Privacy Policy

1. Who we are

School Sport Portal is operated by Luck Dragon Pty Ltd (ABN 64 697 434 898), a company incorporated in Victoria, Australia. Our services include sportportal.com.au, schoolsportportal.com.au, and carnivaltiming.com.

We are subject to the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs).

Contact: privacy@schoolsportportal.com.au

2. What information we collect

School and coordinator accounts

• First name and last name of the account holder
• School name, state, and region
• Work email address
• Role (school coordinator, district coordinator, etc.)

Student records (entered by school coordinators)

• First name and year group (e.g. "Year 5")
• House / team affiliation
• Event entries and results

We do not collect: birthdates, home addresses, parent/guardian details, health or medical information, photos, or any government identifiers.

Usage and technical data

• IP address (retained for 30 days for security purposes only)
• Browser type and device type
• Pages visited and features used (aggregated, not linked to individuals)

Payment data

Payment processing is handled by Stripe, Inc. We do not store credit card numbers. Stripe's privacy policy: stripe.com/au/privacy.

3. How we use your information

• To operate and provide the School Sport Portal service
• To manage your account and process payments
• To send transactional emails (event results, account notices) — no marketing without consent
• To generate carnival programs, draw sheets, and results reports for your school
• To improve and develop the Service using aggregated, de-identified analytics
• To meet our legal obligations

We do not use personal information for advertising, profiling, or automated decision-making.

4. Data storage and security

Data is stored in Google Cloud Firestore infrastructure located in Australia (australia-southeast1 — Sydney). We use Google Cloud Platform's security controls, including encryption in transit (TLS 1.2+) and encryption at rest. Data localisation in Australia is consistent with Victorian DET Information Privacy Principle 9 (IPP 9).

Access controls ensure that:

• School coordinators can only access their own school's data
• District coordinators can only access schools within their district
• Region coordinators can only access divisions within their region
• No cross-school data is visible to other schools

We conduct regular security reviews. In the event of a data breach likely to result in serious harm, we will notify affected individuals and the OAIC as required by the Notifiable Data Breaches scheme.

5. Who we share data with

We do not sell, rent, or trade personal information. We only share data with:

• Google LLC — cloud infrastructure (Firebase / GCP), subject to Google's Data Processing Addendum
• Stripe, Inc. — payment processing only
• Resend — transactional email delivery (school addresses only, no student data)
• Cloudflare, Inc. — CDN and DDoS protection

All sub-processors are required to handle data in accordance with applicable privacy laws.

6. Your rights under the Privacy Act

Under the Australian Privacy Principles, you have the right to access, correct, request deletion of, and complain about handling of your personal information.

To exercise any of these rights, email privacy@schoolsportportal.com.au. We will respond within 30 days. Complaints may be lodged with the OAIC at oaic.gov.au.

7. Cookies and tracking

We use a small number of functional cookies required for login sessions. We do not use tracking cookies, advertising cookies, or third-party analytics that link to individual users.

8. Children's privacy

School Sport Portal collects limited information about students (first name and year group only) as entered by school staff. We do not collect information directly from students, and we do not allow students to create accounts.

9. Retention and deletion

We retain account data for as long as your account is active, plus a 90-day grace period after cancellation. Student event records are deleted within 90 days of account closure. IP and security logs are retained for 30 days.

You may request immediate deletion at any time by emailing privacy@schoolsportportal.com.au.

10. Changes to this policy

Material changes will be notified to account holders by email at least 14 days before they take effect. The current version will always be available at schoolsportportal.com.au/privacy.