^® Workstyle Assessment

1. Overview

This Privacy Policy explains how the PRISM® Workstyle Assessment ("PRISM") collects, uses, stores, and protects personal information when participants, organisations and schools use the platform.

PRISM® is used by adults and by school-age participants alike. Adults join directly with an access code from their facilitator or organisation. For participants under 18, PRISM® is offered through their school or organisation, which is responsible for obtaining the necessary parental or guardian consent at enrolment and acts on behalf of the parent or guardian in authorising participation. We rely on that authorisation for under-18 access.

Where your data is stored. All PRISM® data is hosted in Australia, on Supabase Postgres infrastructure in the Sydney (ap-southeast-2) region. Your personal information is not transferred or disclosed overseas as part of normal operations, with one exception: card payments for Master Facilitator seat purchases are processed by Stripe, which handles that transaction data in the United States. PRISM® never sees or stores card numbers.

We are committed to handling your information consistent with the Australian Privacy Principles (APPs) under the Privacy Act 1988 (Cth) and applicable Queensland privacy legislation.

Privacy contact:

• Email: info@beacon-star.com

2. What we collect

We collect only the information needed to run the assessment, give you your result, and meet our legal and accountability obligations.

2.1 When you start

• First name and last initial for assessment-only Workstyle and Leadership Profiles; first name and full last name for full courses and certification programmes.
• We do not collect an email address from participants taking the assessment.
• Age band (14–17 or 18 and over), used to apply the right rules and age-appropriate content.
• A few brief profile questions (such as gender and region), each answerable with “prefer not to say”, used for cohort-level insight.
• Access code provided by your facilitator, organisation or school.
• You create a password when you start. Together with your name and access code, it lets you return to your work later from any device.
• Acknowledgment that you have read this Privacy notice, with a timestamp.

2.2 During the assessment

• Your responses to the 20-item PRISM® Workstyle self-assessment.
• Progress markers (which step you are on and time on each step).
• Your computed PRISM® profile (Workstyle, or Leadership including your archetype).

2.3 Operational data

• Standard server logs from our hosting and CDN providers (timestamps, IP address, user-agent string), used for security, abuse prevention, and platform performance.
• Audit-log entries recording significant operational events (facilitator sign-ins, admin actions) for accountability and security investigations.

2.4 Demographic information

During profile setup we ask a short set of demographic questions, your age band, gender, work or study status, typical team role, region, time spent living or working overseas, and how many languages you speak. These answers are used only in de-identified, grouped form to understand who takes part, support benchmarking and evaluate the PRISM® framework. They are never published against your name.

What we do not collect

• Date of birth (only the broad age band).
• Health or financial information, or special-category sensitive information such as ethnicity, religion, or health.
• Camera, microphone, or location data.
• Third-party tracking, advertising, or social-media identifiers.

3. Why we collect it

We collect and use your information to:

1. Run the assessment. Present the introduction and questions, record your answers, and compute your PRISM® profile.
2. Authenticate administrators and Master Facilitators. Confirm their email, sign them in, send password resets, and protect their accounts. Participants need no account.
3. Give you your results. Show your profile on screen at the end so you can save or print it.
4. Honour your rights. Respond to requests to access, correct, or delete your data.
5. Protect the platform. Detect and prevent fraud, abuse, or unauthorised access.
6. Comply with law. Respond to lawful requests from regulators or courts, and meet record-keeping obligations.

We do not use your data for marketing, profiling for advertising, or automated decision-making that affects your legal rights.

Participation in PRISM® includes the use of de-identified responses and scores to improve the assessment, evaluate the PRISM® framework, support benchmarking, and produce aggregate research and analytics. This research data does not identify individuals. You may request deletion of identifiable or account data; de-identified data may be retained as described in section 5.

4. How we store and protect it

4.1 Where it lives

All identifiable PRISM® data is stored on Supabase Postgres, hosted in the Sydney region (ap-southeast-2). Static frontend assets are served via Cloudflare's content delivery network with edge presence in Australia. Data is not transferred or disclosed overseas as part of normal operations.

4.2 How it's protected

• Encryption at rest: The database is encrypted at rest by our hosting provider.
• Encryption in transit: All data exchanged between your browser and our systems uses HTTPS with TLS 1.2 or above.
• Access control: Database access is gated by Row Level Security policies. Participants see only their own data. Authorised programme staff — administrators and Master Facilitators — see only what their role allows, and Master Facilitators only the cohorts they manage.
• Passwords: Stored as cryptographic hashes by our authentication provider. Our staff never see your password.
• Audit log: Significant operational events are recorded in an audit log used for accountability and security investigations.
• Security headers: The platform enforces strict transport security, content-security policies, and frame-blocking to reduce the risk of common web attacks.

4.3 Service providers

We do not use third-party analytics, advertising trackers, or AI services that would link your responses to cross-site profiles.

4.4 Cookies and local storage

PRISM® uses only functional storage on your device, a sign-in session token and your language preference. We do not use advertising, analytics, or cross-site tracking cookies.

4.5 Data breaches

If a data breach occurs that is likely to result in serious harm, we will notify the affected individuals (and, for participants under 18, their school or organisation) and the Office of the Australian Information Commissioner, as required by Australia's Notifiable Data Breaches scheme. We maintain an incident-response process to contain and investigate breaches.

5. How long we keep it

We retain personal information for as long as is reasonably necessary for the purposes set out in this policy and to meet our legal and accountability obligations.

• Identifiable account data (name, email, sign-in, course progress and reflections): kept while you are taking part, then removed 12 months after your last activity, unless you ask us to delete it sooner. This applies to everyone, including participants under 18. Your course access ends at the same time, so save or print your profile before then.
• De-identified assessment responses and scores: when your record is removed, your answers and scores are kept for evaluation of the PRISM® framework and aggregate research, separated from your identity. They hold no name, email, account, reference code or cohort name, only the month you finished, and cannot be linked back to you.
• Certificates, payments and audit logs: a certificate’s verification details (its code, your first name and last initial, the credential and the date) are kept so it can still be checked; payment records are kept for as long as the law requires; audit-log entries are retained for accountability and security purposes.

You can ask us to delete your identifiable data at any time. We will action a deletion request within a reasonable time, generally within 30 days, except where law or accountability obligations require us to keep specific records.

6. Sharing your information

We share your information only:

• With your facilitator and programme staff. They can see your first name and the last-name detail required for your activity (last initial for assessment-only profiles, full last name for full courses and certification), participation and completion status, and your PRISM® profile result (your dimension scores). They cannot see an email address for you, because none is collected, and they cannot see your individual recall-quiz or scenario answers, or your private reflections.
• With the service providers listed in section 4.3. They process data on our behalf under contract and only for the purposes set out above.
• Where required by law. For example, a lawful regulator request, court order, or child-safeguarding obligation.

We do not sell your information.

7. Your rights

7.1 Access

You can ask us what personal information we hold about you. We will respond within a reasonable time, generally within 30 days.

7.2 Correction

If any information is inaccurate (for example, your name is recorded wrong), tell your facilitator and we will correct it.

7.3 Deletion

You can ask us to delete your identifiable data. We will action the request within a reasonable time, generally within 30 days, except where law or accountability obligations require us to keep specific records.

7.4 Stopping participation

You can stop using PRISM® at any time and may ask us to remove identifying or account information. De-identified responses already separated from your identity may be retained for PRISM® evaluation, benchmarking and aggregate research. We cannot un-send results that have already been issued.

7.5 Parents and guardians

Parents and guardians of participants under 18 may request to see or correct identifying information about their child, or ask for identifying/account information to be removed. Requests should typically be made through the school or organisation, who will pass them to us. De-identified responses already separated from identity may be retained for PRISM® evaluation, benchmarking and aggregate research. We may verify that the requester is the parent or guardian before acting.

8. Complaints

If you believe we have mishandled your information, please contact us first:

Email: info@beacon-star.com

We will respond within a reasonable time, generally within 30 days.

If you are not satisfied with our response, you can escalate to the Office of the Australian Information Commissioner (OAIC):

Phone: 1300 363 992
Email: enquiries@oaic.gov.au
Website: oaic.gov.au

9. Certification, facilitators and public verification

Sections 2 to 8 describe taking the PRISM® assessment, where you do not create an account and we do not ask for your email address. Certification works differently, and this section says how.

If you take part in a certification programme

• You hold a sign-in account. It carries your name and, depending on how your organisation sets you up, either your email address or a PRISM Sign-in ID.
• We record your progress through the certification course, and where the programme includes an exam, your result, your score as a percentage, and how many attempts you have made.
• When your certification is approved, we issue a certificate carrying your name, the credential, the date, and a unique reference code.

Public verification of certificates

Anyone holding a certificate’s reference code can check it on our verification page without signing in. This is how an employer or a partner organisation confirms a credential is genuine. The page deliberately shows the least it can: your first name and the initial of your last name, the credential, the date it was issued, and whether it is still valid. It never shows your email address, your assessment answers, your profile, or your exam score. Nobody can browse or search the certificates: verification only works if you have given someone the code.

If you are a facilitator or a Master Facilitator

• We hold your name and either your email address or a PRISM Sign-in ID, so you can sign in and so we can send you the messages your programme requires.
• Your sign-ins and significant actions are recorded in the audit log described in section 2.3, for accountability and security.
• If you build an online course page, what you put on it is visible to the participants you share it with. Nothing you build is public.

Everything else in this notice, including your rights in section 7 and how to contact us in section 8, applies to certification participants and facilitators in the same way.

10. Changes to this policy

We may update this Privacy Policy from time to time to reflect changes in our practices or in the law. The "Last updated" date below indicates when the most recent change was published. Material changes will be communicated through the platform.

Current version: 2.3
Last updated: 20 October 2026

11. Contact us

Privacy contact: info@beacon-star.com
Website: assessment.beacon-star.com