Honest crisis-detection boundary
The limits of automated crisis detection — a text-pattern router, not a clinical tool — are disclosed in binding language (written in-house, not reviewed by external counsel) across the terms, the DPA, the privacy policy, and the procurement pack, with the processor-controller boundary stated plainly.
Standards mappings
This control maps to the following standards and frameworks. Each entry states our real relationship with the standard, and the specific requirements this control helps satisfy.
Australian Privacy Act 1988 (APPs, incl. the NDB scheme)PrivacyApplicable law
The primary legal regime. APP 8 drives the residency objective and every disclosed cross-border flow, APP 11 drives retention and erasure, and the Notifiable Data Breaches scheme's assessment clock is built into the incident runbook with OAIC contacts documented. The privacy policy, terms, and DPA template are reviewed and approved in-house; First Six has no external counsel engaged.
- APP 1Open and transparent management of personal information
GDPR (EU General Data Protection Regulation)PrivacyApplicable law
Applies via international students. The 72-hour breach path is in the incident runbook, Article 28 processor terms sit in the DPA (reviewed in-house, not by external counsel), Article 17 erasure maps to the student's own hard-delete cascade (with the audit-trail carve-out disclosed rather than hidden), and Article 22-equivalent disclosure covers automated crisis detection.
- Art. 22Automated decision-making disclosure (equivalence)
Policy mapping
The written standard this control enforces:
Request access and we can share the full policy set, assessment reports, and completed questionnaires under NDA — or answer your security questionnaire directly.