Privacy Policy
Effective Date: 15 April 2026 | Version 1.1
1. Introduction and Scope
2. Categories of Personal Data Collected
2.1 Application Data
Full official name, preferred or display name, email address, phone number, city, state or region, country, graduation year, set identifier, alternate school name on record (if applicable), verification notes or context, referral source, profession, employer, short bio, areas of interest, and privacy/visibility preferences. This data is collected at the point of application submission and is used for identity verification, membership review, and — if the application is approved — to populate your initial member profile.
2.2 Account and Authentication Data
Email address, password (stored only in hashed form), TOTP multi-factor authentication enrolment data, and session tokens. Account data is created only after an application is approved and the applicant redeems a personal invitation. The Platform does not support Google sign-in or any third-party social authentication. Authentication is exclusively via email/password with mandatory TOTP-based MFA.
2.3 Alumni Verification and Identity Data
Full official name, graduation year, set identifier, alternate school name on record (if applicable), verification notes or context provided to assist the review process, referral source, and roster-claim information. This data is collected to verify your identity as a legitimate alumnus/alumna of Ajara Grammar School and to administer your membership.
2.4 Contact Data
Phone number, city, state or region, and country. This data enables the Association to communicate with you and supports geographic organisation of members.
2.5 Profile and Directory Data
Profession, employer or organisation, biographical summary, profile photograph (collected only after account activation, not at application stage), and areas of interest or engagement preferences. This data supports the alumni directory, networking features, and community engagement. All profile and directory data is voluntary.
2.6 Privacy and Communication Preferences
Your choices regarding profile visibility, contact information visibility, professional information visibility, and communication channel preferences. These preferences control how your information appears to other members and how the Association contacts you.
2.7 Consent and Acknowledgement Records
Timestamps, document version references, declaration type identifiers, action context labels, IP addresses, user agent strings, applicant email, and application identifiers associated with your acknowledgement of this Privacy Policy, the Terms of Use, Community Rules, Application Privacy Notice, accuracy declarations, and verification review acknowledgements. These records are maintained for legal compliance and accountability. Consent records are captured at the point of application submission — before any user account exists — and are linked to the application record and applicant email address.
2.8 Invitation and Activation Data
Invitation tokens, issuance timestamps, expiry timestamps, usage timestamps, revocation records, and activation state. This data is generated when an application is approved and an invitation is issued, and is used to manage the secure account activation process.
2.9 Membership Agreement Execution Records
When you execute the Membership Agreement during account activation, an immutable execution record is created containing your full name, membership code, graduation year, agreement version, incorporated document version identifiers, execution timestamp, IP address, and user agent string. This record serves as durable evidence of your acceptance of the Membership Agreement and all incorporated documents. Execution records cannot be modified or deleted.
2.10 Administrative and Security Data
Application submission timestamps, application status history, verification decision records, reviewer identifiers, review notes, membership status change history, membership validity and standing records, recertification request history, IP addresses and user agent strings recorded at the time of consent, access logs, and MFA enrolment metadata. This data supports platform security, audit requirements, and governance functions.
3. How Your Data Is Used
3.1 Application Review and Membership Verification
To review your membership application, verify your identity as a genuine alumnus/alumna of Ajara Grammar School by reviewing submitted identity information against available records, roster data, and contextual evidence, and to communicate the outcome of the review process.
3.2 Invitation and Account Activation
To issue a secure, time-limited, personal invitation upon application approval; to facilitate account creation including password setup and mandatory TOTP MFA enrolment; to present and record your execution of the Membership Agreement; and to transition your application data into your member profile upon successful activation.
3.3 Membership Administration
To manage your membership status, assign membership codes (format: ALM-YYYY-NNNN), maintain membership records, administer membership validity cycles and standing, process recertification requests, process status changes, and administer the membership lifecycle including verification, suspension, reactivation, and deactivation.
3.4 Alumni Directory and Community Features
To populate your member profile within the alumni directory and enable community features such as set-based networking, professional connections, and engagement opportunities — subject to your privacy and visibility settings.
3.5 Communication
To send you application status notifications, invitation and activation emails, executed agreement copies, important membership notices, recertification reminders, Association governance communications, and platform operations updates. Optional engagement and marketing communications are sent only with your explicit consent and can be withdrawn at any time.
3.6 Governance and Institutional Functions
To support Association governance activities including elections, resolutions, committee operations, and formal decision-making processes where membership verification is required.
3.7 Platform Security and Integrity
To protect the Platform against unauthorised access, prevent fraud and abuse, enforce the Terms of Use and Community Rules, manage MFA verification, and maintain the integrity of Association records.
3.8 Legal and Regulatory Compliance
To comply with applicable laws, respond to lawful requests from authorities, establish or defend legal claims, and maintain records required for the Association's legal and regulatory obligations.
4. Visibility and Privacy Settings
5. Application-Stage Data Handling
6. Internal Access and Role-Based Handling
7. Data Retention
8. Your Rights
8.1 Access and Correction
You may access your personal data through your account settings at any time. You may update or correct inaccurate information directly through the Platform or by contacting the Association.
8.2 Data Export
You may request a machine-readable export of the personal data you have submitted to the Platform. Export requests will be fulfilled within a reasonable timeframe.
8.3 Deletion
You may request deletion of your account and associated personal data. Deletion is subject to the retention limitations described in Section 7, and certain data may be retained in anonymised or aggregated form, or where retention is required for legal, governance, or recordkeeping purposes.
8.4 Withdrawal of Consent
Where processing is based on your consent (such as optional communications), you may withdraw consent at any time. Withdrawal of consent does not affect the lawfulness of processing carried out before withdrawal.