us or entering our platform. You may withdraw that consent at any time by emailing us.
9.5 You have a right to:
- Receive information which you supplied in a structured, commonly used, machine-readable format and to transmit that data to another entity, where the data is processed electronically;
- Require us to delete your information in certain circumstances such as when the information is no longer necessary for the purpose for which it was collected, or you withdraw your consent; and
- Object to the processing of your information verbally or in writing.
9.6 If you require us to delete your information, you withdraw your consent, or you object to certain use of your information, it may mean that it is not possible for you to continue using our services.

10. Data Security

10.1 We are committed to protecting your personal information from misuse and loss, and from unauthorised access, modification, and disclosure, and will take reasonable steps to do so, including appropriate technical and organisational measures.
10.2 Our personnel who have access to personal information have been trained to maintain the confidentiality of such information.

11. Sub-Processors

11.1 We will notify you in writing of any new sub-processors or changes to data storage locations before they take effect.
11.2 Hosting and Infrastructure — Digital Ocean provides our Australian cloud hosting for the platform, including the application (via App Platform), managed PostgreSQL database, file storage, and backups. In doing so, Digital Ocean may process account information, usage data, and content stored in the service. The purpose is to host and secure the platform, ensure availability, and maintain backups. Our lawful basis is performance of a contract (to provide the service) and our legitimate interests in security and reliability. Data is processed and stored in Australia (SYD1 region).
11.3 Email — Maileroo provides SMTP email processing for transactional emails (such as account verification and password resets) and optional communications (such as newsletters and product updates, only where a user has opted in). Maileroo processes email addresses and email content for the purpose of delivering those messages. The lawful basis is performance of a contract for essential service notifications and consent for marketing communications. Data is processed and stored in Australia.
11.4 School and operational management (no student data) — Notion is used to manage school relationships, internal documentation, and operational records. Notion processes school-level information only, including school name, administrator contact details (names, email addresses, roles), and membership information. No student personal data is stored in Notion. The purpose is customer relationship management, service coordination, and internal operations. The lawful basis is performance of a contract and our legitimate interests in effective account management. Data is processed in the United States and the European Union.
11.5 Billing and accounting (no student data) — Xero helps us manage billing and financial records. Xero processes school name, contact name, contact email (or accounts email where invoices are directed), ABN (when supplied), and membership information. No student personal data is stored in Xero. The purpose is billing administration and financial record-keeping. The lawful basis is performance of a contract and legal obligation (financial record-keeping).
11.6 Payment processing — Stripe processes payments for individual purchases made through the platform. Stripe processes names, email addresses, and payment details for the purpose of authorising and processing transactions. No payment card details are stored by Study Work Grow — they are handled entirely by Stripe. The lawful basis is performance of a contract. Data is processed in Australia with some processing in the United States and the European Union.

Sub-processor	Applicable services	Nature and purpose	Categories of personal data	Location
Digital Ocean	Primary hosting, database, backups	Cloud hosting, database, file storage, backups	Account info, usage data, stored content, audit logs	Australia (SYD1)
Maileroo	Transactional and optional email	SMTP email delivery	Email addresses, email content	Australia
Notion	School management, internal ops (no student data)	Customer relationship management, documentation	School name, admin contact details, membership info	USA, EU
Xero	Billing and accounting (no student data)	Billing administration, financial record-keeping	School name, contact details, ABN, membership info	USA, EU
Stripe	Payment processing	Payment authorisation and processing	Names, email addresses, payment details	Australia, USA, EU

12. Further Information

12.1 We recognise our responsibility for protecting the privacy of your personal information. If you have a complaint or objection about our administration of your personal information, please contact us at [email protected]. You may also use this address to communicate any questions or comments you may have regarding compliance with our Privacy Policy.
12.2 We will provide at least 7 days’ advance notice of any changes to this Privacy Policy or our Terms & Conditions. We will notify you in writing via email sent to the registered account email and by posting a notice on the platform.
12.3 If you are not satisfied with how we handled your complaint, you can lodge a complaint with the relevant privacy authority:

Australia — Office of the Australian Information Commissioner

Telephone: 1300 363 992
Post: GPO Box 5218, Sydney NSW 2001
Email: [email protected]
Website: www.oaic.gov.au

New Zealand — Office of the Privacy Commissioner

Telephone: 0800 803 909
Post: PO Box 10-094, The Terrace, Wellington 6143
Email: [email protected]
Website: www.privacy.org.nz

Other jurisdictions — If you are located outside of Australia and New Zealand, you may also contact the relevant privacy or data protection authority in your home country.