eftpos Group Privacy Policy

 

eftpos Group and related entities

 

The eftpos group (“eftpos Group”) consists of the parent company, eftpos Payments Australia Limited (ABN 37 136 180 366) and its related entities, Digital Wallet Pty Ltd (ABN 93 624 272 475 AFSL 515270) (trading as “Beem It”) and eftpos Digital Identity Pty Ltd (ABN 80 648 970 101) (offering the connectID solution).

This Privacy Policy is issued on behalf of the eftpos Group and applies to the entities named above. Accordingly, “we”, “us” or “our” in this Privacy Policy, refers to each group entity individually, unless otherwise expressly stated. Where necessary, we will distinguish the specific attributes that are unique to a related entity separately.

The eftpos Group has policies, practices, procedures and systems controls designed to comply with the Privacy Act 1988 (Cth) and the Australian Privacy Principles. This Privacy Policy sets out how the eftpos Group collects, uses, keeps secure and discloses personal information collected by any means and by any technology, including through the “eftposaustralia” or “beemit” or “connectID” websites, except through use of the Beem It app or use of the connectID solution.

Digital Wallet Pty Ltd also has its own privacy policy, which applies to use of the Beem It app and is available through its website at www.beemit.com.au.

eftpos Digital Identity Pty Ltd has its own privacy policy, which applies to use of the connectID solution and is available through its website at www.connectid.com.au/privacy

This policy sets out common aspects of our information handling practices. However, what personal information we collect differs according to our interaction with you. This policy should be read in conjunction with any Privacy Policies published by the related entities named in this policy and any privacy collection statement made available to you before, at or as soon as practicable after the time of collection of your personal information for specific interactions. The Privacy Policy and any privacy collection statement relevant to our specific interaction with you prevails to the extent of any inconsistency with this policy. We will make that clear in the information provided to you for the specific interaction.

 

eftpos Payments Australia Limited (ABN 37 136 180 366)

 

eftpos Payments Australia Limited (ABN 37 136 180 366) (eftpos) operates the eftpos payment system, which is both a debit card payment system and a prepaid card payment system.

“eftpos” is a debit payment system and prepaid card system, which governs and facilitates electronic payment transactions in Australia.

eftpos is trusted by consumers and merchants as a secure, convenient and efficient method of payment. As the Australian domestic debit payment system and prepaid card payment system, eftpos does not have premises outside of Australia, does not provide products or services to persons outside Australia and does not track the behaviours of persons outside Australia in a way that seeks to identify those persons to us. eftpos does interact with counterparties and suppliers outside Australia, including in Europe, the United States of America and across Asia. Those interactions include use of, predominantly, counterparty and supplier employee names and email addresses for business purposes on terms governed by agreements with those counterparties and suppliers.

 

Digital Wallet Pty Ltd (ABN 93 624 272 475 AFSL 515270) trading as Beem It

 

Digital Wallet Pty Ltd is a 100% owned subsidiary of eftpos and provides a peer-to-peer payments facility / App called Beem It. Beem It allows you to pay and get paid by anyone as long as you're both registered Beem It users. Digital Wallet Pty Ltd (trading as “Beem It”) is part of the eftpos Group but has its own privacy policy for products and services provided by it, which is available through its website at www.beemit.com.au.

 

eftpos Digital Identity (ABN 80 648 970 101) (offering the connectID solution and referred to in this policy as connectID)

 

connectID is a 100% owned subsidiary of eftpos and is a digital identity broker or exchange service that makes it easy to share, store and receive your digital identity information online. connectID does not collect personal information (as defined in the Privacy Act) about the individuals whose digital identity information is transmitted using the service but does log digital identity sharing messages between users of the connectID digital identity solution.

 

Privacy Impact Assessment (PIA) Register

Ref. Dated August 2021 detailed description

PIA eftpos connectID - Privacy Impact Assessment Report v1, including updates on the recommendations from initial draft PIA, July 2021.

Privacy: Transparency Report

connectID is committed to being transparent about enforcement body requests for personal information held by us and how we respond. We publish an annual Transparency Report disclosing the number of enforcement body requests for personal information connectID receives. connectID notes that other than relying on party business information, connectID does not retain personal information that may transverse the connectID solution – see the connectID privacy policy here 

Any enforcement body or other entity (including Government and private entities) are required to follow applicable laws and statutes when requesting personal information and data from connectID.

Report Period: 1 July 2021 - 30 June 2022
No requests received.

 

What personal information do we collect

 

The personal information we collect differs according to our interaction with you. The categories of interaction and the types of personal information collected and held by us may include:

For recruitment related activities:

  • Name, address, date of birth, resume, references, skills and experience information, as well as identity- verification and reference check information;

For business interactions (excluding use by you of the Beem It app):

  • Contact information such as your name, company you work for, business address, fixed line or mobile phone number, email address and social media contact information. In the case of sole trader suppliers, we will also collect billing and bank account details. We do interact with counterparties and suppliers outside Australia, including in Europe, the United Kingdom, the United States of America and across Asia. Those interactions use the personal information listed here for business purposes on terms governed by agreements with those suppliers.

For employees of any eftpos group entity using the tools and service providers sourced by eftpos:

  • for the calculation and placement of insurances - your name, email address, mobile phone number, gender, age, address and salary information.
  • For internal business processes and tools eg project and matter management, risk management, training, performance management in the ordinary course of business – name, user name, mobile phone number, gender, age, address, email address, employment history and related records, superannuation records, tax information including tax file number according to legal requirements, premises surveillance logs and your equipment and tool utilisation transaction history, reports and logs
  • For business interaction purposes and BCP in the ordinary course of business – name, user name, email address, mobile phone number
  • For finance and payroll, human resource and employee assistance programs in the ordinary course of business - in addition to the above, and only as relevant to the tool use with appropriate access controls and security measures - payroll-related information (base pay and on-costs), address, bank details, personal email address, expense claims, leave details and performance information.

The four categories of interactions below relate specifically to eftpos for the purposes of this Privacy policy:

For certification authority services:

  • Identification information such as your name, date of birth and place of work and copy of driver’s licence;

For payment processing and provisioning payment products or enabling payment channels:

  • Information required for payment processing, such as eftpos transaction and loyalty program information – this is not personal information about cardholders but may identify a sole trader merchant;
  • Your name, address and mobile phone number, device ID, location details as well as card details at the time of provisioning a card for mobile payments – this information is deleted as soon as practicable after provisioning, save for the tokenised card and device ID details which are de-identified;
  • Payment recipient name, address, mobile phone number, BSB and Account Number and Date of Birth and Place of Birth for person to person payments using eftpos withdrawal and deposit messages;
  • User verification for card not present transactions, device ID and other device specific data and geolocation data at the time of use, as well as the card number.

For disputes and chargebacks administration:

  • Your name, address and the disputed transaction details.

For entry by you into competitions promoted by eftpos:

  • your name, email address, fixed line or mobile phone number, gender, age, transaction receipt information and, for winners, addresses.

Where possible, we will give you the option to deal with us anonymously. However, this may not always be possible, depending on the nature of your interaction with us. We will explain to you if information that identifies you is necessary for the relevant interaction. This will be done either directly or by us asking the person giving us information about you to pass on the details that allow you to access our privacy policy. If you choose not to provide certain personal information (e.g. your date of birth in respect of Certification Authority services or your name and mobile phone number when provisioning a card for mobile payments), we may not be able to provide you with the services you request, or the level of service on which we pride ourselves.

Occasionally, we may collect personal information about other individuals from you (e.g. member/vendor employee contact details). If so, we rely on you to inform those individuals that you are providing their personal information to us and to advise them that they can view this policy via our website to see how we handle their information (refer to our contact details below).

 

How we collect personal information

 

We collect personal information in a number of ways, including:

  • directly from you (if it is reasonable and practicable to do so) for example, when you provide information by phone, in application forms or other agreements, or when you submit your personal details through our group entity websites (eg. for marketing campaigns, certification authority services or complaints) or, for business contact information, through the project management tool used by us in conjunction with our service providers;
  • from third parties, in circumstances where it is unreasonable or impractical to collect the information directly from you, for example, from our members (which are banks and retailers and their aggregator service providers) and from other entities that provide payment processing, disputes and chargeback handling and related services for the purposes of the eftpos payment system, including loyalty and data enrichment;
  • from publicly available sources of information, such as business social media services; 
  • when you visit our websites (refer below for details on information collected through use of our websites); and
  • for employees of any eftpos group entity, from you, other employees, from your publicly available information, employment activities and from financial management or other business-related management tools used by us in conjunction with our service providers or in the ordinary course of business.

 

How we use your personal information

 

Your personal information may be used for any of the following (in addition to specific uses notified to you in a separate privacy collection statement provided at or about the time of collection):

  • verification of your identity (eg. for certification authority services or for marketing competition winners);
  • providing you or, where you work for an eftpos Member or participant entity or partner counterparty, your employing entity with documents and information relevant to your or your entity’s participation in any of the eftpos payment system, the Beem It app or the connectID digital identity scheme;
  • providing you with information about or delivery of our products or services or such services ancillary to or necessary for those products or services (including in accordance with marketing campaigns);
  • providing you with information promoting our products and services if you choose to receive that information and for marketing campaigns, you have expressly informed us of your desire to receive such information;
  • payment processing services, product provisioning, loyalty program support, administration of our business, business analysis, dispute resolution, to prevent or minimise fraud or meet any legal obligations imposed on us;
  • statistical or other analysis or similar research purposes, whether or not for product development;
  • maintenance and development of our business systems and infrastructure, including monitoring performance, testing and upgrading of these systems;
  • for employees:
    • enabling calculation and placement of insurances;
  • providing risk management, financial management, human resource management, training support, performance management, and employee assistance programs in the ordinary course of business, (each a Purpose).

connectID does not retain in a record the digital identity information that passes through the connectID broker solution. However, connectID does retain the metadata related to such information message exchanges for the purposes required under legislation applicable to digital identity services and to verify that an exchange of identity information has occurred. (Note: Metadata is data providing information about one or more aspects of data, such as basic information about data which can make tracking and working with specific data easier. An example includes the means of creation of the data. While this will include a description of the nature of the identity information exchanged IT DOES NOT INCLUDE THE IDENTITY DATA ITSELF and it is not possible to identify an individual based on the connectID exchange transaction logs alone). Users of the connectID digital identity broker service may use your personal information which is passed through the service for various purposes. Please refer to the websites of your authorised identity service provider (eg bank, utility provider, government entity etc) and authorised relying party (anyone you have authorised to seek access to your personal information from your identity service provider) for their privacy policies which will explain how they handle your personal information.

See the privacy policy at www.beemit.com.au/privacy in respect of uses of the Beem It app

See the privacy policy at www.connectid.com.au/privacy in respect of use of the connectID solution

If we receive personal information about you that we did not ask for, then we will take reasonable steps, in a reasonable time after receiving the information, to determine whether the information is required for any legitimate business purpose involving you and if not, to lawfully destroy the information.

Your privacy and personal information is important to us and we will do each of the following:

  • take reasonable steps to ensure the personal information that we collect, use or disclose is accurate, complete and up-to-date and relevant to the use or disclosure;
  • facilitate anonymity or pseudonymity where possible, unless it is impractical in the circumstances;
  • take reasonable steps to protect your personal information from misuse, loss and unauthorised access, modification or disclosure. This includes physical and logical security measures such as premises, infrastructure and database access restrictions, de-identification of data where possible and encryption of data in transit and at rest;
  • take reasonable steps to destroy or permanently de-identify personal information if we no longer need it for any legitimate business purpose.

 

When we disclose your information

 

We will disclose your information:

  • where you have consented to that disclosure, including where you have authorised a third party to seek information about you for the provision by them of products and services to you;
  • for a Purpose to our service providers, including:

               eftpos
    • website hosting in Australia in respect of “cookie” information;
    • database hosting in Australia, the United States of America, the United Kingdom and The Netherlands;
    • product and application testing in Australia and Taiwan;
    • payment processing service providers located in Australia and the United States of America and dispute and chargeback service providers in The Netherlands and the United Kingdom;
    • project collaboration with our counterparties and suppliers in Australia, Germany and the United States of America;
    • identity and reference checks in Australia and to a prospective employee’s country of origin;
    • internal business process database hosting and support services (eg finance, expense management and payroll tools) in Canada, India, Philippines, in the countries of the European Union (e.g., France, Spain, Italy, and Romania)

      Beem It
    • website hosting in Australia in respect of “cookie” information;

      connectID
    • website hosting in Australia in respect of “cookie” information;

We have entered into agreements with each of these entities which require compliance with the Privacy Act 1988 (C’th) and include provisions designed to give your personal information at least the same level of protection as we provide;

  • for a Purpose to:
    • eftpos payment system members (which are banks, independent acquirers and retailers and their aggregator service providers), as necessary, to enable us to provide any of our products or services to you or answer enquiries and administer governance activities related to our rules.
    • participants in the digital identity broker solution for the purposes you have authorised them to seek or provide your personal information.

      These entities are also bound by the Privacy Act 1988 (C’th) and have their own privacy policies, and will observe these when using your personal information;
       
  • where we are required or authorised to do so by law, including in response to a lawful request by any government, regulatory body or enforcement agency;
  • where it is necessary in order to investigate an unlawful activity;
  • where it is necessary to prevent a serious and imminent threat to a person's life, health or safety, or to public health or safety;
  • from time to time, we may inform you that your information including personal information, has been shared between eftpos Group entities for the same primary purpose for which it was disclosed to the eftpos Group entity, primarily for day-to-day business and operational purposes, and we will seek your consent to any secondary purposes; and
  • if required to entities involved in connection with a corporate merger, consolidation, restructuring, the sale of substantially all of our interests and/or assets, or other corporate change requiring the transfer of assets, including during the course of any due diligence process, to the purchaser or surviving entity.  

 

Trans-Border Data flow

 

It is possible that the overseas entities which we share your personal information with may not be subject to foreign laws that provide the same level of protection of information as in Australia or may not be subject to any privacy obligations. Overseas entities may be required or compelled to disclose your personal information to a third party such as an overseas authority. You may not be able to seek redress in the overseas jurisdiction against the overseas entity. If we ask and you consent to us disclosing your personal information to an overseas entity and that overseas entity breaches the Australian Privacy Principles, we will not be accountable for that breach under the Privacy Act and you will not be able to seek redress in respect of that breach under the Privacy Act. Therefore, if we transfer or provide access to your personal information to a recipient outside Australia, we will impose, and review compliance with, obligations on that recipient to comply with the Privacy Act 1988 (C’th) and include provisions designed to give at least the same level of protection for your personal information as we provide.

 

Information collected from any eftpos Group entity website

 

We collect information about the websites and the services, including the number of visitors, when the visits occur, how many pages are viewed and navigation patterns. We may also collect and store your Internet Protocol (IP) address. We get this information from 'cookies', which are a website tool commonly used to identify website users' computers. In these circumstances, it is impractical for us to collect the information directly from you. Knowing this information allows us to ensure that the information and services available through the website are relevant. We may use this information to obtain statistical information, which helps us evaluate and enhance the website. We may also send session numbers and keys as cookies to ensure that your connection, when using our online services, is kept as secure as possible.

It is the eftpos Group’s policy not to sell or pass on any information recorded about your visit to the website for commercial purposes unrelated to any Purpose, unless we have your express consent.

If you decline to provide us with certain personal information when requested (for example, refusing cookies in your browser), the website may not operate optimally or at all.

We also use your IP address to help diagnose problems with and to administer our website. No attempt is made to link any IP address with any individuals that visit the site.

Where our website contains links to other sites, we are not responsible for the information handling practices or content of these external sites. We also maintain several email lists to keep you informed about areas of specific interest. You may request to join our mailing lists by signing up through our website or by contacting us. You may also unsubscribe from any email list at any time.

Any personal information collected from emails to the whistleblower contact address on our website is used for purposes required by law in respect of those emails, our published Whistleblower Policy and for statistical purposes.

We do not sell, rent, loan, trade, or lease any addresses or other information on our lists, or any other personal information that we may collect or hold, to anyone, unless you have provided express consent.

 

Access to your personal information

 

You can request access to the personal information we hold in a record about you. Your request must be in writing and include proof of identity. We may charge a fee for the staff time and any expenses incurred to respond to your request and provide the requested information to you. If it is not possible for us to provide you with access as requested, we will tell you why.

If you think that any personal information we hold about you is not accurate, complete and up-to-date, you may ask us to amend your details. We will take reasonable steps to amend your personal information as you direct, unless we reasonably consider that your information is already accurate, complete and up-to-date, in which case we will tell you why.

If you believe that we have failed to comply with this privacy policy, we encourage you to tell us how and to be as specific as possible so that we can resolve any misunderstanding or dispute between you and us. We will do our best to resolve your complaint as quickly as possible and will in any event respond within 5 days of receiving details from you.

If you are not satisfied with our response to your complaint, you can refer the matter to:

Director of Complaints,
Office of the Australian Information Commissioner,
Level 3, 175 Pitt Street,
Sydney 2000
GPO Box 5218,
Sydney NSW 2001.
Telephone: 1300 363 992
Facsimile: +61 2 9284 9666
Email: enquiries@oaic.gov.au

 

You can contact us by writing to us at Level 11, 45 Clarence St, Sydney NSW 2000 or by email at privacy@eftposaustralia.com.au or by contacting us at (02) 8270 1800 and asking for the Privacy Officer.

Approved by the eftpos Board of Directors on: 29 April 2021