Skip to main content
ARCHI UPSKILL

Privacy Policy and Consent

Version 3 · Effective 30 September 2026 · Policy version 2026-09-30

1. Introduction

In this Privacy Policy, “us”, “we” or “our” means ARCHI UPSKILL PTY LTD (ACN 702 338 976, ABN 66 702 338 976), trading as ARCHI UPSKILL. We are committed to respecting your privacy.

We are bound by, and will deal with your personal information in accordance with, the Australian Privacy Principles (APPs) contained in the Privacy Act 1988 (Cth) (the Privacy Act). You can read the APPs at the Office of the Australian Information Commissioner (OAIC): https://www.oaic.gov.au/privacy/australian-privacy-principles-guidelines/

This Policy sets out how we collect, use, store and disclose your personal information when you use the ARCHI UPSKILL courses, technical onboarding services, website and related services.

Personal information means information or an opinion about an identified individual, or an individual who is reasonably identifiable, whether or not true and whether or not recorded in a material form.

2. Information we collect

We collect the personal information reasonably necessary to provide the Services. This may include:

  • name;
  • email address;
  • telephone or mobile number;
  • account login details and learning records (such as courses accessed, progress, assessment results and certificates);
  • billing information (see clause 3 below: we do not store full credit card numbers);
  • your business or employer details, role and professional information (relevant to our technical onboarding and B2B services);
  • where you deal with us on behalf of a Firm, that Firm’s business details, including its trading name and its Australian Business Number (ABN) or Australian Company Number (ACN);
  • content you create within the Services, such as notes, saved items and submissions;
  • records of your communications with us (including emails, support requests and survey responses); and
  • technical and usage information (see clause 5, Log data and cookies).

We collect only what we reasonably need for the purposes described in this Policy, and we take reasonable steps to avoid collecting sensitive information unless it is necessary and you have consented.

3. Payment information

Payments for the Services are processed by third-party payment processors. We do not collect or store your full credit card numbers or bank account details on our systems. Your payment information is handled by the relevant payment processor in accordance with their own terms and privacy policy and applicable payment-card security standards.

4. How we collect personal information

We collect personal information directly from you when you:

  • register for, or purchase, a Course or Service;
  • create or manage an account;
  • communicate with us by email, phone, chat or support request;
  • complete a survey or provide feedback; or
  • otherwise interact with the Services.

Where access is purchased by a Firm (for example, an architecture practice enrolling its graduates or staff), we may also collect personal information about individual learners from that Firm. Where you provide us with personal information about another person (such as your staff or graduates), you warrant that you have obtained that individual’s consent to share their personal information with ARCHI UPSKILL for onboarding and course-delivery purposes, that you are entitled to provide it, and that you have made the individual aware of this Policy.

We may also collect technical information automatically through your use of the Services, as described below.

5. Log data and cookies

Log data. When you use the Services, we may collect information your browser or device sends, such as your IP address, browser type and version, device information, the pages you visit, and the date, time and duration of your visit.

Cookies. We may use cookies and similar technologies to operate the Services, remember your preferences and understand usage. Cookies are small data files stored on your device. You can set your browser to refuse cookies or to alert you when cookies are being used, but some parts of the Services may not function properly if you do.

Analytics. We may use analytics tools to understand how the Services are used and to improve them. Where information collected via cookies is linked to your account, we treat it as personal information under this Policy.

Account and session records. To operate, secure and protect your account, we may collect and keep records of how it is accessed and used. These records may include, but are not limited to, sign-in and sign-out events and attempts; the network (IP) address used and the approximate location derived from it; browser, operating system and device information your browser or device sends; identifiers we generate or derive to distinguish one browser, device or session from another; the number of devices or sessions signed in to your account at any time; and the date, time, duration and frequency of access. We may collect this information whether or not you are signed in at the time.

6. Why we collect, use and disclose your information

We may collect, hold, use and disclose your personal information to:

  • provide, administer and deliver the Courses and Services you have purchased or requested;
  • create and manage your account and verify your identity;
  • where your access was purchased or sponsored by a Firm or employer, disclose your enrolment, course progress, completion status and assessment results to that Firm or employer;
  • if you generate a Certificate of completion, make your name, the Course(s) it certifies and its date of issue available to anyone who holds that Certificate’s unique verification link or identifier, so its authenticity can be independently confirmed (see clause 8);
  • operate, protect, improve and optimise the Services and users’ experience;
  • process payments (via our payment processor) and manage billing;
  • where you deal with us on behalf of a Firm, record and verify that Firm’s business details so we can raise valid tax invoices against a recorded identifier and meet our record-keeping obligations;
  • respond to your enquiries and provide support, service and administrative messages;
  • send you marketing communications where permitted (see clause 9);
  • comply with our legal obligations, resolve disputes and enforce our agreements;
  • maintain the security and integrity of the Services; and
  • detect, investigate, prevent and respond to account sharing, credential sharing and other unauthorised or unauthorised-seeming access, including by applying automated checks, limits and verification steps to accounts, devices and sessions, and by confirming that Courses and assessments were completed by the person whose account they were completed under.

7. Firm-sponsored access — what your firm can see

If your access to a Course was purchased or provided for you by a Firm or employer (a firm licence), that Firm can see certain information about your progress, through their own firm dashboard. This clause explains what is visible, what is not, and for how long.

What is visible. While a firm licence is active for you, the Firm holding it can see:

  • your name and email address, as recorded by the Firm when the licence was assigned to you;
  • whether your invitation is still pending, whether you have started, are progressing through, or have completed the Course, or whether your licence has expired;
  • whether there is no visible activity to show for your access — which can happen for several different reasons, most of them administrative rather than a reflection of your actual engagement;
  • your percentage completion and the number of modules you have finished;
  • your best assessment (quiz) result;
  • a breakdown of the above by individual Course, where more than one Course is available to you; and
  • the amount of time you have spent actively watching each lesson’s video.

What is not visible. Your Firm cannot see your activity in any Course it did not licence you for, and cannot see anything from a personal account or purchase you held before you received the firm licence. If you held a licence from a different Firm before this one, that Firm’s history is not visible to your current Firm either.

Certificates are not part of this. Your Certificates of completion do not appear on your Firm’s dashboard, and your Firm cannot look one up because it licensed you. If a Firm comes to see your name and a certificate identifier, it is because you gave them the verification link — exactly as any other member of the public would receive it, and by your own decision. See clause 8.

How long it stays visible. The Firm can see this information while your licence is active, and for one month after it expires. After that month, you no longer appear on the Firm’s dashboard. This is a display rule only — nothing is deleted. You keep your account, your login, your full course progress, and any completed work, whether or not a firm licence remains active on your account.

8. Certificates of completion — public verification

If you complete every Course in a Bundle to the required standard, the Services let you generate a Certificate of completion bearing your name, the Course(s) it certifies, its date of issue, and a unique certificate identifier. This clause explains what becomes visible to others as a result, and why.

Why we disclose it. A Certificate is only useful as a credential if a third party — an employer, a regulator, another institution — can confirm it is genuine without having to trust us directly. We make that possible by allowing anyone who holds a Certificate’s unique identifier or verification link to look up and confirm: your name as it appears on the Certificate, the Course(s) it certifies, its date of issue, and whether it remains valid or has been revoked.

What is not visible. Verifying a Certificate does not disclose your email address, your other Course activity, your assessment scores, or any other personal information beyond what is printed on the Certificate itself. A Certificate can only be looked up by someone who already holds its identifier or link — it is not listed in any public directory or search.

The signed credential is published with it. So that a third party can confirm a Certificate without relying on us, the verification page also makes available the digitally signed credential itself — a machine-readable file which anyone who opens the page can copy and keep. It contains the same information as the Certificate: your name, the Course(s), the date of issue and the identifier, and nothing further about you. Because it can be saved, a copy may continue to exist after the Certificate is revoked or deleted; anyone re-checking it against our published records will see the current status.

Revocation is published separately, without naming anyone. We publish a single list recording which Certificates have been revoked. It identifies Certificates only by position in the list — it contains no names, no identifiers and nothing that can be traced back to a person, and it cannot be used to discover who holds a Certificate or how many exist.

Your name cannot be changed after issue. Because a Certificate is a verifiable credential, the name on it is fixed at the moment you generate it and cannot later be edited. Please check it carefully before generating a Certificate.

How long it stays visible. A Certificate remains verifiable for as long as your account exists, including after the Course access, enrolment or firm licence that earned it has expired — a Certificate is a record of something you achieved, not a subscription.

9. Direct marketing

We may send you marketing communications about our Courses and Services by email or other means, in accordance with the Spam Act 2003 (Cth) and the Privacy Act. Every marketing message will include a way to opt out (such as an unsubscribe link), and you can also opt out at any time by contacting us using the details below. We will not sell your personal information or disclose it to third parties for their own direct marketing.

Your marketing consent is separate and optional; see the consent section at the end of this Policy.

10. Disclosure of your information

We may disclose your personal information, for the purposes described in this Policy, to:

  • our personnel and related entities;
  • a Firm or employer that has purchased or sponsored your access, as described in clause 7;
  • any person who holds the unique verification link or identifier for a Certificate of completion you have generated, limited to what is described in clause 8;
  • third-party service providers who help us operate the Services (for example, hosting, payment processing, email delivery, analytics and support tools), who are only permitted to use it to perform those services for us;
  • professional advisers;
  • a purchaser or potential purchaser of our business or assets, provided they agree to handle it consistently with this Policy; and
  • government agencies, regulators or law enforcement, or other parties, where required, authorised or permitted by law (including in response to a subpoena or court order).

11. Disclosure outside Australia

Some of our service providers (such as cloud hosting, payment processing, email delivery and analytics providers) may store or process personal information outside Australia, primarily in the United States and regions utilised by our cloud infrastructure partners.

Before disclosing personal information overseas, we take reasonable steps to ensure the recipient handles it consistently with the Australian Privacy Principles, except where you consent to the disclosure, or it is otherwise permitted under the Privacy Act.

12. Security and data breaches

We take reasonable steps to protect your personal information from misuse, interference and loss, and from unauthorised access, modification or disclosure, using a range of physical, administrative and technical measures. However, no method of transmission over the internet or electronic storage is completely secure, and we cannot guarantee absolute security.

If a data breach occurs that is likely to result in serious harm, we will respond in accordance with the Notifiable Data Breaches scheme under the Privacy Act, including notifying affected individuals and the OAIC where required.

13. Accessing and correcting your information

You may request access to the personal information we hold about you, and ask us to correct it if it is inaccurate, out of date or incomplete, by contacting our Privacy Officer using the details below. We will verify your identity before providing access. In some cases, we may not be able to provide access (for example, where the law permits us to refuse), and if so, we will tell you why.

14. Children’s privacy

The Services are intended for users aged 18 and over and are directed at professionals and businesses. We do not knowingly collect personal information from anyone under 18. If you believe a person under 18 has provided us with personal information, please contact us, and we will take reasonable steps to delete it. (Note: Australia does not set a single statutory age for privacy consent; capacity is assessed individually, and the OAIC is developing a Children’s Online Privacy Code that may introduce further requirements over time.)

15. Links to other sites

The Services may contain links to websites operated by third parties. We are not responsible for the content or privacy practices of those sites, and we encourage you to review their privacy policies before using them.

16. Automated tools

The Services may include features that use automated systems or artificial intelligence to assist with searching, organising or summarising information.

17. Complaints

If you believe we have breached the Privacy Act or mishandled your personal information, please contact our Privacy Officer using the details below, including your contact details and a description of your complaint. We will acknowledge it and respond within a reasonable time. If you are not satisfied with our response, you may contact the OAIC at www.oaic.gov.au.

18. Changes to this Policy

We may update this Policy from time to time by posting the updated version on our website, with a new effective date. Where changes are material, for example, a change to the kinds of personal information we collect or to the third parties we disclose it to, we will notify you directly via the email address associated with your account at least 14 days before the changes take effect.

The 14-day notice period in this clause is given voluntarily. Neither the Privacy Act 1988 (Cth) nor the Australian Privacy Principles requires us to give advance notice of changes to this Policy. We give it because we think you should hear about changes that affect you before they take effect, and this clause is not an acknowledgement that any law requires it.

Introducing a practice this Policy already describes is not a change to this Policy. Where we begin to collect information, or to use information for a purpose, that is already disclosed in this Policy — including where we do so by introducing or changing a feature that this Policy describes in general terms — that is not a material change and no further notice is required under this clause, although we may still choose to tell you.

We encourage you to review the Policy periodically for minor or non-material updates.

19. How long we keep your information

We keep personal information only for as long as we need it for the purposes described in this Policy, or for as long as the law requires us to keep it. When we no longer need it, we delete it or remove the details that identify you. The periods below are the ones we currently apply.

Firm business details. Where you deal with us on behalf of a Firm, we record that Firm’s business details, including its trading name and its Australian Business Number (ABN) or Australian Company Number (ACN), so that we can raise valid tax invoices against a recorded identifier. We keep those for a minimum of five years for statutory tax reasons, including after a licence expires or an account associated with the Firm is closed. A Firm may ask us to correct those details at any time (see clause 13). This five-year minimum applies to the business details of a Firm you onboard. It does not apply to an enquiry you send us before any Firm account exists, which is covered immediately below.

Enquiries. If you send us an enquiry through our website, we delete it about 12 months after we receive it. Where an enquiry has led to a Firm account, we may instead remove the details that identify you and keep only a de-identified record that the enquiry was made. You do not need to wait for that period to pass: you may ask us at any time to delete an enquiry you have sent us, by contacting us using the details below, and we will.

Records we keep to operate and secure the Services. We also apply the following periods:

  • security and activity logs — we remove the network (IP) address and browser details from a log entry about 90 days after the event it records, and delete the entry itself about 12 months after that event;
  • links we email you to confirm a change to your account email address — these expire within an hour, and we delete them once they have expired;
  • invitations to join a Firm — these expire after 7 days, and we delete them once they have expired;
  • records of your signed-in sessions — we delete these once they have expired or been revoked; and
  • files deleted from the Services — we remove these from our systems about 30 days after they are deleted.

Where we are required or permitted by law to keep information for longer — for example, to meet a tax, accounting or record-keeping obligation, or to establish or defend a legal claim — we will keep it for as long as that obligation or purpose requires, and then delete it or remove the details that identify you.

20. Contact us

ARCHI UPSKILL Privacy Officer Email: admin@archiupskill.com

ARCHI UPSKILL — Privacy Policy and Consent · Version 3 · 30 September 2026