Privacy & Data Statement

1. Overview

EpicYou Pty Ltd (ABN 57 686 334 994) operates the Know Yourself, Find Your Path program, powered by the EpicYou platform. This statement explains how EpicYou collects, uses, stores, discloses and protects personal information — including sensitive information about young people — in the delivery of the program.

EpicYou is committed to handling personal information in accordance with the Privacy Act 1988 (Cth), the Australian Privacy Principles (APPs), and the Personal Information Protection Act 2004 (Tas). This statement applies to all participants, school staff, partner organisations and other individuals whose information is collected in connection with the program.

2. What Personal Information We Collect

2A. Student participants

For students completing the Know Yourself, Find Your Path program, EpicYou collects:

• First name and year level (for report personalisation — last name is not required)
• School or organisation name and region
• Responses to the behavioural preferences assessment (16 questions — multiple choice)
• Career pathways and roles saved or selected during the session
• Post-session survey responses (optional, de-identified for evaluation purposes)

EpicYou does not collect date of birth, home address, contact details, health information, cultural background or any other sensitive personal information from student participants unless specifically required and consented to for a particular program variant.

2B. School staff and partner organisation staff

For careers advisors, teachers, youth workers and other staff involved in program delivery, EpicYou collects:

• Name, position and contact details (email and phone)
• Organisation name and location
• Teacher/staff feedback survey responses (optional, for program evaluation)

2C. Parent and caregiver information

Where a parent/caregiver career conversation guide is generated as part of a student's pathway plan, the guide contains the student's first name and pathway information only. EpicYou does not collect personal information directly from parents or caregivers.

3. How We Collect Personal Information

EpicYou collects personal information:

• Directly from student participants through the EpicYou platform during program sessions
• From school staff and partner organisations through onboarding and program coordination processes
• Through post-session surveys administered by the Program Coordinator or delivery staff

All collection occurs with the knowledge of the school or partner organisation. Schools and partner organisations are responsible for ensuring appropriate parental/guardian consent is in place for student participation in accordance with their own consent frameworks and the Child and Youth Safe Organisations Act 2023 (Tas).

4. How We Use Personal Information

EpicYou uses personal information collected from student participants only for the following purposes:

• Generating the student's individual strengths and career pathway report
• Generating the teacher guide and parent/caregiver career conversation guide associated with the student's session
• Administering and evaluating the program, including measuring outcomes against the WPTP Employment Outcomes Framework
• Reporting to funding bodies (Skills Tasmania / Department of State Growth) — in de-identified, aggregated form only

EpicYou does not use student information for marketing, commercial profiling, sale to third parties, or any purpose unrelated to program delivery and evaluation.

5. How We Store and Protect Personal Information

EpicYou stores personal information using secure cloud-based infrastructure (Google Workspace) and takes reasonable steps to ensure personal information is stored and managed in accordance with Australian privacy requirements. Access is restricted to authorised EpicYou program staff and contractors who require access for program delivery and evaluation purposes.

EpicYou implements the following safeguards:

• Password protection and two-factor authentication for all platform access
• Restricted access controls — staff access only the data required for their role
• No student data is stored on personal devices
• Data transmission uses encrypted connections (HTTPS)
• Regular review of data access and storage practices

Student assessment responses and pathway plan data are retained for the duration of the program and for a period of 12 months following program completion for evaluation and reporting purposes. After this period, individual student data is de-identified or securely deleted.

6. Disclosure of Personal Information

EpicYou does not sell, rent or trade personal information. Personal information may be disclosed only in the following circumstances:

• To Skills Tasmania / Department of State Growth for program acquittal and reporting purposes — in de-identified, aggregated form only
• To school staff or partner organisation staff involved in delivering the program to a specific student — limited to that student's pathway plan and report
• Where required or authorised by law
• Where the individual has consented to a specific disclosure

EpicYou does not transfer personal information overseas.

7. Student Reports and Pathway Plans

Each student's pathway plan — including their strengths profile, saved pathways and career report — is generated for the student's own use and to support structured career conversations with their teacher, careers advisor and parent/caregiver.

Student reports are:

• Provided to the student and, where the school has requested it, to the student's careers advisor or teacher
• Not shared with employers, training providers, government agencies or any other third parties without the student's explicit consent
• Not used to make decisions about a student's education or employment pathway

8. Privacy of Children and Young People

EpicYou takes special care with the personal information of children and young people. In addition to the safeguards described in this statement:

• Student first names only (not surnames) are used within the platform
• No student contact information, social media accounts or device identifiers are collected
• Students are not required to create individual accounts or passwords
• No behavioural tracking, cookies or analytics are applied to student interactions within the platform
• Post-session feedback surveys are voluntary and de-identified

Schools and partner organisations are responsible for ensuring that parental/guardian consent is obtained for student participation, in accordance with their existing consent frameworks and the Child and Youth Safe Organisations Act 2023 (Tas).

9. Access to and Correction of Personal Information

Individuals have the right to request access to personal information EpicYou holds about them, and to request correction of information that is inaccurate, incomplete or out of date.

Requests can be directed to:

EpicYou will respond to access and correction requests within 30 days. In some circumstances EpicYou may be unable to provide access — for example, where doing so would unreasonably impact the privacy of another individual. EpicYou will provide reasons where access is declined.

10. Privacy Complaints

If you have a concern about how EpicYou has handled your personal information, please contact us in the first instance:

EpicYou will acknowledge your complaint within 5 business days and aim to resolve it within 30 days. If you are not satisfied with our response, you may contact the Office of the Australian Information Commissioner (OAIC) at oaic.gov.au or the Tasmanian Ombudsman at ombudsman.tas.gov.au.

11. Updates to This Statement

This Privacy and Data Statement will be reviewed annually or earlier if there is a material change to the program's data practices or applicable legislation. The current version is available at epicyounow.com and will be provided to all partner schools and organisations at the commencement of each program year.