Softlink Education Library Product Privacy Policy

How we look after your data — Softlink Library Products

This policy covers: Oliver (including Orbit), MackinVision, AssetManager and LearnPath. We call these the Softlink Library Products.

1. What this policy is about

This policy explains how we look after the personal information your school keeps in our library products — borrower records, loans, and anything else your staff and students update or create while using them. If you are looking for our website and corporate privacy policy, please see our Softlink Privacy Policy.

2. Who decides what happens to your data

Your school decides.

Your school controls your information, we process it according to their instructions. In practice that means we only use the information in your library system to run the library, we do not use it for other purposes.

3. What information is in the products

This depends on how your school sets things up, but it usually includes:

• Borrower records for students and staff — name, year level, class, borrower type, and anything else your school chooses to add, including photos
• Loans — current and past
• Basic school details and your settings
• In LearnPath, material your staff have written, with their name on it if they choose

Information about you is added to the system by the school manually or via imports or integrations to allow you to use the library.

Catalogue and resource records are about books and resources, not people, so they are not personal information.

We also hold things that keep the service running: system logs, backups, your settings, and the support messages you send us. If we are converting data from your old system, we hold a copy of that data while the conversion is happening.

4. What we use it for

To run, support and host your library system, to convert your data and train your staff when you start with us, to answer your support requests, and to meet our legal obligations.

We never sell the information you store in our products, and we never use it for marketing.

5. Where your data is kept

Your data is stored in your part of the world:

We will not copy your data out of your region without asking you first.

Amazon Web Services is the only company we use to host the products.

6. How we keep it safe

Some of the main things we do:

• Our staff only get access to what their job needs, and we check that regularly
• Every staff member has their own account, and signing in needs more than just a password
• Your data is encrypted, both while it is stored and while it travels over the internet
• We test changes before they go live, and we keep our test systems separate from the live ones
• We watch for threats on our computers and in our systems, and we log security events
• We scan for weaknesses and fix them, with the most serious ones first
• An independent, accredited security firm tries to break into the product on a regular basis, and retests to confirm we have fixed what they find
• All our staff do regular security training, and our developers do extra training on secure coding
• We back your data up and we test that the backups actually restore

If you want more detail for a security review, just ask.

7. Companies that help us run the products

These companies handle your personal information for us, as part of delivering the products. In privacy law they are called sub-processors. We process your information based on the school’s instructions and to provide the service.

Every customer’s system is hosted on Amazon Web Services.

If we want to add or change one of these companies, we will tell you in the product at least one month before it happens, so you have time to raise any concerns. We tell you about other changes to this policy the same way.

We require these companies to protect your information to the same standard we do, and if they get it wrong, that is still our responsibility to you.

8. Other services the products can connect to

Our products can connect to other services. Connecting one is your choice, and your school has the relationship with that company, not us.

These are not the same as the companies in section 7, because they are not handling your information on our behalf, they are providing data to the product. We list them so you know what your system can talk to.

8.1 Services that send information to your library system

We use other services to obtain information used by your library. We do not send your personal information out to these vendors.

8.2 Services where information may be shared with the other company

If your school switches one of these on, some personal information may go to that company under your school’s arrangement with them, and the school should seek consent where appropriate. We process or provide your information based on the school’s instructions and to provide the service.

9. Things your school controls

Our products are very flexible. That is useful, but it means some privacy and security decisions are yours to make. We provide secure settings with the product by default, but the school can change these settings to match their own risk appetite. We are happy to help — just ask our support team.

Two things worth knowing about:

Who can see what. We supply the products with a standard set of roles, each given only the access it needs. Once your system is handed over, your administrators can change what each role can see and do, or add new roles.

Your public catalogue. Anyone can search your catalogue without signing in. With the roles we supply, people who are not signed in can see catalogue and resource information only. They cannot see personal information.

10. How long we keep it, and getting it back

We keep the information in your library system for as long as you are a customer and for as long as you need it.

If you leave us, the school can ask us to send your data back to the school and/or delete it. We will do that unless the law requires us to keep something. Backups are deleted in line with our retention schedule or earlier if requested.

If we migrated data for you when you started, we delete our copy once it is no longer needed for the migration.

11. Children

Many of our customers use the products with children. Where that happens:

• We only collect what is needed to run the service
• We do not keep children’s information longer than we need to
• We never share it in a way that would need a parent’s separate permission, and we never use it for advertising

A student does not need to give a first name, last name or email address to have an account — an alias, a password and a borrower type is enough. Other information recorded about a student is your school’s decision.

11.1 COPPA

Softlink complies with the Children’s Online Privacy Protection Act (COPPA) for schools in the US. COPPA covers how online services collect information from children aged 13 and under, and is there to keep parents in control of what is collected about their child.

A student does not have to give a first name, last name or email address to have a MackinVision account. An alias, a password and a patron type is the minimum. When your school sets up accounts, we hold only the info they choose to enter. Optional fields such as first name, middle name, last name, username or alias, student number, password, school, roll class, email address, year, patron type and user role that enable best use of the library are up to your school.

We use this information only to give the student access to the library system. We never ask for more information than is reasonably needed to use the system.

12. If something goes wrong

If we confirm a security breach affecting personal information in your system, we will provide initial notification to the school within 48 hours. We will tell you what we know at the time and keep you updated as we find out more.

13. If someone asks to see their information

If a parent, student or staff member asks what information is held about them, that request goes to your school, because the data is yours. If someone asks us directly, we will refer your request to your school.

14. Security reviews

We take part in customer and sector security assessments, including Safer Technologies for Schools (ST4S) in Australia/NZ.

15. Telling us about a security problem

Anyone who finds a security vulnerability in one of our products or websites can email support@softlinkint.com

16. The Library Link mobile application

The Library Link mobile application requires access to the device camera, used for two things: scanning a QR code during initial setup to configure the location of the related Softlink Library System, and acting as a barcode scanner to identify physical resources. When used as a barcode scanner the camera converts a barcode to a text string, which is transmitted to the Softlink library software. No image data is transmitted or retained by the application.

Camera access is not required for the application to function aside from these features, but the application cannot be installed without the permission being granted.

17. Changes to this policy

We may update this policy from time to time. The current version is at www.softlinkint.com/data-protection-privacy-policy/products. We tell you about changes inside the product, and we give at least one month’s notice before changing any of the companies in section 7.

18. How to contact us

Individual users should contact their school with any questions or concerns. Schools may contact our support team so they can assist you or direct your inquiry, or using the details on our Contact Us page.

Last updated: November 2026