Supplink Merchant App Privacy Policy

This Policy explains how SUPPLINK TECH PTY LTD collects, uses, discloses, stores and protects personal information through the Supplink merchant app.

Last updated：8 August 2026

Effective date：8 August 2026

1. Who we are and scope

SUPPLINK TECH PTY LTD (ABN 23 692 908 311) operates Supplink. This Policy applies to merchant applicants, business owners, contacts, authorised users, beneficial owners and other individuals connected with a merchant account.

We handle personal information in accordance with the Privacy Act 1988 (Cth), Australian Privacy Principles (APPs) and other applicable Australian law. Even if a statutory exemption may apply in a particular case, we use the principles in this Policy as our operational standard.

2. Information we collect and hold

• Account and contact data: name, role, profile image, phone, email, credentials and account identifiers;

• Business and verification data: business and trading name, ABN/ACN, operating address, business type and scope, licences and registration details, identity-document numbers and files, beneficial ownership or authority details;

• Financial and settlement data: bank and account name, BSB/branch and account number, settlement status, payment evidence, refunds, fees, invoices and tax records;

• Product, order and operational data: listing content and images, stock, prices, sales, orders, delivery, after-sales service, complaints, reviews and support communications;

• Location and media: operating or delivery addresses, location when you actively use a map feature, and photos, video or files you choose to upload;

• Technical, usage and security data: device and app version, IP address, network state, logs, diagnostics, push identifiers, login activity, risk and fraud signals; and

• Inferences: merchant-risk, fraud or service-quality indicators derived from transactions, complaints, device and security signals.

3. Sensitive information and identity documents

We do not actively seek health, racial or ethnic origin, religious, political, biometric or criminal-record information for purposes unrelated to merchant services. If reasonably necessary for verification, we collect sensitive information only with consent or where permitted or required by law, and apply stronger access controls.

Identity documents may not always be legally classified as sensitive information, but are high risk. We use them only for onboarding, identity, authority, compliance, fraud prevention or legally required checks.

4. How we collect information

We mainly collect information directly when you register, apply, list products, handle orders or settlement, use maps, camera or file features, contact support or participate in a dispute.

We may also receive information from buyers, merchant administrators, payment and logistics providers, fraud or security providers, public registers such as ABR or ASIC, regulators and other lawful sources. If you provide another person’s data, you must be authorised to do so and should make this Policy available to them.

5. Purposes and consequences of not providing data

If required information is not provided or cannot be verified, we may be unable to approve onboarding, process orders or settle funds. You may refuse non-essential permissions, but the related feature may not work.

• Create, assess, administer and secure merchant accounts;

• Verify business, identity, authority, licensing, settlement eligibility and compliance;

• List products and process orders, payment status, settlement, delivery, invoices, refunds and after-sales service;

• Provide support, notices, complaint handling, risk management and dispute resolution;

• Maintain security, prevent fraud, diagnose issues, analyse and improve services; and

• Meet tax, accounting, food or product safety, consumer-protection, sanctions, enforcement, court and other legal obligations.

6. App permissions

You can review or withdraw permissions in device settings. Withdrawal does not affect earlier lawful handling based on your permission.

• Notifications: order, settlement, security, account and service messages;

• Location while using the app: help select operating or delivery addresses; we do not request continuous background location;

• Camera: capture identity or qualification documents, product, delivery or after-sales evidence; and

• Photos, video and files: select or save materials you actively choose to handle.

7. Disclosure and service providers

We disclose only information reasonably necessary to provide services, where authorised, or where permitted or required by law. Recipients may include relevant buyers, delivery and logistics providers, payment and banking providers, cloud hosting and storage, maps, push messaging, analytics, security and technical support, professional advisers, insurers, government, courts and law enforcement.

We do not sell personal information. Providers processing data for us must be subject to appropriate contractual, confidentiality and security controls and may not use it for unauthorised purposes. A business sale or restructure disclosure occurs only under appropriate confidentiality and legal safeguards.

8. Overseas handling and disclosure

We use technology providers including Amazon Web Services and Google-related services. Data may be stored or processed in Australia and may also be handled by recipients in the United States and other countries where these providers or their controlled subprocessors operate. Locations can change with provider operations; contact us for the current known principal countries.

Where a transfer is a disclosure to an overseas recipient, we take reasonable steps required by APP 8 in the circumstances to require protection substantially consistent with the APPs.

9. Marketing communications

Transactional, security, account and service-maintenance messages are not optional marketing. We send commercial electronic marketing only where we have applicable consent or the law permits. Marketing identifies the sender, provides current contact details and a simple unsubscribe facility.

You may unsubscribe at any time without a fee or a new account. We generally action electronic-marketing unsubscribe requests within five working days.

ACMA Australian spam guidance：https://www.acma.gov.au/avoid-sending-spam

10. Security and retention

We use technical and organisational measures proportionate to sensitivity and risk, including reasonable access restrictions, authentication, transfer and storage protections, logging, backup, workforce and provider controls to protect against misuse, interference, loss and unauthorised access, modification or disclosure. No internet service can guarantee absolute security.

We retain information only as needed for the purposes above or for legal, tax, accounting, transaction, food or product safety, dispute and fraud-prevention obligations. When no longer needed and not legally required, we take reasonable steps to delete, de-identify or put it beyond use.

11. Data breaches

We promptly assess suspected breaches, contain and mitigate harm, and document the response. If the Notifiable Data Breaches scheme applies and serious harm is likely, we notify affected individuals at risk and the OAIC as soon as practicable and recommend protective steps.

12. Access, correction and account controls

You can view or update some data in your account and may request access to or correction of personal information we hold by using the email below. We may verify identity and generally respond within 30 days. If we lawfully refuse or a reasonable charge applies, we explain why and how to complain.

You can disable marketing or non-essential notifications and request account deletion. Deletion does not immediately erase records required for legal, tax, orders, settlement, refunds, disputes, risk or security; those records are restricted to permitted purposes.

13. Privacy complaints

First submit a written complaint to the email below describing the issue, relevant dates and desired resolution. We acknowledge and investigate it and generally respond within 30 days. If more time is required, we explain why and provide an expected timeframe.

If you are dissatisfied with our response, you may complain to the Office of the Australian Information Commissioner (OAIC).

OAIC privacy complaints：https://www.oaic.gov.au/privacy/privacy-complaints

14. Automated decisions, children, third parties and updates

We may use risk or fraud indicators to support human review, restrict high-risk actions or request more verification. If we later arrange automated use of personal information to make decisions reasonably expected to significantly affect an individual’s rights or interests, we will update disclosures as required by the APP 1 rules applying at that time.

The merchant app is for business users aged 18 or over and is not directed to children. Third-party websites or services are governed by their own privacy practices.

We may update this Policy for changes to data practices, features, providers or law. We give appropriate notice of material changes and do not treat continued use alone as consent to a new activity that requires separate consent.

Legal entity：SUPPLINK TECH PTY LTD

ABN：23 692 908 311

ACN：692 908 311

Location：New South Wales 2160, Australia

Email：info@supplink.com.au

Website：https://supplink.com.au