Privacy Policy

This Policy sets out how and why Yellow Canary Holdings Pty Ltd and its related bodies corporate (Yellow Canary, we, us, our) collect, manage and use personal information under the Privacy Act 1988 (Cth) (Privacy Act) and the Australian Privacy Principles (APPs). It also sets out your rights in relation to our handling of your personal information.

What is personal information?

‘Personal information’ has the meaning given to it in the Privacy Act, but generally means any information about a person who is identified, or who is reasonably identifiable.

When does this policy apply?

The Policy applies:

• when you sign up for, access, or use our services;
• when you contact us or otherwise provide us with your personal information;
• when you ask to be part of any mailing list we may send out;
• when you visit our website at www.yellowcanary.com.au; and
• in relation to personal information we collect in the course of our business.

If you do not consent to us collecting, using and/or disclosing your personal information as set out under this Policy, or if we cannot verify your personal information, we may be unable to:

• provide you with a customised experience when you are using our website;
• provide you with our services;
• engage with you, where you are a supplier; a contractor; an employee or representative of a supplier or contractor; or a prospective employee; or
• otherwise respond to your request.

What personal information do we collect and why?

The types of personal information we collect from you or about you, and how we use and disclose that information, depend on your relationship with us. The Schedule to this Policy sets out specific:

• types of personal information we collect;
• reason(s) for which we collect that personal information;
• ways in which we may collect that personal information; and
• third parties we may disclose that personal information to,

depending on your relationship with us.

The rest of this Policy contains more general information about how we manage personal information in the course of our business.

How do we collect personal information?

We aim to collect personal information only directly from you, unless it is unreasonable or impracticable for us to do so. There are some specific cases in which we may collect personal information about you from third parties. These are set out in the Schedule.

How do we use your personal information?

We collect, hold, use and disclose personal information from you or about you for the specific purposes set out in the Schedule, and otherwise:

• where it is reasonably necessary for us to carry out our business functions and activities;
• as required or permitted by law, court or tribunal order.

We may also use your personal information for any purpose which is related to or, in the case of sensitive information, directly related to the purpose for which it was collected. This only applies where you would reasonably expect us to do so. Otherwise, we will obtain your prior consent to any intended use of your personal information.

Will we use your personal information for direct marketing?

Where we have your consent, we may use and disclose your personal information to send you marketing material about us, our products and services and those of our partners which we believe you may be interested in. You can opt out of this at any time by contacting us below or following the opt out link in our marketing material.

How do we share your personal information?

We may share your personal information with third parties where necessary for one of the purposes set out above. This may include sharing your personal information with:

• our affiliates and related companies;
• our suppliers and services providers, such as HubSpot and Tableau, so that they can provide us with the services we need, such as payment collection, marketing, and customer services;
• in respect of personnel of our customers, to that customer, their representatives, or their related bodies corporate in connection with the provision of our services to that customer;
• with third parties, including law enforcement and government agencies or officials where permitted or required by law;
• companies that we plan to merge with or be acquired by or who may invest in us; and
• other third parties with your consent or direction to do so.

Do we share your information overseas?

We generally do not disclose your personal information overseas. However, in respect of personnel or representatives of our customers, if that customer (or that customer’s corporate group) is based overseas, we may disclose your personal information to that relevant country. It is not practicable to list all such countries here.

In such cases, we take reasonable steps to:

• confirm the overseas recipient is already bound by the APPs or an equivalent law such as the European Union’s General Data Protection Regulation; or
• contractually ensure the overseas recipient does not breach the APPs.

Cookies

When you access our website, we may place cookies (small data files that are used to identify a particular browser) on your device. The types of information collected by these cookies, and the reasons we use them, are set out in the Schedule.

Most browsers give you the ability to control cookies. You may decline to accept our cookies, and in some cases your browser may be configured to block some or all cookies, however, doing so may limit the functionality of our website.

Protecting your personal information

We take reasonable steps to protect your personal information from misuse, loss, and unauthorised access, use, modification, and disclosure. This includes through physical, procedural and technical measures, including restricting access to your personal information to those individuals who need it to perform their job. However, you should be aware that no security measure is ever perfect or impenetrable and we cannot guarantee the security of your personal information.

Retention of your personal information

Once we no longer need your personal information for any purpose, we will destroy or de-identify that personal information unless we are required to retain the information by law or a court or tribunal order. You acknowledge that we may need to retain your personal information to collect any fees owed, resolve disputes, troubleshoot problems, assist with any investigations, prevent fraud or risk, enforce our contracts, or take other actions as required or permitted by law.

Accessing your personal information

You have the right to access your personal information that we hold. You may contact our Privacy Officer, whose details are set out below, to request access to your personal information at any time. If we refuse to give you access, we will provide you with a written notice stating our reasons for refusing access.

We may seek to recover our reasonable costs incurred for providing you with access. If so, we will get your approval in advance.

Correcting your personal information

It is important that we hold up-to-date, accurate and complete information about you. We use reasonable attempts to ensure that this is the case, however, we encourage you to reach out to our Privacy Officer, whose details are set out below, if you believe any of the personal information we hold about you is incorrect or out of date. You have the right to ask us to correct your personal information that we hold.

In most cases, we will comply with any request you make. However, if we ever decide not to update that personal information, we will provide you with a written notice explaining our decision.

Resolving your concerns

If you have any questions, concerns or complaints about this Policy or how we handle your personal information, please contact our Privacy Officer at info@yellowcanary.com.au.

We aim to provide an initial response within 48 hours and to resolve your query or complaint within 10 business days.

You may also lodge a complaint with the Office of the Australian Information Commissioner. The contact details of the Office of the Australian Information Commissioner can be found at www.oaic.gov.au.

This Privacy Policy was last updated in March 2022