Victorian UAS - Privacy Policy

Last reviewed October 8th 2026

1. About this policy

Victorian UAS (ABN 74 168 011 470) ("Victorian UAS", "we", "us", "our") is committed to handling personal information in line with the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs).

This policy explains how we collect, hold, use and disclose personal information, and how you can access or correct it or make a complaint.

It applies to:

our website (vuas.com.au) and any related online forms
our online learning platform, VUAS Online (vuasonline.com.au)
our flight operations systems and apps, including Aurora
our drone (RPAS) training, licensing, aerial survey and other services
our dealings with students, clients, suppliers, contractors and job applicants

It does not apply to employee records held by us as an employer, which are exempt under the Privacy Act.

2. What personal information we collect

We collect only the personal information reasonably necessary for our functions and activities. Depending on how you deal with us, this may include:

3. How we collect personal information

Where reasonable and practicable, we collect personal information directly from you, for example when you:

enrol in a course or create an account on VUAS Online
request a quote, book a service or contact us by phone, email or web form
log flights, risk assessments or approvals in Aurora
attend training, assessments or events
apply for a job or engage with us as a contractor

We may also collect information from third parties where you would reasonably expect it, or with your consent, such as your employer or training sponsor, CASA (for example, to verify an ARN or licence), payment providers, and referees.

Cookies and analytics. Our websites use cookies and similar technologies to keep you logged in, remember preferences and understand how our sites are used. We use analytics tools (such as [insert, e.g. Google Analytics]) that collect aggregated usage data. You can disable cookies in your browser, though some features (such as logging in to VUAS Online) may not work.

Unsolicited information. If we receive personal information we did not ask for and could not have collected under APP 3, we will destroy or de-identify it as soon as practicable where lawful and reasonable to do so (APP 4).

Notification. When we collect your information we will take reasonable steps to tell you who we are, why we are collecting it and where to find this policy (APP 5), usually through a collection notice on the relevant form.

4. Why we collect, use and disclose personal information

We use personal information for the primary purpose for which it was collected, and for related secondary purposes you would reasonably expect (APP 6), including to:

deliver training, assess competency and issue certificates and qualifications
process RePL, operator accreditation and other licensing applications, and report to CASA as required
plan, conduct, record and audit drone operations safely and in line with Civil Aviation Safety Regulations Part 101
provide aerial survey, inspection and mapping services to clients
manage accounts, invoicing and payments
respond to enquiries, complaints and support requests
maintain and improve our websites, apps and services, and keep them secure
send service updates and, with consent or where permitted, marketing (see section 6)
comply with legal, regulatory, insurance and record-keeping obligations

We will not use or disclose your information for another purpose unless you consent, or the Privacy Act permits it (for example, where required by law or to lessen a serious threat to someone's life, health or safety).

Automated decisions. From 10 December 2026, we must disclose any decisions that significantly affect your rights or interests and are made solely or substantially by a computer program using your personal information.

5. Who we disclose personal information to

We do not sell or rent personal information. We may disclose it to:

Regulators and government: CASA and other authorities where required or authorised by law
Your employer or sponsor: where they have enrolled you or booked a service on your behalf
Clients: flight records, imagery and reports produced for them under a service agreement
Service providers: IT, cloud hosting, database, learning-platform, email, payment, accounting and insurance providers who help us run our business
Professional advisers: lawyers, accountants and auditors

We require service providers to handle personal information only for the services they provide to us and to keep it secure.

Overseas disclosure. Some of our service providers store or process data outside Australia. Before disclosing information overseas we take reasonable steps to ensure the recipient handles it consistently with the APPs (APP 8).

6. Direct marketing

We may send you information about our courses, services and events where you have consented or would reasonably expect it, in line with APP 7 and the Spam Act 2003 (Cth).

Every marketing email includes an unsubscribe link. You can also opt out at any time by contacting us (section 9). We will action opt-out requests within 5 business days and will not charge you for doing so. Opting out of marketing does not stop service messages, such as course or booking updates.

7. Security, retention and data breaches

We take reasonable technical and organisational steps to protect personal information from misuse, interference, loss and unauthorised access, modification or disclosure (APP 11). These include access controls and multi-factor authentication on our systems, encrypted connections (HTTPS), role-based permissions in VUAS Online and Aurora, staff confidentiality obligations, and secure storage of paper records.

We keep personal information only as long as we need it for the purposes in this policy or as required by law. For example, training and assessment records and flight logs are retained for the periods required by CASA and other regulations, and financial records for at least 5 years under tax law. When information is no longer needed, we securely destroy or de-identify it.

If a data breach is likely to result in serious harm to anyone, we will notify affected individuals and the Office of the Australian Information Commissioner (OAIC) as required by the Notifiable Data Breaches scheme.

8. Access, correction and anonymity

Access. You can ask for access to the personal information we hold about you (APP 12). We will respond within 30 days. We will verify your identity first. Access is free, though we may charge a reasonable fee for the cost of retrieving and providing large volumes of information. If we refuse access, for a reason the Privacy Act allows, we will tell you why in writing and how to complain.

If you believe information we hold is inaccurate, out of date, incomplete, irrelevant or misleading, ask us to correct it (APP 13). You can also update many account details yourself in VUAS Online. If we decline to correct it, we will explain why, and you can ask us to attach a statement to the record.

You can deal with us anonymously or using a pseudonym for general enquiries (APP 2). This is not practicable for training, licensing or bookings, where we must identify you to deliver the service and meet CASA requirements.

9. Complaints, contact and changes

Complaints. If you think we have breached the APPs, contact our Privacy Officer in writing with details of your concern. We will acknowledge your complaint within 5 business days and aim to resolve it within 30 days.

If you are not satisfied with our response, you can complain to the Office of the Australian Information Commissioner (OAIC): oaic.gov.au, phone 1300 363 992.

Changes to this policy. We may update this policy from time to time. The current version is always available on our website, and the date at the top shows when it was last updated. A free copy is available on request.