Legal

Kestrel subscriber agreement

Version 1.0 ·Updated 2026-11-01

Next reviewed by 2027-02-28.

Written for business managers and principals deciding whether to sign, and whoever reads it first.

For schools in Australia. Version 1.0, 25 October 2026.

Parties

1. Hoverpoint.io Pty Ltd (ABN 87 703 233 667) of Level 1, 60 Martin Place, Sydney NSW 2000 (Hoverpoint, we, us, our).

2. The school named as the Subscriber in the Order Summary (Subscriber, you, your).

Background

A. Hoverpoint provides Kestrel, a student information system for schools, as an online service.

B. The Subscriber wishes to use Kestrel to run its school, and Hoverpoint agrees to provide it on the terms of this agreement.

C. Each person who uses Kestrel also accepts the Kestrel Terms of Use, which cover their own account and conduct.

Key points

This summary helps you read the agreement. The terms that follow are the agreement.

  • Your school owns every record in Kestrel. We hold them only to provide Kestrel to you.
  • You pay monthly in arrears, for the students active in Kestrel in each month, at the price of your plan.
  • You can leave at the end of any month, and export your records at any time and for 60 days after you leave.
  • Your records are stored in Australia, encrypted at rest and in transit, and never used to train an artificial intelligence model.
  • Kestrel acts only on an instruction from one of your users, and artificial intelligence features run only where your school turns them on.
  • We tell you at least 30 days before a change to this agreement or to our sub-processors applies.

Part A: Order Summary

Kestrel produces the Order Summary when you sign up, and keeps the current one in Settings. A school that signs on paper completes the details below.

ItemDetails
Subscriber[Full legal name], ABN [ ], ACARA school ID [ ], [Registered address]
Related Entities (clause 3.3)[Name and ABN of each, or none]
Notice contact[Name, position, email]
Billing contact[Name, email]
Start date[Date of acceptance or signing]
Plan (clause 4)[Essentials or Plus]
Billing (clause 8)[Monthly in arrears, or Plus paid a year ahead for [number] Active Students]
Prices$[ ] per Active Student a month for the first 500, then $[ ], excluding GST
Payment method (clause 8.4)[Card or direct debit]
Implementation services (Schedule 5)[Quote reference, or none]
Special conditions[None]

How this agreement is made

A1 The person who signs your school up accepts this agreement for your school in Kestrel. By accepting it, they confirm that your school has authorised them to bind it. Kestrel records their name, role and email address, the version accepted, and the time and network address of the acceptance, and emails them a copy. Acceptance in Kestrel has the same effect as signing below.

A2 A school that prefers to sign may instead sign this agreement below, by hand or electronically. The words are the same either way.

Execution

Executed as an agreement.

Executed by Hoverpoint.io Pty Ltd (ABN 87 703 233 667) in accordance with section 127 of the Corporations Act 2001 (Cth)
Signature of directorSignature of director or company secretary
Name:Name:
Date:Date:
Executed by the Subscriber named in the Order Summary by its authorised representative
SignatureSignature of witness (optional)
Name:Name of witness:
Position:
Date:Date:

The person signing for the Subscriber warrants that they are authorised to bind the Subscriber.

Part B: General terms

1. Definitions and interpretation

1.1 In this agreement:

  • Active Student means a student whose enrolment in Kestrel is current on any day of a Month, for your school or a Related Entity. A student who starts or leaves part way through a Month is an Active Student for that Month.
  • Actions means the steps Kestrel carries out for you, as described in clause 9.
  • AI Features means the features of Kestrel that use an artificial intelligence model, as described in clause 10.1.
  • BBSY means the 30-day Bank Bill Swap Bid Rate published for the first Business Day of the Month in which the amount fell due, or, if it is not published, a comparable rate we reasonably choose.
  • Business Day means a day other than a Saturday, Sunday or public holiday in New South Wales.
  • Fees means the amounts payable under clause 8 and the Order Summary.
  • Integration means another system you connect to Kestrel, such as a finance system, a payment provider, a learning platform, a government portal or your own artificial intelligence assistant.
  • Kestrel means our student information system, provided as an online service, including its user guide and documentation, as updated under clause 22.
  • Month means a calendar month.
  • Order Summary means Part A, as current in Kestrel's Settings or as signed.
  • Personal Information and Sensitive Information have the meanings given in the Privacy Act 1988 (Cth).
  • Plan means Essentials or Plus.
  • Records means all information entered into Kestrel by a User or through an Integration, and everything Kestrel produces from it, including reports, returns, messages, invoices and the record of what each User did.
  • Related Entity means an entity that is part of or controlled with your school and is named in the Order Summary, such as a foundation, a building fund, an early learning centre or a sister school under the same governing body.
  • Service Data means technical and usage information about how Kestrel operates, in aggregated and de-identified form, that does not identify and cannot reasonably be used to identify your school, a User or any other person.
  • Sub-processor means a third party we engage that handles Records to provide Kestrel, as listed in Schedule 4.
  • Terms of Use means the Kestrel Terms of Use that each User accepts.
  • User means any person you give access to Kestrel, including your employees, contractors and volunteers, your students, and their parents and carers.

1.2 Headings are for convenience only. The singular includes the plural. "Including" means including without limitation. A reference to legislation includes any amendment or replacement of it. All amounts are in Australian dollars. No rule of interpretation applies against a party because it prepared this agreement.

2. How the documents fit together

2.1 This agreement is made up of the Order Summary, these general terms and the Schedules. It is the whole agreement between us about Kestrel, and replaces the Kestrel Terms of Service as between us.

2.2 If documents differ, they apply in this order, highest first:

  • (a) special conditions in the Order Summary;
  • (b) these general terms;
  • (c) the Schedules; and
  • (d) the Terms of Use.

2.3 Each User accepts the Terms of Use before using Kestrel. The Terms of Use cover that person's account and conduct. They do not change this agreement, and they do not give you or a User an obligation greater than this agreement gives you. We will not recover the same loss twice, under this agreement and under the Terms of Use.

2.4 Our privacy policy is not part of this agreement and is not changed by it. Our binding commitments to you about personal information are in clauses 12 and 13 and Schedules 2 and 3. Nothing in this agreement reduces what we owe any person under privacy law.

2.5 Clause 20 (Australian Consumer Law) applies over every other part of this agreement.

3. What we provide

3.1 We grant you a non-exclusive, non-transferable right, for the term of this agreement, to use Kestrel to run your school, and to let Users use it for that purpose.

3.2 We will provide Kestrel with due care and skill, using people with the right skills and experience. Kestrel will work materially as its user guide describes.

3.3 You may name Related Entities in the Order Summary. Each one may use Kestrel under this agreement, and its students count as your Active Students. You are responsible for each Related Entity as if it were you.

3.4 We will make Kestrel available and provide support in line with Schedule 1.

3.5 This agreement is for schools in Australia. A school, or a Related Entity, outside Australia needs a separate agreement with us.

4. Plans

4.1 Your Plan decides which parts of Kestrel are turned on. The parts in each Plan are described on our pricing page and in Kestrel.

4.2 Essentials is for a school of one campus and one entity, with up to 749 Active Students.

4.3 Plus is for a school of 500 or more students, or with more than one campus or entity. A Plus school pays for at least 500 Active Students in each Month.

4.4 You may move from Essentials to Plus at any time. The parts of Plus turn on straight away, and you pay the Plus price from the next Month. You cannot move from Plus back to Essentials.

4.5 If an Essentials school has 750 or more Active Students in two Months in a row, we will give you at least 90 days' notice, and your school then moves to Plus from the start of a Month. We never stop you enrolling students.

5. Users and accounts

5.1 You decide who is a User and what each User's role lets them see and do. You must remove a person's access promptly when they should no longer have it.

5.2 You are responsible for what Users do in Kestrel as if it were done by you, and for making sure they follow the Terms of Use.

5.3 You choose how Users sign in, from the methods Kestrel offers: your school's own sign-in, a passkey, or a one-time code sent by email. You must keep your own sign-in system secure where you use it.

5.4 Each of us must tell the other without undue delay, and within 24 hours, after becoming aware of any unauthorised access to Kestrel through your school's accounts or any compromise of a sign-in.

5.5 We act on instructions about your subscription only from your notice contact, your billing contact and Users with an administrator role in Kestrel.

6. Your records

6.1 Your school owns all Records. Nothing in this agreement transfers them to us.

6.2 You grant us a non-exclusive, royalty-free licence to store, copy, process, transmit and display Records only to the extent needed to provide Kestrel and to meet our obligations under this agreement. The licence ends when this agreement ends, subject to clause 17.

6.3 You warrant that, for the Records your school and its Users enter into Kestrel:

  • (a) your school collects the information lawfully, including under the Privacy Act;
  • (b) your school tells the people concerned what privacy law requires it to tell them, including that their information is held by a technology provider;
  • (c) your school has any consent the law requires, including for Sensitive Information; and
  • (d) your school and its Users are authorised to enter the information and to let us handle it as this agreement describes.

6.4 Kestrel is designed to be your school's system of record. You decide how long each kind of Record is kept, using Kestrel's retention settings, and we keep Records in line with those settings for the term of this agreement.

7. Your school's own duties

7.1 Your school remains responsible for its own legal duties, including:

  • (a) its duties of care to students and its child safety obligations;
  • (b) mandatory reporting and other reports it must make about a child;
  • (c) attendance reporting, and statutory returns such as the Census, the Nationally Consistent Collection of Data and reports to the education regulator in its state;
  • (d) the decisions it makes about enrolment, fees, discipline, wellbeing and assessment; and
  • (e) its registration and accreditation.

7.2 Kestrel helps your school carry out those duties. It does not take them over. Check what Kestrel produces before relying on it for a decision about a person, a statutory return, an invoice or a report to a government body.

7.3 We do not provide legal, financial, tax or child protection advice.

8. Fees and payment

8.1 What you pay. After each Month, you pay for the Active Students in that Month at your Plan's price per Active Student. A Plus school pays for at least 500 Active Students. Prices exclude GST.

8.2 Invoices. On the first day of each Month we issue a tax invoice for the Month before. It shows the number of Active Students. Throughout each Month, Kestrel shows your administrators the running count, the students it includes and the expected amount.

8.3 When you pay. We collect each invoice from your payment method when we issue it. A direct debit can take up to three Business Days to clear.

8.4 Payment method. You pay by card where an invoice is $5,000 or less including GST, and by direct debit from an Australian bank account where it is more. Kestrel asks for direct debit details before the first invoice above that amount.

8.5 Price changes. We may change our prices by giving you at least 60 days' notice. A change applies from the first Month that starts after the notice period ends. A price paid a year ahead does not change during that year.

8.6 Plus paid a year ahead. A Plus school may apply to pay a year ahead, at 12 times the Plus monthly price less 10%, for a number of Active Students it nominates. We invoice the year in advance, payable within 14 days, and the year starts when it is paid. During the year your Active Students are limited to the nominated number. An administrator may raise the number at any time and pays the difference for the rest of the year. At the end of the year your school moves to monthly billing unless it applies for another year.

8.7 Promotional codes. A code accepted at sign-up applies as its terms say, from the first invoice above $0.

8.8 Disputed invoices. If you dispute an invoice in good faith, tell us within 30 days of its date and pay the part you do not dispute. We will not suspend Kestrel, charge interest or treat you as late for an amount genuinely in dispute while we resolve it under clause 25.

8.9 Late payment. If a payment fails or is not made, we tell your billing contact and try again. If an amount is still unpaid:

  • (a) 14 days after we first tell you, Kestrel becomes read-only for your school;
  • (b) 30 days after we first tell you, we may suspend Kestrel under clause 15; and
  • (c) 90 days after we first tell you, we may end this agreement by notice.

8.10 Interest. We may charge interest on an amount not paid when due, at BBSY plus 5% a year, calculated daily from the due date until it is paid.

8.11 No Active Students. If your school has had no Active Students for 40 days, we may make Kestrel read-only after telling you, and turn it back on when you ask.

8.12 GST. Where a supply under this agreement is a taxable supply, the recipient pays an additional amount equal to the GST, on receiving a tax invoice.

9. Steps Kestrel takes for your school

9.1 Kestrel can carry out steps for your school, such as sending messages and invoices, collecting payments, submitting statutory returns, exchanging information with Integrations, and changing Records in line with rules your school sets.

9.2 Kestrel takes an Action only on an instruction from a User: when a User starts it, or through an automation that a User with authority to do so has set up and turned on. Your school decides who may give each instruction and whether a person must approve an Action before it takes effect.

9.3 Your school is responsible for the instructions and automations its Users set up, for setting up any approval step, and for making sure each Action meets its own obligations and the terms of each Integration it uses.

9.4 Kestrel records each Action: what was done, when, and on whose instruction. The record is kept in line with your retention settings and is available to your administrators.

9.5 Payments. Where Kestrel collects payments for your school, it does so through your school's own account with our payment provider. Your school is the merchant of record and receives the money directly. We never hold your school's money.

9.6 Clause 9.3 does not reduce our responsibility where an Action does not work as Kestrel's user guide describes, or where a loss is caused by our breach of this agreement or our negligence.

10. Artificial intelligence

10.1 Kestrel's AI Features. Each AI Feature is off until your school turns it on in Kestrel's settings. Your settings decide which AI Features are used, by which roles and within which limits, so their use stays within your school's own artificial intelligence policy. When an AI Feature is used, Kestrel sends the request and the Records needed to answer it, limited to what the User may see, to the model provider named in Schedule 4. The provider processes it in Australia and keeps nothing after answering.

10.2 Your own AI assistant. Your school may connect its own artificial intelligence assistant to Kestrel as an Integration. Your school decides, within its own policies and Kestrel's settings, what the assistant may read or do in Kestrel. Kestrel gives the assistant only what those settings allow and records each request it makes.

10.3 Your school's assistant, and its provider, are your school's choice and responsibility. We are not responsible for how the assistant or its provider handles, stores or uses information once Kestrel has given it to the assistant under your school's settings, or for what the assistant does with it.

10.4 Your school owns what Users ask and what AI Features produce. We do not use Records, requests or responses to train, fine-tune or improve any model, and each provider we use is bound not to.

10.5 What an AI Feature or an assistant produces may be incomplete or wrong. Users must check it before relying on it, especially for a decision about a person.

10.6 We may change the model or provider behind an AI Feature, as a change of Sub-processor under clause 12.6. Any replacement must meet the same commitments on location, retention and training.

11. Integrations

11.1 Your school may connect Integrations to Kestrel. When it does, your school:

  • (a) authorises us to read from and write to that system for your school, within the scope your school sets;
  • (b) warrants that it holds the licence or subscription that system needs, and that connecting it does not breach its agreement with the provider; and
  • (c) warrants that the User who set it up was authorised to do so.

11.2 Where an Integration offers a secure connection method, such as a token, your school must use it, and must not give us a person's own sign-in details for that system.

11.3 Your school must disconnect an Integration when its right to use that system ends.

11.4 The provider of each Integration is responsible for its system. We are not responsible for its availability or accuracy, or for what its provider does. If a provider changes or withdraws access, we will tell you as soon as we can and work with you on the effect.

11.5 You may import Records into Kestrel and export them from it at any time, using the tools Kestrel provides.

12. Privacy and where Records are held

12.1 Each of us must comply with the Privacy Act in connection with this agreement.

12.2 Your school decides why Personal Information in the Records is collected and how it is used. We handle it on your school's behalf, and only:

  • (a) to provide Kestrel and meet our obligations under this agreement;
  • (b) on your school's reasonable written instructions; and
  • (c) where the law requires, in which case we tell you unless the law prevents us.

12.3 We do not sell Records, and we do not disclose them to anyone except a Sub-processor to provide Kestrel, or where the law requires.

12.4 Location. We store Records in Australia, including primary storage, backups and logs, except where Schedule 4 says otherwise for a named Sub-processor and purpose.

12.5 Our people. Our people access Records only where their role requires it, under written confidentiality obligations, and every access is logged.

12.6 Changes to Sub-processors. We will give you at least 30 days' notice before adding or replacing a Sub-processor. If you object on reasonable data protection grounds and we cannot resolve it within those 30 days, you may end this agreement without penalty, and we will refund any Fees paid for the period after it ends.

12.7 We will help your school, reasonably and promptly, to respond to a request from a person to see or correct their information, to a complaint, and to an inquiry from the Office of the Australian Information Commissioner or another regulator.

12.8 Schedule 3 sets out the information we handle and our further commitments.

13. Security and data breaches

13.1 We will maintain the security measures in Schedule 2, including encrypting all data at rest and in transit.

13.2 Each of us must tell the other without undue delay, and within 48 hours, after becoming aware of any unauthorised access to, disclosure of, loss of or change to Records.

13.3 After such a notice, we will both:

  • (a) work together in good faith to investigate, contain and fix the incident;
  • (b) share what we find, as far as each of us lawfully can;
  • (c) consult each other before making a notice that names the other; and
  • (d) each keep responsibility for any assessment and notice we must make under Part IIIC of the Privacy Act.

13.4 Nothing in clause 13.3 delays either of us in meeting our own legal obligations.

14. Term

14.1 This agreement starts on the start date and continues month by month until it ends under this agreement.

14.2 You may end this agreement at any time from Kestrel's Settings or by notice. It ends at the end of the Month in which you end it, and we invoice that Month in the usual way.

14.3 Where your school has paid a year ahead, it may end the agreement at the end of that year. Fees paid for a year are not refunded if your school leaves early, except where clause 12.6, 16.2, 16.3, 22.3, 22.4 or 24.3 or Schedule 1 gives a refund.

15. Suspension

15.1 We may suspend your school's access to Kestrel, in whole or in part, only where:

  • (a) Fees remain unpaid 30 days after we first told you, as clause 8.9 allows;
  • (b) we reasonably believe continued access puts at material risk the security of Kestrel or the records of another school;
  • (c) a User is using Kestrel in material breach of the Terms of Use and your school has not stopped it after we asked; or
  • (d) the law requires it.

15.2 We will tell you before suspending, and give you a reasonable chance to fix the cause where it can be fixed. Where clause 15.1(b) or (d) needs immediate action, we will tell you as soon as practicable afterwards.

15.3 We will limit a suspension to what is reasonably necessary and end it promptly once the cause is fixed. Your school can still export its Records during a suspension, unless that would continue the risk in clause 15.1(b).

15.4 Fees continue during a suspension under clause 15.1(a), (c) or (d). If a suspension was not justified under clause 15.1, you do not pay for the period it lasted.

16. Ending this agreement

16.1 Either of us may end this agreement by notice if the other:

  • (a) commits a material breach that can be fixed and does not fix it within 30 days after a notice describing it;
  • (b) commits a material breach that cannot be fixed; or
  • (c) becomes insolvent, to the extent the law allows.

16.2 You may also end this agreement under clause 12.6, clause 22.3 or Schedule 1.

16.3 We may stop providing Kestrel to your school by giving at least 90 days' notice. If we do, we will refund any Fees paid for the period after it ends.

16.4 When this agreement ends, your right to use Kestrel ends, subject to clause 17, and you pay the Fees for the period up to the end. Each party's rights that arose before the end continue.

16.5 Clauses 1, 6.1, 7, 8, 12, 13, 16.4, 17, 18, 19, 20, 21, 23, 24 and 25 continue after this agreement ends, with any other clause that by its nature is meant to continue.

17. Exporting and deleting Records

17.1 Your school can export its Records at any time, in a common machine-readable format, at no extra charge.

17.2 For 60 days after this agreement ends, we keep the Records and your administrators can still sign in to export them.

17.3 After those 60 days, we delete the Records within 30 days, except copies in backups, which are deleted as the backups expire within 8 days, and anything the law requires us to keep.

17.4 We will confirm the deletion in writing if you ask.

17.5 If your school must keep Records for longer than 60 days after leaving, we can offer a read-only archive for a fee we quote.

17.6 Records we keep under this clause stay subject to clauses 12, 13 and 18 for as long as we keep them.

18. Confidentiality

18.1 Confidential information is information one of us gives the other that is marked confidential, or that a reasonable person would understand to be confidential. Records are your confidential information. Kestrel's design, our security information and our prices for your school are ours.

18.2 Each of us must keep the other's confidential information confidential, use it only for this agreement, and protect it with at least reasonable care.

18.3 Each of us may share the other's confidential information with our own officers, employees, contractors and advisers who need it for this agreement and are bound to keep it confidential.

18.4 Either of us may disclose it where the law, a court or a regulator requires. Where lawful and practicable, we will tell the other first and help limit the disclosure.

18.5 This clause does not apply to information that is public through no breach of this agreement, that the receiver already lawfully knew without a duty of confidence, or that the receiver developed independently.

19. Our intellectual property

19.1 We own Kestrel, including its software, design, user guide and documentation, and everything we create in providing it. Nothing in this agreement transfers those rights to you.

19.2 You must not, and must not let anyone, copy, resell or make Kestrel available to anyone other than Users, reverse engineer it except where the law allows, use it to build a competing product, or test its security without our written permission.

19.3 We may use Service Data to operate, secure, support and improve Kestrel, and to produce statistics. We will not disclose Service Data in a form that identifies your school, a User or any other person.

19.4 We may use your feedback without owing you anything, provided it contains no Records or other confidential information of yours.

20. Australian Consumer Law

20.1 Nothing in this agreement excludes, restricts or modifies any guarantee, condition, warranty, right or remedy your school has under the Competition and Consumer Act 2010 (Cth), including the Australian Consumer Law, or under any other law, where doing so would be against that law or make part of this agreement void.

20.2 Where we are allowed to limit our liability for a breach of such a right, our liability is limited, at our option, to supplying the services again or paying the cost of having them supplied again.

21. Warranties

21.1 Each of us warrants that it has the power to enter into and perform this agreement, and that the person accepting or signing it is authorised to do so.

21.2 We warrant that:

  • (a) we will provide Kestrel in line with clause 3.2;
  • (b) we hold the rights we need to provide Kestrel;
  • (c) as far as we know, Kestrel does not infringe anyone's intellectual property rights; and
  • (d) we will not knowingly introduce malicious code into Kestrel.

21.3 Subject to clause 20 and the express promises in this agreement, and as far as the law allows, we give no other warranty, and we do not warrant that Kestrel will be uninterrupted or free of errors.

22. Changes

22.1 Changes to Kestrel. We improve Kestrel regularly. We will not materially reduce the core features of your Plan without your agreement. We will give at least 90 days' notice before removing or materially changing a feature your school relies on, unless a shorter period is needed to deal with a legal or security risk.

22.2 Changes to this agreement. We may publish a new version of this agreement. We will send each of your administrators what changed and the date it applies, at least 30 days after the notice. A change does not apply to anything that happened before it.

22.3 The new version applies to your school on that date, unless before then you:

  • (a) end this agreement, in which case it ends before the new version applies and we refund any Fees paid for the period after it ends; or
  • (b) dispute the new version in Kestrel, in which case your school stays on the version it had, and we will discuss the change with you.

22.4 If your school disputes a new version and we cannot agree within 60 days, either of us may end this agreement on 90 days' notice, and we will refund any Fees paid for the period after it ends.

23. Liability

23.1 This clause is subject to clause 20.

23.2 Neither of us is liable to the other for indirect or consequential loss, or for loss of profit, revenue, savings, goodwill or opportunity. This does not exclude the reasonable cost of restoring Records, or of notifying people and offering them support after a data breach, where the other party caused the loss.

23.3 Subject to clauses 23.4 and 23.5, each party's total liability to the other for all claims under or in connection with this agreement in any 12-month period is limited to the greater of:

  • (a) the Fees paid or payable by your school in the 12 months before the event giving rise to the claim; and
  • (b) $400,000.

23.4 The limit in clause 23.3 does not apply to:

  • (a) a breach of clause 12 (Privacy) or clause 13 (Security and data breaches) caused by the party's own act or omission;
  • (b) a breach of clause 18 (Confidentiality);
  • (c) a party's obligations under clause 24 (Indemnities);
  • (d) your school's obligation to pay Fees and interest; or
  • (e) fraud or wilful misconduct.

23.5 Neither of us limits liability for death or personal injury caused by our negligence, or for anything that cannot be limited at law.

23.6 Each party's liability, including under an indemnity, is reduced to the extent the other party or its people caused or contributed to the loss.

23.7 Each of us must take reasonable steps to reduce any loss.

24. Indemnities

24.1 We indemnify you against loss, damage and expense arising from a claim by a third party that Kestrel, used as this agreement allows, infringes that party's intellectual property rights.

24.2 Clause 24.1 does not apply to the extent the claim arises from a change to Kestrel not made by us, from combining Kestrel with something we did not provide, or from Records.

24.3 If such a claim is made, we may get you the right to keep using Kestrel, change Kestrel so it no longer infringes, or end this agreement and refund any Fees paid for the period after it ends.

24.4 You indemnify us against loss, damage and expense arising from a claim by a third party, or a regulator, to the extent it arises from:

  • (a) information entered into Kestrel by your school or its Users without the right or authority clause 6.3 requires, or collected or disclosed by your school in breach of privacy law;
  • (b) an instruction, automation or Integration your school or its Users set up, used as Kestrel's user guide describes; or
  • (c) a User's use of Kestrel in breach of the Terms of Use that your school knew of and did not stop.

24.5 A party claiming under an indemnity must tell the other promptly, must not admit or settle the claim without the other's consent (not to be unreasonably withheld), must let the indemnifying party conduct the defence, and must give reasonable help at the indemnifying party's cost.

25. Disputes

25.1 A party with a dispute about this agreement must give the other written notice describing it.

25.2 Within 10 Business Days of the notice, a senior representative of each party must meet, in person or online, and try in good faith to resolve it.

25.3 If it is not resolved within 20 Business Days of the notice, either party may refer it to mediation by the Australian Disputes Centre under its mediation rules, with the cost shared equally.

25.4 Neither party may start court proceedings about the dispute until 20 Business Days after it was referred to mediation, unless the other party has not taken part in the steps in this clause.

25.5 This clause does not stop either party seeking urgent relief from a court, or meeting its own legal duties, such as a notice under the Privacy Act. Each party keeps performing this agreement while a dispute is resolved.

26. General

26.1 Assignment. Neither of us may assign or transfer this agreement without the other's written consent, not to be unreasonably withheld, except to a related company or to a buyer of all or most of the relevant business, on notice. Any buyer of our business takes on this agreement in full.

26.2 Notices. A notice must be in writing. We send notices to the notice contact in the Order Summary, or to your administrators in Kestrel. You send notices to support@hoverpoint.io. An email notice is given when sent, unless the sender receives a delivery failure.

26.3 Publicity. We will not use your school's name or logo, including in a list of schools that use Kestrel, without your written consent.

26.4 Events beyond control. Neither of us is liable for a delay or failure caused by an event beyond its reasonable control, if it tells the other promptly, works to reduce the effect, and resumes as soon as practicable. If the event lasts more than 30 days, either of us may end this agreement by notice.

26.5 Relationship. We are independent contractors. This agreement does not create a partnership, joint venture or agency.

26.6 Waiver. Not enforcing a right straight away does not give it up.

26.7 Severance. If part of this agreement is invalid, that part is removed and the rest continues.

26.8 Variation. Except as clause 22 allows, this agreement may only be changed in writing agreed by both of us.

26.9 Counterparts and electronic acceptance. This agreement may be accepted in Kestrel, or signed in counterparts and electronically. Each way binds the parties as if they had signed one copy by hand.

26.10 Governing law. This agreement is governed by the law of New South Wales. Each of us submits to the exclusive jurisdiction of the courts of New South Wales and the courts that hear appeals from them.

Schedule 1: Availability and support

1. Availability

We aim to have Kestrel available for 99.9% of the school day, measured each Month. The school day is 7:00 am to 6:00 pm on a weekday, in your school's own time zone. Kestrel's status page shows whether Kestrel is answering and its availability on each recent day.

Time Kestrel is unavailable does not count against the target when it is caused by: maintenance we tell you about at least 5 Business Days ahead and carry out outside the school day; urgent maintenance needed to protect the security of Kestrel; an outage of an Integration; an event under clause 26.4; or something your school or a User did.

The target is what we work to. Missing it in one Month does not give a credit or refund. If Kestrel misses the target in three Months in a row, you may end this agreement by notice within 30 days after the third, and we will refund any Fees paid for the period after it ends.

2. Support

Support is answered from 8:30 am to 5:00 pm Sydney time, Monday to Friday, except New South Wales public holidays, by email to support@hoverpoint.io and through Kestrel. A request that arrives outside those hours counts from the start of the next Business Day. Your school gives each request its priority. A reply is a person at Hoverpoint who has read the request, agreeing its priority and saying what happens next.

PriorityWhat it meansTime to a replyUpdates
1. The school cannot workNo-one at the school can sign in or reach Kestrel, the roll cannot be marked, or records are missing or wrong.One business hourEvery two hours until fixed
2. A task cannot be donePart of Kestrel does not work and there is no other way to do the task, such as a report the school owes that will not run.Four business hoursEach Business Day until fixed
3. A task has a way round itSomething does not work as it should, and there is another way to do the task.One Business DayAs agreed
4. A question or a requestHow to do something in Kestrel, or a change the school would like.Three Business DaysAs agreed

Schedule 2: Security measures

AreaWhat we do
EncryptionAll data, including Records, backups and logs, is encrypted at rest, using AES-256 or an equivalent standard, and in transit, using TLS 1.2 or higher. Fields classified as restricted are also encrypted by the application, under a separate key for each school, before they reach the database.
LocationRecords are stored in Amazon Web Services' Australian regions, including backups and logs, as clause 12.4 and Schedule 4 describe.
SeparationEach school's Records are kept logically separate from every other school's.
Signing inUsers sign in with your school's own sign-in, a passkey or a one-time code sent by email. Our people use multi-factor authentication for all administrative access.
Our people's accessNamed accounts, least privilege, access only where a role requires it, every access to Records logged, and access reviewed at least every quarter.
Record of activityKestrel records what each User opens, changes, sends and exports, and when, for your school's administrators to see.
Backups and recoveryEncrypted backups at least three times a day, kept for 8 days. A backup is restored and checked at least once a Month. The most data that could be lost is the time since the last backup.
Secure developmentPeer review of each change, automated security and dependency scanning, and separate environments for development, testing and production. Records are never used outside production.
TestingAn independent penetration test at least once a year, with a summary of findings and fixes available to you on request.
Fixing weaknessesCritical weaknesses fixed within 7 days and high-risk weaknesses within 30 days of our becoming aware of them.
IncidentsA documented incident response plan, with the notice times in clause 13.2.
ContinuityA business continuity and disaster recovery plan, tested at least once a year, with a summary available to you on request.
Sub-processorsA security assessment of each Sub-processor before we engage it and at least once a year after.
CertificationWhen we hold an independent security certification, we will give you the current certificate or report on request.

Schedule 3: Information we handle

ItemDetail
PurposeProviding Kestrel to your school as its student information system.
DurationThe term of this agreement, then the export and deletion periods in clause 17.
People whose information is handledStudents and applicants; their parents, carers and family members; your employees, contractors and volunteers; former students; donors; and other people your school records.
Kinds of informationNames, contact details, dates of birth and identifiers; enrolment, attendance, assessment and reporting records; family and custody arrangements; fees, invoices and payments; messages; and the record of activity in Kestrel.
Sensitive informationHealth and medical information, wellbeing and child protection records, disability and learning support information, court orders, and other Sensitive Information your school chooses to record. Your school is responsible for any consent the law requires.
LocationAustralia, except as Schedule 4 says for a named Sub-processor and purpose.
Model trainingNone. Records are never used to train, fine-tune or improve any model, by us or by any Sub-processor.

Our further commitments

1. Instructions. We handle Records only on your school's instructions, as recorded in this agreement or given under clause 5.5. If we think an instruction would breach the law, we tell you and need not follow it.

2. Our people. Each person we allow to handle Records is bound by a written confidentiality obligation that continues after they leave, and is trained in privacy and security for their role.

3. Assessments. We will reasonably help your school with a privacy impact assessment, a security assessment such as Safer Technologies 4 Schools, or a consultation with a regulator.

4. Showing compliance. We will give your school the information reasonably needed to show we meet clauses 12 and 13 and this Schedule.

Schedule 4: Sub-processors

Sub-processorWhat it doesWhereWhat it handles
Amazon Web Services Australia Pty LtdHosting, storage and backupsAustralia (Sydney)All Records
Amazon Web Services: Amazon BedrockModel processing for AI Features, only where your school turns them onAustralia (Sydney and Melbourne)Each request and the Records needed to answer it, during processing only. Nothing kept, nothing used for training.
AgentMailDelivering the emails Kestrel sendsUnited StatesEach email's address and content, to deliver it. We remain accountable for its handling under Australian Privacy Principle 8.1.
StripeCollecting the Fees you pay usAustralia and United StatesYour billing contact and payment details only. No Records.
Let's EncryptIssuing the certificates that secure connections to KestrelUnited StatesKestrel's web addresses only. No Records.

Schedule 5: Implementation services

We may help your school start using Kestrel, for example by bringing in records from its current system, setting up Kestrel, connecting Integrations and training Users. These services are optional and outside the Fees.

Where your school asks for them, we will give a written quote setting out the services, the price or rates, the timing, and what your school needs to provide. The services begin when your school accepts the quote in writing, and the quote then forms part of this agreement.

Your school is responsible for the accuracy of the records it gives us to bring in, and for checking them once they are in Kestrel.