Australia Privacy Policy

Last Updated: September 1, 2026

1. About This Privacy Policy

For individuals in Australia, we handle personal information in accordance with the Australian Privacy Principles under the Privacy Act 1988 (Cth) (Privacy Act). In this policy:

‘personal information’ means information or an opinion about an identified individual, or an individual who is reasonably identifiable, whether true or not and whether recorded in a material form or not; and
‘sensitive information’ (a subset of personal information) includes information about health, biometrics and biometric templates, racial or ethnic origin, political opinions, religious beliefs or affiliations, philosophical beliefs, membership of a trade union, sexual orientation or practices, and criminal records.

This Privacy Policy applies in relation to the personal information we collect from anyone who visits our websites and/or uses our Services in Australia, and exists to supplement, and applies in addition to, our general Privacy Policy (General Policy). To the extent of any inconsistency with the General Policy, this Privacy Policy will prevail.

Specifically, this Privacy Policy describes:

the types of personal information we obtain;
how we use that personal information;
with whom we share it;
your rights in respect of your personal information; and
how you can contact us about our privacy practices, including to make a complaint.

Capitalised terms not defined in this Privacy Policy have the meanings given to those terms in the General Policy.

Please read this Privacy Policy carefully to understand our policies and practices regarding the personal information we collect and how we use it.

This policy is available free of charge on our website. On request, we will take reasonable steps to provide a copy in a different format.

2. Personal Information We Collect

We collect your personal information where it is reasonably necessary for us to provide our Services and operate our business, for the purposes outlined in the General Policy.

At or before the time we collect your personal information (or, if not practicable at that time, as soon as practicable afterwards), we will take reasonable steps to notify you of:

the personal information we will collect from you;
the purposes for which we are collecting that personal information;
the consequences if you do not provide that personal information to us;
how we may use or disclose that personal information (including to any overseas recipients); and
how you may access and correct your information or make a complaint.

We collect personal information directly from you where practicable and by lawful and fair means. If we receive personal information that we did not solicit, we will determine whether we could have collected it under this policy and applicable law and if we determine that we should not have collected it, we will take reasonable steps to destroy or de identify it.

Where we collect sensitive information, we will only do so with your consent or as otherwise permitted by Australian law.

Where we collect the personal information of a child who lacks the capacity to consent to that collection, we will obtain consent from a parent or guardian, or from the child’s school acting on the parent’s behalf, before collecting that personal information, and we will handle that personal information in accordance with this Privacy Policy.

3. Sensitive Information

Collection and handling

We may, in limited circumstances, collect and handle certain categories of sensitive information, including health information (for example, details about medical conditions, medication, disability status or vaccination records, which you choose to provide) and biometric information, including facial images or facial geometry data captured through our identity-verification or security features (Face Images),which we may use to create and compare facial templates for identity verification and fraud prevention purposes, as well as for the purposes of the verification of certain documents (for example, working with children certifications).

We will only collect such sensitive information where it is reasonably necessary for one or more of our functions or activities and we have obtained your express consent (or an applicable legal exception applies), and we will only use or disclose it:

in accordance with applicable laws, this Privacy Policy and the General Policy; and
for the purposes expressly stated at the time of collection or purposes directly related to those purposes that you would reasonably expect.

AI use

We may may use AI tools to analyse Face Images for the above-stated purposes and will do so in accordance with applicable laws, this Privacy Policy and the General Policy.

However, except as permitted by applicable law or with your consent, we do not use AI to make decisions about you that have legal or similarly significant effects, without meaningful human oversight. If we propose to use AI in a way that is likely to have a significant effect on you, we will provide additional notice and explain your available options, including how to request human review.

4. How We Use Personal Information

We use and disclose personal information for the purposes for which it was collected (as outlined in the General Policy) and for related (or, if sensitive information, directly related) purposes that you would reasonably expect, or otherwise, with your consent, or as required or authorised by law.

We do not adopt as our own, use, or disclose government related identifiers (such as Medicare, tax file, or driver licence numbers) disclosed to or collected by us, except as permitted by the Privacy Act and we will protect such identifiers disclosed to us to the extent that they constitute personal information for the purposes of the Privacy Act.

5. How We Disclose Personal Information

We are likely to disclose personal information to overseas recipients (including our service providers, delivery networks, support teams and related companies) for the purposes described in this Privacy Policy and the General Policy. Due to the dynamic nature of our service providers and the way that modern cloud and support services operate, it is not practicable for us to list all the countries in which such recipients may be located at a particular point in time.

We typically disclose personal information to the following categories of overseas recipients:

cloud hosting and data storage providers;
software (including software-as-a-service) vendors;
IT support and cybersecurity service providers;
payment and billing processors;
professional advisers; and
customer support providers.

In the ordinary course of operations, those recipients are commonly located in areas overseas, including the United Kingdom, the United States of America, and certain member states of the European Union.

However, the specific providers that we use, and the countries in which they are located, may change as our service arrangements evolve.

Before we disclose personal information overseas, we take reasonable steps to ensure that the relevant overseas recipient will not breach the Australian Privacy Principles, in relation to that personal information; these steps may include conducting privacy and security due diligence, using contractual terms that require the recipient to handle personal information in a manner that provides comparable protection to the Australian Privacy Principles, and implementing technical and organisational measures to protect that personal information.

You may contact us at any time to request further information about whether your personal information is likely to be disclosed to overseas recipients and, if so, the countries in which those recipients are likely to be located at that time (see How to Contact Us in the General Policy).

6. Your Rights and Choices

Where lawful and practicable, you may interact with us anonymously or by using a pseudonym (for example, when making a general enquiry). However, you acknowledge that if, in dealing with you under anonymity or via a pseudonym, we cannot reasonably identify you, then we may not be able to assist you or provide you with our Services.

You may request access to your personal information by contacting us (see How to Contact Us in the General Policy. We will respond within a reasonable timeframe and provide that access in the manner you request if, it is reasonable and practicable to do so. We may charge a reasonable fee to cover the costs of providing access (but not for making a request). If we refuse access, we will provide written reasons and explain how you can make a complaint.

You may request that we correct your personal information by contacting us (see How to Contact Us in the General Policy if you consider it is inaccurate, out of date, incomplete or irrelevant. We will respond within a reasonable timeframe. If we refuse a requested correction, we will provide written reasons and explain how you can make a complaint. If we correct personal information and you ask us to notify third parties to whom we have disclosed that personal information, we will take reasonable steps to do so, where practicable and lawful.

If you have a question or complaint about how we handle your personal information, please contact (see How to Contact Us in the General Policy. We will acknowledge your complaint and respond within a reasonable timeframe. If you are not satisfied with our response, you may refer your complaint to the Office of the Australian Information Commissioner (OAIC) for further assistance. See www.oaic.gov.au for contact details.

7. Advertising and Marketing

We may use your personal information for direct marketing in accordance with the Privacy Act. You may opt out of direct marketing at any time by using the unsubscribe facility in our communications or by contacting us.

We will not use or disclose sensitive information for direct marketing unless you have expressly consented to that use.

8. How We Protect Personal Information

We will take reasonable steps to protect your personal information from misuse, interference and loss, and from unauthorised access, modification or disclosure.

We take reasonable steps to ensure that the personal information we collect is accurate, up to date and complete, and that information we use or disclose is, having regard to the purpose, accurate, up to date, complete and relevant. However, you acknowledge that we rely on you to provide information to us that is, to your knowledge, accurate, up to date and complete.

Where required under Australia’s Notifiable Data Breaches scheme, we will notify you and the OAIC of eligible data breaches.

9. Retention of Personal Information

Where we no longer need personal information for any purpose permitted under this Privacy Policy, the General Policy and the Privacy Act, and we are not required by law to retain it, we will take reasonable steps to destroy it or to de identify it.