Privacy Policy (CA)

This Privacy Policy explains how Vericus Pty Ltd ("Cadmus," "us," "we," or "our") collects, uses, discloses, and protects your personal information when you use our educational technology platform and related services (Services). We are committed to protecting your privacy in accordance with Canada's Personal Information Protection and Electronic Documents Act (PIPEDA) and applicable provincial privacy laws.

This policy helps you understand what personal information we collect, why we collect it, how we use it, and your rights regarding that information.

We collect various types of information to offer our Services. This ranges from basic information, such as a user’s name, to more complex information, such as product usage details. We collect information in the following ways:

1. Information provided to us by your institution

Our Services integrate with various other technologies used by your institution. Your institution provides us with the necessary information that we need to set up and maintain your account to use our Services. This includes the following:

Account and user information: This includes some of your personal information, including your name, institution-assigned email address, a unique student ID, and your enrolment status in the subject where Cadmus is being used. We do not receive your institution's passwords. Your institution shares this information with us based on your consent to their privacy policies.

In some cases, an institution may wish to participate in an evaluation of our Services by sharing past assessments and subject information with us for comparison purposes. This information is non-personal and anonymised, and may also be requested directly from Subject Coordinators. This information includes the following:

Assessment outcomes information: This includes student enrolment and submission numbers, anonymised grade distributions, academic misconduct case numbers, and Turnitin similarity score distributions.

Subject outcomes information: This includes anonymised subject experience survey information, student enrolment and completion numbers, and anonymised grade distributions.

2. From your direct use of our Services

We collect information about how you use Cadmus. This includes the following:

Cookies: You can control cookies through your browser settings, though disabling certain cookies may affect the functionality of our Services. We use secure cookies to remember whether you have signed into Cadmus on your internet browser. We collect and store this information locally on your device using mechanisms such as browser web storage and application data caches. This allows you to access our Services directly, without first needing to log in through your institution’s Learning Management System. We only use cookies for authentication to our Services and do not make them available for third-party services or advertisers.

Device information: We collect information on the devices and Internet addresses (IPs) you use to access our Services. This information is used to help us deliver the Service, keep you secure, and improve our Services.

Your Work: Our Service is designed to enable our “Users” (teachers and students) to create and submit assignments and other assessment documents (“Your Work”). Your Work is regularly saved and stored on the Cadmus cloud servers. This information includes all the written and uploaded contents of Your Work, as well as additional information associated with its creation, such as a timestamp when Your Work is saved or submitted.

Usage information: We collect information on how you interact with our Service outside of Your Work. This includes how you interact with the Cadmus interface, for example, if you click on an assessment resource or access articles in the Cadmus Manual. This information is used to help us debug issues and deliver and improve our Services. In accordance with your institution’s privacy policy, we may also provide teachers and other institutional staff members access to your information so that they can support you.

Accessing Support: We may collect personal information when you contact Cadmus Support, for example, your name and email address. We use this information to debug issues and improve our Services.

1. Within Cadmus and your institution

Within Cadmus: Your information is only accessed by those who are required to provide support for the use of our Service. This may include technical staff who are responsible for developing and maintaining the Service, as well as support staff who are responsible for providing Users with help and assistance.

Non-personal information, like past assessments and subject outcomes information, is only accessed by those required to complete evaluations of our Service. This may include staff who are responsible for data analysis and communicating findings.

Within your institution: The information we collect and use is shared with your institution as part of the Service. Please read your institution’s privacy policy to learn more.

2. Outside of Cadmus and your institution

For providing our Service: We use third-party partners to help us provide our Service on behalf of your institution. For example, we use Amazon Web Services (AWS) for hosting and storage, Turnitin to provide users with Similarity Reports and grading tools, Userpilot to deliver in-app onboarding and updates, and HubSpot to help us administer support. These third-party partners may have access to some of your personal information. 

For evaluating our Service: We use third-party partners to collect and store non-personal information, like past assessments and subject outcomes information. For example, we collect information using Typeform and store information using Google Drive.

For storage: We use a data hosting service provider (AWS) to store and provide data hosting services in relation to your information. We only disclose information to the extent necessary for us to store and host your data. In compliance with your institution's privacy policy, your data is stored only in Canada. We ensure through contractual or other means that our service providers maintain a comparable level of protection for your personal information.

For legal reasons: We may share your personal information with third parties outside of Cadmus if we have a good-faith belief that access, use, preservation or disclosure of the information is reasonably necessary to:

1. meet any applicable law, regulation, legal process or enforceable governmental request;
2. enforce applicable Terms of Service, including investigation of potential violations;
3. detect, prevent, or otherwise address fraud, security or technical issues; or
4. protect against harm to the rights, property or safety of Cadmus, our users or the public as required or permitted by law.

We work hard to protect the personal information we hold from misuse, interference and loss, as well as unauthorised access, modification and disclosure. In particular:

1. All Services use SSL encryption for transmitting data.
2. We use secure signed HTTP cookies to authenticate and identify users. These cannot be shared with a third party or issued outside our Services.
3. We regularly review our information collection, storage and processing practices, including physical security measures, to guard against unauthorised access to systems.

Your personal information will be sent to AWS and will be kept in accordance with AWS’ security policy.

Breach Notification: In the event of a breach of security safeguards involving your personal information that creates a real risk of significant harm, we will notify affected individuals and report to the Office of the Privacy Commissioner of Canada as required by law.

We retain your personal information only as long as necessary to fulfil the purposes for which it was collected or as required by relevant Canadian privacy laws. Personal information is securely destroyed when no longer required.

Under Canada’s Personal Information Protection and Electronic Documents Act (PIPEDA) and applicable provincial privacy laws, you have the following rights:

1. Right of access: Request access to your personal information and information about how it has been used and disclosed.
2. Right to correction: Challenge the accuracy and completeness of your personal information and have it amended as appropriate.
3. Right to withdraw consent: You may withdraw consent at any time, subject to legal or contractual restrictions and reasonable notice.
4. Right to challenge compliance: You may challenge our compliance with PIPEDA by contacting our Privacy Officer. 

To exercise your rights, contact us at support@cadmus.io.

If you wish to find out about the personal information we hold about you, or believe that some or all of the personal information we hold about you is out of date, incomplete, incorrect, irrelevant or misleading, you can contact us on the details below.

We reserve the right to refuse to provide you with or correct information that we hold about you as permitted by applicable Canadian privacy legislation. However, if we refuse to provide you access to or correct your personal information, we will inform you of the reasons for that refusal.

We generally provide access to personal information at no charge. If your request involves significant processing costs, we may charge a reasonable administrative fee and will inform you before processing your request.

We will respond to your request within 30 days. If we need more time, we will notify you within that period.

If you have any complaints about how we have handled your personal information, please contact our Privacy Officer, Alister Rutter at:

Email: support@cadmus.io

Address: 802-803/37 Swanston St, Melbourne VIC 3000

We take complaints seriously and will endeavour to respond within a reasonable time of receiving written notice of your complaint.

If you have not received a response of any kind in relation to your complaint within 30 days, you have the right to take the matter directly to the Office of the Privacy Commissioner of Canada:

Website: www.priv.gc.ca

Phone: 1-800-282-1376

We regularly review our compliance with our Privacy Policy. We work with the appropriate Canadian regulatory authorities, including the Office of the Privacy Commissioner of Canada, to resolve any complaints regarding the transfer or processing of personal data that we cannot resolve with our Users directly.

Our Privacy Policy may change from time to time. We will not reduce your rights under this Privacy Policy without your explicit consent. We will post the most recent version of this Privacy Policy on our website. Please check the website from time to time to review any changes.

Last updated: October 2025