Student Privacy Information
Introduction
Microsoft Office 365 (O365) provides students with access to twenty-first century learning tools to support their education. This document provides information on the data collected during students use of O365 and Microsofts commitment to managing that data.
What data is collected?
Users control the information that is transferred to, and stored by, Microsoft in O365. This may include text, images, photographs, sound and multimedia.
In addition, in the course of using the O365 service and in order to deliver the service, Microsofts systems will generate some information such as logs about user access to the O365 services.
How is the data used?
Microsoft does not use this collected information to track users online activities or build profiles for behaviour analysis or other commercial purposes.
Microsoft does not use, access or collect this data for any other reason other than to provide the Office 365 services to users - in particular, Microsoft will not use or disclose user data for advertising purposes.
The ACT Education Directorate has ensured through its contract with Microsoft governing the delivery of O365, that there are a number of express commitments relating to user data. These include:
- Ownership of user data rests at all times with users, and not Microsoft.
- Microsoft will meet stringent international standards that are generally acknowledged as the benchmark for providers of Online Services.
Is the data secure?
Physical data centre access is restricted to authorised personnel and multiple layers of physical security are implemented. Microsoft personnel are only able to access user data in extremely limited circumstances and subject to rigorous approval and oversight.
Microsoft use subcontractors to perform a variety of support services for O365. Examples of these include, physical hardware maintenance, technical support and facilities services (e.g. security guards at data centre locations).
Microsoft will only disclose data at the direction of the ACT Education Directorate or if compelled to do so by law.
The O365 service incorporates a large number of privacy controls. Privacy controls are enabled by default for all customers of O365.
When is the data deleted?
Microsoft will remove all user and associated data from its systems when the ACT Education Directorate removes a user account from the system.
Where is the data?
For the O365 service, user data is stored predominantly in data centres situated in Hong Kong and Singapore.
Microsoft Office 365 Privacy Information
Microsoft's approach to privacy, security and transparency with O365 is accessible at http://www.trustoffice365.com.
Further information:
- http://www.microsoft.com/en-us/twc
- http://www.microsoft.com/contracts
- https://www.microsoft.com/en-us/legal/default.aspx