Privacy Policy

1. Who we are

Career Bridge is a career and opportunity platform operated by the Malaysian Students’ Council of Australia, NSW Chapter (MASCA NSW), a NSW incorporated association. We run Career Bridge as a volunteer initiative under our EduCare portfolio to help Malaysian students at Australian universities find internships, graduate jobs, and skills programs.

In this policy, “we”, “us”, and “our” refer to MASCA NSW. “You” or “your” refers to anyone who uses Career Bridge at careerbridge.mascansw.com.au.

How to contact us about privacy:

• Email: educare@nsw.masca.org.au
• Postal: c/o MASCA NSW Secretariat, NSW Australia
• Privacy Officer: EduCare Director, MASCA NSW

2. Scope of this policy

This policy covers personal information that we collect, hold, use, and disclose through Career Bridge. It does not cover:

• Information you give to other organisations (employers, sponsors, third-party platforms) when you click out from Career Bridge.
• Information collected through MASCA NSW’s general activities (events, social channels, membership) that are not part of Career Bridge. Those are governed by MASCA NSW’s general privacy practices.

We comply with the Australian Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs) where they apply to us. Even where the APPs do not strictly apply (small not-for-profit exemptions can sometimes apply), we choose to follow them as good practice.

3. What information we collect

We collect only what we need to run the platform. Specifically:

3.1 Account information

When you create a Career Bridge account, we collect:

• Your email address.
• Your name (as you provide it).
• Authentication tokens issued by Google if you sign in with Google OAuth.

3.2 Profile information (optional)

You may choose to add:

• The university you attend or attended.
• Course or degree information.
• Year of study.
• Career interests, industries, or job preferences.
• A resume file uploaded to your private storage area.

You control whether to add this information. You can leave it blank, edit it, or remove it at any time.

3.3 Form responses

If you submit a Career Bridge form, we collect what you provide on the form. This usually includes your contact details and the information the form asks for.

This includes the Think Tank registration form. When you register for Think Tank we collect your team details and, for each member, their name, email, phone, university, state, study level, degree, discipline, and a resume file. From August 2026 every one of these is required to complete a registration, including the resume. You can register for Think Tank without a Career Bridge account. How resumes from the Think Tank resume drive are shared is explained in section 6.3.

3.4 Think Tank competition submissions

A recorded Think Tank team lead may upload one case-competition submission for their team in each enabled round. We collect the PDF or PPTX file, its original filename and size, a cryptographic file receipt, the team registration and lead connected to it, the submission time and applicable deadline, the declaration accepted by the lead, and any documented extension or judging review decision. The private team-link credential is stored only as a one-way hash; the raw link is not stored in the database.

We use this information only to receive, secure, timestamp, administer, and judge the Think Tank competition, resolve an eligibility or timing question, and maintain a fair audit trail. Competition files are available only to authorised MASCA NSW EduCare administrators and the people appointed to judge or administer the competition. They are not part of the optional employer resume drive and are not shared for recruitment simply because a team submits one.

Career Bridge treats every participant PDF and PPTX as an untrusted file. Its format and receipt checks are not a malware scan. Competition administrators and judges are instructed to use an approved isolated or sandboxed viewer, not to enable active content or macros, and not to follow embedded links when reviewing a submission.

3.5 MYAU expressions of interest and completion invitations

Where you previously submitted a MYAU expression of interest to MASCA NSW or SUAMS, we may receive the contact and study information recorded in that approved event source so we can ask you to complete the current Career Bridge registration. An expression of interest is not a confirmed booking. We do not create a Career Bridge account, confirm attendance, select consent choices, or issue an attendance QR code from an imported response.

A completion invitation displays personal suggestions only after you sign in with and verify the same email address. You can review and correct every suggestion before submitting. Conflicting or duplicate source responses are held for authorised review rather than silently overwriting information you have confirmed in Career Bridge.

Legacy MYAU resume files may first be inventoried using file metadata. We do not copy a legacy file into your account, extract information from its contents, or treat it as employer-sharing consent unless the source notice or a new consent authorises that processing. Resume-derived details remain suggestions until matched and confirmed or reviewed.

3.6 Usage and analytics data

When you use Career Bridge, we automatically collect basic usage information so we can improve the platform and report aggregate metrics to our exec council and partners. This includes:

• Pages you view and the order you view them in.
• Buttons or job listings you click.
• The approximate time you spend on a page.
• Your device type, browser type, and operating system.
• A truncated or hashed IP address used for rough geolocation and abuse prevention.
• A randomly generated session identifier that is not tied to your name.

We do not link this analytics data to your account profile in a way that lets us reconstruct an individual user’s behaviour, except where strictly needed for security investigations.

3.7 Job interactions

We record which jobs and opportunities you save, click on, or apply to from within Career Bridge. We use this to show you a relevant feed and to report aggregate trends to partner organisations.

3.8 What we do NOT collect

• We do not collect payment information. Career Bridge has no paid features.
• We do not collect government identifiers (passport numbers, tax file numbers, MyKad, student ID numbers).
• We do not collect health information, racial or ethnic data, religious beliefs, sexual orientation, or other sensitive information as defined by the Privacy Act, unless you voluntarily include it in a form response.
• We do not record audio or video of you.

4. How we collect information

We collect information in three ways:

1. Directly from you. When you sign up, fill out a profile, submit a form, upload a resume, or interact with the platform.
2. Automatically. When you visit the site, our analytics and server logs record the technical and usage data described in section 3.6.
3. From an approved earlier event source. For the MYAU completion process described in section 3.5, we may receive an earlier expression of interest or legacy event record from MASCA NSW or SUAMS. The invitation tells you why we have it and lets you confirm or correct it.

We do not buy personal information about you from third-party data brokers.

5. How we use your information

We use your information for the following purposes:

• Operating the platform. Authenticating you, showing you a personalised feed of jobs and opportunities, and remembering items you have saved.
• Running Think Tank fairly. Receiving and timestamping one file per team for each enabled round, applying the published deadline or a documented team-specific extension, providing files to authorised judges, and recording the judging or forfeiture outcome.
• Communicating with you. Sending platform notifications, event invitations, job alerts you have opted into, and important policy updates. You can unsubscribe from non-essential email at any time.
• Completing MYAU attendance. Reconciling an earlier expression of interest, presenting reviewable registration suggestions, preventing duplicate invitations, recording delivery or suppression status, and issuing a QR code only after a verified registration succeeds.
• Reporting in aggregate. Producing anonymised, aggregated reports for the MASCA NSW exec council, partners, and sponsors. These reports show totals and trends. They never include individual records, names, or anything that identifies a specific student.
• Improving the platform. Diagnosing errors, fixing bugs, and prioritising new features based on patterns in how the platform is used.
• Safety and abuse prevention. Detecting account abuse, scraping, or behaviour that breaches our Terms of Service.
• Legal compliance. Meeting our obligations under Australian law where relevant.

We do not use your personal information for advertising. Career Bridge does not run third-party advertising and does not sell user data.

6. Who we share your information with

We share information in a small number of well-defined situations.

6.1 Service providers (data processors)

We use the following third-party services to run the platform. Each handles specific data on our behalf under their own privacy and security commitments:

• Supabase (database and authentication). Stores your account, profile, saved opportunities, and resumes. Hosted on Amazon Web Services infrastructure.
• Vercel (hosting and edge delivery). Hosts the front-end and routes requests. May store short-lived server logs.
• PostHog Cloud (EU instance). Records anonymised page-view and click data.
• Email delivery services. Supabase Auth and MASCA NSW’s approved email service deliver account verification, password recovery, event invitations, and operational messages. The exact campaign sender must be approved and tested before a MYAU batch is released.
• Google (OAuth sign-in). If you sign in with Google, Google handles the authentication. We receive only your email and name.

These providers are bound by their own privacy commitments and act as our processors. They do not use your data for their own marketing.

6.2 Partner organisations (aggregate only)

We share aggregate, anonymised reports with sponsors, partner employers, and university stakeholders. These reports describe totals and broad trends only, for example how many students viewed a category of listing or the general mix of universities represented. They never identify any individual.

As a general rule, we do not share individual records with sponsors or partners from your everyday use of Career Bridge. A partner does not receive your account name, email, profile, resume, or click history simply because you use the platform. The exceptions are where you give us specific, opt-in consent — the Think Tank resume drive (section 6.3) and the MYAU Career Fair resume drive (section 6.4). Apart from those, if a partner ever wants to contact you directly, you receive a clear, separate opt-in choice on the platform.

6.3 Think Tank resume drive (opt-in)

MASCA NSW runs Think Tank, a case competition with a linked resume drive. When you register for Think Tank you can choose to take part in the resume drive by ticking the consent box on the registration form. This box is off by default — taking part is your choice, and you can register for Think Tank without it.

If you opt in, you are giving us your specific consent to share the resume and the registration details you provide — your name, email, phone, university, state, study level, degree, discipline, and team name — with the partner companies that support Think Tank, after the event, so they can consider you for internship and graduate roles. We share these details only with Think Tank partner companies, only for recruitment relating to Think Tank, and only for members who have opted in.

You can withdraw your consent at any time by emailing educare@nsw.masca.org.au. Withdrawal stops any further sharing. We cannot recall information a partner company has already received, but we will tell the partner you have withdrawn and ask them to delete it.

6.4 MYAU Career Fair resume drive (opt-in)

MASCA NSW co-presents the Malaysian-Australia Career Fair (MYAU) with SUAMS, a Sydney Malaysian student society. When you register to attend, you can choose to take part in the MYAU resume drive by ticking the consent box on the registration form. This box is off by default — you can attend without it.

If you opt in, you are giving MASCA NSW and SUAMS your specific consent to share the resume and the registration details you provide — your name, email, phone (if given), university, state, study level, and discipline — with the employers taking part in the career fair, so they can consider you for interviews on the day and for internship and graduate roles afterwards. We share these details only with MYAU career-fair employers, only for recruitment relating to the fair, and only for attendees who have opted in. Choosing to be considered for on-the-day interviews relies on this same consent.

You can withdraw your consent at any time by emailing educare@nsw.masca.org.au. Withdrawal stops any further sharing. We cannot recall information an employer has already received, but we will tell them you have withdrawn and ask them to delete it.

6.5 MYAU organising team and restricted demographic reporting

Authorised MASCA NSW and SUAMS organisers may access the MYAU details needed to administer registration, check-in, participant support and the consent choices attached to the fair. Access is event-scoped and does not grant general Career Bridge administration.

MASCA NSW may maintain a restricted student-demographic directory made from confirmed Career Bridge records and reviewed legacy records. It may contain identifying information only where operational access has been expressly approved. Broader reporting to sponsors or partners remains aggregated under section 6.2. Direct Drive resume links, invitation credentials and internal authentication identifiers are not included in that demographic projection.

6.6 Think Tank judges and competition administrators

We give each team’s final case submission to only the MASCA NSW volunteers, independent judges, and partner representatives appointed to administer or judge Think Tank. They receive it for competition judging and integrity purposes, not as a recruitment resume or a general sponsor dataset. Access is limited to the relevant judging and review period.

6.7 Legal disclosure

We may disclose your information if we are legally required to do so by an Australian court, regulator, or law enforcement agency. We will resist overbroad or improper requests where lawful and reasonable to do so.

6.8 Sale of data

We do not sell, rent, or trade your personal information to anyone, ever.

7. Career Bridge data does not flow to NexArah

Specifically:

• Your account, profile, resume, saved jobs, click history, and any other personal information collected by Career Bridge stay inside the MASCA NSW infrastructure (the only outward sharing is the opt-in Think Tank and MYAU Career Fair resume drives in sections 6.3 and 6.4, which go to those events’ partner companies and employers — never to NexArah).
• There is no automated pipeline, API connection, or shared database between Career Bridge and NexArah.
• NexArah does not have admin or backend access to Career Bridge.
• Aggregated analytics produced by MASCA NSW are not shared with NexArah unless they are also published openly.
• If, in the future, MASCA NSW ever runs a separate, opt-in survey that contributes to NexArah research, that survey will be a clearly labelled, separate process with its own consent flow. It will not draw from your Career Bridge account.

This separation is governed by an internal boundary document maintained by MASCA NSW and is reviewed annually. The Director’s role is disclosed to the MASCA NSW committee and recorded in the association’s Register of Disclosed Interests under section 31 of the NSW Associations Incorporation Act 2009.

If you have concerns about this arrangement, contact our Privacy Officer using the details in section 1.

8. How long we keep your information

• Active accounts. We keep your data for as long as your account is active.
• Inactive accounts. If you do not log in for 24 consecutive months, we email you a reminder. If there is no response within 30 days, we delete or anonymise your account and resume.
• Think Tank resume drive. Registration details and resumes collected through the Think Tank resume drive are kept for up to 12 months after the relevant Think Tank event, then deleted or anonymised — unless you ask us to delete them sooner.
• Think Tank competition submissions. PDF or PPTX files, receipts, extension records, and judging review records are kept only for judging, any documented review or integrity process, and competition governance. MASCA NSW EduCare applies a reviewed deletion schedule after those purposes end. We delete the uploaded file when it is no longer required and may retain only the minimum non-file receipt and audit record where reasonably necessary for competition governance or law.
• MYAU Career Fair resume drive. Registration details and resumes collected through the MYAU resume drive are kept for up to 12 months after the career fair, then deleted or anonymised — unless you ask us to delete them sooner. MYAU attendees use a verified Career Bridge account to complete registration, manage their booking and receive their QR code. Email educare@nsw.masca.org.au to withdraw or request deletion.
• MYAU EOI candidates and source records. Unconfirmed invitation candidates, approved source fields and resume-processing observations are kept only for event completion, reconciliation, support and the published retention period, normally no longer than 12 months after the fair. We may retain the minimum non-identifying audit evidence and a protected suppression record needed to honour an opt-out, hard bounce, complaint or deletion request.
• Analytics data. Anonymised page-view and click data is retained for up to 24 months in aggregate form. Raw event logs are retained for up to 90 days.
• Backups. Encrypted backups may retain data for up to 30 days after deletion before being overwritten.
• Legal holds. Where we are required to retain information for a legal reason, we keep it for the period required and then delete it.

9. Your rights

Under the Australian Privacy Principles, you have the following rights. To exercise any of them, contact our Privacy Officer.

• Access. You can ask for a copy of the personal information we hold about you. We will respond within 30 days.
• Correction. You can ask us to correct information that is inaccurate, out-of-date, incomplete, irrelevant, or misleading.
• Deletion. You can ask us to delete your account and the personal information attached to it. We will action this within 30 days, except where we must retain information for legal reasons.
• Withdraw consent. You can withdraw consent for non-essential processing (such as marketing email) at any time.
• Complaint. You can complain about how we handled your information. See section 14.

We do not charge a fee for access or correction requests. We may ask you to verify your identity before we action a request.

10. Cookies and similar technologies

Career Bridge uses a small number of cookies and similar technologies:

• Essential session cookies. Required to keep you logged in. Set by Supabase Auth. These cannot be disabled without breaking sign-in.
• Analytics cookies or device identifiers. Used to count page views and measure feature usage. These are anonymised. You can opt out using the in-app cookie banner or your browser settings.
• Preference cookies. Remember settings such as your saved filter for the job feed.

We do not use third-party advertising cookies, retargeting pixels, or social tracking pixels.

11. International data transfers

Some of our service providers store data outside Australia. As of the effective date:

• Supabase stores account and resume data on Amazon Web Services infrastructure in the AWS Seoul (ap-northeast-2) region, in South Korea. Your personal information is therefore held overseas, and this is an overseas disclosure under Australian Privacy Principle 8.
• Vercel runs edge servers in multiple regions worldwide.
• The analytics provider may process data in the United States or European Union depending on configuration.
• The email service provider may process emails in the United States or European Union.

When personal information is sent overseas, we take reasonable steps to ensure the recipient handles it consistently with the APPs. However, you should be aware that overseas data may be subject to the laws of those jurisdictions, which can differ from Australian law.

If you are uncomfortable with international transfer, do not create a Career Bridge account.

12. Security

We take reasonable steps to protect your information:

• All traffic between your browser and our servers is encrypted using HTTPS.
• Passwords are not stored as plain text. Supabase Auth handles password hashing using industry-standard algorithms.
• Database access uses row-level security policies so users only see their own data.
• Admin access is restricted to a small group of vetted volunteers and is gated by role-based access control.
• API keys and secrets are stored in protected environment variables, not in the public code.
• We log admin actions for audit purposes.

No system is perfectly secure. If we ever suffer a data breach that affects you, we will notify you and the Office of the Australian Information Commissioner (OAIC) where required by the Notifiable Data Breaches scheme.

13. Children and young people

Career Bridge is intended for users aged 16 and over.

• If you are under 16, please do not create an account. If we learn that we hold information about a user under 16, we will delete it.
• If you are between 16 and 18, we recommend that a parent or guardian review this policy with you before you sign up.
• The platform is built around tertiary student opportunities. Most users are 18 or older.

14. Making a privacy complaint

If you think we have mishandled your information:

1. Contact us first. Email our Privacy Officer at educare@nsw.masca.org.au. Tell us what happened and what you would like us to do. We will acknowledge your complaint within 7 days and aim to resolve it within 30 days.
2. Escalate to OAIC. If you are not satisfied with our response, you can lodge a complaint with the Office of the Australian Information Commissioner. See oaic.gov.au/privacy/privacy-complaints or call 1300 363 992.

If you are based in Malaysia and prefer to engage with the Malaysian Personal Data Protection regime under the PDPA 2010, you can also contact the Malaysian Personal Data Protection Department at pdp.gov.my. We acknowledge the PDPA’s relevance to Malaysian citizens but note that Career Bridge is operated from Australia and is primarily governed by the Australian Privacy Act.

15. Changes to this policy

We may update this policy from time to time. When we make a material change, we will:

• Update the “Last updated” date at the top.
• Post a notice in the platform’s announcement banner for at least 14 days.
• Email registered users for significant changes.

If you do not agree with a change, you can delete your account at any time.

16. Past security advisories

For transparency, MASCA NSW records the following vendor security advisories that have affected platform components used by Career Bridge.

• 2026-05-20: Vercel security advisory. Our hosting provider (Vercel) issued a general security advisory to all customers regarding an internal incident at their end. Vercel’s notification confirmed that they had no reason to believe MASCA’s credentials or member data had been compromised. As a precautionary measure, on the same day we rotated all platform credentials, reviewed the deployment activity log, and migrated all environment variables to Vercel’s hardened “sensitive” storage tier. No notifiable data breach occurred under the Notifiable Data Breaches scheme.
• 2026-06-14: Proactive security hardening. As part of a routine security review, we identified and fixed a database access-control flaw before any misuse occurred, tightened database row-level security, locked resume storage to document file types, and added account and resume deletion controls plus additional security headers. This was a preventative hardening release. No member data was exposed and no notifiable data breach occurred.

We commit to updating this section whenever a vendor security advisory or data breach materially affects, or potentially affects, member data on Career Bridge.

17. Contact

MASCA NSW, Career Bridge Privacy Officer
Email: educare@nsw.masca.org.au
Postal: c/o MASCA NSW Secretariat, NSW Australia
Web: careerbridge.mascansw.com.au

For general MASCA NSW enquiries that are not about Career Bridge privacy, see masca.org.au.