The business of GO1 includes an online marketplace for e-learning resources (alongside software and services to produce and deliver such training and resources), which are made available by and through a number of partners, including content sharing partners, distribution partners and implementation partners, (all of whom are referred to as ‘affiliates’ for the purpose of this policy). Where the terms “GO1”, “we”, “us” and “our” are used throughout this policy, they mean GO1 Pty Limited (ABN 91 134 998 020) of Units 4 & 5, 2908 Logan Road, Underwood, Queensland, Australia, 4119 and its related bodies corporate (as that phrase is defined in s50 of the Corporations Act 2001 (Cth), wherever they are located in the world.
We are passionate about lifelong learning, making learning accessible to people in all parts of the world and providing those people with a digital learning record for life. We operate in numerous countries, including Australia, EU countries, the US and several Asian and African countries and are continually expanding our global reach. We acknowledge our obligations to all recipients of our services and products, including visitors to our website at www.go1.com, our registered users (‘learners’) and administrators of our software portals on behalf of learners (‘administrators’) ( collectively, ‘users’) to collect, manage, process and use personal information in accordance with the laws and regulations of each of the countries in which we operate, including the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs), the latest General Data Protection Regulation that applies to the European Union (GDPR) and the California Consumer Privacy Act 2018 (CCPA). Under the CCPA, we are required to provide certain information for Californian residents, which we do in our California Privacy Disclosure.
- what information we collect and why we collect it;
- how we collect, use and secure that information;
- the choices we offer, including how to access and update information;
- international transfers of data, including out of the European Union; and
- how we will respond to data breaches.
What we collect and why
The reasons we collect, store, process and use this kind of information include:
- to identify and authenticate users, including administrators and associated learners;
- to allow users within an organisation (e.g. within an employer) to communicate with each other;
- for support or response purposes, when users request support or make an inquiry;
- to plan, improve, tailor, optimise and promote our products and services for users;
- to provide users with relevant information and offers of courses and other services that we believe might be of interest to users, which we may do by email;
- to manage users’ accounts;
- to send users prizes, certificates or Scholarships™ to use our courses and other services and products;
- to provide learners with a lifelong digital learning record; and
- for contractual and other lawful legitimate business purposes or for the establishment, exercise or defence of legal claims.
We do not collect more data than is necessary for the above purposes.
Our affiliates and other third party service providers to GO1, which may include cloud based customer relationship, content management and hosting services and involve application programming interfaces, are also given access to some or all of the above information for similar purposes. For example:
- our course content providers may have access to names of learners enrolled in the providers’ courses;
- our distribution partners, who offer our content for sale through their own platforms or who otherwise integrate with our software, may collect and handle the same enrolment information as well as other information concerning the learning activities and course completion progress of learners in relation to courses that have been accessed via our distribution partners’ websites; and
- our implementation partners may have access to the information we collect for the purpose of assisting us and our distribution partners to develop our systems to offer and deliver our products and services.
All such third parties are bound by the same laws and regulations that we are, wherever they are located in the world, and we require them to adopt and apply data protection policies and practices that are consistent with this policy.
Users need to understand that their choice not to provide certain personal information, as described above, will limit or prevent their ability to access and use our products and services.
How we collect information
We ordinarily ask for consent from users to collect, process, manage, store and use personal information, as set out in this policy, including when users purchase or request a trial of our products or services, as a prerequisite to such purchase, trial and use. This is ordinarily done on-line, as part of registration (including for trial purposes) or of course enrolment. When users ‘get in touch’ with us via the contact page on our website or directly to firstname.lastname@example.org they will voluntarily provide the kind of information set out above.
How long we hold information
We hold information only for so long as is necessary for the purposes set out above; in this, we are guided by our contractual obligations and by other lawful legitimate business interests. For example, we commit to learners that we will retain their digital learning record for life, as part of our service. If, at any time, a learner wishes us to delete or transfer their learning record, they may do so as set out below.
Accessing, updating and deleting personal information
Upon registration, administrators and learners have ongoing access to their online accounts, within which they can correct inaccuracies or update or add information. Additionally, they (and other users such as those who trial our products and services) can request us, via email@example.com to:
- make changes to their accounts, including to personal information;
- send to them, or to transmit to another controller, all of their stored personal information (in which case we will do so in a structured, commonly used and machine-readable format);
- restrict processing of specific personal information; or
- delete information.
Similarly, users may withdraw their consent for us to hold any or all of their personal information by request to firstname.lastname@example.org and may unsubscribe to any or all emails through the automated facility sent with each email.
As mentioned above, these actions or requests will limit the ability of users to access and use our products and services.
It may be the case that, for contractual or other lawful legitimate business purposes, we retain and use an archived version of users’ personal information, which may be pseudonymised, anonymised or otherwise de-identified.
We have facilities in place to request affiliates and other third parties, as necessary, to amend or delete personal information held on their systems.
We work hard to protect GO1 and our users from misuse, interference, loss, unauthorised access, modification or disclosure of information we hold. In doing so, we apply technical and organisational measures to ensure a level of security appropriate to the risk including:
- analysing and assessing privacy and security issues, risks and impacts during the design and development of new features and solutions for our products, services and delivery platform, governed by guidelines and security standards for our IT developers;
- ensuring confidentiality, integrity, availability and resilience of processing systems and services (for instance, we restrict access to personal information to GO1 employees, contractors, affiliates and other third parties described above, who need the information for the purposes described above and who are subject to strict contractual privacy and confidentiality obligations);
- the ability to promptly restore availability and access to personal data in the event of an incident;
- regular review and testing of our information collection, storage and processing practices, including physical security measures, aimed to ensure security of data processing; and
- as we deem necessary, pseudonymisation and encryption (e.g. using SSL) of data; for example, for the purpose of transfers, when data is encrypted and access is restricted at rest.
We are guided in these activities by ISO/IEC 27001:2013, the international standard that describes best practice for an information security management system and by the ‘Guide to securing personal information (‘Reasonable steps’ to protect personal information)’, dated January 2015, issued by the Office of the Australian Information Commissioner.
Given that GO1 operates internationally, personal information of users may be transferred across national and continental borders, including for contractual and other lawful legitimate business purposes or at the request of users. Within the GO1 organisation, such international transfers are governed by internal controls and rules, consistent with this policy and the relevant legislation and regulation, including the GDPR.
For such international transfers within GO1 and to and from affiliates and other third parties, GO1 has in place enforceable agreements containing privacy and data protection obligations consistent with this policy and the relevant legislation and regulation, including the GDPR.
GO1 utilises Amazon Web Services (AWS) and Microsoft Azure (Azure) in its operations and to process and transfer data.
GO1 has Data Processing Agreements in place with AWS and Azure, including Model Clauses (clauses that make specific guarantees around transfers of personal data in compliance with the GDPR), which enable GO1 to transfer personal data outside the European Economic Area (EEA) to any countries with the knowledge that personal data will be given the same level of protection it receives in the EEA.
Both Amazon.com, Inc. (AWS) and Microsoft Corporation (Azure) are certified under the EU-US Privacy Shield, which means that GO1 can transfer personal data from the EU to the US in a compliant way. These certifications can be found at the EU-US Privacy Shield website: https://www.privacyshield.gov/list
Cookies and log files
We allow limited use of various technologies to collect and store information when users visit our website; this may include using cookies (i.e. a string of unique data that a website stores on a user’s computer and that the user’s browser provides to the website each time the user returns) or similar technologies to identify the user’s browser or device. For example, at the time of publication of this policy, we use Intercom (for our support tools, including chat within an organisation of learners) and Google analytics and mix panel (for website traffic metrics and analytics). This helps us to optimise our users’ experience and to continually improve and tailor our products and services for users.
Users may set their browser to block all cookies or to indicate when a cookie is being set.
We automatically log IP addresses, browser types and dates/times, which assist with our support efforts, diagnoses of user-initiated issues and queries, and audits for security purposes.
We acknowledge the various data breach obligations in each of the jurisdictions in which we operate, including in Australia. We commit to promptly identify and respond to any breaches, to act to prevent harm and to report, if and as required, to the relevant supervisory authority and users.
Complaints, inquiries and requests
As mentioned above, requests to access, update, restrict or delete personal information can be made to email@example.com.
Last updated: 4 February 2020