How data is hosted, secured, backed up and managed across the CAQA LMS website and platform, and the responsibilities clients retain.
This Data Processing and Security Notice explains how CAQA LMS, part of CAQA Groups and a Career Calling International Pty Ltd (ABN 53 162 651 238) initiative, hosts, secures, backs up and manages data across this website and the CAQA LMS platform, and the responsibilities that subscribing organisations retain. It should be read with our Privacy Policy, the LMS Platform Terms and the Subscription Terms.
This notice is written for the organisations CAQA LMS serves: registered training organisations, ELICOS colleges, higher education providers and enterprise learning teams, together with their administrators, compliance staff and the learners whose records are held in a tenant.
For learner records, course content and other information held within a client tenant, the subscribing organisation remains responsible for the lawful collection, accuracy and permitted use of that information under its own privacy and regulatory obligations. CAQA LMS hosts and processes tenant data on the client's behalf to provide learning management platform support, course delivery infrastructure, learner tracking and digital learning administration tools, and does not use tenant data for unrelated purposes.
This website collects only the information you choose to submit through enquiry and contact forms, platform tour requests and newsletter subscriptions, typically your name, organisation, email address and phone number, together with routine analytics information about how the site is used. No learner records are collected through the public pages of this website, and no payments are taken through this website, so no payment card details are collected here.
Within a subscribed tenant, the platform processes the data the client and its users enter, which may include learner enrolment details, contact information, course progress, assessment submissions and outcomes, trainer feedback, communications and audit logs. The categories of data actually held depend on how the client configures and uses its tenant.
Platform data is hosted on reputable commercial infrastructure with physical and environmental safeguards managed by the hosting provider. Where the subscription agreement records specific hosting locations or data residency commitments, those commitments prevail. Clients can ask us to confirm current hosting arrangements before subscribing.
Access to tenant data is restricted through role-based permissions controlled by the client's administrators, and CAQA LMS staff access is limited to personnel who need it to provide support, maintenance and administration. Administrative access is authenticated, logged and reviewed. Each organisation's tenant is logically separated from other tenants.
We maintain routine automated backups of platform data and documented restore procedures, and we test recovery processes periodically. Backups exist to support service continuity and disaster recovery; clients who need point-in-time exports for their own records can request data exports as described below.
If we become aware of a security incident that affects tenant data, we will assess it promptly, take steps to contain and remediate it, and notify the affected client's nominated administrator without undue delay, giving enough detail for the client to meet its own obligations, including any notification duties under the Notifiable Data Breaches scheme. Clients must likewise tell us promptly about suspected compromise of their accounts or misuse of their tenant.
Clients are responsible for granting access only to authorised users, keeping user lists and permissions current, using strong authentication, obtaining any consents needed to collect learner information, entering accurate data, and configuring their tenant in line with their regulatory obligations. Conduct requirements for all users are set out in the Acceptable Use Policy.
While a subscription is active, tenant data is retained under the client's control. When a subscription ends, the client may request an export of its content and records in a reasonable format before access closes, after which tenant data is deleted or de-identified within a reasonable period, subject to backup cycles and any retention required by law.
This notice is general information about our practices and is not legal advice. It does not replace the client's own privacy compliance program, and the signed subscription agreement prevails over this summary if they differ.
If you have questions about this policy, contact the CAQA LMS team by email at info@caqa.com.au, by phone on 1800 266 160, or through our contact page. Our offices are at 2/10 Lawn Court, Craigieburn, Victoria 3064, and we are available Monday to Friday, 9 am to 5 pm.
To Receive Updates And Offers
