Last Updated: 20 February 2026

KIDDO is operated by The University of Western Australia (UWA).

This page lists third-party service providers (“sub-processors”) engaged by UWA to support delivery of the KIDDO platform.

UWA remains responsible for the performance of its sub-processors in accordance with:

  • The KIDDO User Agreement
  • The KIDDO Privacy Policy
  • The UWA Information Privacy Policy
  • The Privacy Act 1988 (Cth)

Sub-processors process personal information only for the purposes described below and are subject to appropriate contractual, confidentiality and security obligations.

What Is a Sub-Processor?

A sub-processor is a third-party service provider that processes personal information on behalf of UWA to support the operation, security or improvement of the KIDDO platform.

Sub-processors act only under UWA’s instructions and do not determine the purposes of processing.

This page lists only service providers that receive personal information from the KIDDO platform.

Where users independently register with third-party event or webinar platforms, those platforms act as independent controllers and are not sub-processors of KIDDO.

Current Sub-Processors

1. Spoon (Technical Services Provider)

Organisation: Spoon Media Pty Ltd
Website: https://spoon.au/

Purpose of Processing

Application management, platform maintenance, deployment management, vulnerability management and coordination of hosting services.

Data Types Disclosed

  • Educator account data
  • Student assessment and milestone data (where applicable)
  • Parent account data (where applicable)
  • Platform usage logs
  • System configuration information

Lawful Basis (where applicable)

Processing is necessary for performance of the KIDDO User Agreement and delivery of the service.

Location of Processing

Australia (primary operations).

Safeguards

Spoon is subject to contractual security, confidentiality and data protection obligations. Spoon manages infrastructure providers on UWA’s behalf.

2. Amazee.io (Managed Hosting Provider)

Organisation: Amazee.io
Website: https://www.amazee.io

Purpose of Processing

Managed cloud hosting services, infrastructure management, secure storage and system availability for the KIDDO platform.

Data Types Disclosed

  • Educator account data
  • Student assessment data (where applicable)
  • Parent account data (where applicable)
  • Platform usage logs
  • Database backups

Lawful Basis (where applicable)

Processing is necessary for performance of the KIDDO User Agreement and delivery of the service.

Location of Processing

Australia (Sydney region via AWS infrastructure).

Safeguards

Amazee operates secure managed cloud infrastructure and is subject to contractual security and confidentiality obligations through Spoon.

3. Amazon Web Services (AWS)

Organisation: Amazon Web Services, Inc.
Website: https://aws.amazon.com

Purpose of Processing

Cloud infrastructure services supporting Amazee managed hosting.

Data Types Disclosed

Data hosted within the KIDDO production environment, including:

  • Educator account data
  • Student assessment data
  • Parent data
  • System logs
  • Encrypted backups

Lawful Basis (where applicable)

Processing is necessary for delivery of the KIDDO platform.

Location of Processing

Australia (Sydney region).

Safeguards

Data is stored within Australian-based infrastructure and protected by industry-standard cloud security controls.

4. Stripe Payments Pty Ltd

Organisation: Stripe Payments Pty Ltd
Website: https://stripe.com

Purpose of Processing

Payment processing and subscription billing for KIDDO platform licences.

Data Types Disclosed

  • Name
  • Email address
  • Organisation name
  • Billing details (where provided)
  • Payment transaction data
  • Subscription status

Payment card numbers are processed directly by Stripe and are not stored by KIDDO systems.

No student assessment data is disclosed to Stripe.

Lawful Basis

Processing is necessary for performance of a contract relating to payment for KIDDO platform licences.

Location of Processing

Australia and United States (and other jurisdictions where Stripe operates data centres or sub-processors).

Safeguards

Stripe maintains PCI-DSS compliant payment infrastructure and industry-standard security controls.

5. Mailchimp (Intuit Inc.)

Organisation: Intuit Inc. (Mailchimp)
Website: https://mailchimp.com

Purpose of Processing

Email communications relating to:

  • Platform updates
  • Educational resources
  • Workshops and professional development
  • Service announcements

Data Types Disclosed

  • Educator and staff name
  • School name
  • Educator and staff email address

No student data or assessment data is disclosed to Mailchimp.

Lawful Basis (where applicable)

Processing is necessary for performance of the service and UWA’s legitimate interests in communicating service-related and educational information. Users may unsubscribe from optional communications.

Location of Processing

United States.

Safeguards

UWA takes reasonable steps to ensure appropriate contractual and technical safeguards are in place consistent with the Australian Privacy Principles.

6. Google Analytics (Google LLC)

Organisation: Google LLC
Website: https://policies.google.com/privacy

Purpose of Processing

Website analytics to:

  • Understand usage patterns
  • Improve functionality
  • Monitor system performance
  • Enhance user experience

Data Types Disclosed

  • IP address
  • Device and browser information
  • Usage data
  • Cookie identifiers

No student assessment data is disclosed to Google Analytics.

Advertising, remarketing and audience-building features are not enabled.

Lawful Basis (where applicable)

Processing is necessary for UWA’s legitimate interests in maintaining, securing and improving the platform and website experience.

Location of Processing

United States and other jurisdictions where Google operates data centres.

Safeguards

UWA takes reasonable steps to ensure appropriate contractual and technical safeguards consistent with the Australian Privacy Principles.

Not Sub-Processors

Webinar and event registration platforms (including Humanitix and Livestorm) are not sub-processors of KIDDO.

Users who register for events provide their information directly to those platforms under their own privacy policies. KIDDO does not transfer KIDDO platform user data to those services.

Overseas Disclosure

Where a sub-processor processes personal information outside Australia, UWA takes reasonable steps to ensure appropriate safeguards are in place consistent with:

  • The Australian Privacy Principles
  • The UWA Information Privacy Policy

The relevant country of processing is listed in each sub-processor entry above.

Changes to Sub-Processors

UWA may update this page from time to time to reflect changes to service providers.

Material changes will be reflected in the “Last Updated” date above.

Further Information

For further information about how personal information is handled, please refer to:

  • The KIDDO Privacy Policy
  • The UWA Information Privacy Policy
  • Or contact KIDDO administration