Paylab Pty Ltd (ACN 650 927 325) – including YardPay and the Paylab app / Rewards.

Paylab Pty Ltd (ACN 650 927 325) (Paylab, we, us or our) is committed to protecting personal information in accordance with the Privacy Act 1988 (Cth) (Privacy Act), the Australian Privacy Principles (APPs) and other applicable privacy and data protection laws. This Privacy Policy explains how we collect, hold, use, disclose and protect personal information when you interact with Paylab, YardPay, the Paylab app, our websites, applications and related services.

1. Who we are

Paylab Pty Ltd (ACN 650 927 325) is the entity responsible for the personal information handled under this Privacy Policy. Paylab operates:

• YardPay – a payment facilitation service that allows Trainers/Service Providers to present invoices through participating Invoice Platforms and receive invoice-linked payments from Payers, supported by our Payment Providers;
• the Paylab app and Rewards – a rewards membership service through which members can earn, track and redeem cashback rewards and other benefits offered by Paylab and participating reward partners; and
• related websites, applications, customer support channels and other services we make available from time to time (together, our services).

This Privacy Policy applies across all of Paylab's websites including www.yardpay.com.au, apps and services. It is structured so that:

• section 2 sets out how we handle personal information across all Paylab services;
• section 3 contains additional information that applies only to YardPay;
• section 4 contains additional information that applies only to the Paylab app, Rewards and other Paylab member services;
• sections 5 to 8 explain our marketing, analytics and tracking practices, how we use and disclose personal information, our automated decision-making and risk controls, and our overseas disclosures; and
• section 9 explains how to access or correct your personal information, make a complaint and contact us, for all services.

Where a service-specific section applies, it should be read together with the general information in section 2. Some of our services are also subject to separate terms, collection notices or disclosure documents (such as the YardPay terms or a Financial Services Guide), which should be read together with this Privacy Policy.

Key terms: In this Privacy Policy, Invoice Platform means a third-party business-management or invoicing platform through which YardPay payment gateway services are presented; Trainer/Service Provider means a business that issues invoices and receives payments through YardPay; Payer means a person who pays, or is invited to pay, an invoice through YardPay (including an invited guest); and Payment Provider means a bank, payment processor, payment gateway, card scheme or other payment-services provider we use to process, authenticate or settle payments.

2. Information applying to all Paylab services

What is personal information

Personal information: is information or an opinion, whether true or not and whether recorded in a material form or not, about an individual who is identified or reasonably identifiable.

Sensitive information: Sensitive information is a subset of personal information that receives a higher level of protection under the Privacy Act. It includes information about racial or ethnic origin, political opinions or associations, religious or philosophical beliefs, trade-union or professional-association membership, sexual orientation or practices, criminal record, health or genetic information, and certain biometric information or templates. We do not generally seek to collect sensitive information unless it is reasonably necessary for our functions or activities and collection is permitted by law, including where you provide it in connection with a complaint or support request or where it is required for identity, fraud, AML/CTF, sanctions or other legal or regulatory purposes.

Information we collect across our services

The types of personal information we may collect about you, whichever of our services you use, include:

• identifying, contact and account information such as your name, date of birth, email address, telephone number, residential or postal address, postcode, user or account identifiers, and information about your role or authority to act for a business or other person;
• records of your communications with us, including support requests, enquiries, feedback and complaints;
• information you provide to us when you participate in any interactive features, including surveys, feedback forms, contests, promotions, activities or events;
• your preferences in receiving marketing from us and our third parties and your communication preferences;
• if you access software, applications or websites we make available, authentication and access data, IP address, device/browser information, search or navigation activity and information collected through cookies, tracking technologies and security tools (see section 5); or
• where you are a worker of ours or applying for a role with us, your professional history such as your previous positions and professional experience, or whether you hold required authorisations or licences (if applicable).

Additional information we collect for particular services is described in section 3 (YardPay) and section 4 (Paylab app and Rewards).

Metadata and technical information: Even if you do not directly provide identifying details, information generated when you use our website, app or services may be personal information depending on the circumstances. We may collect browser type and version, operating system, referrer URL, pages viewed, date and time, IP address, device identifiers, cookie or pixel identifiers, approximate location derived from network information and other technical or usage data. We use this information for security, fraud prevention, service delivery, analytics and, where permitted, advertising or marketing.

How we collect personal information

We collect personal information in a variety of ways, including:

• when you provide it directly to us, including face-to-face, over the phone, by email, through an application, website, onboarding flow, online form, payment link or other digital channel;
• from other participants in our services, such as Invoice Platforms, Trainers/Service Providers, Payers, reward partners, authorised representatives and other persons involved in an invoice, payment, reward or account;
• from Payment Providers, banks, identity-verification and screening providers, technology providers, analytics providers and other service providers used to operate our services; or
• from public registers, publicly available sources and authorised government or official identity-verification sources where permitted by law.

Use of approximate location and geofencing

We may use approximate location information, including postcode information provided to us and location inferred from an IP address or similar network information, to support service eligibility, geofencing, security and fraud prevention. We do not currently collect precise device location for these purposes.

If approximate location or postcode information is required for a particular control or feature and is not available, that control or feature may not operate as intended.

Your choice and information from third parties

Your choice: You do not have to provide personal information to us unless required by law or by the terms of a service you choose to use. However, if you do not provide information that is reasonably necessary for onboarding, verification, payment processing, membership administration, risk management or compliance, we may be unable to provide some or all of our services. This Privacy Policy explains our information-handling practices and does not, by itself, operate as a blanket consent to every collection, use or disclosure.

Information from third parties: If we receive personal information about you from a third party, we will handle it in accordance with this Privacy Policy and applicable law. If you provide personal information about another person, you must be authorised to do so or otherwise have a lawful basis for providing it, and you should ensure that person is given any privacy notice required in the circumstances.

Storage and security

We take reasonable technical and organisational measures appropriate to the nature and sensitivity of the personal information we hold and the risks of misuse, interference, loss, unauthorised access, modification or disclosure. These measures may include access controls, authentication, security monitoring, staff training, supplier management, incident-response procedures and secure handling of information throughout its lifecycle.

No method of electronic transmission or storage is completely secure. However, this does not limit our obligations under applicable privacy or data-protection laws to take reasonable steps to protect personal information.

Retention and destruction

We retain personal information only for as long as it is reasonably needed for the purposes for which it may be used or disclosed, or as required by law, regulatory, financial-services, AML/CTF, tax, accounting, dispute, audit or record-keeping obligations. When personal information is no longer required and no legal retention requirement applies, we take reasonable steps to destroy it or ensure it is de-identified, including through appropriate processes for service providers and backup systems where reasonably practicable.

Data breaches

If we become aware of a suspected data breach, we will take reasonable steps to contain and assess it. Where there is an eligible data breach that is likely to result in serious harm, we will notify affected individuals and the Office of the Australian Information Commissioner (OAIC) as required by the Notifiable Data Breaches scheme. We will also cooperate with relevant service providers, Invoice Platforms, Payment Providers, reward partners and other affected entities where a breach involves shared or interconnected systems.

Links to other websites

Our website may contain links to other parties' websites. We do not have any control over those websites and we are not responsible for the protection and privacy of any personal information which you provide whilst visiting those websites. Those websites are not governed by this Privacy Policy.

3. YardPay-specific information

This section applies when you use YardPay as a Payer, invited guest, Trainer/Service Provider, authorised representative or other participant. YardPay principally collects and uses personal information for payment, verification and regulatory purposes.

Information we collect for YardPay

In addition to the information described in section 2, when you use YardPay we may collect:

• your date of birth or age, where reasonably required for identification, eligibility or compliance purposes;
• business, employment, role, authority, ownership or control information where relevant to onboarding, beneficial ownership, customer due diligence or the services you use;
• where we need to verify your identity or authority, government-issued identification, document details and verification results (including where verification is carried out through an authorised identity-verification service or official source), and proof-of-address or related documents where required;
• bank account, settlement and payment information, including nominated account details and payment method information provided to us or our Payment Providers (we may receive tokens, masked card details or transaction references rather than full card details);
• invoice, payment, settlement, reconciliation, refund, reversal, chargeback and transaction information, including details of payments initiated, processed, settled, refunded, reversed or disputed through YardPay and associated fees, surcharges, adjustments and payment-provider information;
• identity-verification and screening information, including verification outcomes and information relating to sanctions, politically exposed person (PEP), adverse-media, fraud and other compliance or risk checks;
• payment-authentication and risk information, including 3D Secure (3DS) outcomes, risk scores, risk flags and transaction-monitoring alerts (see section 7);
• device, network, security and fraud-prevention information, including IP address, device identifiers and approximate location or postcode/geofencing information where reasonably required; and
• information provided by or through an Invoice Platform, Trainer/Service Provider, Payer, authorised representative or other participant in connection with an invoice, payment or account.

Why we collect and use YardPay information

We collect, hold, use and disclose YardPay information to:

• register, identify, authenticate and onboard Trainers/Service Providers, Payers and authorised representatives;
• present and process eligible invoice-linked payments, facilitate settlement, reconciliation and reporting, and handle refunds, reversals, disputes and chargebacks;
• carry out identity, authority and business verification, beneficial ownership and customer due diligence (including know-your-customer (KYC) and ongoing customer due diligence), and sanctions and PEP and or Adverse Media screening;
• conduct transaction monitoring, fraud prevention and payment-authentication controls (see section 7); and
• comply with our AML/CTF, financial services, sanctions, record-keeping and reporting obligations, including obligations to AUSTRAC and to our Australian financial services licensee or principal (where applicable).

YardPay disclosures

For YardPay, we may disclose personal information to Payment Providers and payment systems operators or processors; identity-verification, screening and fraud-prevention providers (including providers that access authorised government or official identity-verification sources); the relevant Invoice Platform, Trainer/Service Provider or Payer to the extent reasonably necessary to provide, reconcile, support or administer the relevant invoice or payment; and regulators and government agencies such as AUSTRAC and ASIC where required or authorised by law. Further detail on our disclosures is set out in section 6.

AML/CTF records and reporting

Records we collect for AML/CTF purposes, including customer due diligence and transaction records, are generally retained for at least seven years, or longer where required by law. Where we are required by law to report a matter to AUSTRAC or another authority, we may be prohibited from telling you about that report, and this may limit the information we can provide in response to an access request or complaint.

4. Paylab app / Rewards-specific information

This section applies when you use the Paylab app, join or participate in Rewards, or take part in promotions we run. Unlike YardPay, the Paylab app and Rewards involve the use of personal information for membership, rewards, promotions, marketing and partner arrangements.

Information we collect for Rewards

In addition to the information described in section 2, when you use the Paylab app or Rewards we may collect:

• membership and profile information, including your membership status, membership tier or plan, sign-up and account details, and any linked accounts;
• cashback rewards activity, including cashback rewards earned, balances, qualifying activity or purchases, adjustments and expiry;
• redemption history, including the rewards, prizes, vouchers or benefits you redeem or claim, and delivery or fulfilment details;
• your preferences and interests, including reward categories, offers and communications you are interested in;
• entries into promotions, competitions and prize draws, and information required to verify eligibility and deliver prizes; and
• information exchanged with participating reward partners, such as confirmation of your eligibility, qualifying transactions, offer or voucher codes and redemption status.

Why we collect and use Rewards information

We collect, hold, use and disclose Rewards information to administer your membership; calculate, award and adjust rewards; process redemptions and fulfil rewards or prizes; run promotions, competitions and additional member benefits; personalise the offers and content you see in the Paylab app; detect and prevent fraud or misuse of rewards; and, subject to section 5, send you marketing about Paylab and our reward partners.

Reward partners

Some rewards and offers are provided by or with participating reward partners. We only disclose to a reward partner the personal information reasonably necessary to confirm your eligibility, deliver or fulfil a reward or offer, verify a redemption or administer the partner arrangement, unless you consent to a broader disclosure. Reward partners may also provide us with personal information about your qualifying activity or redemptions. Reward partners handle personal information they collect in accordance with their own privacy policies.

We do not provide your personal information to reward partners or other organisations for their own direct marketing unless you have expressly agreed to this.

Promotions and competitions

Where we run a promotion or competition, the relevant terms and conditions may contain additional information about how entrant information is handled. Where required by trade promotion laws or permit conditions, we may publish or disclose limited winner information (such as name and suburb or state).

Separation from YardPay information

We do not use YardPay identity-verification, screening, transaction-monitoring or payment information for Rewards marketing or advertising purposes, except where you have consented or the use is otherwise permitted by law.

Earned-wage services

Where Paylab provides an earned-wage service to a business or employer, we may collect information provided by that business or employer about eligible workers, earned or accrued wage amounts, eligibility or availability information, and related payment or disbursement information. We use this information to administer that service, verify eligibility or amounts made available by the employer, and process related payments or disbursements.

5. Marketing, analytics and tracking

Our marketing, advertising and tracking activities principally relate to the Paylab app, Rewards and our marketing websites. Messages and notices we send in connection with a YardPay invoice, payment, verification or account (such as payment confirmations, receipts, security alerts or verification requests) are service communications rather than marketing, and we do not use the fact that you made a particular YardPay payment to target advertising to you.

Marketing communications

We may use your personal information to send you promotional information about our services, Rewards, promotions and offers from our reward partners that may be of interest to you, and to measure or improve our marketing, where permitted by law and subject to applicable consent, transparency and opt-out requirements (including the Spam Act 2003 (Cth)).

Restrict and unsubscribe: To object to processing for direct marketing/unsubscribe from our email database or opt-out of communications (including marketing communications), please contact us using the details in section 9 or opt-out using the opt-out facilities provided in the communication. Opting out of marketing will not stop us sending service communications that are necessary to provide a service you use.

Cookies and tracking technologies

We may use cookies, tracking pixels and similar technologies on our websites, applications and emails. Depending on their configuration, these technologies may collect personal information including IP address, device or browser identifiers, pages viewed, session activity, referral URLs, approximate location and interactions with forms or content. We use these technologies for essential functionality and security, analytics and, where permitted, advertising or marketing. We take reasonable steps to minimise the information collected and to configure third-party tracking technologies, so they do not intentionally collect identity documents, payment credentials, sensitive information or other information not required for the relevant purpose, including within YardPay payment and verification flows.

Where non-essential analytics or advertising technologies are used, we will provide appropriate notice and choice as required by applicable law. You can also manage cookies through your browser or device settings and, where available, our cookie or privacy-preference tools.

You can block tracking pixels by using ad-blocking or privacy-focused browser extensions. Some email providers allow you to block images by default, which can prevent tracking pixels in emails from loading.

However, if you use your browser settings to block all cookies (including essential cookies) and tracking pixels you may not be able to access all or parts of our website and you may not receive personalised content.

Google Analytics

We use Google Analytics to measure and understand use of our websites and applications and may use Google Analytics advertising features where enabled. Google and other third-party vendors may use first-party identifiers and, where applicable, advertising cookies or other identifiers. These technologies may collect technical and usage data about you.

You can manage Analytics and advertising choices through available website cookie or privacy controls, browser settings, Google account and advertising settings, and Google Analytics opt-out tools where applicable. Further information about how Google collects and processes data through Google Analytics is available in Google's privacy and Analytics information.

Meta Pixel and Meta advertising tools

We use Meta analytics and advertising tools, including the Meta Pixel, principally in connection with the Paylab app, Rewards and our marketing websites. Depending on our configuration, these tools may also use features such as advanced matching or the Conversions API. They help us measure advertising performance and deliver advertising that may be relevant to you on Meta platforms based on activity on our websites or applications. You can manage advertising and activity preferences through Meta's privacy and advertising settings.

6. Use and disclosure of information

Primary and related purposes

We use and disclose personal information for the primary purpose for which it was collected, as described in this Privacy Policy and in any collection notice given at the time. We may also use or disclose personal information for a secondary purpose where you would reasonably expect us to and the purpose is related to the primary purpose (or, for sensitive information, directly related), where you have consented, or where otherwise required or authorised by law. For example, related purposes may include administering Rewards and partner arrangements, providing customer support, and delivering and improving the service you are using.

Purposes for which we use personal information

Personal information: We collect, hold, use and disclose your personal information for the following purposes:

• where the information is reasonably necessary for our functions or activities, including to register, identify, authenticate and onboard users; operate YardPay, the Paylab app and Rewards; administer accounts and memberships and support users; and provide related payment, rewards, risk and compliance functionality;
• for the YardPay-specific purposes described in section 3 and the Rewards-specific purposes described in section 4;
• to work with you as a Payer, invited guest, Trainer/Service Provider, member, customer, supplier, reward partner, authorised representative or other participant in our services;
• to contact and communicate with you about our business, including in response to any support requests you lodge with us or other enquiries you make with us, including via any website we operate;
• for internal record keeping, administrative, invoicing and billing purposes;
• for analytics, service improvement, market research and business development, including to understand use of our services and improve associated applications and platforms, using de-identified or aggregated information where reasonably practicable;
• for advertising and marketing where permitted by law, as described in section 5;
• to run promotions, competitions and/or offer additional benefits to you;
• if you have applied for employment with us, to consider your employment application; and
• to comply with legal and regulatory obligations, including privacy, financial services, AML/CTF, sanctions, fraud-prevention, record-keeping, reporting, law-enforcement and regulatory requirements, and to establish, exercise or defend legal rights.

Sensitive information: We only collect, hold, use and disclose sensitive information for the following purposes:

• any purposes you consent to;
• the primary purpose for which it is collected;
• secondary purposes that are directly related to the primary purpose for which it was collected, including disclosure to the below listed third parties as reasonably necessary to work with you as a customer or supplier of our business;
• to contact emergency services, or to speak with your family, partner or support person where we reasonably believe there is a serious risk to the life, health or safety of you or another person and it is impracticable for us to obtain your consent; and
• if otherwise required or authorised by law.

Our disclosures of personal information to third parties

Personal information: We disclose personal information to third parties where reasonably necessary for the purposes described in this Privacy Policy, with your consent where required, or where required or authorised by law. This may include disclosure to:

• our employees, contractors and/or related entities;
• IT service providers, data storage, web-hosting, online-form, messaging and server providers;
• identity-verification, screening and fraud-prevention providers, including providers that access authorised government or official identity-verification sources;
• payment systems operators, Payment Providers or processors;
• Invoice Platforms, Trainers/Service Providers, Payers and other business partners to the extent reasonably necessary to provide, reconcile, support or administer the relevant invoice or payment service;
• participating reward partners, to the extent reasonably necessary to confirm eligibility, deliver or fulfil a reward or offer, verify a redemption or administer the partner arrangement (see section 4);
• marketing, advertising, analytics and tracking-technology providers where permitted and subject to applicable privacy requirements (see section 5);
• our Australian financial services licensee or principal (where applicable), professional advisers, bankers, auditors, insurers and insurance brokers;
• if we merge with, or are acquired by, another company, or sell all or a portion of our assets, your personal information may be disclosed to our advisers and any prospective purchaser's advisers and may be among the assets transferred;
• regulators, external dispute resolution bodies and government agencies, including ASIC, AUSTRAC, OAIC and AFCA where applicable;
• courts, tribunals, regulatory authorities and law enforcement officers, as required or authorised by law, in connection with any actual or prospective legal proceedings, or in order to establish, exercise or defend our legal rights; and
• any other third parties as required or permitted by law, such as where we receive a subpoena.

Sensitive information: We only disclose sensitive information with your consent where consent is required, or where the disclosure is otherwise permitted or required by law. This may include disclosure to:

• our employees, contractors and/or related entities;
• IT service providers, data storage, web-hosting and server providers;
• professional advisors;
• if we merge with, or are acquired by, another company, or sell all or a portion of our assets, our advisers and any prospective purchaser's advisers, and it may be among the assets transferred;
• courts, tribunals, regulatory authorities and law enforcement officers, as required or authorised by law, in connection with any actual or prospective legal proceedings, or in order to establish, exercise or defend our legal rights;
• identity-verification, screening, fraud-prevention or other service providers where disclosure is lawful and reasonably necessary; and
• any other third parties as required or permitted by law, such as where we receive a subpoena.

7. Automated decision-making and risk controls

YardPay verification, fraud and transaction monitoring

YardPay uses computer programs to help make decisions about payments and accounts. These processes are designed to protect users, prevent fraud and meet our AML/CTF obligations.

Payment authentication: Paylab may receive and use automated payment-authentication, fraud and security outcomes, including 3D Secure (3DS) success or failure, together with related transaction, device and security information, to determine whether a payment can proceed, should be declined or requires further review.

Risk-based transaction monitoring: YardPay uses an automated risk-scoring system that assesses Payers and Trainers/Service Providers each time a payment request or payment method is created or updated. The kinds of personal information used include:

• transaction information, such as the number, amount and cumulative value of payments over a period, changes compared with your usual activity, and the number of different payees a Payer pays;
• payment information, such as payment failures, 3DS authentication attempts, changes to payment methods and whether a valid payment or charge authorisation is in place;
• network and device information, such as IP address, whether an IP address or device is new for your account, is shared across multiple accounts or appears on a blocklist; and
• account information, such as how recently an account was created, periods of inactivity, and identity-verification status.

The kinds of decisions made or substantially assisted by these processes include:

• whether a payment can proceed, is declined or is held for review;
• whether additional identity verification (step-up KYC) is required before further payments can be made; and
• whether an account is flagged for monitoring or suspended, which blocks further payment activity until the matter is reviewed by Paylab.

Suspensions are reviewed by Paylab personnel, who may lift the suspension or clear the account. If you believe an automated decision about you is wrong, please contact us using the details in section 9 and we will review it.

Paylab app and Rewards

The Paylab app and Rewards may use automated processes to calculate cashback rewards and prizes, determine eligibility for offers and promotions, personalise the offers and content shown to you, and detect potential fraud or misuse of rewards (for example, unusual redemption activity). The kinds of personal information used may include your membership details, rewards activity, redemption history, preferences and device or usage information. Where such a process could reasonably be expected to significantly affect your rights or interests (such as cancelling rewards or suspending a membership), we will maintain appropriate human review.

Use of Artificial Intelligence (AI)

Overview: We may use artificial intelligence and machine-learning technologies, including technologies provided by third parties (AI Technologies), in our business operations and services. Where AI Technologies process personal information, we will only use them where reasonably necessary for our functions or activities and where permitted by applicable law.

How we use AI Technologies: We may use AI Technologies for the following purposes:

• to conduct analysis and processing;
• to generate and modify content and coding;
• to improve and optimise our services and operations;
• to automate certain processes and communications, such as routine tasks;
• to personalise your experience with our services;
• for quality assurance purposes; and
• to assist with customer support and queries.

Data Protection and Security: Where AI Technology providers process personal information for us, we take reasonable steps to assess their privacy and security practices and to use contractual, technical and organisational controls appropriate to the risks, including restrictions on use, access, retention and disclosure where appropriate.

We do not knowingly permit personal information to be used to train public or general-purpose AI models unless that use is lawful, reasonably necessary, subject to appropriate contractual and security controls, and appropriately disclosed or consented to where required.

Your Rights and our Commitments: We will treat information generated or inferred by the AI Technologies about individuals as personal information and you maintain all rights over your personal information as outlined in this Privacy Policy, regardless of whether AI Technologies are used in processing. When using AI Technologies with your personal information:

• Transparency and control: where AI Technologies are used to make, or materially assist, a decision that may significantly affect you, we will provide the transparency required by law. We take reasonable steps to verify material AI-generated outputs and maintain appropriate human review or escalation for significant decisions where required by our risk and compliance framework;
• Security: we implement appropriate technical and organisational measures to ensure that our use of AI Technologies maintains the security and integrity of your personal information. This includes regular testing and monitoring of AI outputs for accuracy and reliability; and
• Risk mitigation: we regularly assess and document the risks associated with our use of AI Technologies in processing personal information and implement appropriate mitigation measures. This includes ongoing monitoring of AI Technologies and regular reviews of their performance and impact.

If Paylab arranges for any other computer program to make, or do a thing that is substantially and directly related to making, a decision that could reasonably be expected to significantly affect an individual's rights or interests, we will update this Privacy Policy to identify the kinds of personal information used and the kinds of decisions involved, as required by APP 1.

8. Overseas disclosures and service providers

We may disclose personal information to service providers or other recipients located outside Australia or allow overseas personnel of service providers to access personal information, where this is reasonably necessary for the purposes described in this Privacy Policy. At present, the United States, the United Kingdom and Turkey are likely overseas locations for processing, storage or access by some of our service providers. Key overseas service providers include:

The service providers and locations we use may change over time. Before disclosing personal information to an overseas recipient, we take the reasonable steps required by APP 8 to ensure the recipient handles the information consistently with the APPs, unless an exception applies. In some circumstances, we may remain accountable for the overseas recipient's handling of the information.

9. Access, correction, complaints and contact details

This section applies to all Paylab services, including YardPay, the Paylab app and Rewards.

Access: You may request access to personal information that we hold about you. We do not charge you for making an access request. If we charge for giving access, the charge will not be excessive and will reflect reasonable costs permitted by law. In some circumstances we may refuse access as permitted by the Privacy Act (including where giving access would be unlawful, for example because of AML/CTF reporting restrictions). If we refuse access, or cannot provide it in the form requested, we will provide any notice and reasons required by law and, where reasonable, work with you to provide access in another suitable way.

Correction: If you believe that any information we hold about you is inaccurate, out of date, incomplete, irrelevant or misleading, please contact us using the details below. We will take reasonable steps to promptly correct any information found to be inaccurate, out of date, incomplete, irrelevant or misleading. Please note, in some situations, we may be legally permitted to not correct your personal information. If we cannot correct your information, we will advise you as soon as reasonably possible and provide you with the reasons for our refusal and any mechanism available to complain about the refusal.

Complaints: If you believe we have breached the Privacy Act, the APPs or this Privacy Policy, please contact us using the details below and provide relevant details of your complaint. We will investigate and respond within a reasonable period. If you are not satisfied with our response, you may complain to the OAIC (www.oaic.gov.au, 1300 363 992). Financial-services complaints may also be dealt with under the applicable internal and external dispute resolution arrangements described in the relevant YardPay terms or Financial Services Guide.

Amendments: We may vary this Privacy Policy from time to time by publishing an updated version on our website. If a change materially affects how we collect, use or disclose personal information, we will take reasonable steps to provide additional notice and obtain consent where required by law. The current version and effective date will be shown with the Policy.

Last updated: 23 September 2026

For any questions, requests, complaints or notices, please contact our Privacy Officer at:

Privacy Officer
Paylab Pty Ltd (ACN 650 927 325)
Level 5, 153 Walker Street, North Sydney NSW 2060
Email: privacy@paylab.com.au