Terms & Privacy

These terms cover the Flex Series 2026–27 Summer School Holiday Program, the iPad giveaway and how we look after your family's information. Parents and guardians, please read them with your girl.

Last updated: 12 November 2026

This Privacy Policy explains how Girls Day Out in STEM collects, uses, protects and deletes personal information for Flex Series 01: Digitally Curious, an online STEM program for girls aged 10–14 running 4–31 January 2027. It sits alongside the Flex Series 01: Digitally Curious Terms and Conditions (the “Terms”).

1.1 Who we are. Flex Series 01: Digitally Curious (The Event) is run by KP International Group Pty Ltd (ABN 74 617 180 408) trading as Girls Day Out in STEM (GDOS, we, us, our).

1.2 Who this Policy is for. This Policy applies to participating girls (Participants), their parents and legal guardians (Parents), schools and teachers making group bookings, scholarship applicants and sponsors, and anyone who contacts the Flex Help Desk.

1.3 What it covers. This Policy covers every part of The Event, as listed in the table below.

1.4 Our approach. We collect the least information needed to run The Event safely. We do not sell children’s information, use it for targeted advertising or profiling, or ask children to trade their privacy for participation. Every AI activity in The Event is a pre-designed simulation with no live AI, so Participants’ work is never sent to an AI provider.

1.5 Plain-language summary for Participants. A short version of this Policy written for 10–12-year-olds (see the Schedule at the end) is emailed to the Parent with the booking confirmation so they can go through it with the Participant, and shown again in the Event Hub on Day One of each intake. It tells Participants what we collect, why, who can see it, what choices they have and where to get help.

1.6 Inconsistency. This Policy should be read with the Terms. It does not change the fee, Refund Policy or School Holiday Program iPad Giveaway terms set out in the Terms. Where the Terms do not address how a child’s personal information is handled, this Policy applies and we apply the requirement giving the greater protection to the child, subject to law.

2.1 National baseline. GDOS handles personal information in line with the Privacy Act 1988 (Cth) and the 13 Australian Privacy Principles (APPs), even though, as a small business with annual turnover under $3 million, GDOS is exempt from the Privacy Act. We choose to align with it because families and schools should expect the same protection from us as from a large organisation.

2.2 Children’s Online Privacy Code. The OAIC must register a Children’s Online Privacy Code by 10 December 2026 (OAIC). The Event is an online service built for children. Because GDOS is exempt, the Code will not legally bind us, but we voluntarily align with it where practical for an organisation of our size.

2.3 States and territories. Participants may join from anywhere in Australia.

2.4 Schools and education departments. For school group bookings, we also follow the school’s and education department’s privacy, child-safety and ICT requirements, as set out in clause 5.6.

3.1 Minimum necessary. We collect only what we need to deliver The Event, keep Participants safe, process payments, run the iPad Giveaway and meet our legal obligations. The table below sets out what we collect for each part of The Event.

3.2 Accessibility and wellbeing information. A Parent may choose to tell us about a Participant’s accessibility, learning or participation needs so we can support her. This is sensitive information. We collect it only with the Parent’s consent, and we ask the Parent to check with the Participant that she is comfortable with us knowing.

3.3 Information in The Terms. The Terms list the categories of Participant information we may handle. We manage each of these under this Policy and collect each one only where it is needed for The Event.

3.4 Anonymity and pseudonymity. Participants take part using a Flex name rather than their real name. Parents will need to identify themselves for us to manage a booking and when making general enquiries and for requesting Help Desk assistance.

3.5 Information from others. We may receive information about a Participant from her school (for group bookings), a scholarship sponsor, or a Parent of another Participant reporting a safety concern. We manage it under this Policy.

3.6 Unsolicited information. If we receive personal information we did not ask for and do not need, we will destroy or de-identify it as soon as practicable, unless the law or a child-safety concern requires us to keep it.

4.1 Purposes. We use personal information to:

• process bookings, payments, scholarships, school group bookings and waitlists;
• set up and manage Event Hub and Flex Island accounts;
• deliver the daily AI Flex challenges as pre-designed lab simulations and record completion;
• provide Flex Help Desk support;
• keep Participants safe online, moderate activity and respond to concerns;
• administer the iPad Giveaway as set out in the Terms;
• send Event communications to Parents;
• send marketing about GDOS programs to Parents who have opted in;
• improve future programs using de-identified or aggregated information; and
• meet our legal, tax, audit and child-safety obligations.

4.2 No secondary use. We do not use personal information for any other purpose unless the Parent consents or the law allows or requires it.

4.3 Parent consent. All Participants are aged 10–14. Before collecting a Participant’s information, we obtain the consent of her Parent at booking. Consent is informed, voluntary, current and specific. At booking, the Parent ticks separate boxes, none of them pre-ticked, to confirm they are 18 or over and the Participant’s parent or legal guardian and give permission for her to take part; accept the Terms; and consent to this Policy. We check that the booking name matches the paying adult and send a confirmation email so a Parent can tell us if a booking was made without their knowledge.

4.4 The child’s voice. Parent consent does not remove the Participant’s own rights. We explain to Participants, in age-appropriate language, what we collect and why, and we take their views seriously. A Participant can ask a Parent, a GDOS facilitator or the Help Desk to raise privacy concerns for her.

4.5 Event communications. As stated in the Terms, by registering for The Event a Parent consents to receiving communications about The Event, such as booking confirmations, login details, intake reminders, safety notices and Giveaway notifications. These go to the Parent’s email or mobile, not to the Participant.

4.6 Marketing. Every marketing message includes an unsubscribe option, and Parents may opt out at any time by contacting [email protected]. We never send marketing to Participants.

4.7 Withdrawing consent. A Parent may withdraw consent at any time by contacting us. If the information is essential to The Event (for example, an Event Hub account), withdrawal may mean the Participant can no longer take part. Fees remain subject to the Refund Policy in the Terms.

4.8 Automated decisions. No decision with a significant effect on a Participant is made solely by an automated system. The iPad Giveaway winner is chosen by random electronic draw as set out in the Terms, and completion is based only on whether all seven daily Flex activities were submitted, never on the quality of the work.

4.9 Best interests of the child. Where a Parent’s request and a child’s safety conflict, safety comes first.

5.1 Event Hub accounts. Each Participant receives a Flex name and an event-only sign-in managed by GDOS. Login details are sent to the Parent. As the Terms require, Parents and Participants must keep passwords confidential. GDOS staff will never ask for a password.

5.2 Flex Island and live sessions. Flex Island activities are set to the safest practical settings by default:

• Participants appear only by Flex name and avatar;
• Participant cameras and microphones are off and are useable;
• leaderboards, badges and polls show Flex names and state only;
• Flex Island is single player, with no chat or messaging between Participants and;
• There are no recordings of any personal identifiers such as personal faces or voices.

5.3 AI Flex challenges: a pre-designed simulation with no live AI. Every daily Tech Time is a pre-trained lab simulation designed and built by GDOS, so Participants learn how AI works behind the scenes in a fun, safe, controlled environment. Its safety features are:

• No live AI. No AI model generates content during The Event. Every AI response Participants see is written in advance and checked by GDOS for girls aged 10–14.
• No typing. Participants choose from pre-set options, so there is no free-text box where personal or sensitive information could be entered.
• Nothing leaves Flex Island. Participants’ choices are never sent to an AI provider and are never used to train any AI model.
• Safe, controlled outputs. Every Participant sees the same age-appropriate responses, so there is no risk of unexpected, harmful or inappropriate AI content.
• Mistakes by design. Where the simulation shows AI getting something wrong, GDOS has scripted the error to teach Participants to question and check AI.
• Clearly labelled. Each Tech Time is labelled on screen as a lab simulation, so Participants know they are not talking to a real AI.
• Real-world safety skills. Participants still learn never to share their real name, address, school, photos or other personal information with an AI tool outside The Event.

Parents or Participants can report anything that worries them to a GDOS facilitator or the Help Desk at any time.

5.4 Certificates and keepsakes. Certificates and keepsakes show only the Participant’s Flex name and are delivered to the Parent’s email or the Event Hub.

5.5 School group bookings. Schools should provide GDOS with no more student information than the agreed program needs. We follow the school’s and education department’s consent, privacy, child-safety and ICT requirements.

5.6 Cookies and analytics. We keep tracking in child-facing areas to the minimum needed to run and secure The Event. We do not use advertising cookies, behavioural advertising or cross-site tracking in the Event Hub or Flex Island. Any analytics are assessed before use and, where practicable, de-identified.

6.1 People with access. Every GDOS director, staff member, facilitator, Help Desk team member, intern, contractor and volunteer who may interact with Participants or access their information must:

• hold a current working-with-children clearance for their role (for example, a Queensland Blue Card, or the equivalent in their state or territory);
• complete GDOS child-safety, privacy and cyber security induction;
• follow the GDOS Code of Conduct and keep information confidential; and
• report any child-safety, privacy or security concern immediately.

6.2 No private contact. Adults working on The Event must not contact a Participant privately, or outside approved GDOS systems. Only necessary contact with Participants to support them may only happen in the Event Hub, Flex Island or the Help Desk, where it is visible to GDOS and recorded.

6.3 Flex Help Desk. The Help Desk operates 7 days, 9 am–5 pm AEST, during The Event. It is a support channel, not a private relationship between an adult and a child. The Help Desk:

• uses GDOS organisational accounts only, with role-based access;
• collects only what is needed to resolve the issue;
• never asks for passwords or payment card numbers;
• keeps a record of each enquiry and how it was handled;
• prevents downloading or sharing of Participant information outside GDOS systems.

6.4 Safeguarding concerns. If a message or activity suggests a Participant may be at risk of harm, normal Help Desk handling stops, and the matter is escalated under GDOS’s Child Safety and Incident Response procedures. We may share information with police, child-protection authorities, the eSafety Commissioner, a school or the Parent where the law requires it or it is necessary to protect a child, as the Terms allow for disclosures required by law.

6.5 Online harm. Participants and Parents can report unsafe behaviour, bullying or inappropriate content to a facilitator or the Help Desk. We may restrict or remove a user’s access to protect others, as set out under Termination in the Terms. Serious online harm can also be reported to the eSafety Commissioner at esafety.gov.au.

6.6 No penalty for speaking up. A Participant will never be penalised for raising a genuine privacy or safety concern.

7.1 When we disclose. Consistent with the Confidentiality section of the Terms, we do not ordinarily disclose personal information to third parties. We disclose it only:

• to service providers who help us run The Event on our behalf, under contract (clause 7.2);
• where required or authorised by law, judicial process or a government authority, including mandatory child-safety reporting;
• where necessary to prevent a serious threat to a child’s life, health or safety;
• to a school, for that school’s group booking; or
• with the Parent’s consent.

7.2 Our service providers. The table below lists the main types of providers we use. Each is bound to use the information only to provide its service to GDOS, keep it secure, notify us of breaches, and return or delete it when the service ends. A provider must not use Participants’ information to advertise, profile, train unrelated AI models or build its own datasets.

7.3 Overseas disclosure. Where information is stored or processed overseas, we take reasonable steps under APP 8 to make sure the provider handles it in a way consistent with the APPs. We prefer providers that store Participants’ information in Australia where a suitable option exists.

7.4 iPad Giveaway. The Giveaway is open to Australian residents over the age of 18. In line with the Terms:

• The winner is notified by the email address used during paid registration, within two business days of the draw;
• The winner verifies their identity and eligibility before the prize is awarded;
• The winner’s first initial and surname are published on the GDOS website and social media channels on 1 February 2027 and remain published for at least 30 days;
• The winner’s name and Australian postal address are given to Australia Post to send the prize by registered post; and
• No child is identified in any winner publicity, and the child is never asked for any details.

7.5 We never sell information. We never sell, rent or trade personal information, and never share Participants’ information for advertising.

8.1 Security. We protect personal information with controls informed by the ASD Essential Eight.

8.2 Retention. As the Terms state, we retain information to administer The Event and the iPad Giveaway. We keep it no longer than needed, then securely delete or de-identify it, as set out below.

8.3 Data breaches. Any suspected loss, unauthorised access to, or misuse of personal information must be reported to GDOS immediately. We will contain the breach, protect affected children, preserve evidence and assess it within 30 days. If it is an eligible data breach under the Notifiable Data Breaches scheme, we will notify the OAIC and the affected Parents as soon as practicable and tell them what they can do to protect themselves. We will also notify a school or other authority where required.

8.4 Your part. Parents and Participants help keep accounts safe by keeping passwords confidential, as the Terms require, signing out on shared devices, and telling us straight away if they think an account has been misused.

9.1 Your rights. Parents, and Participants with their Parent’s help, may contact us to:

• ask what information we hold about them;
• request access to it or correction of it;
• ask how it is used, who it is shared with and how long we keep it;
• withdraw consent or opt out of marketing;
• ask us to delete their information; or
• raise a privacy or child-safety concern.

9.2 How we respond. We will verify the requester’s identity, respond within 48 hours, and handle every request respectfully and in a child-focused way, explaining our answer in plain words a child can understand. When a Parent or Participant asks us to delete information, we will delete it, not just de-identify it, unless the law requires us to keep it (such as tax records), it is needed to protect a child’s safety, or it relates to a legal claim. There is no charge to make a request. If we refuse a request, we will explain why in writing and how to complain.

9.3 Complaints. Please contact us first so we can try to resolve your concern. If you are not satisfied with our response after 30 days, you may complain to the Office of the Australian Information Commissioner at oaic.gov.au or on 1300 363 992. Online safety complaints can also be made to the eSafety Commissioner.

9.4 Contact. Privacy and Child Safety Officer: Petriea Skitek, Managing Director, Girls Day Out in STEM. Email: [email protected]. During The Event, the Flex Help Desk is available 7 days, 9 am–5 pm AEST.

9.5 Changes to this Policy. We may update this Policy by posting a revised version on our website, as with the Terms.

9.6 Review. We will review this Policy on an as needed basis.

9.7 Governing law. This Policy is governed by the laws of Queensland, Australia.

Thank you,

Team Girls Day Out in STEM

Hi!

Here is how we look after your information.

• What we know about you: your first name, school and state. Your parent/guardian gives us this when they book.
• Why we need it: so you can log in, participate in Flex Island activities, do your daily Flex challenges and get help if something goes wrong.
• Who can see it: only the GDOS team who run the Event. Other girls only see your Flex name and state on the leaderboard. We never sell your information.
• AI in Flex is a safe practice lab: every AI answer was made in advance by the GDOS team, there’s no typing, and nothing you choose is sent to live AI. Remember, never type your real name, address or share photos into an AI tool.
• Your choices: you or your parents/guardian can ask to see your information, fix it, or delete it.
• Feel unsafe or need help? Tell your parent/guardian, a GDOS Flex facilitator or the Flex Help Desk (9 am–5 pm, every day). You will never get into trouble for speaking up.
• When we delete it: your Flex Island account and activities are deleted 7 days after completion of your program.

Thank you,

Team Girls Day Out in STEM