1. Introduction
   1. 1. This document is the privacy policy of Data Mesh Group Pty Ltd ABN 72 629 446 251 (DMG) and its related bodies corporate. DMG is committed to protecting and maintaining the privacy, accuracy and security of the personal information of all our customers and business associates. This privacy policy provides information about how we manage your personal information.
      2. This policy includes our credit reporting policy (see Attachment 1), which provides information about how we manage your credit-related information.
      3. This policy also contains brief information about how we use cookies on our websites. For more detailed information about how we use cookies, please see the cookies policy included as Attachment 2 to this Privacy Policy.
2. What personal information do we collect and hold?
   1. 1. When used in this privacy policy, the term “personal information” means information that is about you in circumstances where you are identified or are reasonably identifiable. For example, this might include your name, address, telephone number or email address.
      2. The kinds of information that we may collect and hold about you may include:
         1. your name and contact details;
         2. what products you buy and from where and when;
         3. financial details such as the details of the transactions that we process including purchase amounts, refund amounts, payment card details, your bank and the scheme name of the card;
         4. information about how you interact with us when you use our online portals;
         5. device information, such as which browser you use, your operating system and how you use your device;
         6. your location if you have used a physical terminal for payment;
         7. login information such as usernames and the IP address of your device when accessing our websites and portals; and
         8. if you are a direct merchant customer of DMG: credit-related information such as details relating to credit history, credit capacity and eligibility for credit. Please see our credit reporting policy in Attachment 1 for more information.
3. How do we collect your information?
   1. 1. DMG provides payment processing services to merchants and businesses and we may collect your personal information from merchants and businesses in the course of processing and facilitating transactions, such as when you purchase a product from a merchant or business using your payment card.
      2. In other cases, we collect your personal information directly from you in ways including:
         1. through your access and use of our websites or portals;
         2. by phone, email, face-to-face or social media interactions between you and our representatives; and
         3. if you are merchant who is an individual and a customer of DMG, when you apply for and use our services.
      3. If we are not able to collect some or all of your relevant personal information, we may be unable to process transactions in which you are involved or to engage with you as a customer of DMG or to respond fully to any complaints or questions that you may have.
4. How do we use your information?
   1. 1. We collect, hold, use and disclose your personal information for the following purposes:
         1. processing financial transactions in which you are involved including processing payments, refunds and reversals and transferring your personal information to other parties involved in the processing of the transactions;
         2. facilitating your use of our portals and websites including understanding how you interact with them;
         3. providing you with information through our portals and websites and otherwise to provide information to you;
         4. understanding our customers (and their customers) better and improving our processes and services;
         5. performing administration or shared services within our corporate group, or marketing, planning, product or service development, quality control and research for DMG and its related bodies corporate;
         6. detecting or preventing fraud or other misconduct as may be required as part of our customer services and as by applicable law and regulation and best practice at any given time. If false or inaccurate information is provided and fraud is identified or suspected, details may be passed to fraud prevention agencies or other parties who may be affected by fraud;
         7. processing and responding to requests or complaints made by you;
         8. reorganising or making changes to our organisation or corporate group;
         9. enforcing our legal rights and protecting the rights of third parties; and
         10. fulfilling our legal obligations such as reporting requirements to regulators or to law enforcement agencies.
         11. to generate consumer insights which is based on aggregated and de-identified information and therefore do not identify any individual.
5. With whom do we share your personal information?
   1. 1. We may disclose your personal information to entities within our company group and with third parties outside of DMG including:
         1. those involved in processing the transactions in which you are involved including merchants, businesses, banks and other payment processing service providers who help to process, manage or administer those transactions;
         2. authorised representatives of DMG who sell products or services on our behalf;
         3. approved third parties who are authorised to assess the validity of financial and identification information;
         4. fraud reporting agencies and organisations established to detect, identify, investigate or prevent suspected or actual fraudulent or other criminal activity or misconduct;
         5. service providers who help us to maintain, review and develop our business systems, procedures and technology infrastructure including testing or upgrading our computer systems;
         6. organisations involved in a corporate re-organisation or transfer of DMG assets or business;
         7. organisations that assist with our product planning, analytics, research and development;
         8. mailing houses and telemarketing agencies and media organisations who assist us to communicate with you including media or social networking sites;
         9. other organisations involved in our normal business practices including our agents and contractors as well as our accountants, auditors or lawyers and other external advisers; and
         10. government or regulatory bodies as required or authorised by law or in order to protect your interests or the interests of DMG or third parties.
6. Cookies
   1. 1. In some cases, we may also collect your personal information through the use of cookies. When you access our website, we may send a “cookie” (which is a small summary file containing a unique ID number) to your computer.
      2. Our cookies do not collect personal information, but enable us to recognise your computer and keep track of products or services that you view so that, if you consent, we can send you news about those products or services.
      3. We also use cookies to measure traffic patterns in the aggregate. We use this to research our visitors’ habits so that we can improve our online products and services. We may log IP addresses to analyse trends, administer the website, track users’ movements and gather broad demographic information.
      4. If you do not wish to receive cookies, you can set your browser so that your computer does not accept them.
7. Direct marketing
   1. 1. We may send you direct marketing communications and information about our products and services that we consider may be of interest to you. These communications may be sent in various forms including mail, SMS and email, in accordance with applicable marketing laws.
      2. If you indicate a preferred method of communication, we will endeavour to use that method whenever practical to do so. You may opt-out of receiving marketing communications from us at any time by contacting us using the details set out in this policy or by using the opt-out facilities provided in the marketing communications you receive from us. We will then ensure that your name is removed from our mailing list.
8. Your information may be disclosed to entities overseas
   1. 1. We may disclose personal information to our related bodies corporate and third-party suppliers and service providers located overseas for some of the purposes listed above.
      2. We take reasonable steps to ensure that the overseas recipients of your personal information do not breach the privacy obligations relating to your personal information.
      3. We may disclose your personal information to entities located outside of Australia including the following:
         1. our related bodies corporate, located in India and the United States; and
         2. our data hosting and other IT service providers, located in India and the United States.
9. Your information is secure
   1. 1. We store personal information in a combination of secure computer storage facilities. In doing so, we have taken reasonable steps to protect your personal information from misuse, loss and unauthorised access, modification or disclosure. The information security steps that we take are comprised of technical and organisational measures including:
         1. implementing robust confidentiality and data security requirements and periodic mandatory privacy training for our relevant staff;
         2. using security policies, processes and measures to control access to our systems and premises;
         3. taking reasonable steps to ensure access to personal information is only provided to authorised persons; and
         4. ensuring that our service providers apply appropriate security measures.
      2. As our website is linked to the internet and the internet is inherently insecure, we cannot provide any assurance regarding the security of transmission of information you communicate to us online. We also cannot guarantee that the information you supply will not be intercepted while being transmitted over the internet. Accordingly, any personal information or other information which you transmit to us online is transmitted at your own risk.
      3. We will, with your help, keep your personal information accurate, complete and up-to-date. Additionally, we take reasonable steps to securely destroy personal information when we no longer need it.
10. Your rights to access and correct personal information
    1. 1. You may request access to any personal information we hold about you at any time by contacting us (using the details in the ‘Contacting us’ section below). You also have the right to ask us to confirm whether we hold any personal information about you and to ask us to correct that information. Before we provide you with access to your personal information, we may require some proof of identity. When contacting us to request access to, or correction of, any personal information we hold about you, we ask that you provide us with as much detail as you can about the information in question as this will help us to retrieve it.
       2. Where we hold information that you are entitled to access, we will try to provide you with suitable means of accessing it (for example, by posting or emailing a copy to you). We may charge you a reasonable fee to cover our administrative and other reasonable costs in providing the information to you. We will not charge for simply making an access request and will not charge for making any corrections to your personal information.
       3. There may be instances where we cannot grant you access to the personal information that we hold about you or are not required to do so. For example, we may need to refuse access if granting access would interfere with the privacy of others or if it would result in a breach of confidentiality. If that happens, we will give you written reasons for any refusal and set out any mechanisms available to you to complain about our refusal of your request.
       4. If you believe that personal information we hold about you is incorrect, incomplete or inaccurate, you may request that we correct it. We will then consider if the information requires correction. If we do not agree that there are grounds for correcting your personal information, (if you so request) we will add a note to the personal information stating that you disagree with it. We will not charge you for making a request that your personal information be corrected, for correcting your personal information or adding a note to the personal information stating that you disagree with it.
11. What is the process for complaining about a breach of privacy?
    1. 1. If you believe that we have breached your privacy, please contact us using the contact information below and provide details of the incident so that we can investigate it. We will treat your complaint confidentially, investigate your complaint and ensure that we contact you when your complaint is resolved within a reasonable time.
       2. We will deal with any complaint by investigating it and providing a response to you within a reasonable time, provided that we have all necessary information and have completed any investigation required. In some cases, we may need to ask you to put your complaint in writing so that we are sure that we understand it and for further information about your complaint or to verify your identity. We will attempt to confirm with you as appropriate your understanding of the relevant conduct and what you expect as an outcome to your complaint.
       3. If you are dissatisfied with the outcome of our handling of your complaint, please contact us. Alternatively, you may take your complaint to the privacy regulatory in your country.
       4. In Australia, the regulator is the Privacy Commissioner at the Office of the Australian Information Commissioner (OAIC). The contact details for the OAIC are available from the OAIC’s website at www.oaic.gov.au.
12. Contacting us
    1. 1. If you have any questions or concerns about this privacy policy or a complaint regarding the treatment of your privacy or a possible breach of your privacy, please use us using the details set out below.
       2. Please contact our Privacy Officer at:Post:Privacy Officer Data Mesh group Pty Ltd Level 29, Tower 1, 100 Barangaroo Avenue Sydney NSW 2000Email: privacy@datameshgroup.com.au
13. Changes to our privacy policy
14. 1. We may change this privacy policy from time to time. Any updated versions of this privacy policy will be posted on our website.

Attachment 1: Credit Reporting Policy

1. 1. About this credit reporting policy
      1. This credit reporting policy contains additional information about how DMG manages personal information collected in connection with a credit application that you make to us or a credit facility that we may provide to you.
      2. Credit information about identifiable individuals is a form of personal information. This credit reporting policy is intended to be read with our privacy policy above. This credit reporting policy includes information about rights in relation to credit-related information including access and correction and what can happen if we provide information to a credit reporting body (CRB). Our privacy policy provides additional information about how we manage your credit-related information.
      3. In this policy, credit-related information also includes credit information, credit eligibility information and credit provider (CP) derived information as those terms are defined in the Privacy Act 1988 (Cth) (the Privacy Act).
2. What types of credit information do we collect and hold?
   1. 1. When we are checking your credit worthiness and at other times, we might obtain or exchange information about you with a CRB or another credit provider. This information may include:
         1. identification information about you (which generally includes your name, date of birth, gender, current and previous addresses, the name of your current employer and your driver’s licence number);
         2. consumer credit liability information about you;
         3. repayment history information;
         4. information about your credit worthiness, credit standing, credit history or credit capacity;
         5. a statement that an information request has been made about you by a credit provider, mortgage insurer or trade insurer;
         6. the type of consumer credit or commercial credit, and the amount of credit, sought in an application;
         7. court proceedings information about you;
         8. personal insolvency information about you;
         9. new arrangement information about you (in other words, where a debt that you owe has been varied because it was overdue); and
         10. an opinion by a credit provider that the applicant has committed a serious credit infringement in relation to consumer credit provided by the credit provider to the applicant.
      2. If we obtain credit-related information about you from a CRB, we may derive information from it that has a bearing on your credit-worthiness or could be used in establishing your eligibility for consumer credit. This may include information such as credit scores and assessments, which we generate from the information that we receive.
      3. If there is another applicant named in a credit application, you may need to provide their personal information and you warrant that the other applicant has consented to the collection of their personal information and has authorised you to provide it for the purposes for which it is being collected.
3. How do we collect your credit-related information?
   1. 1. We collect your credit-related information directly from you and from third parties such as CRBs, other credit providers, your nominated trade references, courts, law enforcement agencies and other government entities.
      2. We are also required to collect information in accordance with the National Consumer Credit Protection Act 2009 (Cth) which requires us to make inquiries about you when assessing an application for credit made by you.
4. What happens if we are not able to collect your credit-related information?
   1. 1. If we are not able to collect some or all of the information described above, we may be unable to provide you with credit, which may mean that we decline to provide you with some or all of our products and services.
5. For what purposes do we collect, hold, use and disclose your credit-related information?
   1. 1. We collect, hold, use and disclose your credit-related information for the following purposes:
         1. to enable us to develop, administer and manage our services and businesses;
         2. manage the products we provide as well as your account with us;
         3. to arrange and assess an application for credit;
         4. to obtain credit assessments and reports;
         5. to engage a CRB to conduct a credit and reference check;
         6. to assess and monitor your creditworthiness;
         7. to assisting customers to avoid defaulting on credit obligations;
         8. to administer and manage credit arrangements;
         9. for billing purposes and collection of debts;
         10. to provide information to CRBs as permitted by law;
         11. to advise credit providers of the status of your agreement with us, in circumstances where you are in default with credit providers;
         12. to deal with complaints;
         13. to enforce our rights when you are in breach, including debt recovery and other enforcement; and
         14. complying with the law as authorised or as required.
6. With whom do we share your credit-related information?
   1. 1. We may disclose your personal information to entities of the kind described in our privacy policy and also to:
         1. CRBs, who may use your driver’s licence number to authenticate your identity. See below for more information about disclosures we may make to CRBs;
         2. other credit providers which provide, or are considering providing, credit to individuals;
         3. third parties that provide services to us (or to individuals on our behalf) including debt collectors, credit management agencies and other third parties that process applications for credit made to us; and
         4. any organisation for any authorised purpose with your express consent.
      2. We may combine or share any information that we collect from you with information collected by any of our related bodies corporate.
      3. If we disclose your credit information to a CRB:
         1. the CRB may include the information in reports provided to credit providers to assist them to assess your credit worthiness; and
         2. if you fail to meet your payment obligations in relation to consumer credit or commit a serious credit infringement, we may be entitled to disclose this to the CRB.
      4. Each CRB has a policy about the management of credit-related information. You can get a copy of the relevant CRB’s policy by contacting the relevant CRB.
7. Disclosing information to CRBs
   1. 1. Under the Privacy Act, credit providers can disclose certain information about an individual’s credit history to CRBs. We do not generally exchange information with CRBs but provide the following information about how we might exchange information in exceptional cases or in the future.
      2. We exchange information with CRBs for the purpose of obtaining a credit report about individuals or to allow the CRB to maintain a credit information file about individuals. We participate in credit reporting so that we are able to obtain information to make better and more informed decisions about providing credit to our customers. The Privacy Act restricts the purposes for which credit providers can access and use information that is held by CRBs.
      3. We may disclose the following credit-related information about a customer’s credit to CRBs:
         1. that we provide credit to a customer;
         2. the type of credit held by a customer;
         3. the amount of credit provided to a customer;
         4. the terms and conditions of a customer’s credit; and
         5. when a customer’s credit account is opened and closed.
      4. We may also disclose how a customer repays their credit. If a customer fails to make repayments on their credit or a customer defaults on their obligations or commits a serious credit infringement, we may report this information to a CRB. Equally, we may inform a CRB if a customer makes repayments on time or if a customer has corrected a default. The CRB may include the information in reports provided to credit providers to assist them to assess an individual’s credit worthiness.
8. How can you access and correct your credit-related information or complain about a breach of your privacy?
   1. 1. Please see our privacy policy for details about how you can access and correct your credit-related information or complain about a breach of your privacy, and for details about how we may disclose your credit-related information to entities outside Australia.
      2. In respect of correcting your credit-related information, if we have collected that information from a third-party source, such as a CRB or another credit provider, you may find it more efficient to make your correction request to that third party.
      3. If you request that we correct any credit-related information about you and we cannot respond to your correction request without consulting with other credit providers or CRBs in relation to your request, we may do so and these bodies are permitted by law to assist us in resolving your correction request.
      4. If we correct your credit-related information at your request, we will inform you and each other credit provider and CRB to which we have previously disclosed that information that we have corrected your information. Where we have disclosed your credit-related information after you made a complaint, but before it was resolved, we will inform the recipient that you have made such a complaint and will subsequently inform that entity of the outcome of your correction request.
9. Your rights under the Privacy Act in relation to credit-related information
10. 1. You are entitled to:
       1. opt out of direct marketing pre-screenings: CRBs often use credit information to assist credit providers to market their products and services. If you do not want the CRB to use your credit information in this manner, the Privacy Act gives you the right to request that you be excluded from being contacted;
       2. request non-disclosure where you believe you have been, or are likely to have been, a victim of fraud: if you believe that you are a victim of fraud, or are likely to have been a victim of fraud, you are entitled, under the Privacy Act, to request that the CRB not use or disclose any of your credit information;
       3. obtain the CRB policy about the management of credit-related information by contacting the CRB; and
       4. access credit-related information that we hold about you from us to request that we correct the information and to make a complaint to us.

Attachment 2: DMG Cookies Policy

DMG uses cookies on its website to provide you with a better and more user-friendly website experience.

What are cookies?

Cookies are small files that are placed on your device by websites that collect information about your use of those websites. Different types of cookies are used for different purposes. Some cookies are active for a single session that, for example, help to facilitate the completion of application forms or surveys while other cookies(persistent cookies) are stored on your device and help websites remember your information and settings when you visit them in the future.

1. 1. How we use cookies DMG uses cookies for various purposes including:
      1. allocating an identification number to your internet browser (you cannot be identified from this number);
      2. determining if your browser has previously visited the website and remembering your settings/preferences;
      3. tracking and reporting on your website usage;
      4. identifying other pages or third-parties’ websites your browser has accessed;
      5. personalising your experience including your access to services that we provide on our websites e.g. providing customised content, support and advertising that may be relevant to your interests and needs; and
      6. providing enhanced security and fraud detection.
      For our customers using the DMG platform (the Platform), we monitor your use of the Platform, including:
      1. activity on our websites (including the identity of the website that linked you to ours);
      2. activity information where we place our advertising (known as targeted advertising);
      3. activity on other websites where the owner has agreed to share information with us;
      4. whether you have followed links on our website and activity information where we place our advertising (known as targeted advertising); and
      5. details about your browser when you interact with us including:
         1. your IP address;
         2. technical information about the browser and device used;
         3. monitor colour and resolution;
         4. connection type and carrier;
         5. digital or other media consumption choices or preferences from linked websites where the owner of such websites (e.g. media broadcasters) has agreed to share information with us; and
         6. other information for which you have given your consent.
2. Cookies and Privacy Some of this information can be connected by DMG to your customer number, but will not be disclosed in this format to external parties. Where you are identified, and this information is connected to insights we know about you, DMG will treat the use and disclosure of your information in accordance with its Privacy Policy. Where this information is used for direct marketing purposes, DMG will ensure your marketing preferences are reflected in any use. You can let us know if you do not wish to receive direct marketing at any time.
   
   
3. How to Choose Cookies Settings You can choose to change your browser’s cookies settings via your browser’s privacy settings, including blocking the use of cookies. If you choose to delete or block cookies, your experience on the DMG website may be limited.