Privacy Policy

1. Who we are

This website provides the AU/NZ Entertainment Laser Safety Officer (LSO) training course and the Operator Induction course at lsocourse.zone.net.au and lasers.co.nz. It is operated by Flying Pictures Laser Show Systems (ABN 81 394 284 413), trading as Flying Pictures. We handle personal information in line with the Australian Privacy Act 1988 (including the Australian Privacy Principles) and, for New Zealand users, the Privacy Act 2020. For privacy enquiries contact apps@zone.net.au.

2. Information we collect

• Account — full name, email address and a hashed password.
• Course activity — module progress, quiz and exam answers and scores, attempt dates and completion dates.
• Photo ID — a photograph of your identity document, uploaded before the exam solely to confirm that the person sitting it matches the name on the certificate.
• Payment details — when you buy a course, payment is taken by Stripe on Stripe's own page. We receive confirmation of the payment, the amount, a Stripe customer and session reference and your email — not your card number.
• Certificates — your name, certificate number and issue dates.
• Login records — the date and time of each login and which of our sites you used (Australia or New Zealand), used to run and support the course.
• Emails you send us — for example refund or support requests.

Our web server keeps standard access logs (IP address, pages requested, time) for security and troubleshooting.

3. How we use it

• To create and manage your account and provide the course you paid for.
• To take payment, issue receipts, process refunds and keep the financial records the law requires.
• To track progress and exam results, verify your identity, and issue, verify and (if necessary) revoke certificates.
• To send transactional emails: email verification, password resets, payment confirmation, exam results and access-expiry reminders.
• To keep the site secure and prevent fraud, cheating and abuse.

We do not send marketing emails, sell your information, or use it for advertising.

4. Cookies

We use only the cookies needed to keep you logged in (a secure session cookie). We do not use advertising or analytics cookies or third-party trackers. When you go to Stripe to pay, Stripe may set its own cookies under its privacy policy.

5. Who we share it with

We use these service providers, who handle your information only to provide their service to us:

• Stripe (Stripe Payments Australia Pty Ltd and Stripe, Inc.) — payment processing, fraud screening and receipts.
• Resend — sending transactional emails (your name and email address).
• Hostinger — hosts our servers and database, including uploaded photo ID.
• Cloudflare — DNS only.

We may also disclose information where the law requires it, to protect our rights, or to a regulator or your employer where you have asked us to confirm your certificate.

6. Information stored or processed overseas

Our servers are hosted by Hostinger in India, so your account data and uploaded photo ID are stored there. Stripe and Resend process data in the United States and other countries. We take reasonable steps to make sure these providers protect your information, but by using the site you acknowledge that overseas recipients may not be bound by the Australian Privacy Principles or New Zealand Privacy Act.

7. Public information

If you earn a certificate, your name, certificate number, course and issue and review dates appear on the public graduates register and on the verification page. This is how employers, venues and regulators confirm a certificate is genuine. If you do not want to be listed, contact us before taking the exam.

8. Security

Passwords are hashed with bcrypt and never stored in plain text. All connections use HTTPS. Payment card data never touches our servers. Photo ID files are kept outside the public web directory and are accessible only to administrators. No system is perfectly secure; if a breach is likely to cause serious harm we will notify you and the relevant regulator as the law requires.

9. How long we keep it

• Account and course data: for the life of your enrolment (24 months) plus a further 12 months.
• Payment and refund records: at least 5 years, as required for tax and accounting.
• Certificate records: indefinitely, so certificates stay verifiable.
• Photo ID: deleted when your account data is deleted, subject to any need to keep it to resolve a certificate dispute.

10. Your rights

You can ask us to:

• give you a copy of the personal information we hold about you;
• correct information that is wrong or out of date;
• delete your account and associated data (certificate and payment records may be retained as described above).

Email apps@zone.net.au. We aim to respond within 30 days. If you are not satisfied, you can complain to the Office of the Australian Information Commissioner or, in New Zealand, the Office of the Privacy Commissioner.

11. Changes to this policy

We may update this policy from time to time. Changes are posted here with a new date. If a change materially affects how we use your information, we will tell you by email.