Acrux Education – Platform Terms of Service

Effective Date: 01 January 2025

Last Updated: 01 January 2055

‍

1. Introduction and Definitions

These Terms of Service (“Terms”) govern access to and use of the Acrux Education platform and associated services (“Platform”) provided by Acrux Education Pty Ltd (“we”, “us”, “our”). By accessing or using the Platform, you (the subscribing school, institution, or authorised user, referred to as “you” or “School”) agree to be bound by these Terms.

“User” means any individual authorised by the School to access the Platform, including teachers, heads of department, and internal staff.

“Student Data” refers to personal information relating to students entered into the Platform by authorised Users.

“Anonymised Data” refers to data that has been stripped of personal identifiers and cannot be used to re-identify individuals.

2. Service Description

The Platform provides tools for assessment management, AI-assisted marking, curriculum resources, and educational analytics. We grant you a limited, non-exclusive, non-transferable licence to use the Platform solely for educational purposes during the term of your subscription.

Use of the Platform is subject to subscription limits as agreed (e.g. by school, by user type, or per student). We reserve the right to improve, modify, or discontinue any part of the Platform with reasonable notice.

3. User Accounts and Responsibilities

Only authorised Users may access the Platform. You are responsible for:

• Ensuring account information is accurate and kept up to date

• Managing user roles and permissions

• Maintaining the security and confidentiality of login credentials

• Ensuring Platform use complies with applicable laws and school policies

You agree not to:

• Circumvent access controls or security features

• Use the Platform for unlawful or non-educational purposes

• Attempt to reverse-engineer or interfere with the Platform’s functionality

4. Data Handling and Privacy

The School retains ownership of all personal data uploaded to the Platform, including Student Data. Acrux acts as a data processor and will only process personal data on the School’s behalf in accordance with applicable privacy laws and our Data Protection Policy.

The School is responsible for ensuring that it has the necessary authority, consents, or legal basis to upload personal data to the Platform.

We apply appropriate technical and organisational safeguards, including encryption, access controls, and audit logging. Our Data Protection Policy and Data Processing Agreement (DPA) provide further details.

5. Anonymised and Derived Data

We may generate Anonymised Data from Platform usage for the purposes of research, system improvement, and AI model training. This data:

• Is fully de-identified and cannot be used to re-identify individuals

• Is processed and stored separately from Student Data

• Remains the intellectual property of Acrux Education

Anonymised Data may be retained indefinitely and is not subject to deletion requests.

6. Subscription and Payment Terms

Subscriptions are billed annually in advance. Unless otherwise agreed, each subscription includes a 30-day free trial. Access may be terminated at any time during the trial.

Unless cancelled with at least 30 days’ written notice prior to the renewal date, subscriptions will automatically renew at the then-current pricing.

Fees are non-refundable unless required by law. We may suspend access to the Platform for overdue accounts after giving reasonable notice.

7. Term and Termination

These Terms apply for the duration of your subscription. Either party may terminate the agreement:

• With written notice before renewal

• Immediately upon material breach by the other party

Upon termination:

• Access to the Platform will be revoked

• Identifiable data will be deleted or returned per our Data Protection Policy

• Anonymised Data may be retained by Acrux Education

8. Intellectual Property

All intellectual property rights in the Platform, including software, design, code, and documentation, remain the property of Acrux Education.

The School retains ownership of all content and personal data it uploads. Acrux is granted a licence to process such data solely to provide the services described.

9. Warranties and Disclaimers

We provide the Platform on an “as-is” and “as-available” basis. While we take reasonable steps to ensure continuity and security, we do not guarantee uninterrupted access or error-free operation.

To the maximum extent permitted by law:

• Our total liability is limited to the amount paid under your current annual subscription

• We are not liable for indirect, incidental, or consequential damages

10. Support and Maintenance

Standard support is available during business hours via email or our help desk. We may conduct scheduled maintenance and will provide reasonable notice where possible.

11. Confidentiality

Each party agrees to protect any confidential information disclosed under these Terms and not to use it for any purpose other than fulfilling this agreement.

Confidentiality obligations survive termination, and do not apply to publicly available or legally compelled disclosures.

12. Changes to Terms or Services

We may update these Terms from time to time. We will notify you of material changes by email or in-platform notice.

Continued use of the Platform following such updates constitutes acceptance of the revised Terms.

13. Dispute Resolution and Governing Law

These Terms are governed by the laws of Western Australia. Any disputes shall be subject to the exclusive jurisdiction of the courts of that region.

14. Education-Specific Considerations

• The Platform is designed for use by authorised school staff only

• Students do not access the Platform directly

• AI-generated marks are suggestions only; final grading decisions remain with the teacher

• Role-based access controls (e.g. for HODs, teachers) are implemented

15. Contact
TeacherEA Holdings Pty Ltd T/As Acrux Education

Email: info@acrux.education

Privacy: privacy@acrux.education

Data Protection: dpo@acrux.education

‍

Data Protection Policy

Effective Date: 01 January 2025

Last Updated: 01 January 2025

At Acrux Education, we are committed to safeguarding personal data and complying with applicable data protection laws in the jurisdictions in which we operate, including the Privacy Act 1988 (Australia), UK GDPR, and Singapore’s Personal Data Protection Act 2012 (PDPA).

This policy describes how we collect, use, store, and protect personal information when you use our products and services.

1. Who We Are

Acrux Education (“we”, “us”, “our”) provides a secure digital platform that enables schools and educators to manage assessments, track progress, and deliver educational outcomes.

Our platform is used by authorised school staff to administer and review assessments, manage student records, and access insights into teaching and learning.

Depending on context, we act as either:

• a Data Processor when handling data on behalf of schools, or
• a Data Controller for account-level and operational data

2. Data We Collect and Process

We collect and process the following categories of personal information:

a. Teacher Information

• Full name and email address
• Role and affiliated school
• Subjects taught and class assignments
• Login and usage activity (e.g. last login, page views)
• Support tickets and communications

b. Student Information (provided by schools)

• Full name and national student identifier
• Class enrollment and assessment records
• Assessment responses and associated metadata
• Marking and grading outcomes
• Derived analytics data (e.g. performance trends, error types)

c. Analytics and AI-processed Data

• To support insight reporting and AI-based marking, we generate and store analytics based on student responses.
• All large-scale analysis and AI training uses anonymised data with UUIDs in place of personal identifiers.

We do not collect student data directly. All student information is provided and managed by authorised school staff.

3. Purpose of Processing

We process personal data for the following purposes:

• To provide secure access to the Acrux platform for authorised school staff
• To manage user accounts, classes, and teaching assignments
• To deliver, store, and assess student work and results
• To facilitate automated marking and feedback using AI tools
• To generate performance analytics and progress insights for teachers and schools
• To support large-scale anonymised research and product improvement
• To respond to technical support queries and operational communications
• To comply with legal obligations and education data standards

Where possible, we use pseudonymised or anonymised data (e.g., UUIDs) when conducting analytics or research beyond the direct provision of school services.

4. Lawful Basis for Processing

We process personal data based on the following lawful grounds:

• Contractual necessity – to provide our services to schools and their authorised staff
• Legitimate interest – to operate and improve our platform, ensure security, and conduct research and development
• Legal obligation – to comply with applicable laws, including education regulations and privacy legislation
• Consent – where required, such as for receiving product updates or marketing communications

For student data, we act solely under the authority of schools and process such data only in accordance with their instructions.

5. How We Store and Protect Data

• Data is hosted in secure, access-controlled environments on Google Cloud Platform (GCP).
• Data may be stored in regions including Australia, the UK, and Singapore, depending on school location.
• We apply:
  • Encryption at rest and in transit
  • Role-based access control (RBAC)
  • Regular vulnerability assessments
  • Audit logs and incident response protocols

6. Data Sharing and Transfers

We may share data with trusted third parties under strict controls and only for legitimate operational or research purposes. These include:

• Cloud infrastructure providers (e.g. Google Cloud Platform) for hosting, storage, and security
• Internal staff and subcontractors under confidentiality agreements
• Legal and regulatory authorities when required by law
• Research institutions and universities for approved studies using fully anonymised datasets, with no identifying student or school information

Cross-border data transfers (e.g. for hosting or research) are protected by:

• Standard Contractual Clauses (SCCs) or other lawful transfer mechanisms under UK GDPR
• Australian Privacy Principle 8.1 for overseas disclosure
• Singapore PDPA Sections 26–28 for international transfers

We do not sell or monetise any data, and no personal information is used for advertising or profiling.

7. Data Retention

We retain personal data only for as long as necessary to fulfil the purposes outlined in this policy or to comply with legal and contractual obligations.

• Teacher and staff data: retained for the duration of the account + 12 months
• Identifiable student data (e.g. names, student ID, assessment submissions): retained for the duration of a student’s enrolment at the school or as directed by the school
• Anonymised student data (e.g. answer patterns, assessment analytics, AI training data): retained indefinitely for research and system improvement purposes. This data is fully anonymised and cannot be linked back to an individual.

When a school requests data deletion, we will:

• Delete all identifiable data associated with the request
• Retain only anonymised data, where such data cannot be used to re-identify any student or user

All deletion actions are logged and confirmed back to the requesting school.

8. Your Rights

Depending on your jurisdiction, you may have certain rights regarding your personal data, such as:

• The right to access, correct, or delete personal data
• The right to restrict or object to processing
• The right to request a copy of your data (data portability)

For teachers and school staff, you may contact us directly at privacy@acrux.education to exercise these rights.

For student data, all requests must be made through the student’s school. As a data processor, we are not permitted to act on direct student or parent requests unless instructed by the school.

We will assist schools with any data-related requests they submit on behalf of students or staff. We aim to respond to all valid requests within 30 days.

9. Children’s Data

Our platforms are designed for use by schools and educators. Students do not create accounts or directly interact with the platform. All student data is provided by authorised school staff.

We process student data only under contractual agreements with schools and in accordance with their instructions.

10. Data Protection Officer (DPO)

If you are based in the UK or Singapore and wish to contact our DPO:

Dr Leanne Russell

📧 dpo@acrux.education

11. Updates to This Policy

We may update this policy from time to time. Material changes will be communicated via the platform or email. The latest version is always available at www.acrux.education.

‍

Information Security Policy

Acrux Education Pty Ltd
Version: 1.0
Effective Date: December 2025
Review Date: December 2026

1. Purpose

This policy establishes the information security requirements for Acrux Education to protect the confidentiality, integrity, and availability of data entrusted to us by schools, students, and educators.

2. Scope

This policy applies to all Acrux Education systems, data, personnel, and contractors who access company information assets.

3. Infrastructure Security

3.1 Cloud Platform

Acrux Education operates exclusively on Google Cloud Platform (GCP) with the following security controls:

• Region Isolation: Separate deployments per region to ensure data sovereignty
  • Australia: australia-southeast1 (Sydney)
  • Singapore: asia-southeast1
  • United Kingdom: europe-west2 (planned)
• Data Residency: Customer data remains within its originating region and is not transferred across jurisdictions
• Australian Data: Stored and processed exclusively in Sydney to comply with Australian Privacy Principles

3.2 Network Security

• All database instances use private IP only with no public internet exposure
• Database connectivity via VPC connector - no external access permitted
• SSL/TLS encryption required for all database connections (ssl_mode = "ENCRYPTED_ONLY")
• Firewalls configured at cloud infrastructure boundaries

3.3 Encryption

• Data in Transit: All data encrypted using TLS 1.2 or higher
• Data at Rest: All stored data encrypted using GCP's default encryption (AES-256)
• Database: Cloud SQL with enforced SSL connections

4. Access Control

4.1 User Authentication

All platform users must authenticate using:

• Email and password combination
• Passwords must meet the following requirements:
  • Minimum 8 characters
  • Cannot be similar to username, email, or name
  • Cannot be a commonly used password
  • Cannot be entirely numeric

4.2 Session Management

• Access tokens expire after 60 minutes of inactivity
• Refresh tokens expire after 4 hours (production environment)
• Session warning displayed 10 minutes before expiry
• Rate limiting on password reset requests (5 per hour)

4.3 Staff Access

• All Acrux Education staff require Multi-Factor Authentication (MFA) for system access
• Access privileges are role-based and follow the principle of least privilege
• Unique credentials required for all user and administrator accounts
• Account access removed immediately upon termination of employment

4.4 Password Policy for Staff Systems

Staff and administrator passwords must:

• Be unique to Acrux Education systems
• Be changed if compromise is suspected
• Not be shared with any other person
• Comply with platform password requirements

5. Data Protection

5.1 Data Classification

All customer data is classified as confidential and handled accordingly.

5.2 Data Handling

• Customer data is only accessed for service delivery and support purposes
• No customer data is used for advertising or marketing purposes
• Test environments use separate, non-production data
• Development and production environments are completely isolated (separate GCP projects)

5.3 Third-Party Services

• All third-party cloud services are assessed for security compliance
• Third parties with access to customer data are contractually bound to data protection requirements
• A register of third-party services is maintained and reviewed regularly

6. Monitoring & Incident Response

6.1 Monitoring

Acrux Education maintains comprehensive monitoring including:

• GCP native monitoring and alerting
• Sentry application error tracking
• Internal monitoring dashboards
• Automated alerting for security events

6.2 Incident Response

In the event of a security incident:

1. Incident is logged and assessed for severity
2. Immediate containment actions are taken
3. Affected customers are notified as required by law
4. Root cause analysis is conducted
5. Preventive measures are implemented

6.3 Vulnerability Management

• Regular vulnerability assessments are conducted
• High-risk and critical security updates are applied within 14 days of release
• Default passwords are changed on all infrastructure devices

7. Physical Security

• All infrastructure is hosted in GCP data centres which maintain SOC 2, ISO 27001, and other certifications
• No customer data is stored on local devices or portable media
• Staff devices with access to systems are encrypted

8. Training & Awareness

• All staff receive data protection training upon onboarding
• Cyber security awareness training is conducted annually
• Policy awareness is reinforced through regular communications

9. Policy Review

This policy is reviewed annually or following any significant security incident or change to operations.

Contact for Security Enquiries:
Email: security@acrux.education
Website: https://www.acrux.education

‍

Service Level Agreement (SLA)

Acrux Education Pty Ltd
Version: 1.0
Effective Date: December 2025
Review Date: December 2026

1. Overview

This Service Level Agreement ("SLA") describes the service availability commitment for the Acrux Education platform, including Acrux Mark and Acrux Analyse.

2. Definitions

TermDefinitionPlatformThe Acrux Education web application and associated servicesService HoursThe published operating hours for each region (see Section 3.2)DowntimePeriod during Service Hours when the Platform is unavailable due to issues within Acrux Education's controlRest PeriodScheduled offline hours designed to support teacher work-life balanceMonthly Uptime Percentage(Total Service Hours minutes - Downtime minutes) / Total Service Hours minutes × 100

3. Service Availability

3.1 Uptime Commitment

Acrux Education commits to 99.5% monthly uptime during Service Hours.

This allows for approximately 2.5 hours of unplanned downtime per month during operating hours.

3.2 Service Hours

The Platform operates during the following hours in each region:

RegionService HoursRest PeriodAustralia7:10am – 11:00pm AWST11:00pm – 7:10am AWSTUnited Kingdom7:10am – 11:00pm GMT/BST11:00pm – 7:10am GMT/BSTSingapore7:10am – 11:00pm SGT11:00pm – 7:10am SGT

3.3 Rest Period — Supporting Teacher Wellbeing

Acrux Education is committed to supporting healthy work-life balance for educators. The Platform is intentionally offline during evening and early morning hours to encourage teachers to rest and recharge.

During the Rest Period, users will see a friendly reminder encouraging work-life balance, with contact details for genuine emergencies.

The Rest Period is not counted as Downtime for SLA purposes. This scheduled offline time also allows us to deploy updates and improvements without impacting teachers during working hours.

3.4 Exclusions

The following are not counted as Downtime:

• Rest Period: Scheduled offline hours as defined above
• Scheduled Maintenance: Any additional planned maintenance with at least 48 hours notice
• Emergency Maintenance: Critical security updates that cannot be delayed
• External Factors: Internet connectivity issues, third-party service outages, DNS issues outside our control
• Force Majeure: Natural disasters, government actions, or other events beyond reasonable control
• Customer-Caused Issues: Misuse of the platform, exceeded usage limits, or issues with customer's own systems

4. Support Services

4.1 Support Availability

Support ChannelAvailabilityEmail SupportMonday–Friday, 9:00am – 5:00pm (AWST/GMT per region)Knowledge Base24/7 at https://help.acrux.educationEmergency ContactAvailable for critical issues — leanne@acrux.education

4.2 Response Times

PriorityDescriptionInitial Response TargetCriticalPlatform completely unavailable during Service HoursWithin 2 hoursHighMajor feature unavailable, no workaroundWithin 4 hoursMediumFeature impaired but workaround existsWithin 1 business dayLowMinor issue, questions, feature requestsWithin 2 business days

Response times apply during business hours (Monday–Friday, 9:00am – 5:00pm local time).

4.3 Support Contact

• Email: support@acrux.education
• Privacy Enquiries: privacy@acrux.education
• Security Enquiries: security@acrux.education
• Knowledge Base: https://help.acrux.education

5. Data Protection

5.1 Backup & Recovery

ProtectionDetailBackup FrequencyDaily automated backupsBackup Retention30 daysPoint-in-Time RecoveryAvailable for up to 7 daysRecovery Time Objective4 hours for major incidents

5.2 Data Location

Customer data is stored in the region specified for their account:

• Australia: Sydney (australia-southeast1)
• United Kingdom: London (europe-west2)
• Singapore: Singapore (asia-southeast1)

Data does not leave the specified region.

6. Service Credits

6.1 Eligibility

If the Monthly Uptime Percentage falls below 99.5% during Service Hours, eligible customers may request a service credit.

Monthly Uptime (during Service Hours)Service Credit< 99.5% but ≥ 99.0%10% of monthly fee< 99.0% but ≥ 95.0%25% of monthly fee< 95.0%50% of monthly fee

6.2 Credit Request Process

1. Submit credit request to support@acrux.education within 30 days of the incident
2. Include dates and times of experienced Downtime
3. Credits applied to future invoices (not redeemable for cash)

6.3 Limitations

• Maximum credit per month: 50% of monthly fee
• Credits are sole remedy for failure to meet SLA
• Credits require customer account to be in good standing

7. Customer Responsibilities

To ensure optimal service delivery, customers agree to:

• Use the Platform during published Service Hours
• Maintain current browser versions as recommended
• Report issues promptly via support channels
• Provide reasonable cooperation for troubleshooting
• Ensure adequate internet connectivity

8. Monitoring & Reporting

8.1 Service Status

Current service status available at: https://status.acrux.education

8.2 Incident Communication

During service disruptions:

• Status page updated within 30 minutes of detection
• Email notification for major incidents
• Regular updates until resolution
• Post-incident summary provided for significant outages

9. Changes to SLA

Acrux Education may update this SLA with 30 days written notice. Continued use of the Platform after changes take effect constitutes acceptance of the updated terms.

Contact:
Email: support@acrux.education
Website: https://www.acrux.education

‍

Business Continuity Plan

Acrux Education Pty Ltd
Version: 1.0
Effective Date: December 2025
Review Date: December 2026

1. Purpose

This plan ensures Acrux Education can maintain critical operations and recover from disruptions while minimising impact to schools and educators who rely on our platform.

2. Scope

This plan covers the Acrux Education platform (Acrux Mark, Acrux Analyse) and supporting infrastructure hosted on Google Cloud Platform.

3. Recovery Objectives

MetricTargetDescriptionRecovery Time Objective (RTO)4 hoursMaximum time to restore service following a major incidentRecovery Point Objective (RPO)24 hours (standard) / Minutes (with PITR)Maximum acceptable data loss

4. Infrastructure Overview

4.1 Production Environment

• Platform: Google Cloud Platform (GCP)
• Region: australia-southeast1 (Sydney) for Australian customers
• Region: europe-west2 (London) for United Kingdom customers
• Compute: Cloud Run (multi-zone within region)
• Database: Cloud SQL PostgreSQL 16 (Enterprise Edition)
• Storage: Google Cloud Storage (regional redundancy)

4.2 Backup Strategy

ComponentBackup FrequencyRetentionRecovery MethodDatabaseDaily (02:00 UTC)30 daysAutomated restorePoint-in-Time RecoveryContinuous7 daysTransaction log replayApplication CodeContinuous (BitBucket)IndefiniteGit deploymentConfigurationVersion controlledIndefiniteInfrastructure as Code

5. Risk Assessment

5.1 Failure Scenarios

ScenarioLikelihoodImpactRecovery TimeSingle zone outageLowMinimalMinutes (auto-failover)Database zone failureLowService degradationHoursFull region outageVery LowFull outage4+ hoursData corruptionVery LowData loss risk1-4 hoursCyber attackLowVariableHours to days

5.2 Mitigation Controls

• Cloud Run automatically distributes across multiple zones within Sydney region
• GCS buckets replicated across zones within the region
• Database backups stored in GCS with regional redundancy
• Point-in-time recovery enabled for granular data restoration

6. Incident Response Procedures

6.1 Detection & Assessment

1. Automated monitoring alerts via GCP Monitoring, Sentry, and internal dashboards
2. On-call personnel assess severity and impact
3. Incident classified as Critical, High, Medium, or Low

6.2 Response Actions

Critical Incident (Complete service outage):

1. Immediate notification to all technical personnel
2. Assess root cause and estimated recovery time
3. Communicate status to affected customers within 1 hour
4. Execute recovery procedures
5. Provide regular updates until resolution

High Incident (Partial service degradation):

1. Technical personnel notified and begin investigation
2. Implement workarounds where possible
3. Communicate to affected customers if impact exceeds 30 minutes
4. Execute remediation

6.3 Recovery Procedures

Database Recovery:

1. Identify point of failure
2. If data corruption: Restore from point-in-time recovery
3. If zone failure: Restore from daily backup to alternate zone
4. Verify data integrity
5. Resume service

Application Recovery:

1. Cloud Run automatically handles zone failures
2. If region-wide: Deploy to alternate region from BitBucket
3. Update DNS/routing as required
4. Verify functionality

7. Communication Plan

7.1 Internal Communication

RoleNotification MethodTimeframeTechnical TeamAutomated alerts + PhoneImmediateLeadershipPhone + EmailWithin 15 minutes

7.2 External Communication

AudienceMethodTimeframeAffected SchoolsEmail + Status PageWithin 1 hourDistribution PartnersDirect contactWithin 2 hours

7.3 Status Page

Service status updates published at: https://status.acrux.education (or equivalent)

8. Testing & Maintenance

8.1 Testing Schedule

Test TypeFrequencyDescriptionBackup RestorationQuarterlyVerify backups can be restored successfullyFailover SimulationAnnuallyTest zone failover proceduresCommunication TestAnnuallyVerify contact lists and notification systems

8.2 Plan Maintenance

• This plan is reviewed annually
• Updated following any significant incident
• Updated when infrastructure changes occur
• All personnel informed of material changes

9. Dependencies

9.1 Third-Party Services

ServicePurposeCriticalityFallbackGoogle Cloud PlatformInfrastructureCriticalNone (primary platform)SentryError monitoringMediumGCP native monitoringBitBucketSource controlMediumLocal copies

9.2 GCP Service Level Agreement

GCP provides a 99.95% monthly uptime SLA for Cloud Run and Cloud SQL, with service credits for failures to meet this target.

10. Roles & Responsibilities

RoleResponsibilityCTO (Paul Kamarudin)Overall BCP ownership, technical recovery decisionsCEO (Dr. Leanne Russell)Customer communication, business decisions

Emergency Contact:
Email: support@acrux.education
Website: https://www.acrux.education

‍