Privacy impact assessments

What this register is

Kestrel stores the records of school students, and children use parts of it. Hoverpoint Pty Ltd, which provides Kestrel, is bound by the OAIC's Children's Online Privacy Code, made under the Privacy Act 1988. The Code asks for a privacy impact assessment before a service or a change that affects children's privacy, and for a published register of those assessments. This page is that register.

When Hoverpoint makes an assessment

Hoverpoint has assessed Kestrel as it stands, and assesses the privacy impact on children of each of these before it is released:

s38(1)(a)

A new service or activity that children are likely to use, or that is primarily concerned with their activities.

s38(1)(b)

A new or changed way of handling personal information in an existing service that is likely to have a significant impact on children's privacy.

Planning a change to Kestrel asks whether it needs an assessment, and a change that needs one is released with its assessment on this register.

What each assessment covers

Each assessment answers the six things section 38(2) of the Code asks for.

(a) Nature, scope, context, flows and purposes

What the service does, whose information it handles, who uses it, where the information comes from and goes, and what each part of it is for.

(b) Why the handling is strictly necessary

Why each class of information about a child is needed to provide the service, and what is deliberately left uncollected.

(c) Lawful and fair means

How the information is collected, from whom, and what the person is told.

(d) The best interests of the child

Whether the handling is consistent with the best interests of the child, and the reasoning the finding rests on.

(e) Compliance with the Code and the Act

How the service meets the Children's Online Privacy Code and the Australian Privacy Principles.

(f) Risk of harm to children

What could go wrong for a child, how likely and how serious it is, and what reduces it.

The risks of harm it weighs include physical, emotional, developmental and material harm to a child.

The register

PIA-043: Removing the records of applicants who never enrol

Putting down the records of the children who enquired or applied and never started, on periods the school sets: two per outcome, one for the documents, the health and learning answers and the notes, and one for the whole record, bounded at thirty days and seven years. A monthly pass marks each record whose period has run out and the nightly disposal reaps it, a fortnight's notice in counts comes first, a legal hold or a registrar's keep stops it, a statutory class is a floor it will not cross, and a family can ask for a child's record to be destroyed that night. What is left of a removed application is a line of counts with no name and a receipt for a paid fee with no child.Finding Removing the records of applicants who never enrol is consistent with the best interests of the child, and keeping them indefinitely was not. A child who looked at a school and went elsewhere has no continuing relationship with it, and the school has no purpose that needs that child's health answers, learning needs or an interviewer's opinion. The three ways removal could itself harm a child are built out: a thirty-day floor and a registrar's keep protect a record the family still needs, a statutory class is a floor the pass will not cross so a child-protection record is left and raised, and a person goes only where their last reason to be on the record goes with it. A line of counts standing for a single application keeps a medium residual.Under s38(1)(b)Assessed 16 October 2026By Hoverpoint Pty Ltd

PIA-042: References and specialists' reports about an applicant

Asking a person who knows a child applying for a reference, or a specialist for a report, with the family's consent or from a family's nomination the registrar confirms, and the person answering on a page at the school's own address without an account. The person reads the child's name, year of entry and the school's questions only after verifying their address with a code. A specialist's report is kept restricted, and a family reads each request's state and a reply only where the school shared it.Finding The handling of children's information in references and specialists' reports is consistent with the best interests of the child. It asks only with the family's consent or nomination, names the child to the person only after they verify their address, stores no link secret, keeps a specialist's report at the restricted tier behind a grant the school chooses, audits each read, and strips the answers twelve months after the child starts. A School only reference is an opinion the family cannot read, and that risk keeps a medium residual.Under s38(1)(b)Assessed 14 October 2026By Hoverpoint Pty Ltd

PIA-041: Open days and expos, with check-in and follow-up

Booking a family onto a school's open day, expo stand, information evening or online session from the school's page, the office, the desk, a kiosk at a stand or a poster, checking each person in on the day, and the emails that follow. A booking names one adult with an email or phone, the children and a head count, and finds a family already on the register before anyone is created. A helper at the desk reads the names and desk codes and no email or phone, name labels show a name and the desk code, and a family that did not come is invited to book again only with its own consent to enrolment news.Finding The handling of children's information at open days and expos is consistent with the best interests of the child. It asks for what an enquiry asks for, finds a family already known before creating anyone, shows a helper names and no contact point, answers each booking on the school's page alike, keeps only a hash of each QR code, loads no tag and sends the invitation to book again only with the family's own consent. A name label on a child is read by anyone at the event, and that risk keeps a medium residual.Under s38(1)(b)Assessed 14 October 2026By Hoverpoint Pty Ltd

PIA-040: Applications, enrolments and starters through the API

Another admissions system sending applications, starts, withdrawals and enrolments into Kestrel under a token with application.write, and a school's own SIS reading the children starting at the school under a token with starter.read. A write names the child, the adults and the place, and a person sent without an id who may already be on file stops the write with the ids of the records they may be. The read names each starter's identity, start day and placement, and the adults with standing on them and the adult who applied, with their email and mobile.Finding The handling of children's information in sending applications and enrolments through the API, and reading starters from it, is consistent with the best interests of the child. It collects what the office's own forms collect, stops on a possible match for the sender to choose, never updates a person it found, leaves out each protected child and each protected adult's contact points, and audits each call against each person it is about. The adult who applied is sent before the school checks their standing, and that risk keeps a medium residual.Under s38(1)(b)Assessed 13 October 2026By Hoverpoint Pty Ltd

PIA-039: Exporting a Common Transfer File in England

Writing the Common Transfer File for a pupil who has left a school in England, for the registrar to upload to the Department for Education's School to School service. The file names the pupil's UPN, ULN, names, date of birth, sex, last year level, address, telephone numbers and email, and each adult contact with their relationship, parental responsibility, address, telephone numbers and email. It is written from the record as at the download, checked against the schema, saved in the registrar's browser and audited against the pupil. Kestrel stores no copy and sends it nowhere.Finding The handling of children's information in exporting a Common Transfer File is consistent with the best interests of the child. It writes only what the specification asks for and the school already records, leaves out each protected address and number, names no attendance, special educational needs or results, stores no copy of the file, sends it nowhere, and audits each download against the pupil. The next school receives no attendance or special educational needs history from the file, and that risk keeps a medium residual.Under s38(1)(b)Assessed 12 October 2026By Hoverpoint Pty Ltd

PIA-038: Importing a Common Transfer File in England

Starting a pupil at a school in England from the Common Transfer File their previous school sent. The file is read in the registrar's browser and not stored, and the registrar ticks which of the pupil's sex, UPN, ULN, preferred name, address and contacts to record. Each part is written through the person record's own writes. The pupil's attendance, special educational needs and key stage results are shown to read and not stored.Finding The handling of children's information in importing a Common Transfer File is consistent with the best interests of the child. It records only what Kestrel records for a pupil started by hand, lets the registrar leave out each part, stores no copy of the file, and sends none of the special educational needs, attendance or results to the server. The special educational needs are read and not recorded, and that risk keeps a medium residual.Under s38(1)(b)Assessed 12 October 2026By Hoverpoint Pty Ltd

PIA-037: A nursery child's funded early education in England

The funded early education a school in England that is a funded provider records for each nursery child: the universal, extended and expanded hours a week and the weeks each is funded for, the 30 hours eligibility code, whether the child receives the early years pupil premium and its basis, whether the child receives the disability access fund, and the hours the child attends. It covers the school's setting that turns the record on, the one grant the registrar has, the section on the child's record, the read model the early years census reads, and the census file the school sends its local authority.Finding The handling of children's information in funded early education is consistent with the best interests of the child. It records what the census asks for and no benefit or diagnosis, reaches only the registrar who makes the claim, names no child in anything it sends, and is kept for as long as the school keeps the record of what it claimed. Withdrawing a child does not end their entitlement, and that risk keeps a medium residual.Under s38(1)(b)Assessed 12 October 2026By Hoverpoint Pty Ltd

PIA-036: A pupil's looked-after and young-carer status in England

Recording that a pupil at a school in England is looked after by a local authority, with the authority named, or is a young carer, with whether a parent or guardian or the school identified them, each with the day it began and ended. It covers the Care status section on the pupil's record and the staff roles that reach it, the change that ends a status and opens the next, and the read model that answers, for some pupils on a day, which are looked after and which are young carers, with no authority and no dates.Finding The handling of children's information in a pupil's looked-after and young-carer status is consistent with the best interests of the child. It records the two facts the census asks for and no reason or detail behind them, reaches only the staff who keep the SEND register, names no child in anything it sends, and answers the census's question with no authority and no dates. A status stays recorded until a member of staff ends it, and that risk keeps a medium residual.Under s38(1)(b)Assessed 12 October 2026By Hoverpoint Pty Ltd

PIA-035: Allegations against an adult in England

An allegation that an adult working with a school's children in England has harmed a child, recorded as a child-safety concern under Keeping Children Safe in Education: the case manager and the deputy case manager who open it, the referral to the local authority designated officer due within one working day and the local authority it went to, which of the five outcomes it ended in, and the chair of governors or the proprietor who alone takes an allegation about the case manager.Finding The handling of children's information in an allegation against an adult is consistent with the best interests of the child. It records what was received under the existing seal, refers the allegation to the local authority designated officer on time, keeps an allegation about the head from the head, and sends nothing. The chair of governors or the proprietor reads each concern the school records, and that risk keeps a medium residual.Under s38(1)(b)Assessed 12 October 2026By Hoverpoint Pty Ltd

PIA-034: Exam entries, coursework marks and an awarding body's results, England

The entries an exams officer at a school in England makes for an awarding body's GCSE and A level series and the entries file sent to it, the coursework marks the school's teachers awarded for that series' components and the marks file sent with them, and the results the body sends back on results day. It covers each file's validation and what is kept of a file sent so an amendment can be made, the refusal of a results file written for another centre, matching a result to a student by the UCI and then by the candidate number open for the series, the one row kept for each result when a corrected file is loaded, and the role or staff who reach each side of the exchange.Finding The handling of children's information in the exam entries, the coursework marks and the awarding body's results is consistent with the best interests of the child. An entries file sends an awarding body only the fields the common format requires and names the candidate and the field before a file with a fault exists; a marks file identifies a candidate by the number the school allocated and states the mark the teacher recorded, refusing one it would have to round; a results file for another centre is refused whole, and a result that names no student or two is reported and never written. Each side reaches only the staff who already keep the candidate's numbers or read the markbook and transcript, one student at a time. A file downloaded and sent to the wrong body is outside what Kestrel can stop, and that risk is low.Under s38(1)(b)Assessed 10 October 2026By Hoverpoint Pty Ltd

PIA-033: Privacy request deadlines by jurisdiction

The privacy register's answer dates, now set by the law where the school is: thirty days, extendable to sixty, for an Australian school, and one calendar month, extendable by two more, for a school in England, which moves when the school records the reply to a question about who is asking or what the request covers. Also the Privacy officer role, the one shipped role that keeps the register, and the line on the morning list for a request due within the week.Finding The handling of children's information in the privacy register is consistent with the best interests of the child. Each request is answered within the period the school's law sets, the register is kept to the role the school names for it, and the line on the morning list names a reference and a date and no person. A findings reader can see a request's reference and its answer date, and that risk is low.Under s38(1)(b)Assessed 10 October 2026By Hoverpoint Pty Ltd

PIA-032: A pupil's ethnicity and first language in England

Recording an English pupil's ethnic group and first language in the codes the DfE's school census asks for. It covers the DfE's code lists shipped as reference data keyed to one country, so a school is offered its own return's question and neither the Australian nor the English question reaches the other's schools; the pupil's own ethnic group as a sealed column at the strictest tier, validated against the school's code table inside the write transaction and read one pupil at a time; and England's first language as the existing language-at-home column under its own label.Finding The handling of children's information in the ethnic group and the first language is consistent with the best interests of the child. An English school owes the DfE a return that asks for both, the answer is the family's own in the DfE's codes with a way of declining, and the ethnic group is sealed at the strictest tier the register has, so it cannot be indexed, sorted, searched or listed and is read only on the pupil's own census section by a reader holding the restricted capability.Under s38(1)(b)Assessed 10 October 2026By Hoverpoint Pty Ltd

PIA-031: England's SEND register

The register a school in England keeps of its pupils with special educational needs and disabilities: each pupil's provision, SEN support or an EHC plan, the primary need and any secondary need from the DfE's list, the day each provision began and ended, the local authority that issued a plan, the staff roles that reach it, and the screen and the section on the pupil's record it is kept from.Finding The handling of children's information in England's SEND register is consistent with the best interests of the child. It records the census's types of need and no diagnosis, reaches only the staff who keep the NCCD register, names no child in anything it sends, and keeps the record for the term an English school keeps a pupil's SEN file. A plan's annual review is not shown as due, and that risk keeps a medium residual.Under s38(1)(b)Assessed 10 October 2026By Hoverpoint Pty Ltd

PIA-030: England's pre-employment checks

The checks a school in England records of the adults who work with its children under Keeping Children Safe in Education: identity, enhanced DBS, the children's barred list, prohibition from teaching, section 128, right to work, an overseas criminal record check, qualifications and references, each with its certificate number, the day it was seen and who saw it. It covers the duties the office marks on a position, employed to teach or in a management position, which decide who needs the prohibition and the section 128 checks, and how cleared to work is derived from each required check.Finding The handling of England's pre-employment checks is consistent with the best interests of the child. It records nothing about a child and serves the child's safety: an adult is shown as cleared to work only once each check required of them is current, an interim or a barred outcome keeps them from being cleared, and an Australian school's requirements are unchanged. A position whose duties the office has not marked asks for neither duty check, and that risk keeps a medium residual.Under s38(1)(b)Assessed 10 October 2026By Hoverpoint Pty Ltd

PIA-029: Telling a coach when a restriction starts and ends

The daily job that tells the school's restriction-notice roles and an activity's own coach and manager when a restriction on what a student may do starts or ends. It covers the cross-domain read the medical layer makes of the activities layer to find that staff, the idempotent send that catches up a restriction recorded with a start already past and skips one voided before its start, and the message's wording, which never includes the sealed clinical detail. It is extended to cover naming the sport and the fixture a concussion or an injury happened on, read the same cross-domain way, and the SCAT6 concussion assessment, whose answers become one summary sentence on the case.Finding The handling of children's information in the restriction notice is consistent with the best interests of the child. A coach already supervises the activity the restriction covers and already needs to know what a student may not do there; the notice tells them the fact and never the clinical reason, read through a cross-domain model declared at the internal tier alone, and a restriction the school has voided is never sent.Under s38(1)(b)Assessed 7 October 2026By Hoverpoint Pty Ltd

PIA-028: Advancement, giving and alumni

The foundation and alumni office: gifts, receipts, pledges and bequests; appeals and invitations to former students, past parents and donors; reunions and functions; the alumni association; and the opt-in alumni directory, from a record that begins while a former student is a child.Finding The handling of children's information in the advancement layer is consistent with the best interests of the child. A child is touched only where they act, by giving a gift, attending a function or reaching their leaving year; no advancement message reaches anyone under 18; the giving day names no-one; and a protected person is off each list, export, door list and directory.Under s38(1)(a)Assessed 7 October 2026By Hoverpoint Pty Ltd

PIA-027: A learner profile for each student

A student's learner profile on their record: academic strengths and knowledge and skills calculated afresh from the markbook and the learning progressions, their work samples, and a teacher's dated observation of their leadership, character traits, unique potential, preferred ways of learning and motivation. It covers who reads and who records an observation, the void chain a correction uses, the family portal section the school may switch on, off by default, and the absence of any student portal or export path to any part of it.Finding The handling of children's information in a student's learner profile is consistent with the best interests of the child. Three of its four parts are calculated afresh from the markbook, the learning progressions and the document store, and store nothing new; the fourth, a teacher's recorded observation, is dated, kept under the teacher's own name and never updated, a correction instead naming the row it replaces. The staff who already hold the markbook's capabilities read or record it, and a parent reads the same answer about their own child only where the school has switched the family section on and their standing grants reports; the section defaults off, the opposite of the portal's own default for a family section, because a family reading the school's judgement of a child needs the school's own decision first. No student portal or export path reaches it.Under s38(1)(b)Assessed 7 October 2026By Hoverpoint Pty Ltd

PIA-026: Microsoft 365 for staff

A school connecting its Microsoft 365 tenant for its staff: the directory reads an administrator grants Kestrel's application, the staff group the school chooses, the Exchange scope an Exchange administrator sets on that group's direct members, the check that Exchange refuses a mailbox outside it, and each member of staff's own switch. It covers what the connection is for: lessons, duties and meetings written to a teacher's Outlook calendar, invitations and their responses, free and busy times read when a slot list is built, a teacher's message to a family sent from their own mailbox, and an Outlook email or meeting a member of staff files to a student's record.Finding The handling of children's information through the Microsoft 365 integration is consistent with the best interests of the child. No child's mailbox can be reached, because Microsoft enforces the limit as well as Kestrel and nothing is synced until Exchange has refused a mailbox outside the staff group. Each member of staff opts in for their own mailbox, a member of staff is linked only through their staff identity, and Kestrel keeps no copy of the school's directory. A staff mailbox is read by its delegates and the school's Exchange administrators, so what is written there reaches them, and that risk keeps a medium residual.Under s38(1)(b)Assessed 7 October 2026By Hoverpoint Pty Ltd

PIA-025: A student reads their own calendar in the portal

A student reading their own lessons, tasks due and activity events on the portal calendar: the class's name and room on a lesson, the class code and task name on a task due, and the activity and fixture on an event, from the record the office already keeps.Finding The handling of children's information in the student portal's calendar is consistent with the best interests of the child. One master switch, `base:calendar`, is asked once before any source answers a student and starts off; the lessons source keeps a further switch of its own, `timetable:today`. Each source answers only that student's own classes, activities or memberships, and no entry names another student.Under s38(1)(b)Assessed 6 October 2026By Hoverpoint Pty Ltd

PIA-024: A student's own house points, merits, sanctions and shared goals in the portal

A student reading their own Wellbeing section in the portal: the merits and notes and each sanction the school marked for parents, read through the same two parent-visible read models PIA-017 assesses, the house ladder for the school year to date with the student's own house named, and the goals on their own current plans a plan's owner has marked shared with them. It covers what stays out of the answer: a goal not marked shared, a goal's actions, a restricted entry, an entry not marked for parents, a counselling note, a case, the reason for a sanction and a void's reason.Finding The handling of children's information in the portal's Wellbeing section, offered to a student, is consistent with the best interests of the child. The section reads the same two read models the school publishes for parents, the house ladder that names no student, and only a goal a plan's owner has marked shared, never its actions. The route is reached by the student alone, so a parent's own standing on the same child cannot widen what is read here, and the section is offered to a student only where the school has switched it on.Under s38(1)(b)Assessed 6 October 2026By Hoverpoint Pty Ltd

PIA-023: Next year's estimated mark

A head of department reading each continuing student's estimated mark for next year in the department's subjects, calculated from the mean of this year's scaled results, and amending the figure with a mark of their own and the reason for it. It covers who sees the estimate and the amendment, what the amendment keeps of the figure it replaces, and the absence of any family, portal or export path to either.Finding The handling of children's information in next year's estimated mark is consistent with the best interests of the child. Nothing is stored but the amendment: the estimate itself is calculated afresh from results the markbook already has, only the head of department reviewing their own department reads a student's estimate, no family, portal or export path reaches it, and an amendment keeps the calculated figure beside the mark the head of department gave instead, with the reason, who gave it and when.Under s38(1)(b)Assessed 6 October 2026By Hoverpoint Pty Ltd

PIA-022: A child's details in the portal

A family reader and a student reading who the school has a child down as in the portal: the names, the date of birth, the year level, the home group and its teachers, the house and the state student number, from the record the office already keeps.Finding The handling of children's information in the portal's Student details section is consistent with the best interests of the child. The section reads the record the school already keeps, names the child and the home group's teachers and no other adult, asks the reader's standing on that child before anything is read, and a student reads their own only where the school switches it on.Under s38(1)(b)Assessed 4 October 2026By Hoverpoint Pty Ltd

PIA-021: Classroom instructions

A classroom strategy learning support publishes for a student: the strategy in their own words, the days it applies over, the classes it covers, who published and ended it, the teachers of those classes reading it for a class they take today, and each teacher's answer on whether they used it, with a short note only learning support reads.Finding The handling of children's information in classroom instructions is consistent with the best interests of the child. An instruction names a strategy and never a diagnosis, the tables have no link to the NCCD register, a teacher reads an instruction only for a class the timetable says they take today, and the answers reach learning support alone. The strategy still tells a teacher the child is supported differently, which no design undoes while the teacher has to apply it, and that risk keeps a medium residual.Under s38(1)(b)Assessed 28 September 2026By Hoverpoint Pty Ltd

PIA-020: Exam provisions

What a student is approved for in an exam: the kind, the amount its kind takes, the one line an exam supervisor reads, who approved it and when, the days it applies over, why it was approved and the NCCD adjustment it answers, the section learning support records it from on the student's record, and the sheet a rostered supervisor and the exam office read one session's provisions on.Finding The handling of children's information in exam provisions is consistent with the best interests of the child. A provision names an arrangement and never a diagnosis, why it was approved is sealed and reaches only a holder of the register's restricted grant, the link to the NCCD adjustment reaches no other layer, the section is behind a capability only learning support is granted at the start, and a supervisor reads one session's lines inside a window around it. The one line an adult in the room reads still tells them the child is treated differently, which no design undoes while the adult has to apply it, and that risk keeps a medium residual.Under s38(1)(b)Assessed 26 September 2026By Hoverpoint Pty Ltd

PIA-019: Webhooks

A school subscribing one of its own systems to changes in the record: the address, the kinds of change and the API token an administrator names, the signed post of each allowed write of those kinds with the kind, the table, the record's id and the moment and nothing else, the retries and the log of what arrived, and the subscriber's fetch of the record through the API at its token's tier.Finding The handling of children's information through webhooks is consistent with the best interests of the child. A post names a record and a moment and none of its content, the content is fetched through the API at the tier of a token the school issued, each post is signed and sent over HTTPS to a public address the school named, and the school can revoke a subscription at once. A subscription may name a kind of record its token cannot read, so a subscriber can learn that such a record changed and when, and that risk keeps a medium residual.Under s38(1)(b)Assessed 26 September 2026By Hoverpoint Pty Ltd

PIA-018: A student's own requests in the portal

A student opening the Forms and requests section of the student portal: the forms they have sent with where each stands and the approver's note on a decline, the forms the school offers to students, and sending one, which collects the answers the school's form asks for from the student's own account. It covers what stays out of the section: a form about any other person, a form the school keeps for families or staff, a file, and a consent.Finding The handling of children's information in the portal's Forms and requests section, offered to a student, is consistent with the best interests of the child. A student reads and sends only about themselves, is offered only the forms the school publishes for students, and sends by their own act with nothing prefilled or kept as a draft. A request a student sends about themselves is listed in the family section of the same name, so a parent can read it, and a decline note is shown as the approver wrote it. Those two risks keep a medium residual.Under s38(1)(b)Assessed 25 September 2026By Hoverpoint Pty Ltd

PIA-017: A child's shared wellbeing entries in the portal

A family reader opening a child's Wellbeing section in the portal: the merits and notes the school marked for parents and each sanction of a kind the school tells parents of, with their dates, read through the two parent-visible read models. It covers what stays out of the answer: an entry not marked for parents, a restricted entry, a counselling note, a case, the reason for a sanction and a void's reason.Finding The handling of children's information in the portal's Wellbeing section is consistent with the best interests of the child. The section reads only the two read models the school publishes for parents, asks the reader's standing on that child before anything is read, drops a voided entry and its reason, and is offered to families alone. A teacher's note marked for parents is shown as written, and that risk keeps a medium residual.Under s38(1)(b)Assessed 24 September 2026By Hoverpoint Pty Ltd

PIA-016: Reports, dashboards, overnight findings and the warehouse export

The reporting layer as built: the library of standard reports a staff member runs at their own tier, the role dashboards that run those reports when opened, the overnight findings that tell the office which children need attention with a morning message that names no-one, and the nightly warehouse files a school's own tool fetches with a token through a signed link that stops working after ten minutes. Question answering and webhooks are assessed on their own.Finding The handling of children's information in the reporting layer is consistent with the best interests of the child. Nothing is collected and no figure about a child is stored. A report runs at the reader's own tier and only for a reader with the owning domain's capability, a finding is a stated rule that a person closes, the morning message names no child, and a warehouse file has only declared columns, none at the restricted tier, and today names no child. A file a school has fetched cannot be recalled, and a later column at the sensitive tier or a name in a file widens what leaves, so those two risks keep a medium residual until a review row on this assessment is a condition of each file that adds one.Under s38(1)(b)Assessed 24 September 2026By Hoverpoint Pty Ltd

PIA-015: A child's released results in the portal

A family and a student reading a child's released results in the portal: each result a teacher has released with its mark or level and its feedback, the outcomes its task assesses, the child's progress against those outcomes worked over the released results alone, the family's standing on the child that decides who reads, the switch that keeps a student's own reading off until the school turns it on, and the results a teacher has not released staying out of the answer and out of each figure.Finding The handling of children's information in the portal's Results section is consistent with the best interests of the child. Nothing is collected or stored. A family reads only where their standing on the child grants reports, a student reads only their own and only where the school has switched the section on, the release rule the teacher chose decides what is read, progress is worked over the released results alone, and no classmate's result is answered. A copy a family saved before a teacher corrected a result cannot be recalled, and that risk keeps a medium residual.Under s38(1)(b)Assessed 24 September 2026By Hoverpoint Pty Ltd

PIA-014: Absences, sanctions and sick bay visits on a person's timeline

Staff reading a student's absences, sanctions and sick bay visits beside their messages on the person record's Timeline section: the source each of attendance, wellbeing and medical registers, the capability each is read under, the tier each line sits at, the reasons, presentations and treatments that stay sealed in their own layers, and the counselling record staying off the timeline.Finding The handling of children's information in the timeline sources attendance, wellbeing and medical register is consistent with the best interests of the child. Nothing is collected or stored. A reader is asked only for the sources whose capability they hold and receives no line above their tier, so a reader without medical's capability sees no sign of a visit. A line says a label and a moment and never a reason, a presentation or a treatment, and the counselling record has no source. A reader inferring more from the sequence than any line says cannot be designed out, and that risk keeps a medium residual.Under s38(1)(b)Assessed 24 September 2026By Hoverpoint Pty Ltd

PIA-013: A student chooses subjects in the portal and their family reads the choices

A student ranking the subjects a round offers and sending the whole set from their own portal, the sentence the server gives for each rule a set breaks, the round that takes no choices before it opens or after it closes, a family reading the round and the set that was sent under their standing on the child, the switch that keeps a student's own choosing off until the school turns it on, and the absence of any control for a parent to send.Finding The handling of children's information in the portal's Subject selection section is consistent with the best interests of the child. Only the student sends their own set and the person written is the signed-in account's own, a family reads only where their standing on the child grants reports and has no control to send, a student reads only their own and only where the school has switched the section on, and a set that breaks a rule saves nothing and shows the reason.Under s38(1)(b)Assessed 24 September 2026By Hoverpoint Pty Ltd

PIA-012: A child due to start on the nurse's worklist

The nurse's action-plan worklist deciding who it is about from enrolment's facts: the children placed at the school today, the children with an accepted place who are due to start inside the next 399 days and the day each of them starts on, the child who is neither leaving both lists, and the nurse working on a declared condition before the child is a student.Finding The handling of children's information on the nurse's worklist is consistent with the best interests of the child. The change is mostly a narrowing: the worklist is the children the school is responsible for, and a child who withdrew, declined or left is no longer worked on. What it adds is the smallest fact that lets the nurse have a plan, a medication and a briefing ready on a child's first day, that the child is coming and when, read live from enrolment at the reader's own ceiling. A child dropped because the office has not recorded an acceptance keeps a medium residual, and the child's own record shows each declared condition without a filter.Under s38(1)(b)Assessed 24 September 2026By Hoverpoint Pty Ltd

PIA-011: A child's published reports in the portal

A family and a student reading a child's published reports in the portal: the reports the school has sent home under their reporting period, the signed link to each document that stops working after ten minutes, the family's standing on the child that decides who reads, the switch that keeps a student's own reading off until the school turns it on, and the report a school takes back leaving the section at once.Finding The handling of children's information in the portal's Reports section is consistent with the best interests of the child. Nothing is collected or stored. A family reads only where their standing on the child grants reports, a student reads only their own and only where the school has switched the section on, the answer is the period and a short-lived signed link, with none of the comments as rows, and a report the school takes back is no longer answered. A copy a family saved before a report was taken back cannot be recalled, and that risk keeps a medium residual.Under s38(1)(b)Assessed 24 September 2026By Hoverpoint Pty Ltd

PIA-010: Consent

What a family agrees to about a child: the record of each consent, the purposes a school asks about, the five ways one is given, the twelve-month limit, the withdrawal, the note beside a yes, the rule that only a person with parental responsibility gives a consent about a child, and the staff roles that read and record it. It covers the ask a school raises, who it reaches and the four states each child stands in against it, the medical-treatment consent shown beside each child on a camp pack, and the decision that a student does not give their own consent.Finding The handling of children's information in consent is consistent with the best interests of the child. A consent is a dated fact for one purpose, a consent about a child ends inside twelve months, only a person holding parental responsibility on the day may give it, a family withdraws it whenever it chooses, and the note beside it is sealed. Kestrel records no consent given by a student for themselves.Under s38(1)(b)Assessed 24 September 2026By Hoverpoint Pty Ltd

PIA-009: A child's attendance in the portal

A family reader and a student reading a child's attendance for the term in the portal: the rate, each absence and late arrival with its code and category, and which are still unexplained, from the register the office already keeps.Finding The handling of children's information in the portal's Attendance section is consistent with the best interests of the child. The section reads the register the school already keeps, answers with the code and no staff note, asks the reader's standing on that child before anything is read, and a student reads their own only where the school switches it on.Under s38(1)(b)Assessed 23 September 2026By Hoverpoint Pty Ltd

PIA-008: Activity selection and allocation

The round a school collects ranked choices in, the choices a family or a student sends on the portal form, the allocation the ranks and the school's tiebreak propose, the places a coordinator confirms, and the standing each family is told.Finding The handling of children's information in activity selection is consistent with the best interests of the child. A rank sits a tier above the membership it produces, one capability reaches it, the family section asks the reader's standing on that child, and nothing about a choice leaves the school.Under s38(1)(b)Assessed 18 September 2026By Hoverpoint Pty Ltd

PIA-007: Counselling case notes

The counsellor's own record of a student: what a session, a contact, a referral or a safety plan says, the moment of the session, the case it belongs to, the templates a school writes them from, and the two grants that reach them.Finding The handling of children's information in the counselling record is consistent with the best interests of the child. A note is its own record under its own capability, sealed and reached by the counsellor alone, no pastoral grant reaches it or is told that one exists, nothing about a note leaves the school, and it is kept as health information.Under s38(1)(b)Assessed 18 September 2026By Hoverpoint Pty Ltd

PIA-006: The statutory returns

The framework that checks a statutory return against the record, produces its file, records each run with its checksum and keeps the file sealed as a document, starting with the census counts.Finding The handling of children's information in the statutory returns is consistent with the best interests of the child. A return is an obligation the school already has, each run needs the passkey again and is recorded, and the file is sealed and disposed of under the return's class.Under s38(1)(b)Assessed 18 September 2026By Andrew Todd, privacy officer, Hoverpoint Pty Ltd

PIA-005: The calendar and its iCal feeds

The calendar on the console and the family portal, read from the dated records each layer keeps, and the feed a member of staff or a parent subscribes to from a calendar application at a secret address, with what it shows and who it resolves as on each fetch.Finding The handling of children's information in the calendar and its iCal feeds is consistent with the best interests of the child. The calendar stores no entry, a feed shows titles and times and no place or student, the secret is kept only as a hash, and each fetch resolves the reader's standing again, so a feed shows no more than its person reads signed in.Under s38(1)(b)Assessed 18 September 2026By Hoverpoint Pty Ltd

PIA-004: Communication history and timeline

The telephone calls, counter visits, letters and meetings staff log with a family or about a student, the summary each keeps and the tier its author declares, the timeline on the person record that puts them beside what the school sent, the messages to staff that name a student, and the staff roles that read and log them.Finding The handling of children's information in the communication history and timeline is consistent with the best interests of the child. A logged conversation keeps a short summary in its author's words, sealed and withheld below the tier its author declared, a teacher reads only the conversations about the students they teach, a message to staff about a student is read by the holders of the message capability alone and never by the family, and nothing about a conversation leaves the school.Under s38(1)(b)Assessed 17 September 2026By Hoverpoint Pty Ltd

PIA-003: Activity rosters and scheduling

The seasons a school runs, the teams, ensembles and clubs in each, which students are on each and from when, which adults supervise each on a current working with children check, and the events each schedules.Finding The handling of children's information in activity rosters and scheduling is consistent with the best interests of the child. The rosters record who is on each activity and from when with no rating or note, no adult is assigned without a current check, and nothing about a named child leaves the school but a message staff write to the families on a roster.Under s38(1)(a)Assessed 17 September 2026By Hoverpoint Pty Ltd

PIA-002: The NCCD register

The register a school keeps for the Nationally Consistent Collection of Data on School Students with Disability: each student's level of adjustment and category of disability, why the school decided it, the evidence and the consultations behind it, the staff roles that reach it, and the annual review reminder.Finding The handling of children's information in the NCCD register is consistent with the best interests of the child. The register contains what the collection asks for and no diagnosis, seals the reasons, reaches only the staff who keep it, and names no child in anything it sends.Under s38(1)(b)Assessed 17 September 2026By Hoverpoint Pty Ltd

PIA-001: Kestrel as built

The whole service as it stands on 16 September 2026: the staff console, the family portal, the office kiosk, a school's public forms, the API and the LISS server, the immunisation register, the scheduled jobs, messaging, imports, retention and disposal, and each class of record a school keeps about a child.Finding The handling of children's information in Kestrel is consistent with the best interests of the child. Each class of information serves the child's safety, education or wellbeing, or a record the law requires the school to keep, and none is used for advertising, profiling, analytics or the training of a model.Under s38(1)(a)Assessed 16 September 2026By Andrew Todd, privacy officer, Hoverpoint Pty Ltd

For a school in England

A school in England is under the UK GDPR, and is the controller of the records it keeps in Kestrel. Hoverpoint Pty Ltd is its processor under Article 28. The assessments of the records Kestrel keeps for a school in England alone are on the register above, and each names the lawful basis under Article 6 and the condition under Schedule 1 to the Data Protection Act 2018 that the school relies on:

PIA-030: Pre-employment checks on staff

Article 6(1)(c), the duty Keeping Children Safe in Education and the Independent School Standards place on the school.Condition A DBS certificate and a barred-list, prohibition or section 128 outcome are criminal offence data under Article 10. The conditions are paragraphs 1 and 18 of Schedule 1 to the Data Protection Act 2018, which paragraph 36 extends to that data.

PIA-031: The SEND register

Article 6(1)(c) or (e), the school's duties under the Children and Families Act 2014 and the SEND Code of Practice.Condition A pupil's type of need is special category data. The condition is Article 9(2)(g), with paragraph 6 of Schedule 1 to the Data Protection Act 2018.

PIA-032: A pupil's ethnicity and first language

Article 6(1)(c), the census return the Department for Education requires.Condition Ethnic origin is special category data. The condition is Article 9(2)(g), with paragraph 6 of Schedule 1 to the Data Protection Act 2018.

PIA-034: Exam entries and results

Article 6(1)(e), the school's public task of educating the pupil, and its duty as an examination centre.Condition Entries and results are not special category data, so no condition is needed.

As controller, the school makes its own data protection impact assessment under Article 35. Hoverpoint gives a school in England a template for it, built from the six parts above, and the school completes it for its own processing.

Reading an assessment

Hoverpoint gives the Information Commissioner a copy of this register and of each assessment on it when the Commissioner asks. A school, or someone assessing Kestrel for one, can ask for a copy of an assessment by writing to privacy@hoverpoint.io. A school in England asks for the template there too.