How we handle personal information.

Introduction

KPI Mystery Shopping Pty Ltd (ACN 621 986 589) ("KPI", "we", "our" or "us") operates this website at https://www.kpimysteryshopping.com.au (the "Website") and the mystery shopping platform at https://login.kpimysteryshopping.com.au (the "Platform").

We are committed to handling personal information responsibly and in accordance with the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs).

This Privacy Policy explains what personal information we collect, why we collect it, how we use and disclose it, and how you can access, correct, or raise concerns about it.

By using the Website, sending us an enquiry, registering an account or using the Platform, you acknowledge that you have read and understood this Privacy Policy.

1. About this policy

1.1 This Privacy Policy applies to all personal information collected by KPI in connection with the Website, enquiries from prospective and current clients, the Platform, shopper registration, assignment management, payment processing, and related business operations.

1.2 This policy does not apply to information that is not personal information, or to information that has been de-identified such that individuals cannot reasonably be identified.

1.3 We may update this Privacy Policy from time to time. The current version will always be available on our website. Continued use of the Website or the Platform after an update constitutes acceptance of the revised policy.

2. What personal information we collect

2.1 We collect personal information that is reasonably necessary for our business functions. The types of personal information we may collect include:

• (a) identity information: full legal name, date of birth, and residential address;
• (b) contact information: email address and phone number;
• (c) enquiry information: where you contact us through the Website, your name, email address, phone number, company, industry, the size of your network and the content of your message;
• (d) financial information: bank account details, Australian Business Number (ABN), tax file number (where required), and payment-related documentation including completed Statement by a Supplier forms;
• (e) identification documents: copies of government-issued identification provided for account verification or payment compliance purposes;
• (f) platform and assignment data: account login credentials, assignment history, submitted reports, supporting documentation, photographs, receipts, and related deliverables;
• (g) communications: correspondence between you and KPI, including emails, platform messages, and dispute-related communications;
• (h) technical data: IP addresses, browser type, device identifiers, and usage data collected automatically when you access the Website or the Platform; and
• (i) any other information you voluntarily provide to us in connection with your use of the Website or the Platform.

2.2 Where you provide personal information about another individual (for example, a subcontractor assisting with an assignment), you must ensure that individual is aware of and consents to the collection and use of their information in accordance with this policy.

3. How we collect personal information

3.1 We collect personal information in the following ways:

• (a) directly from you when you send us an enquiry, register an account, complete your profile, accept or complete assignments, submit reports, or communicate with us;
• (b) automatically through the Website and the Platform using cookies, analytics tools, and similar technologies when you access or use our website or digital systems;
• (c) from third parties, including identity verification services, payment processors, and other service providers engaged to support our operations; and
• (d) from publicly available sources where relevant to verifying information you have provided.

3.2 You are not required to provide personal information to us, but if you do not, we may be unable to respond to your enquiry, register your account, allocate assignments, process payments, or provide services to you.

4. Why we collect and use personal information

4.1 We collect and use personal information for the following purposes:

• (a) to respond to enquiries and to discuss and arrange the services you have asked about;
• (b) to register and manage your shopper account;
• (c) to allocate, administer, and manage assignments;
• (d) to process payments and comply with Australian taxation requirements, including withholding tax obligations;
• (e) to verify your identity and eligibility to participate on the Platform;
• (f) to review, assess, and quality-check submitted reports and deliverables;
• (g) to investigate suspected fraud, misconduct, or breaches of our Shopper Terms and Conditions;
• (h) to communicate with you about enquiries, assignments, platform updates, policy changes, and operational matters;
• (i) to improve the Website, the Platform and our services;
• (j) to comply with our legal and regulatory obligations; and
• (k) for any other purpose disclosed to you at the time of collection or to which you have consented.

4.2 We will not use your personal information for a purpose that is unrelated to the purposes listed above without your consent, unless otherwise permitted by the APPs.

5. Disclosure of personal information

5.1 We may disclose your personal information to:

• (a) our clients, to the extent necessary to administer assignments and deliver reporting outcomes (client disclosure is limited to assignment-relevant information and does not include your identity unless expressly required);
• (b) third-party service providers engaged to support our operations, including payment processors, identity verification providers, cloud hosting and data storage providers, email delivery providers, IT support providers, and analytics platforms;
• (c) our professional advisors, including lawyers, accountants, and auditors, under obligations of confidentiality;
• (d) government agencies, regulators, and law enforcement bodies where required or authorised by law, including the Australian Taxation Office; and
• (e) any other party with your consent.

5.2 We require third-party service providers to handle personal information in accordance with applicable privacy laws and to use it only for the purposes for which it was disclosed.

6. Overseas disclosure

6.1 Some of our third-party service providers may store or process personal information outside Australia. This may include cloud hosting, email delivery, payment processing, or analytics services operated from overseas locations, including the United States (website hosting and analytics) and the European Union (email delivery).

6.2 Where personal information is disclosed to overseas recipients, we take reasonable steps to ensure those recipients handle the information in a manner consistent with the APPs, including through contractual arrangements.

6.3 By using the Website or the Platform, you acknowledge that your personal information may be transferred to and stored in countries outside Australia.

7. Cookies and tracking technologies

7.1 The Website and the Platform use cookies and similar tracking technologies to operate and improve them, analyse usage patterns, and support platform functionality. On the Website this includes Vercel Analytics, which does not use cookies, and Google Analytics, which does.

7.2 You may configure your browser to refuse cookies, but doing so may affect the functionality of the Platform.

7.3 We do not use cookies to collect sensitive personal information or to track your activity outside the Website or the Platform.

8. Security of personal information

8.1 We take reasonable steps to protect personal information from misuse, interference, loss, and unauthorised access, modification, or disclosure.

8.2 These steps include password-protected systems, access controls, encrypted data transmission, and secure storage practices.

8.3 While we take reasonable precautions, no data transmission over the internet or electronic storage system is completely secure. We cannot guarantee the absolute security of personal information.

8.4 If you become aware of any unauthorised access to your account or a suspected data breach, you must notify us immediately at info@kpimysteryshopping.com.au.

9. Data retention

9.1 We retain personal information for as long as it is necessary for the purposes for which it was collected, or as required by law.

9.2 In particular, we retain financial and payment records for a minimum of seven years to comply with Australian taxation and accounting obligations.

9.3 When personal information is no longer required, we take reasonable steps to destroy or de-identify it.

10. Notifiable data breaches

10.1 KPI is subject to the Notifiable Data Breaches (NDB) scheme under Part IIIC of the Privacy Act 1988 (Cth).

10.2 If we have reasonable grounds to believe that an eligible data breach has occurred, we will notify affected individuals and the Office of the Australian Information Commissioner (OAIC) as required by law.

10.3 We maintain a Data Breach Response Plan to manage and respond to data breaches in a timely and appropriate manner.

11. Access and correction

11.1 You have the right to request access to the personal information we hold about you and to request correction of information that is inaccurate, out of date, incomplete, irrelevant, or misleading.

11.2 To make an access or correction request, please contact us using the details in clause 14. We will respond within a reasonable time and in accordance with the APPs.

11.3 We may decline an access or correction request in circumstances permitted by the APPs, and will provide written reasons for any refusal.

11.4 We do not charge a fee for making an access or correction request, but may charge a reasonable fee for providing access where the request involves significant time or resources.

12. Sensitive information

12.1 We do not intentionally collect sensitive information (as defined in the Privacy Act 1988 (Cth)) unless it is reasonably necessary for our functions and you have consented to its collection, or collection is required or authorised by law.

12.2 If you believe you have provided sensitive information to us, please contact us at info@kpimysteryshopping.com.au.

13. Complaints

13.1 If you have a complaint about how we have handled your personal information, please contact our Privacy Officer using the details in clause 14.

13.2 We will acknowledge your complaint within 5 business days and aim to resolve it within 30 days.

13.3 If you are not satisfied with our response, you may lodge a complaint with the Office of the Australian Information Commissioner (OAIC):

• (a) Website: www.oaic.gov.au
• (b) Phone: 1300 363 992
• (c) Post: GPO Box 5218, Sydney NSW 2001

14. Contact us

14.1 For privacy-related enquiries, access or correction requests, or complaints, please contact:

15. Governing law

15.1 This Privacy Policy is governed by the laws of Queensland, Australia, and the Privacy Act 1988 (Cth).