Privacy Policy

1. Who we are

Letts Learn Pty Ltd (ABN 77 683 713 028), trading as Vero Education (Vero, we, us), supplies a school administration and student-movement service to Australian schools.

You can contact our Privacy Officer at support@vero.education.

2. Scope and roles

For school and user data processed through the Vero service, the school determines the purposes for which that information is handled and Vero acts on the school's documented instructions. For information Vero collects for its own business purposes, such as website enquiries, demo bookings, service administration and security, Vero determines the handling described in this policy. Schools remain responsible for their own collection notices, authority, user access and use of school records.

Vero includes the main application, administration application and teacher web app, together with the providers and optional integrations listed below. Students do not receive Vero accounts or direct Vero support.

3. Information Vero handles

Depending on school configuration and the authorised Wonde or CSV source, Vero may handle:

• student and staff name, title, school email, account or source identifier, role and profile image;
• school, year, house, registration group, class, subject, room and timetable relationships;
• gender and date of birth where supplied by the school's authorised source to distinguish or organise records;
• movement/pass origin, destination, departure, arrival or return and duration;
• late-to-class, uniform, positive-values and other authorised school-workflow records;
• authentication, session, role, administrator, audit and security records;
• support reports, authorised attachments and service communications; and
• IP address, browser/device, request, error and operational metadata created by the service and its providers.

Required and optional profile fields depend on the school's source and configuration. Only mapped CSV fields required for Vero are imported. Unexpected personal information supplied in a note, import, upload or support report is not used for a new purpose; if it is not reasonably necessary or lawfully retainable, Vero deletes or de-identifies it as soon as practicable and coordinates with the responsible school.

4. How we collect information

We collect information from the contracting school, an authorised CSV or image upload, a school-authorised Wonde connection, authorised school staff, optional Microsoft Entra sign-in, people who contact or book with us, and the technical operation of the service and website.

There is no public account sign-up. Schools authorise and manage staff access, and Vero support is provided through authorised school staff rather than directly to students.

5. How information is used

We use information to:

• deliver the contracted school functions and authorised integrations;
• authenticate users and enforce school and role permissions;
• secure, monitor, troubleshoot, support and recover the service;
• respond to access, correction, deletion, export, complaint and incident requests;
• respond to enquiries, understand website use and send relevant product news or offers with consent;
• communicate service, security, privacy and contractual changes; and
• comply with law and protect people, schools and the service.

Vero does not sell personal information or use school or user data for third-party advertising or to train AI models.

6. Public website, enquiries and cookies

When a person visits vero.education, requests a demo, asks for a quote, books a meeting, submits a form or sends email, Vero may handle the contact and school details they choose to provide, the request content, page and referral attribution, IP address, browser/device metadata, and security or error information.

Vero uses first-party cookies and identifiers to understand website use, connect enquiries with earlier visits, manage bookings and protect the site. A visitor identifier may remain for up to 365 days and a session identifier for up to one day. Vero does not use third-party advertising trackers on this site.

Vero may use contact details to respond to enquiries, provide service communications and send relevant product news or offers. Marketing emails are sent with consent and include a way to unsubscribe.

7. Service providers and countries

Vero uses the providers below to operate the service. Core school records in the primary application database and the Wonde synchronisation workload are hosted in Sydney, Australia, with encrypted backups also hosted in Australia. Website requests, security metadata and some email information may be handled through overseas edge or service infrastructure as shown below.

Vero reviews new providers before use and gives notice of material changes as described below.

8. Storage, retention, export and deletion

Core database and file records are held for the active school contract or a shorter school-instructed period. Following a validated termination or deletion instruction, active records are targeted for removal within 30 days and recoverable backup copies expire within 90 days, subject to an applicable legal hold or an agency-approved records requirement.

Security-relevant logs target 12 months where supported; error records target 90 days; closed support records target 12 months. Provider-supported periods are documented and minimised. Recovery copies are access restricted and encrypted. If deleted data is restored during disaster recovery, Vero re-deletes it before ordinary service resumes.

Schools retain control of their school and user data and remain responsible for their records obligations. Any agreed retention, export, legal-hold or disposal requirements take priority over Vero's default periods.

9. Access, correction, deletion, export and complaints

An individual or authorised school may request access to, correction of, deletion of or a reusable export of personal information by emailing support@vero.education. Vero verifies identity and authority, coordinates with the responsible school, explains lawful exceptions and provides written deletion confirmation on request.

Privacy complaints use the same contact. We will acknowledge the complaint, investigate it and aim to provide a written response within 30 calendar days. If more time is reasonably required, we will explain why and provide an updated timeframe. If a complaint remains unresolved and the Privacy Act applies, Australian individuals may contact the Office of the Australian Information Commissioner.

10. Security and incidents

Vero uses school and role access restrictions, multi-factor authentication for privileged access where supported, encryption in transit and at rest, managed hosting, monitoring, secure development, backups and incident/recovery procedures.

If a security or privacy incident affects a school, Vero will contain and investigate it and notify the school without undue delay, then notify individuals or regulators where required by law or the applicable agreement. Notifications provide the relevant facts available at the time and are updated as the investigation progresses.

11. Notice before material changes

Vero gives affected school administrators at least 30 calendar days' notice before a planned material change to this policy or the School Service Terms, the purposes for handling school or user data, or the service providers and countries used to handle it.

If prior notice is not possible because of law, an emergency or circumstances outside Vero's reasonable control, notice is provided as soon as practicable.

12. Contact

Privacy Officer
Letts Learn Pty Ltd / Vero Education
support@vero.education