Privacy Policy

1 Overview

BadgeTrust ("we", "us", "our") operates the certificate verification platform at badgetrust.info. We are committed to protecting the privacy of everyone who uses our platform — whether you are a student whose certificate is stored, an employer verifying a credential, or a training organisation issuing certificates.

This Privacy Policy explains what personal information we collect, why we collect it, how we use it, and your rights under the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs).

2 Information We Collect

2.1 Certificate holder information

When a registered training organisation issues a certificate through BadgeTrust, the following information is stored:

• Full name of the certificate holder
• Email address (if provided at time of issue)
• Course name and qualification code
• Issuing organisation name
• Issue date and expiry date (where applicable)
• Unique certificate code and QR code

2.2 Verification activity

When a certificate is verified via our platform, we log:

• The certificate code that was looked up
• Date and time of the verification request
• IP address of the requesting party

Verifiers are not required to create an account or provide personal information to perform a verification lookup.

2.3 Contact form

If you contact us via the contact form, we collect your name, email address, and the content of your message.

2.4 Technical data

We automatically collect standard server log data including IP addresses, browser type, referring URLs, and pages visited. This is used solely for security monitoring and platform performance.

3 How We Use Your Information

We use the information we collect exclusively for the following purposes:

• Operating the verification service — storing and returning certificate records in response to legitimate lookup requests.
• Delivering certificates — emailing a certificate PDF to the holder at the time of issue, where an email address was provided.
• Fraud prevention — detecting and preventing abuse, forgery attempts, and unauthorised access to the platform.
• Responding to enquiries — replying to contact form submissions.
• Platform improvement — using aggregated, anonymised usage data to improve the service.

We do not use your personal information for marketing purposes. We do not build profiles of verifiers or share individual verification activity with certificate holders.

4 Disclosure to Third Parties

We do not sell, rent, or trade personal information. We may share information only in the following limited circumstances:

• Hosting and infrastructure providers — our web hosting provider processes data as part of normal server operation. They are contractually bound to handle data securely and not to use it for their own purposes.
• Email delivery — when we send certificate emails, we use SMTP services. Only the recipient email address and certificate PDF are transmitted.
• Legal obligation — if we are required to disclose information by law, court order, or government authority.

All third-party service providers used by BadgeTrust are required to handle personal data in a manner consistent with this policy.

5 Data Storage & Security

Certificate records are stored in a secured MySQL database hosted in Australia. We implement the following safeguards:

• TLS encryption on all data in transit (HTTPS enforced site-wide)
• Access to the admin panel is protected by authentication and rate limiting
• Sensitive directories are blocked from public access via server configuration
• Session-based access controls with automatic timeout

While we take all reasonable steps to protect personal information, no method of electronic storage or transmission is 100% secure. If you become aware of a security concern, please contact us immediately at info@badgetrust.info.

6 Retention Period

Certificate records are retained indefinitely by default to ensure that verifications can be performed years after a qualification is issued — consistent with how RTOs are required to maintain training records under the Standards for Registered Training Organisations (RTOs) 2015.

If a certificate holder or issuing organisation requests deletion of a record, we will assess the request in accordance with applicable law. Contact us at info@badgetrust.info to make such a request.

Contact form submissions are retained for 12 months and then deleted.

7 Your Rights

Under the Australian Privacy Principles, you have the right to:

• Access personal information we hold about you
• Correct inaccurate, incomplete, or outdated information
• Request deletion of your personal information (subject to legal retention requirements)
• Complain about how we have handled your information

To exercise any of these rights, please contact us using the details below. We will respond within 30 days.

If you are not satisfied with our response, you may lodge a complaint with the Office of the Australian Information Commissioner (OAIC) at oaic.gov.au.

8 Cookies

BadgeTrust uses only essential session cookies required for the secure operation of the admin panel. We do not use tracking cookies, advertising cookies, or any third-party analytics scripts on the public-facing pages of this site.

Public visitors can use the certificate verification function without any cookies being set.

9 Changes to This Policy

We may update this Privacy Policy from time to time. When we do, we will revise the "Last updated" date at the top of this page. We encourage you to review this policy periodically.

Continued use of the platform after changes are posted constitutes acceptance of the updated policy.

10 Contact Us

For any privacy-related enquiries, access requests, or complaints, please contact us: