Data Processing Addendum

1. Scope

This Data Processing Addendum (DPA) applies when Better Tuition Academy ("BTA", "we", "us") processes personal information on behalf of a customer (parent, student or guardian) in connection with the BTA Tutor Portal service. It is intended to support compliance with the Privacy Act 1988 (Cth), the Australian Privacy Principles (APPs), and to provide equivalent protections to those set out under article 28 of the GDPR for customers located outside Australia.

2. Roles

For most personal information collected directly from parents and students (names, contact details, academic records, lesson history) BTA is the APP entity / data controller. For limited categories - notably AI-assisted study artefacts that students generate - BTA acts as processor of student-submitted content on behalf of the family.

3. Categories of personal information

• Identification + contact: full name, email address, mobile phone, postal address.
• Family relationships: links between parent, child, sibling and primary contact records.
• Academic: year level, school, subjects, lesson attendance, homework submissions, exam scores, tutor commentary.
• Operational: lesson schedules, billing transactions, communication preferences, cancellation history.
• Engagement telemetry: pseudonymised analytics events (under-13 users excluded at the application layer).
• Safeguarding: working-with-children check (WWCC) numbers for staff, child safety incident records.

4. Sub-processors

BTA engages the following sub-processors to deliver the service. Updates to this list will be reflected here within 30 days of any change.

• Supabase (database + auth + storage; Sydney, Australia (AWS ap-southeast-2)).
• Vercel (hosting + edge network; Sydney, Australia (syd1)).
• Anthropic (AI processing of tutoring artefacts; does not retain prompts by default).
• Resend (transactional email).
• Twilio (SMS reminders + notifications).
• Stripe (subscription billing).
• Pinch Payments (BECS direct debit).
• Sentry (error monitoring).

5. Security measures

• Row-level security policies on every customer-facing database table.
• TLS for all data in transit; managed encryption at rest via Supabase.
• Role-based access control with admin / receptionist / finance / marketing / compliance roles and an audit log for sensitive actions.
• Daily managed backups; documented disaster-recovery procedure (see internal runbook).
• Mandatory WWCC for staff handling under-18 personal information.
• Under-13 users are excluded from analytics events and operate behind explicit parental consent (APP 3).

6. Data subject rights

Parents (on behalf of their family) and any individual whose personal information BTA holds may request access, correction, deletion or export of that information. Export is self-service from Settings → Privacy; other requests should be sent to privacy@xtutio.com and will be actioned within 30 days.

7. Breach notification

BTA will notify affected customers and, where legally required, the Office of the Australian Information Commissioner (OAIC), within 72 hours of becoming aware of an eligible data breach as defined under the Notifiable Data Breaches scheme.

8. International transfers

Some sub-processors store data outside Australia (notably Anthropic, Resend, Stripe and Sentry in the United States). BTA relies on contractual safeguards comparable to APP 8.2(b) for these transfers.

9. Term + return

Upon termination of a customer's account, personal information is retained for 30 days to allow reactivation, then deleted in accordance with the Privacy Policy. Financial records required by Australian tax law are retained separately for 7 years.

10. Contact

Privacy officer: privacy@xtutio.com. Postal correspondence may be addressed to the XTutio operating company, Sydney, NSW, Australia.