Last updated: 21 September 2026
1. Who we are
This policy is issued by Toolbox Education Pty Ltd (ABN 63 646 777 488), of 146-150 Chapel Street, St Kilda VIC 3181 ("Toolbox Education", "we", "us", "our"). We run preventative psychology workshops in schools, and this policy explains how we handle personal information under the Australian Privacy Principles in the Privacy Act 1988 (Cth).
It covers toolboxeducation.com, our workshop booking and delivery process, workshop feedback, our newsletter, and facilitator recruitment. It doesn't cover Toolbox Workplace or Toolbox Clinic, which are separate parts of the Toolbox group with their own policies.
2. Information we collect
What we collect depends on how you interact with us:
- School enquiries and bookings - when a school contacts us through our website form or directly, we collect the enquirer's name, school name, email, phone number, the type of workshop they're interested in, and any message or booking details they provide.
- Workshop feedback - after a workshop, students are invited to complete a short feedback form. It asks for the state, the facilitator's first name, the workshop topic, the student's school name, and year level, plus rating and free-text answers about the session. It does not ask for the student's name, email or any other directly identifying contact detail.
- Parent & staff workshop attendees - when a school books a parent or staff workshop, we may hold the contact details the school provides for coordinating that session, and, where relevant, details of who attended.
- Facilitator applications - if you apply to join our team, we collect what you provide in that application (name, contact details, and information relevant to assessing your application, such as availability, your Working with Children Check status, and relevant experience), via our recruitment form.
- Newsletter recipients - we don't run a public newsletter sign-up on the website. We only send our newsletter to schools that have booked a workshop with us, and to parents or staff who have attended a parent or staff workshop, using the contact details already collected through that booking or attendance.
- Website usage information - once you've accepted our cookie banner, we collect general information about how the site is used (see Cookies & website analytics below).
- Cookie consent records - we keep a record of whether you accepted or rejected cookies, and when, so we don't ask you again unnecessarily.
3. Children, students & schools
Toolbox Education's workshops are booked and arranged by schools, and we rely on schools to have the appropriate consent and information in place for their students to take part - including for related activities like the workshop feedback form referred to above. Consistent with that, our feedback form is designed to avoid collecting a student's name, contact details or other directly identifying information.
Photography and video: occasionally, and only where a school has separately arranged the necessary permission with parents or guardians, our facilitators may photograph or film part of a workshop for our own marketing (for example, on our website or social media). We rely on the school's arrangement for this rather than seeking our own consent from students directly. If your school has organised this and you have questions, please get in touch with your school in the first instance, or contact us at info@toolboxeducation.com.
Safety disclosures: if a student discloses something serious during a workshop (for example, relating to self-harm or abuse), our facilitators follow a clear disclosure protocol: what was disclosed is recorded in an incident report, which is sent directly to your school's wellbeing coordinator, usually within 24 hours, so the right support can follow. This is sensitive information handled only for that safety purpose, shared with the school responsible for the student's care, and access to it is limited to the people who need it to respond appropriately.
4. How we collect it
- Directly from you, through our website's contact and feedback forms.
- From your school, when they make a booking - which may include contact details for parents or staff attending a workshop.
- Directly from job applicants, through our recruitment form.
- Automatically, through cookies, once you've accepted them (see below).
5. Why we collect and use it
- To respond to enquiries and arrange, deliver and invoice workshop bookings.
- To deliver workshops and the term's worth of follow-up activities that come with them.
- To evaluate and improve our programs, using workshop feedback.
- To assess facilitator applications and manage recruitment.
- To send our newsletter to schools that have booked with us, and parents or staff who've attended a workshop - you can opt out at any time using the unsubscribe link in any newsletter, or by emailing us.
- To meet our legal, insurance and duty-of-care obligations, including responding appropriately to a safety disclosure made during a workshop.
- To understand how our website is used, so we can improve it, once you've consented to analytics cookies.
6. Cookies & website analytics
When you first visit our site, a banner asks whether you're OK with non-essential cookies. Until you accept, we don't load analytics or marketing scripts.
- Strictly necessary - things like remembering your cookie choice. These run regardless of your answer, because the site needs them to function.
- Fonts - our site loads the Montserrat typeface from Google Fonts on every visit, which involves your browser requesting it from Google's servers (sending your IP address as part of that request). This happens regardless of your cookie choice, as it's needed to display the site as designed.
- Spam protection - our contact form uses Google reCAPTCHA to block automated spam submissions, which involves Google collecting some device and interaction information under its own privacy policy.
- Analytics - once enabled, we use Google Analytics (GA4) to understand site traffic and improve the site, but only for visitors who accept cookies. Where enabled, IP addresses are anonymised.
You can change your mind at any time using the "Cookie settings" link in the footer of any page.
7. Who we share it with
We don't sell your personal information. We share it with:
- Netlify - who host our website and process submissions from our contact and cookie-consent forms.
- Google - for our feedback and facilitator-application forms (Google Forms), our site's typeface (Google Fonts), spam protection on our contact form (reCAPTCHA), and website analytics (Google Analytics), once enabled.
- Our CRM system - which we use to manage relationships with schools and clients.
- Our accounting and invoicing platform - which we use to process payments and issue invoices for bookings.
- Your school - specifically, a school's own wellbeing coordinator, in the case of a safety disclosure incident report as described above.
- Where required by law, regulation, or a valid request from a law enforcement or government body.
8. Where it's stored
Some of the service providers listed above, including Netlify and Google, may store or process information on servers located outside Australia, including in the United States. Where this happens, we take reasonable steps to ensure your information continues to be handled consistently with the Australian Privacy Principles.
9. How we protect it
We take reasonable technical and organisational steps to protect personal information from misuse, loss, and unauthorised access. Our website forms are submitted over an encrypted (HTTPS) connection, and access to the information we hold is limited to staff, team leaders and facilitators who need it to do their jobs.
10. How long we keep it
We haven't finalised fixed retention periods for every category of information yet. Our general approach, which we're still confirming internally, is:
- Enquiries and bookings: generally up to 7 years for information connected to a confirmed, paid booking (consistent with standard Australian business record-keeping practice), and up to 2 years for enquiries that don't lead to a booking, after which it's securely deleted or de-identified.
- Workshop feedback: retained for program evaluation purposes, generally up to 3 years, then deleted or de-identified.
- Unsuccessful facilitator applications: generally up to 12 months, in case a suitable future role arises, then deleted.
- Safety disclosure incident reports: retained only as long as necessary for child-safety and legal record-keeping purposes.
These figures are current placeholders while we finalise our internal retention schedule, rather than a legal commitment set in stone - this page will be updated once that's confirmed.
11. Access & correction
You can ask us what personal information we hold about you, and ask us to correct it if it's wrong, by emailing info@toolboxeducation.com. We'll respond within a reasonable time.
12. Complaints
If you have a concern about how we've handled your personal information, contact us first at info@toolboxeducation.com so we can try to resolve it directly. If you're not satisfied with our response, you can lodge a complaint with the Office of the Australian Information Commissioner (OAIC) at oaic.gov.au.
13. Changes to this policy
We may update this policy from time to time as our practices or services change. The version on this page at any given time is the current one - the "last updated" date at the top reflects the most recent change.
Toolbox Education Pty Ltd (ABN 63 646 777 488)
146-150 Chapel Street, St Kilda VIC 3181
info@toolboxeducation.com · (03) 7045 5364
