This privacy policy applies to information collected by EdUP Solutions Pty Ltd (ACN 679 333 594), including through https://upval.com and associated sites and services (collectively, the UpVal Platform).
The purpose of this privacy policy is to set out what personal information will be collected, how it will be used and disclosed, how it will be protected, and your rights in relation to your personal information.
In addition to complying with our privacy obligations under the Australian Privacy Act 1988 (Cth), to the extent that we collect personal information about individuals residing in the UK or European Union, we are a data controller for the purpose of the UK Data Protection Act 2018 and EU General Data Protection Regulation (EU) 2016/679 (GDPR).
Please read this privacy policy carefully. By using the UpVal Platform or otherwise providing your personal information to us, you acknowledge that you have read and understood this privacy policy and that you agree to its terms.
We may update this privacy policy from time to time. If we make significant or material changes, we will provide you with reasonable notice of the changes by email or other means as may be appropriate. To the extent permitted under applicable law, by accessing the Platform or otherwise engaging with us after such notice period, you will be deemed to have accepted the changes to this privacy policy. If you do not agree to any change, you must notify us and immediately cease your engagement with our services.
Personal information for a specified purpose: The type of personal information we collect depends on the purpose for collection and circumstances of collection, but may include:
Student data: UpVal is used by schools and educational organisations to manage student awards and recognition programs. Personal information relating to students is collected and processed on behalf of the organisation (school) using the Platform, which acts as the data controller for that student data. We process such data only as directed by the organisation and in accordance with this privacy policy and any applicable data processing agreement.
Special categories of personal information: Generally, we do not collect any special categories of personal information, such as information that reveals racial or ethnic origin, political opinions, religious or philosophical belief, trade union membership, genetic data, biometric data, health status, sex life or sexual orientation. However, if such information is required, we will only collect and process this type of personal information with your express consent and for the purposes set out in this privacy policy.
In most cases, the information we process will be collected directly from you or your organisation for one or more of the following reasons:
Under the GDPR, the lawful bases we rely on for processing personal information are as follows.
Where you have given your consent: This applies where you have freely given an informed, specific and unambiguous indication that we are permitted to collect and process your personal information in accordance with this privacy policy.
At any time, you may revoke your consent to the processing of some or all of your personal information by emailing us at hello@upval.com or using the “unsubscribe” function in any communication that we send to you.
If you revoke your consent, we may have to terminate services if consent is the only legal basis for our processing of your personal information. The withdrawal of your consent will not affect processing of personal information that occurs before you notify us that you have withdrawn your consent.
For our legitimate business interests: This applies where the processing of your personal information is necessary for us to deliver products and services to you.
In general, we will let you know at the time of collection whether the provision of personal information to us is optional or whether it is required. If we have indicated that the requested personal information is required and you do not provide it, we may not be able to provide you with products and services.
We use third party providers to deliver services and perform certain functions on our behalf. We may share your personal information with the third parties we work with and/or who provide us with services or perform functions on our behalf. These third parties include:
We may also disclose your personal information to a third party if such disclosure is necessary to:
We generally hold your information in Australia. This means that if you are an EU resident, your personal information may be transferred and stored outside the European Economic Area.
Because of the international nature of EdUP Solutions’ activities, certain personal information may be transferred to third countries, including the United States, for storage and other processing in accordance with the purposes set out in this privacy policy. Where information is transferred outside of the European Economic Area it will be:
Our services or websites may contain links or references to third-party websites, products and services. Information collected by such third parties, which may include your location data or contact details, is governed by that third party’s privacy practices or policies. We recommend that you check the privacy policies of those third parties. We accept no responsibility or liability for any third party’s practices or policies or your provision of personal information to them.
To help prevent unauthorised access, maintain data accuracy, and ensure the correct use of personal information, we take reasonable steps to put in place appropriate technical and organisational measures to safeguard and secure the information we collect. Each organisation’s data is stored in an isolated database environment to prevent cross-organisation data access. We also take reasonable steps to ensure our third party providers are required to protect personal information in accordance with applicable privacy laws and to a no less onerous standard as set out in this privacy policy.
Given the nature of the internet we cannot guarantee security of information transmitted through the internet. We will do our best to protect your personal information, however any transmission is at your own risk.
We will only retain your personal information for as long as it is needed for the purpose for which it was collected (or any other purpose you have consented to) or for so long as we are required by law to retain it. After such time we will securely dispose of your personal information by deleting it from our servers. We may retain anonymised and/or de-identified data for statistical, research or other analytical purposes.
Organisation and award data will be retained while your organisation’s account is active. Upon account deletion, we will make reasonable efforts to delete your data within 30 days, though backup copies may persist briefly.
Account information is kept while your account is active and potentially up to 7 years after deletion to meet legal requirements, resolve disputes, or enforce agreements.
Marketing data is retained until you unsubscribe.
Log data is typically retained for up to 90 days for security and analytics purposes.
Under privacy law, you have certain rights in relation to the personal information we hold about you. We set out these rights and how to exercise them below. Some of these rights only apply in certain circumstances and to certain individuals under the applicable laws of their jurisdiction.
You have the right to know whether we hold and process personal information about you, and if we do, to access the personal information we hold about you and certain information about how we use it and who we share it with.
You may correct any personal information we hold about you that is inaccurate. You may have incomplete personal information we hold about you completed, including by means of a supplementary statement (taking into account the purposes of processing). During the period while we assess whether the personal information we hold about you is inaccurate or incomplete, you may exercise your right to restrict our processing of the applicable data as described below.
You may request that we delete the personal information we hold about you in the following circumstances:
During the period while we consider your request for erasure, you may exercise your right to restrict our processing of the personal information as described below.
Please note that after we delete your personal information, we may not be able to facilitate any further involvement with our services.
You may have a right to restrict our processing of your personal information in certain circumstances. However, we may use the personal information again if there are valid grounds under applicable privacy law for us to do so (e.g., for the defence of legal claims or for another individual’s protection).
You may request we restrict processing and just store the personal information we hold about you where:
You may have the right to receive the personal information that we collect from you in a structured, commonly used and machine-readable format and a right to request that we transmit such personal information to another party, where technically feasible.
If you wish for us to transfer the personal information we hold about you to another party, please ensure you provide the complete and accurate details of that party. We are not responsible for the security of the personal information or its processing once received by the third party.
We do not undertake any automated processing of personal information, including profiling, which produces legal effects or similarly significantly affects any individual.
We will respond to any request to exercise the above rights without undue delay and at least within one month (although this may be extended in certain circumstances if permitted by applicable law). You must provide us with proof of identity before we can respond to any request to exercise your rights. Where we refuse any request, you have the right to make a complaint to us or to your local data protection authority.
To exercise these rights, contact us with your name, contact details (email and phone number), and a clear description of your request at hello@upval.com.
All personal information collected, used and disclosed in connection with UpVal and associated products and services will be held by EdUP Solutions Pty Ltd (ACN 679 333 594), an Australian company with a registered office at 90 Howard Avenue, Dee Why NSW, Australia, 2099.
If you have any questions about this privacy policy or wish to make a complaint about our privacy practices, you can contact us by email at hello@upval.com.
If we are unable to satisfactorily resolve your concerns about our handling of your personal information, you can contact your local data protection authority or the Office of the Australian Information Commissioner at: GPO Box 5218, Sydney NSW 2001, or via their website at https://www.oaic.gov.au/
Last updated: 13 Apr 2026