Privacy Framework Overview

Educational Pioneers Australia Pty Ltd (EPA Global) operates in the overseas education, migration advisory, and professional placement sectors across Australia, India, and Nepal, with a digital presence that extends its data collection to other jurisdictions. This document consolidates EPA Global's privacy obligations into three distinct policies, each addressing a specific stakeholder group and its associated data flows.

Regulatory Landscape

Jurisdiction	Primary Legislation	Key Obligation
Australia	Privacy Act 1988 (Cth); Australian Privacy Principles (APPs 1–13); Notifiable Data Breaches Scheme; Migration Act 1958 (for migration data)	13 APPs govern collection, use, storage, access and cross-border transfer. Mandatory breach notification to OAIC and affected individuals.
India	Digital Personal Data Protection Act 2023 (DPDPA); Information Technology Act 2000 (residual); IT (Reasonable Security Practices) Rules 2011	Consent-based processing. Data Fiduciary obligations. Cross-border transfer restrictions. Data Principal rights including erasure.
Nepal	Individual Privacy Act 2018 (Byaktigat Gupta Ra Guptata Sambandhi Ain 2075)	Right to privacy of personal information. Consent required for collection and transfer. Prohibition on unauthorised disclosure.

Three-Policy Structure

Policy	Audience	Scope Summary
Policy 1	Students & Immigration Clients (B2C)	Personal and sensitive data of prospective and enrolled students, visa applicants, and PR clients.
Policy 2	B2B Partners & Institutional Contacts	Contact and business data of partner agencies, sub-agents, university representatives, and referral networks.
Policy 3	Website Visitors & Digital Users	Data collected through epaglobal.com, edchimp.com and any EPA digital channels — enquiry forms, cookies, analytics, and marketing.

All three policies are to be read together as EPA Global's unified Privacy Framework. In the event of any conflict between policies, the more protective provision applies. These policies are effective from the date of adoption by the CEO and are to be reviewed annually.

1.1 Introduction

Educational Pioneers Australia Pty Ltd (EPA Global) and its affiliated entities (collectively "EPA Global", "we", "us", "our") are committed to protecting the privacy and personal data of all students, immigration clients, prospective applicants, and their families who engage with our services. This policy explains what personal information we collect, why we collect it, how we use and protect it, and what rights you have in relation to your personal data.

This policy complies with the Australian Privacy Act 1988 and the Australian Privacy Principles (APPs), India's Digital Personal Data Protection Act 2023 (DPDPA), and Nepal's Individual Privacy Act 2018, as applicable based on your country of residence and the jurisdiction in which your engagement with EPA Global originates.

1.2 Who We Are

EPA Global is an overseas education consultancy and migration advisory firm. We assist students and professionals in applying for undergraduate degrees, postgraduate programmes, vocational qualifications, and permanent residency or skilled migration visas, primarily to Australia, New Zealand, the United Kingdom, Germany, Malta, France, and other destinations.

Our principal office is located in Sydney, Australia. We also operate a regional office in Canberra, Australia, and branch offices in Kolkata, Karnal, Bengaluru, Bareilly, and Surat (India), and Kathmandu (Nepal). In Australia, EPA Global holds or operates under a registered migration agent licence (MARA) for the provision of regulated migration advice.

1.3 Personal Data We Collect

1.3.1 Information You Provide Directly

• Full name, date of birth, gender, and nationality
• Passport details and national identification numbers
• Contact information: email address, phone number, residential address
• Academic qualifications, transcripts, degree certificates, and mark sheets
• English language test results (IELTS, PTE, TOEFL, Duolingo, OET)
• Financial documentation: bank statements, scholarship letters, loan sanction letters, financial sponsorship declarations
• Statement of Purpose, personal statements, Letters of Recommendation
• Work experience records, employment history, and professional certificates
• Visa application history: prior visas, refusals, immigration violations
• Medical and health information where required for visa applications (for example, Australian health examinations)
• Police Clearance Certificates and character documentation
• Emergency contact information and family details where relevant to visa streams
• Payment information including fee receipts and scholarship information (we do not store credit/debit card numbers)

1.3.2 Sensitive Information

Certain categories of data are classified as sensitive and are afforded heightened protection under applicable law. We may collect the following sensitive data only where it is directly relevant to your application or visa stream and with your explicit consent:

• Health and medical information (required for certain visa health checks)
• Criminal history (required for character requirements in migration applications)
• Biometric data where lodged with government immigration authorities
• Religious affiliation or ethnic origin where voluntarily provided in personal statements

We do not collect sensitive information speculatively. Sensitive data is collected only where specifically required by the destination country's immigration authority or educational institution.

1.3.3 Information Collected Indirectly

• Referral information where a partner agency submits your inquiry on your behalf
• University or institution assessments and conditional offer letters
• Australian Department of Home Affairs or equivalent immigration authority communications
• Communication records from our CRM system (WhatsApp, email, phone logs)

1.4 How We Collect Your Data

• Directly from you through our website enquiry forms, WhatsApp, phone, email, or walk-in consultation at any EPA branch
• Through our B2B partner agencies who refer students to EPA Global on your behalf. In such cases, the partner is responsible for notifying you that your data is being shared with EPA Global.
• From educational institutions (offer letters, conditional admissions, fee confirmations)
• From immigration authorities in the course of lodging and monitoring your application
• From third-party assessment services (IELTS score verification, credential assessors)

1.5 Legal Basis for Processing

Jurisdiction	Legal Basis
Australia (Privacy Act 1988 / APPs)	Collection is necessary for or directly related to our primary function as an education and migration consultancy. Processing is authorised under APP 3 (solicited personal information) and APP 6 (use and disclosure for the primary purpose of collection). Sensitive information is collected with your consent and only where directly necessary. Migration-related processing is also governed by the Migration Act 1958.
India (DPDPA 2023)	Processing is based on your free, informed, specific, and unambiguous consent provided at the point of engagement. You have the right to withdraw consent at any time. We also process data where necessary to perform our service contract with you, or to comply with legal obligations applicable to EPA Global.
Nepal (Individual Privacy Act 2018)	Collection and processing is based on your express consent. We collect only information that is necessary for the service you have requested and do not collect personal information beyond what is proportionate to that purpose.

1.6 How We Use Your Data

We use your personal information for the following purposes:

• Assessing your eligibility for overseas education programmes or migration pathways
• Preparing and submitting applications to educational institutions on your behalf
• Preparing and lodging visa or migration applications with relevant government authorities
• Communicating with you about the progress of your application and any required actions
• Providing counselling, destination advice, course comparisons, and fee guidance
• Arranging Overseas Health Cover (OHSC), education loans, and accommodation where requested
• Post-enrollment support: orientation, visa alerts, attendance monitoring, fee reminders, and pastoral care
• Maintaining accurate records as required by professional licensing obligations (including MARA)
• Improving our internal processes, training, and service quality
• Marketing our services to you, including updates on new programmes, destination opportunities, or scholarship alerts — only with your consent, and you may opt out at any time
• Complying with our legal and regulatory obligations

1.7 Sharing Your Personal Data

We do not sell, rent, or trade your personal information. We share your data only in the following circumstances:

1.7.1 Universities and Educational Institutions

We share your application materials, academic records, and supporting documents with institutions where you choose to apply. This is the core purpose of our service and forms part of our agreement with you.

1.7.2 Immigration Authorities

For migration and student visa applications, we transmit your personal information to the relevant government body (e.g., Australian Department of Home Affairs, UK Visas and Immigration, New Zealand Immigration). This is a legal requirement of the visa application process.

1.7.3 Third-Party Service Providers

We engage third-party providers for specific services that support your application. These include:

• Education loan partners (for financing referrals — you choose whether to proceed)
• OHSC providers (for health cover bundled with Australian applications)
• Credential assessment bodies (e.g., NAATI, Skills Assessment bodies)
• Translation and notarisation services where required

All third-party providers engaged by EPA Global are required to maintain confidentiality and handle your data consistently with applicable privacy laws.

1.7.4 Partner Agencies (B2B)

Where your inquiry was submitted by a partner agency on your behalf, that agency may receive updates on your application status as part of the service agreement between EPA Global and the partner. The partner agency is bound by a Partner Agreement that includes data handling obligations.

1.7.5 Legal and Regulatory Requirements

We may disclose your information to courts, regulators, or law enforcement bodies where we are legally required to do so, or where disclosure is necessary to protect the rights, property, or safety of EPA Global, its clients, or the public.

1.8 Cross-Border Data Transfers

By the nature of overseas education and migration services, your personal data will be transmitted to educational institutions and government authorities in destination countries (Australia, New Zealand, United Kingdom, Germany, Malta, France, and others). By engaging EPA Global's services, you acknowledge and consent to these transfers as they are integral to the service.

For transfers of Indian residents' data outside India: EPA Global complies with the cross-border transfer requirements under the DPDPA 2023. Transfers are made only to countries notified by the Central Government as permitting data transfers, or where necessary to provide services you have explicitly requested. For Nepali residents' data, transfers are made only with your consent or where required by the government application process.

For Australian residents: EPA Global complies with APP 8 regarding overseas disclosure. Before disclosing personal information to an overseas recipient, EPA Global takes reasonable steps to ensure the recipient handles the information consistently with the APPs.

1.9 Data Retention

Data Category	Retention Period
Active client records (during engagement)	Retained throughout the engagement and for 7 years following closure of the file.
Visa and migration records	7 years from case closure, consistent with MARA record-keeping obligations (Migration Act 1958, MARA Code of Conduct).
Application documents (transcripts, passports, bank statements)	Retained for 7 years from the date of submission or case closure, then securely destroyed.
Communication records (email, WhatsApp logs)	Retained for 3 years from last contact, or 7 years if part of a migration file.
Unsuccessful or withdrawn applications	Retained for 3 years from date of withdrawal or refusal.
Marketing contact list	Retained until opt-out or withdrawal of consent. Removed within 30 days of request.

Retention periods reflect the longest applicable obligation across all jurisdictions in which EPA Global operates. Where a shorter period is mandated by local law, that period applies to data held in that jurisdiction.

1.10 Your Rights

1.10.1 Australia — Australian Privacy Principles

Under the Privacy Act 1988 and the APPs, you have the following rights:

• APP 12 — Access: You may request access to your personal information held by EPA Global. We will respond within 30 days.
• APP 13 — Correction: You may request that we correct personal information that is inaccurate, incomplete, or out of date.
• APP 2 — Anonymity: You may ask not to identify yourself when making a general enquiry, where practicable.
• Opt-out of direct marketing at any time.
• Notifiable Data Breaches: In the event of a data breach that is likely to result in serious harm, EPA Global will notify both the Office of the Australian Information Commissioner (OAIC) and affected individuals as required under the Notifiable Data Breaches Scheme.

1.10.2 India — Digital Personal Data Protection Act 2023

Under the DPDPA 2023, Data Principals (individuals whose data is processed) have the following rights:

• Right to Information: Request a summary of the personal data processed and the processing activities.
• Right to Correction and Erasure: Request correction of inaccurate data, or erasure of data no longer necessary for the purpose it was collected.
• Right to Grievance Redressal: Lodge a complaint with EPA Global's designated Data Protection contact. If not satisfied, escalate to the Data Protection Board of India.
• Right to Nominate: Nominate another individual to exercise your rights in the event of your death or incapacity.
• Right to Withdraw Consent: Withdraw consent at any time. Withdrawal does not affect lawfulness of prior processing, and may affect our ability to continue providing services.

1.10.3 Nepal — Individual Privacy Act 2018

Under Nepal's Individual Privacy Act 2018, you have the right to:

• Request access to personal information held about you by EPA Global.
• Request correction of inaccurate or outdated personal information.
• Object to processing not consistent with the purpose for which consent was given.
• Withdraw consent at any time for purposes beyond the core service obligation.

1.11 Data Security

EPA Global implements appropriate technical and organisational measures to protect your personal information from unauthorised access, loss, misuse, alteration, or disclosure. These measures include:

• Restricted access: Only authorised personnel with a need to process your data for your case have access to your file.
• CRM access controls: Client records in our CRM system are access-controlled by role. Counselors access only their assigned cases.
• Encryption: Documents transmitted electronically use encrypted channels where available.
• Physical security: Printed documents containing personal data are stored in locked filing cabinets and are not left unattended.
• Staff training: All EPA Global staff are trained on data handling obligations as part of onboarding and annual refreshers.
• Third-party oversight: All third-party processors are assessed for their data handling practices before engagement.

In the event of a data breach, EPA Global will follow its internal Data Breach Response Procedure and notify affected individuals and relevant authorities in accordance with applicable law.

1.12 Cookies and Digital Tracking

For information about how EPA Global collects and uses data through our website and digital platforms, please refer to Policy 3: Website & Digital Privacy Policy.

1.13 Changes to This Policy

EPA Global may update this policy from time to time to reflect changes in our services, applicable law, or internal practices. The updated version will be published on our website with the date of revision. For material changes, we will notify active clients directly by email or through our CRM communication channels.

1.14 Contact & Complaints

For all privacy-related enquiries, requests, or complaints, please contact EPA Global's Privacy Contact:

Privacy Contact	Avinash Pradhan, Director — Operations (Privacy & Compliance point of contact until a dedicated Head HR is appointed)
Email	enquiry@epaglobal.com
Postal Address	Educational Pioneers Australia Pty Ltd (EPA Global), Canberra Office — Level 1/76 Emu Bank, Belconnen ACT 2617
Response Time	We will acknowledge your request within 5 business days and respond fully within 30 calendar days.

If you are not satisfied with EPA Global's response, you may escalate to the relevant authority:

• Australia: Office of the Australian Information Commissioner (OAIC) — www.oaic.gov.au
• India: Data Protection Board of India (once fully constituted under the DPDPA 2023)
• Nepal: Department of Information Technology or relevant authority

2.1 Introduction

This policy governs how Educational Pioneers Australia Pty Ltd (EPA Global) collects, stores, uses, and protects the personal and business data of individuals representing B2B partner organisations — including sub-agent representatives, staff at partner consultancies, university and institutional contacts, referral partners, and other professional collaborators.

This policy applies to all partners operating under a Partner Agreement with EPA Global, including partners based in India, Nepal, Pakistan, Bangladesh, Sri Lanka, and other source markets. It does not replace or supersede the formal Partner Agreement, which governs commercial obligations.

2.2 Data We Collect About Partner Contacts

• Full name, designation, and business role
• Business name, registered address, and branch office details
• Email address, WhatsApp number, and direct phone number
• Account login details for EPA Global's partner portal or CRM (where applicable)
• Case submission history: names, nationalities, and destination preferences of students referred (client data — governed by Policy 1)
• Commission earned, commission payout records, and bank or payment details for remittance
• Communication history: emails, meeting notes, WhatsApp messages relevant to partnership management
• Performance data: conversion rates, application volumes, visa success rates
• Training attendance and knowledge assessment records (where EPA partner training is provided)

EPA Global does not collect sensitive personal information (health, religion, ethnicity, criminal history) from B2B partner contacts. If any such information is inadvertently received, it will not be retained.

2.3 How We Use Partner Contact Data

• Managing the commercial and operational relationship with your organisation under the Partner Agreement
• Processing commission payments and maintaining accurate financial records
• Communicating destination updates, university offers, visa policy changes, and product information
• Onboarding new partners and providing access to EPA Global's partner resources, training, and CRM tools
• Tracking and reporting application volumes for internal performance management and BHAG reporting
• Compliance with any anti-money laundering, fraud prevention, or regulatory screening obligations
• Maintaining auditable records for MARA compliance (where the partner submits migration-related cases)

2.4 Legal Basis for Processing

EPA Global processes B2B partner contact data on the following legal bases:

• Performance of the Partner Agreement: Data processing is necessary to fulfil our contractual obligations, including case management, commission tracking, and operational communication.
• Legitimate interests: EPA Global has a legitimate interest in maintaining accurate records of its partner network and ensuring efficient case routing.
• Legal obligation: Commission and financial records are maintained to satisfy tax, audit, and regulatory requirements in India, Australia, and Nepal.
• Consent (India — DPDPA 2023): Where EPA Global collects data about partner contacts beyond what is strictly necessary for contract performance, such processing is based on consent.

2.5 Sharing Partner Data

• Finance and accounting: Partner commission records are shared with EPA Global's internal finance function and, where required, with auditors or tax authorities.
• Technology providers: CRM and ERP platforms used by EPA Global may host partner data. All platforms are assessed for their security practices.
• Legal and regulatory authorities: Where required by applicable law or during any regulatory investigation.

EPA Global does not share partner contact lists, performance data, or commission structures with any third party for commercial or marketing purposes.

2.6 Data Retention — Partner Data

Data Category	Retention Period
Active partner records	Retained for the duration of the Partner Agreement and 5 years following termination.
Commission and financial records	7 years from the transaction date, consistent with Indian tax law and Australian Taxation Office requirements.
Communication and case history	3 years from last active case, or 5 years from partner termination.
Dormant partner records (no cases >12 months)	Archived after 12 months of inactivity. Deleted after 3 years unless reactivated.

2.7 Your Rights as a Partner Contact

Individual representatives of partner organisations are natural persons and retain privacy rights under applicable law. These include:

• The right to access personal data held by EPA Global about you individually.
• The right to request correction of inaccurate personal information.
• The right to request erasure of your personal contact data where it is no longer required (note: financial and compliance records may be retained under legal obligation).
• The right to withdraw from marketing communications at any time.

Partner organisations that have signed a Partner Agreement with EPA Global may also request a summary of their case history and commission records through the designated Head of Business Development.

2.8 Data Security for Partner Records

Partner commission data, bank details, and contact information are treated as confidential business information. Access to partner financial records is restricted to finance and senior leadership. Partner case data is accessible to the counseling and processing teams only on a need-to-know basis for active case management.

2.9 Contact

For B2B privacy queries or data access requests, please contact the Head of Business Development at EPA Global, or direct your request to the general privacy contact listed in Policy 1, Section 1.14.

3.1 Introduction

This policy applies to all individuals who visit Educational Pioneers Australia Pty Ltd (EPA Global)'s website (epaglobal.com, edchimp.com and any associated branch or campaign pages), interact with our social media accounts, submit an online enquiry, respond to a digital advertisement, or engage with any EPA Global digital communication channel.

This policy should be read alongside Policy 1 if you subsequently become an EPA Global client. In that case, Policy 1 governs the handling of your personal data in full.

3.2 Data Collected Automatically

When you visit our website, certain technical data is collected automatically by our hosting provider and analytics tools. This may include:

• IP address and approximate geographic location (country/city level)
• Browser type and version, operating system, and device type
• Pages visited, time spent, and navigation path on our website
• Referral source (how you arrived at our website — e.g., Google search, social media ad)
• Date and time of visit

This data is collected in aggregate form and is primarily used for website performance monitoring and improvement. It does not, in ordinary circumstances, identify you as an individual.

3.3 Cookies and Tracking Technologies

EPA Global's website uses cookies and similar tracking technologies. Cookies are small text files placed on your device to help our website function correctly and to help us understand how visitors use our site.

Cookie Type	Purpose	Can Be Disabled?
Strictly Necessary	Required for the website to function (e.g., form submission, session management). No personal data collected beyond session identifiers.	No — these are essential for site operation.
Analytics Cookies	Google Analytics or equivalent — used to understand visitor behaviour in aggregate. No individual tracking without consent.	Yes — by declining analytics cookies at the cookie consent banner.
Marketing / Retargeting Cookies	Meta Pixel and Google Ads conversion tracking — used to measure effectiveness of paid campaigns and deliver relevant ads.	Yes — by declining marketing cookies at the cookie consent banner.

On first visit to our website, you will be shown a cookie consent notice. You may accept all cookies, accept only necessary cookies, or customise your preferences. You can update your cookie preferences at any time through the settings link in the website footer.

For Australian visitors, our cookie practices are consistent with APP 1 (transparency) and the ACMA Do Not Call Register Act 2006 for marketing. For Indian visitors, marketing cookies are placed only with your consent as required by the DPDPA 2023. For Nepali visitors, all non-essential tracking requires your consent under the Individual Privacy Act 2018.

3.4 Enquiry Forms and Lead Capture

When you submit an enquiry through our website, we collect:

• Your name, email address, and phone number
• Your country of residence, intended destination country, and preferred programme type
• Any message or additional details you choose to include

This information is automatically routed to EPA Global's CRM system and assigned to a counselor within 2 hours. It is used to respond to your enquiry and assess your eligibility for our services. By submitting an enquiry form, you provide consent for EPA Global to contact you about your stated area of interest.

You may opt out of further contact at any time by replying to any communication or by contacting us at the address in Section 3.10.

EPA Global does not use enquiry form data for any purpose other than responding to your specific enquiry and assessing eligibility for services you have expressed interest in. We do not sell enquiry data to third parties under any circumstances.

3.5 Social Media and Paid Advertising

EPA Global operates official accounts on LinkedIn, Instagram, Facebook, and YouTube, and operates a TikTok account for its Nepal branch. When you interact with our social media content (likes, comments, direct messages, form fills), the relevant platform's own privacy policy governs the platform's collection and use of your data. EPA Global receives only what you choose to share with us directly.

EPA Global runs paid advertising campaigns on Meta (Facebook/Instagram) and Google. These platforms may use cookies and tracking pixels to measure campaign performance and optimise delivery. You can control ad preferences through Meta's Ad Settings or Google's My Ad Centre.

We do not use social media engagement data for purposes beyond understanding the performance of our content and communicating with individuals who contact us directly through those platforms.

3.6 WhatsApp and Messaging Channels

EPA Global uses WhatsApp as a primary communication channel for enquiries and client updates. When you contact us via WhatsApp, your phone number and message content are received by EPA Global and may be logged in our CRM as part of your enquiry or client file. WhatsApp's own privacy policy governs Meta's processing of your data on their platform. EPA Global's use of your WhatsApp contact data is governed by this policy and, if you become a client, by Policy 1.

3.7 Email Marketing and Newsletters

EPA Global may send you email updates about new programmes, scholarship alerts, destination information, or visa changes if you have:

• Subscribed to our mailing list on the website, or
• Submitted an enquiry and indicated an interest in receiving updates, or
• Become an EPA Global client and have not opted out of non-essential communications.

Every marketing email will include an unsubscribe link. Unsubscribe requests are processed within 5 business days. Opting out of marketing emails does not affect essential service communications if you are an active client.

For Indian residents: Email marketing is sent only with your prior consent as required under the DPDPA 2023 and the TRAI Telecom Commercial Communications Customer Preference Regulations.

For Australian residents: Email marketing is conducted in compliance with the Spam Act 2003 (Cth). All commercial electronic messages include EPA Global's identity, a functional unsubscribe mechanism, and are not sent to individuals who have previously unsubscribed.

3.8 Third-Party Links

Our website may contain links to third-party websites including university portals, immigration authority sites, and partner resources. EPA Global is not responsible for the privacy practices of these external sites. We encourage you to review the privacy policy of any site you navigate to from our website.

3.9 Data Retention — Digital Data

Data Category	Retention Period
Website analytics data	26 months (Google Analytics default retention), then aggregated and anonymised.
Enquiry form submissions not converted to clients	12 months from submission, then deleted from CRM unless active nurture sequence is agreed.
Email marketing list	Until opt-out or 3 years of inactivity.
Cookies	Session cookies expire when you close your browser. Persistent cookies expire as set (typically 30–90 days for analytics; up to 180 days for retargeting).

3.10 Contact

For questions about our website data practices, cookie settings, or digital marketing opt-outs, contact us at the privacy contact details listed in Policy 1, Section 1.14. For cookie management, use the preference centre accessible through our website footer.

Adoption & Review

These three policies constitute Educational Pioneers Australia Pty Ltd (EPA Global)'s Privacy & Data Protection Policy Framework, Version 1.0. They are effective from the date of adoption by the Chief Executive Officer and apply to all branches and jurisdictions in which EPA Global operates.

Item	Detail
Document Title	Educational Pioneers Australia Pty Ltd (EPA Global) Privacy & Data Protection Policy Framework
Version	1.0
Effective Date	To be inserted on adoption
Policy Owner	Director — Operations (Avinash Pradhan), interim until Head HR & Admin is appointed
Approved By	Chief Executive Officer (Nishant Maroo)
Next Review Date	12 months from effective date, or earlier if material regulatory change occurs
Policies Included	Policy 1: Client & Student · Policy 2: B2B Partner · Policy 3: Website & Digital · Policy

Signature	Signature
______________________ Nishant Maroo Chief Executive Officer, Educational Pioneers Australia Pty Ltd (EPA Global) Date: ______________________	______________________ Ishwar Singh Chief Operating Officer, Educational Pioneers Australia Pty Ltd (EPA Global) Date: ______________________

These policies are confidential documents of Educational Pioneers Australia Pty Ltd (EPA Global). Policy 1 (Client), Policy 2 (Partner), and Policy 3 (Website) are external-facing and must be made available on the EPA Global website. Policy 4 (Employee) is internal only and must be included in the HR Handbook and communicated to all staff at onboarding.