Privacy Policy

1. General
   
   1. This Privacy Policy and Collection Statement details Our commitment to protect You and Your customers’ Personal Information.
   2. We may collect, use, disclose, transfer or otherwise handle any Personal Information, and complies with the Privacy Act 1988 (Cth) (“Privacy Act”) and the Australian Privacy Principles (“APPs”) and applicable Laws.
2. Collection of Personal Information
   
   1. Information You Provide
      
      1. We collect Personal Information You provide to Us voluntarily, such as Your name, phone number, email address, home address, business address, business name, bank account, taxation information, driver’s licence and utility bills.
      2. We may collect Your Personal Information in the course of Your use of the Services, or:
         
         1. when You provide it to Us, or You offer or apply for use of our products or Services;
         2. when You provide it to Us in any way (including by completing a form, disclosing information over the phone or via email, or providing us a business card);
         3. during the application process for the use of Our products or Services;
         4. when You provide feedback to Us;
         5. when You visit or fill in a form on Our website;
         6. when You visit a premises from which We operate;
         7. when You otherwise contact Us by telephone, fax, email, social media, post or in person; or
         8. where We are otherwise required or authorised by Law to do so.
   2. Information that is Collected Automatically
      
      1. We collect some information about You automatically through cookies or similar technologies when you interact with Our website or Dashboard. This information may include but is not limited to the type of device You use, Your operating system and software version identifiers, Your IP address, Your browser type and the pages You view on Our website or Dashboard, and what interactions You have with the content.
   3. Information Obtained from Other Sources
      
      1. We may receive Your Personal Information from other sources, including third parties such as credit ratings agencies, identity verification agencies, banks and service partners that are authorised to provide such information. We also seek and receive information about You from social media platforms when You interact with Us on those platforms or when We are conducting fraud analysis.
      2. We may also collect Your Personal Information from other third parties, including but not limited to:
         
         1. Your nominated representative;
         2. Our share registry service provider; and
         3. other publicly available sources of information.
   4. Information Relating to Children and Minors
      
      1. We do not target or market intentionally to children under eighteen years of age. Visitors of all ages may interact with Our website, but no information is collected knowingly about those under the age of eighteen without parental consent. If Your Account has been registered by a child under eighteen years of age using false information, Your Account will be closed and any Personal Information collected will be erased from Our records.
3. Our Obligations
   
   1. Without limiting Clause 1.3, We must:
      
      1. only use Personal Information to the extent necessary to perform Our own obligations in accordance with the Agreement;
      2. without limiting any of Our own obligations under the Agreement, take such steps as are reasonable in the circumstances to protect any Personal Information from:
         
         1. misuse, interference and loss; and
         2. unauthorised access, modification or disclosure;
      3. not do anything that adversely affects the accuracy, currency or completeness of any Personal Information;
      4. ensure that reasonable organisational steps including encryption, staff training and security measures are taken to protect Your Personal Information from misuse or intrusion;
      5. ensure that none of Our Personnel who have access to any Personal Information use, disclose, transfer or retain such Personal Information except to the extent necessary to perform their duties of engagement;
      6. notify You immediately if We become aware of any actual or potential misuse, interference, loss or unauthorised access, modification or disclosure of Personal Information, or if We become aware of a breach of this Clause;
      7. notify You as soon as reasonably practicable after We receive any:
         
         1. request concerning access to or correction of any Personal Information; or
         2. complaint about the handling of any Personal Information;
      8. comply with any reasonable requests or directions from You concerning:
         
         1. the storage, security, use and disclosure of any Personal Information;
         2. remedying or otherwise dealing with any event referred to in Clause 3.1(m)(vi); and
         3. the handling of any request or complaint referred to in Clause 3.1(m)(vi);
      9. notify You as soon as reasonably practicable after We become aware that a disclosure of any Personal Information may be required by Law;
      10. at any time at Your request, or on the termination or expiration of the Agreement for any reason:
          
          1. ensure that any Personal Information is de-identified, as defined in the Privacy Act, or destroyed except as required by Law; or
          2. otherwise deal with any Personal Information in accordance with Your reasonable directions;
      11. if We become aware that there are reasonable grounds to suspect that an Eligible Data Breach may have occurred in relation to any Personal Information collected, stored or processed by Us in the course of providing the Services:
          
          1. promptly provide written Notice to You specifying the nature and details of the suspected Eligible Data Breach, the kind of Personal Information potentially affected and recommendations for any actions to be taken by You in response to the breach;
          2. carry out a reasonable and prompt assessment of whether there are reasonable grounds to believe that the suspected Eligible Data Breach amounts to an actual Eligible Data Breach; and
          3. promptly discuss in good faith the results of the assessment with You, as well as the proposed preventative, remedial or other action to be taken by Us;
      12. if We become aware that there are reasonable grounds to believe that an Eligible Data Breach has occurred in relation to any Personal Information (whether after conducting an assessment of a suspected Eligible Data Breach in accordance with Clause 3.1(l)(ii) or otherwise):
          
          1. if as assessment pursuant to Clause 3.1(l)(ii) has not been conducted, prior to taking any other action in connection with the Eligible Data Breach, immediately provide written Notice to You of the nature and details of the Eligible Data Breach, the kinds of information concerned and recommendations for any actions to be taken by You and/or affected individuals in response to the breach;
          2. promptly discuss and negotiate in good faith with You which Party will be the Party responsible for fulfilling the relevant notification requirements under the Law in respect of the Eligible Data Breach, including notifications to the Office of the Australian Information Commissioner (“OAIC”) and the relevant affected individuals;
          3. where the Parties agree that We will be the Party responsible for fulfilling the relevant notification requirements, and We comply with all such requirements in accordance with the Privacy Act, You must provide any and all assistance as may be necessary;
          4. obtain Your approval prior to issuing any relevant notification statements to the OAIC and affected individuals in accordance with the Privacy Act. You must not unreasonably withhold Your approval where We are required by Law to issue a notification and You have not made a determination to fulfil the notification requirement Yourself;
          5. You must provide approval as soon as reasonably practicable to Us under Clause 3.1(m)(iv) above to enable Us to comply with Our notification requirements;
          6. promptly take appropriate remedial action to mitigate any loss or interference with privacy flowing from the Eligible Data Breach, prevent any further serious harm to affected individuals and protect the affected Personal Information from further misuse or breach; and
          7. without limiting the foregoing, cooperate with and provide reasonable assistance to You for the purpose of ensuring that You comply with the statutory obligations under the Privacy Act.
4. Use and Disclosure of Your Personal Information
   
   1. Purpose for Collection of Personal Information
      
      1. Personal Information collected by Us in connection with the Services may be held and used by Us to assist in the administration of the Services. This may be to allow Us to:
         
         1. identify and communicate with You;
         2. enable Us to provide You with requested information;
         3. otherwise assist You by providing You with information and support;
         4. collect and process payments (either on behalf of You as part of Our Services, or for payments made to Us e.g. by You in consideration for Our Services);
         5. help Us to manage and enhance products or Services we provide to You; and
         6. personalise and customise Your experience on Our website.
      2. We may also use Your Personal Information to:
         
         1. help Us manage and respond to a general or specific shareholder enquiry;
         2. process share applications and services shareholders’ needs;
         3. provide facilities and services a shareholder may request;
         4. carry out appropriate administration in relation to Our shareholders and Our share registry, including to submit listing applications to, or respond to enquiries from, corporate regulators;
         5. conduct research for the purposes of improving existing products or Services or creating new products or Services;
         6. help us research the needs of Our customers to enable Us to market Our products and Services with a better understanding of their needs generally;
         7. analyse our shareholder base and for development and planning;
         8. protect You and Us from fraud;
         9. help us manage Our business operations;
         10. facilitate business support including maintenance, backup and audits;
         11. respond to any queries or complaints You may have; and
         12. comply with Our statutory and legal obligations.
      3. Personal Information collected by Us may be used for the purpose of direct marketing Our Services. Such direct marketing will only be directed towards entities We already provide Services to or their representatives, or any other person who expresses an interest in receiving Our Services. Direct marketing can be discontinued at any time by request from You.
      4. We may seek and obtain information from third parties including credit reporting agencies for the purpose of creating and maintaining a credit information file containing Personal Information about You. This may include a commercial or consumer credit report, bank reference, third party opinion, credit memorandum or other information as is reasonably necessary to assess and maintain Your credit position.
      5. As required by the Anti-Money Laundering and Counter-Terrorism Financing Act 2006 (Cth) (“AML/CTF Act”), prior to providing the Services, we will collect and verify Your Personal Information to ensure its accuracy and validity.
   2. Disclosure of Personal Information
      
      1. After collecting Your Personal Information, to the extent permitted by the Law, we may disclose it to:
         
         1. Our Affiliates, agents, representatives and subcontractors;
         2. Your nominated representatives;
         3. any financial institution You have an account with;
         4. professional service providers and advisors who perform functions on our behalf, such as lawyers;
         5. Your and Our insurers;
         6. Government Bodies or other regulatory agencies as required by Law;
         7. debt collecting agencies;
         8. Financial Services Providers including but not limited to Mastercard, Eftpos, Visa or American Express;
         9. credit reporting bodies;
         10. document verification service providers, document issuers or official record holders via third party systems;
         11. to the extent permitted by Law, any entity reasonably necessary to allow Us to provide the Services;
         12. any entity You reasonably request Us to disclose Your Personal Information to; and
         13. any entity you consent to Us to disclosure Your Personal Information to.
   3. Automated Decision-Making and Artificial Intelligence
      
      1. We use computer programs and automated systems, including Artificial Intelligence (“AI”), to make or assist in making decisions about Your eligibility for Our Services and products.
      2. Personal Information that may be used in the operation of such computer programs and automated systems includes information you provide to Us at the time of applying to use Our Services, such as:
         
         1. Your name;
         2. Your telephone number;
         3. Your email address;
         4. Your home address;
         5. Your device ID, device type, geo-location information, computer and connection information, statistics on page views, traffic to and from the sites, ad data, IP address and standard web log information;
         6. Your business address;
         7. Your business name;
         8. Your bank account;
         9. Your bank account balance;
         10. Your bank account transaction details;
         11. Your direct debits and scheduled payments;
         12. Your saved payees;
         13. Your taxation information;
         14. Your driver’s licence details; and
         15. Your utility bills.
      3. The kinds of decisions made solely by the operation of such computer programs and automated systems includes:
         
         1. the initial assessment of Your business to determine whether or not it is classified as high-risk to Us and / or Our Affiliates or Financial Services Providers; and
         2. the initial determination as to whether Your business is eligible to receive Services from Us.
   4. Overseas Disclosure
      
      1. Some of Your Personal Information may be disclosed, transferred, stored, processed or used overseas by Us, or by third party service providers. This may happen if:
         
         1. Our offices or related entities are overseas;
         2. We outsource certain activities or Services overseas;
         3. Transactions, information, Services or products have an overseas connection; or
         4. Our computer systems including information technology services are located overseas.
      2. You consent to the collection, use, storage, and processing of Your Personal Information outside of Australia as set out in this Privacy Policy and Collection Statement.
      3. In particular, Your Personal Information may be disclosed to third parties in the United Kingdom, New Zealand and/or the United States and such other countries in which those parties or their, or Our, computer systems may be located from time to time, where it may be used for the purposes described in this Privacy Policy and Collection Statement.
5. Notification of Changes to this Privacy Policy
   
   1. We reserve the right to update or alter this Privacy Policy and Collection Statement and You are encouraged to check on our website at www.fatzebra.com periodically for updates.
6. Your Rights
   
   1. Accessing Your Personal Information
      
      1. You may at any time:
         
         1. request a copy of our Privacy Policy;
         2. request a copy of Your Personal Information held by Us;
         3. request We delete Your Personal Information held by Us;
         4. request We correct or amend any of Your Personal Information held by Us; and
         5. request that We do not send Your Personal Information to any other organisation for the purpose of direct marketing.
      2. any reasonable request made under Clause 6.1(a) must be complied with by Us, to the extent required by the Law, in a timely manner and must be responded to in a reasonable period.
      3. We may be unable to continue to provide the Services to You if we comply with a request made under Clause 6.1(a)(iii).
   2. Further Information and Contact
      
      1. You may contact Us at any time regarding this Privacy Policy and Collection Statement at the below contact details:

Fat Zebra Pty Ltd
Phone: 1300 281 640
Post: Level 2, 58-62 Kippax Street, Surry Hills NSW 2010
Email: notices@fatzebra.com
Website: www.fatzebra.com

2. If You are not satisfied with your communication with Us in relation to this Privacy Policy and Collection Statement, you can refer Your complaint to:

Office of the Australian Information Commissioner
Phone: 1300 363 992
Post: GPO Box 5218, Sydney NSW 2001
Website: www.oaic.gov.au

7. Definitions
   
   1. Capitalised words used in this Privacy Policy and Collection Statement have the following meaning:
      
      1. Account means any account You create with Us in connection with the Services;
      2. Affiliates means an entity that is directly or indirectly controlled by a Party or under common control with a Party; for the purposes of this definition, “control” means:
         
         1. the beneficial ownership of more than 50% of the issued shares of the Party; or
         2. the capacity to determine the outcome of decisions about the Party’s financial and operating policies in accordance with section 50AA of the Corporations Act 2001 (Cth).
      3. Agreement means the Fat Zebra Master Agreement or any sub-agreements as available on Our website and amended from time to time;
      4. Dashboard means Our dashboard that allows You to manage Your Account, connect with other service providers, and enable additional features;
      5. Eligible Data Breach has the meaning given to that term in the Privacy Act;
      6. Financial Services Providers means an entity that offers financial products, advice and services including banking, payment services, card services and payment schemes;
      7. Government Body / Government Bodies means:
         
         1. any national, supranational, federal, state, local or other governmental authority or regulatory body operating in Australia; and
         2. any government or any governmental, semi‑governmental, administrative, fiscal, judicial or quasi-judicial body, department, commission, authority, tribunal, agency or entity operating in Australia.
      8. Law/s means:
         
         1. Legislation, meaning any national, supranational, federal, state and local laws, statutes, directives, regulations, rules, codes or ordinances enacted, adopted, issued or promulgated by any court or Government Body or common law or any consent decree or settlement Agreement entered into with any Government Body, including the Privacy Act and any other applicable privacy legislation or rules in any jurisdiction; and
         2. Regulations, meaning the by-laws, rules, operating regulations and any other instructions issued by the Payment Systems, as the same may be amended or varied from time to time;
      9. Network/s means a system that facilitates the electronic transfer of funds between parties, such as consumers, businesses and financial institutions through various payment methods including credit cards, debit cards, bank transfers and digital wallets.
      10. Notice means written notices that may be delivered to a Party by hand, registered post or electronically by the Dashboard, where applicable, or email to that Party’s nominated address or to an alternate address as notified to the Party giving the Notice;
      11. Our, Us or We means Fat Zebra Pty Ltd ACN 154 014 785;
      12. Party means, where applicable, an entity bound by the Agreement, or alternatively, an entity whose Personal Information is collected, used, disclosed, transferred or otherwise handled by Us;
      13. Payment Systems means the international and domestic schemes and Networks governing card payments;
      14. Personal Information has the meaning given to that term in the Privacy Act;
      15. Personnel means any director, officer, employee, agent, contractor or subcontractor of a Party or its Affiliates;
      16. Services means the services offered by Us as described in the exhibits to the Agreement;
      17. Transactions means financial and non-financial payment transactions including but not limited to purchases, authorisations, pre-authorisations, declines, voids, refunds or captures; or events including but not limited to network tokenization, updates or authentication; and
      18. You or Your means an entity whose Personal Information is collected, used, disclosed, transferred or otherwise handled by Us.