Privacy policy

Last updated: 15 April 2025

Section 1 – Purpose

This privacy statement (statement) affirms RMIT University’s commitment to privacy and its approach to the responsible handling of personal, sensitive and health information, in all its forms.

As a public university established under Victorian law, RMIT’s privacy obligations are primarily governed by the Privacy and Data Protection Act 2014 (Vic) and the Health Records Act 2001 (Vic). RMIT or its controlled entities may be required to comply with other privacy regulations in other jurisdictions to the extent they apply to its activities, including the Privacy Act 1988 (Cth), the Vietnam Personal Data Protection Law (PDPL), and the European Union General Data Protection Regulation (GDPR)

This statement outlines how RMIT collects, uses, and discloses your personal information when you visit, use our Services at, or make a purchase from shortcourses.rmit.edu.au (our Site) or otherwise communicate with us about the administration, management or provision of short courses or related functions of our Site.

For the purposes of this statement, "you" and "your" means you as the user of the Services, whether you are a customer, website visitor, or another individual whose information we have collected pursuant to this statement.

Please read this statement carefully. If you have any questions, please contact the RMIT Privacy Office by email at privacy@rmit.edu.au.

Section 2 – How we collect your information

RMIT only collects information about you by lawful and fair means and in a non-intrusive way. RMIT collects personal, sensitive and health information as necessary for its core functions, including for educational, research, community and commercial purposes.

The information that we collect and use varies depending on how you interact with us.

Your personal information is usually collected directly from you. In some cases, we may collect information from a third party, such as a government authority, agency, contractor, or other educational or research institutions. Where personal information is provided to us by a person other than you, it will be deleted or de-identified if not required, or you will receive a notice of its collection, its use and your rights as a data subject.

In addition to the specific core functions set out above, we may use information we collect about you to communicate with you, provide the Services relating to courses purchased at www.shortcourses.rmit.edu.au, comply with any applicable legal obligations, enforce any applicable terms of service, and to protect our rights and the rights of our users or others.

Section 3 – What information do we collect

Personal information means information that is recorded (in physical or electronic form), is about an individual, where the individual’s identity is apparent or could reasonably be ascertained.

The following sections describe the categories and specific types of personal information we collect:

Information that you directly submit to us through our Services may include:

Basic details including your name, address, phone number, email, level of study

Sensitive details including your gender identity, citizenship status, racial or ethnic origin

Order information including your name, billing address, shipping address, payment confirmation, email address, phone number.

Account information including your username, password, security questions.

Shopping information including the items you view, put in your cart or add to your wishlist.

Customer support information including the information you choose to include in communications with us, for example, when sending a message through the Services.

Some features of the Services may require you to directly provide us with information about yourself (such as when you purchase a short course). You may elect to not provide this information but doing so may prevent you from using or accessing these features.

RMIT relies on the information provided by you as being accurate, complete and current.

Information we collect through cookies:

We also automatically collect certain information about your interaction with the Services ("Usage Data"). To do this, we may use cookies, pixels and similar technologies ("Cookies"). Usage Data may include information about how you access and use our site and your account, including device information, browser information, information about your network connection, your IP address and other information regarding your interaction with the Services.

Information we obtain from Third Parties:

We may obtain personal information about you from third parties, including from vendors and service providers who may collect information on our behalf, such as:

Companies who support our Site and Services, such as Shopify

Our payment processors, who collect payment information (e.g., bank account, credit or debit card information, billing address) to process your payment in order to fulfill your orders and provide you with products or services you have requested, in order to perform our contract with you.

When you visit our Site, open or click on emails we send you, or interact with our Services or advertisements, we, or third parties we work with, may automatically collect certain information using online tracking technologies such as pixels, web beacons, software developer kits, third-party libraries, and cookies.

Section 4 – How we use your information

RMIT uses personal information including sensitive and health information to deliver our core functions, and comply with our obligations with respect to the provision of education and research. We use your information for the primary purpose for which it was collected, a related secondary purpose that you may reasonably expect (with the exception of sensitive or health information), as required by law, or with your permission or consent.

The laws in some jurisdictions require us to tell you about the legal ground we rely on to use or share your personal information. These legal grounds may include, but are not limited to, meeting our contractual commitments to you, for a legitimate interest, to comply with law, or to perform a public task. We will always consider your rights when using your personal information.

We use your personal information for:

Providing products and services -

To provide you with the Services (short courses) in order to perform our contract with you, including to process your payments, fulfill your orders, to send notifications to you related to your account, purchases, returns, exchanges or other transactions, to create, maintain and otherwise manage your account, to arrange for shipping, facilitate any returns and exchanges and to enable you to post reviews.

Marketing & Advertising –

For marketing and promotional purposes, such as to send marketing, advertising and

promotional communications by email, text message or postal mail, and to show you advertisements for products or services.

This may include using your personal information to better tailor the Services and advertising on our Site and other websites.

Security and Fraud Prevention -

To detect, investigate or take action regarding possible fraudulent, illegal or malicious activity. If you choose to use the Services and register an account, you are responsible for keeping your account credentials safe.

We highly recommend that you do not share your username, password, or other access details with anyone else. If you believe your account has been compromised, please contact us immediately at ()

Communicating with you –

to provide you with customer support and improve our Services. This is in our legitimate interests in order to be responsive to you, to provide effective services to you, and to maintain our business relationship with you.

Section 5 – Cookies

Like many websites, we use Cookies on our Site.

A cookie is a small text file that is sent to your device by means of your web browser. The information stored can be re-sent to our servers during a next website visit. A cookie file is stored in your web-browser and allow us or a third party to make a record of your visit to improve future visits to our websites. Cookies will not record your email passwords or your bank account details. Cookies do not harm your computer.

RMIT uses the following types of cookies:

1. Functional Cookies

Are essential for the proper functioning and security of our websites
Do not collect any personal information

2. Analytical Cookies

Help us detect any bugs and improve our websites
Collect anonymous information about your visits to our websites

Are never used for marketing purposes

3. Marketing Cookies and Other Cookies

Store preferences based on previous visits to our websites

Help us identify relevant e-mails, social media and banner ads for you

Allow our partners to display personalised offers and advertisements on their websites

Use information from third parties (for example, Google, Facebook) to personalise information displayed to you on our websites.

All personalised cookies including marketing cookies and other cookies are blocked for users visiting our website from the EU region

You can choose to change your browser's cookie settings via your browser privacy settings, including blocking of the use of cookies. However, this may result in an inability to login or view some RMIT or third-party web pages.

For specific information about the Cookies that we use related to powering our store with Shopify, see https://www.shopify.com/legal/cookies.

Section 6 – How we disclose your information

We may share your personal information with third parties where appropriate for the purposes set out in this statement, including but not limited to:

Our contracted service providers or partners, including overseas and local agents, information technology service providers (such as Adobe, Google and Microsoft), venues and event organisers, research and statistical analysis providers, call centres, hard copy and electronic mailing houses, professional advisers (such as recruitment advisers, auditors, accountants, insurers, and lawyers), and externally hosted applications and software subscriptions; and

With marketing and communication partners, including Shopify, to provide services and advertise to you. [[NOTE TO MERCHANT: INSERT THE FOLLOWING SENTENCE IF USING SHOPIFY'S AD SERVICES, SUCH AS SHOPIFY AUDIENCES]] [For example, we use Shopify to support personalized advertising with third-party services]. Our business and marketing partners will use your information in accordance with their own privacy notices.

When you direct, request us or otherwise consent to our disclosure of certain information to third parties, such as to ship you products or through your use of social media widgets or login integrations, with your consent.

With regulatory, investigative, law enforcement or government bodies.

Other educational institutes and educational partners, some of which are overseas, including educational agents; and

As required or authorised by law.

These recipient organisations and contracted service providers are required to keep personal information confidential and provide the same privacy safeguards as we do. Some of these recipients may be located outside of Victoria or Australia, which means that your personal information may be transferred interstate or overseas (trans-border), including but not limited to:

the United States of America;

Singapore;

India

Vietnam

other countries in Asia;

countries in the European Union, such as the UK and Spain.

Where we transfer your personal information to a recipient outside of Victoria or Australia, we take reasonable steps to ensure the recipient handles the information in accordance with this Privacy Statement, our Policies, and the relevant privacy and Victorian health information principles.

Where appropriate, examples of third parties that RMIT provides personal information to and for what purposes are captured in more detailed privacy collection statements or notice, which are provided to you at the time your personal information is collected.

Section 7 – User generated content

The Services may enable you to post product reviews and other user-generated content.

If you choose to submit user generated content to any public area of the RMIT shop, this content will be public and accessible by anyone.

We do not control who will have access to the information that you choose to make available to others, and cannot ensure that parties who have access to such information will respect your privacy or keep it secure.

We are not responsible for the privacy or security of any information that you make publicly available, or for the accuracy, use or misuse of any information that you disclose or receive from third parties.

Section 8 – Third party websites & links

Our Site may provide links to websites or other online platforms operated by third parties. If you follow links to sites not affiliated with or controlled by us, you should review their privacy and security policies and other terms and conditions.

We do not guarantee and are not responsible for the privacy or security of such sites, including the accuracy, completeness, or reliability of information found on these sites.

Information you provide on public or semi-public venues, including information you share on third-party social networking platforms may also be viewable by other users of the Services and/or users of those third-party platforms without limitation as to its use by us or by a third party.

Our inclusion of such links does not, by itself, imply any endorsement of the content on such platforms or of their owners or operators, except as disclosed on the Services.

Section 9 – Children’s personal information

The Services are not intended to be used by children, and RMIT does not knowingly collect any personal information about children. The short courses on our Site are configured in such a way that they will not allow someone who identifies as being under 16 years of age to purchase a course.

If you are the parent or guardian of a child who has provided us with their personal information, you may contact us at privacy@rmit.edu.au to request that it be deleted.

Section 10 – Storage of information

RMIT applies safeguards and takes appropriate security measures to protect your personal information from misuse, loss, unauthorised access and disclosure.

Stored information is also archived in accordance with the Public Records Act 1973 (Vic), which determines when information should be retained or disposed. Reasonable steps are taken to destroy or permanently de-identify your personal information when it is no longer needed for any purpose.

Personal information may be stored in hard copy documents, as electronic data, or in RMIT software or systems, including cloud or other types of network or electronic storage.

Some of the ways RMIT seeks to protect personal information include:

Privacy processes and the protection of information;

Document storage and data security processes;

Security measures for access to RMIT systems and networks;

Controlling access to RMIT premises; and

Website protection measures.

Where it is necessary to share your personal information with a contracted service provider or third-party, RMIT takes reasonable steps to ensure that there are appropriate safeguards, such as, legally binding and enforceable instrument, in place to protect your personal information.

RMIT operates in Australia and overseas, including Spain and Vietnam. Accordingly, we may need to share some of your information we collect about you between RMIT entities in these jurisdictions. For example, this could include the transfer of your information from an EEA country to Australia, and vice-versa.

Section 11 – Accessing your information

You have the right to request access to and/or correct any personal information concerning you that is held by RMIT. For the most part, you can do this via myRMIT. For further information please contact RMIT Student Connect. 

Complex access requests may require a formal application under the Freedom of Information Act 1982 and such requests should be directed to the RMIT University Freedom of Information Officer

Section 12 – Complaints about privacy

If you are concerned that RMIT may have breached its privacy obligations or this Statement, please contact us (see section 13). When contacting us, please provide as much detail as possible in relation to your issue or complaint.

RMIT takes privacy seriously and undertakes to resolve privacy complaints in a timely, fair and transparent way.

If you are not satisfied with our handling of your complaint, you may refer the issue to the Office of the Victorian Information Commissioner, the Health Complaints Commissioner for health information, or in some circumstances, the relevant supervisory authority in another jurisdiction. 

Section 13 – How to contact us

Please feel free to contact us on (03) 9925 1161 or email privacy@rmit.edu.au if you have any questions or concerns about this Statement or RMIT’s collection, use or disclosure of your personal information.

Section 14 – Changes to this Statement

We may change this Privacy Statement without notice, particularly where there are new developments in our working practice or if there are changes in the relevant laws. Therefore, we encourage you to check back occasionally to see if anything has changed.