1. We respect your privacy
- InDebted Holdings Pty Ltd ACN 635 375 165 respects your right to privacy and is committed to safeguarding the privacy of our customers and website visitors. This policy sets out how we collect, manage and treat your personal information.
- We adhere to the Australian Privacy Principles contained in the Privacy Act 1988 (Cth) (Privacy Act) and to the extent applicable, the EU General Data Protection Regulation (GDPR).
Our collection, use, disclosure and processing of your personal information is regulated by the GDPR if:
- you interact with our UK related entity;
- we provide our services to you whilst you are located in the EU; or
- we monitor your behavior whilst you are located in the EU.
- "Personal information" is information we hold which is identifiable as being about you. This includes information such as your name, email address, identification number, or any other type of information that can reasonably identify an individual, either directly or indirectly.
- In this Policy, “we”, “us” and “our” means InDebted Holdings Pty Ltd and its related entities and individual companies who are part of the InDebted Holdings Pty Ltd Group (InDebted Group) which are data controllers of your personal information are all jointly responsible for this Policy. The InDebted Group is made up of InDebted Holdings Pty Ltd, InDebted Australia Pty Ltd, InDebted IP Pty Ltd, InDebted New Zealand Limited, InDebted Platform Co UK Limited, InDebted Canada Ltd, Enhanced Accounts Management Corp.
2. What personal information is collected
- InDebted Holdings Pty Ltd will, from time to time, receive and store personal information you submit to our website, provided to us directly by you or other organisations that you have relationships with or given to us in other forms.
- You may provide basic information such as your name, phone number, address and email address to enable us to send you information, provide updates and process your product or service order.
- We may collect additional information at other times, including but not limited to, when you provide feedback, make a complaint, when you provide information about your personal or business affairs, change your content or email preference, respond to surveys and/or promotions, provide financial or credit card information, communicate with our customer support or interact with us through our website, applications or digital communication channels.
- Additionally, we may also collect any other information you provide while interacting with us.
- We may also collect personal information about you from third parties or organisations including our related companies, publicly available sources of information (i.e. such as public registers), your approved representatives, other organisations, who jointly with us, provide products or services to you, third party websites, applications or platforms containing interactive InDebted content or that interface with our own websites and applications, social media platforms (if you publicly comment or send us a private message) and digital tracking tools such as cookies.
3. How we collect your personal information
4. How we use your personal information
- InDebted Holdings Pty Ltd may use personal information collected from you to provide you with information about our products or services. We may also make you aware of new and additional products, services and opportunities available to you.
InDebted Holdings Pty Ltd will use personal information only for the purposes that you consent to when we seek your consent. This may include to:
- provide you with products and services during the usual course of our business activities;
- administer our business activities;
- manage, research and develop our products and services;
- provide you with information about our products and services;
- communicate with you by a variety of measures including, but not limited to, by telephone, email, sms or mail; and
- investigate any complaints.
- If you withhold your personal information, it may not be possible for us to provide you with our products and services or for you to fully access our website.
- We are also allowed to use your personal information to fulfil any contract we have with you (which includes acting on instructions you give us before entering into a contract), to comply with our legal obligations or when it is in our legitimate interest. When we use your personal information for our legitimate interest, we only process your personal information that is necessary to fulfil our legitimate interests and on balance we have considered that our interests are not outweighed by your interests.
- We may disclose your personal information to comply with a legal requirement, such as a law, regulation, court order, subpoena, warrant, legal proceedings or in response to a law enforcement agency request.
- If there is a change of control in our business or a sale or transfer of business assets, we reserve the right to transfer to the extent permissible at law our user databases, together with any personal information and non-personal information contained in those databases.
5. Disclosure of your personal information
6. General Data Protection Regulation (GDPR) for the European Union (EU)
- InDebted Holdings Pty Ltd will comply with the principles of data protection set out in the GDPR for the purpose of fairness, transparency and lawful data collection and use.
- We process your personal information as a Processor and/or to the extent that we are a Controller as defined in the GDPR.
- We must establish a lawful basis for processing your personal information. The legal basis for which we collect your personal information depends on the data that we collect and how we use it.
- We will only collect your personal information with your express consent for a specific purpose and any data collected will be to the extent necessary and not excessive for its purpose. We will keep your data safe and secure.
- We will also process your personal information if it is necessary for our legitimate interests, or to fulfil a contractual or legal obligation.
- We process your personal information if it is necessary to protect your life or in a medical situation, it is necessary to carry out a public function, a task of public interest or if the function has a clear basis in law.
- We do not collect or process any personal information from you that is considered "Sensitive Personal Information" under the GDPR, such as personal information relating to your sexual orientation or ethnic origin unless we have obtained your explicit consent, or if it is being collected subject to and in accordance with the GDPR.
- You must not provide us with your personal information if you are under the age of 16 without the consent of your parent or someone who has parental authority for you. We do not knowingly collect or process the personal information of children.
7. Your rights under the GDPR
- If you are an individual residing in the EU, you have certain rights as to how your personal information is obtained and used. InDebted Holdings Pty Ltd complies with your rights under the GDPR as to how your personal information is used and controlled if you are an individual residing in the EU
Except as otherwise provided in the GDPR, you have the following rights:
- If we rely on your consent to process your personal information, to withdraw your consent where we will stop processing the activities relevant to your consent;
- to be informed how we received your personal information and how it is being used;
- access your personal information (we will provide you with a free copy of it);
- to object to us using your personal information where we are relying on our legitimate interest to do so and we can challenge your objection and communicate with you in accordance with our legal obligations;
- to correct your personal information if it is inaccurate or incomplete;
- to delete your personal information (also known as "the right to be forgotten") if there is no need for us to keep it;
- to restrict processing of your personal information;
- to receive, retain and reuse your personal information for your own purposes;
- to object to your personal information being used; and
- to object against using your personal information for direct marketing, automated decision making and profiling.
- We may ask you to verify your identity and provide us with additional information before acting on any of your requests.
- We will respond to you as soon as possible but within 30 days from the date of your request.
8. Hosting and International Data Transfers
- Information that we collect may from time to time be stored, processed in or transferred between parties or sites located in countries outside of Australia. These may include, but are not limited to Australia & the USA.
- We and our InDebted Group companies have offices and/or facilities in Australia, New Zealand, The UK and The Philippines. Transfers to each of these countries will be protected by appropriate safeguards, these include the use of standard data protection clauses adopted or approved by the European Commission which you can obtain from the European Commission Website;.
- The hosting facilities for our website are situated in Australia & the USA. Transfers to each of these Countries will be protected by appropriate safeguards, these include the use of standard data protection clauses adopted or approved by the European Commission which you can obtain from the European Commission Website.
- Our Suppliers and Contractors are situated in Australia, The Philippines & the USA. Transfers to each of these Countries will be protected by appropriate safeguards, these include the use of standard data protection clauses adopted or approved by the European Commission which you can obtain from the European Commission Website.
- You acknowledge that personal data that you submit for publication through our website or services may be available, via the internet, around the world. We cannot prevent the use (or misuse) of such personal data by others.
9. Security of your personal information
- InDebted Holdings Pty Ltd is committed to ensuring that the information you provide to us is secure. In order to prevent unauthorised access or disclosure, we have put in place suitable physical, electronic and managerial procedures to safeguard and secure information and protect it from misuse, interference, loss and unauthorised access, modification and disclosure.
- Where we employ data processors to process personal information on our behalf, we only do so on the basis that such data processors comply with the requirements under the GDPR and that have adequate technical measures in place to protect personal information against unauthorised use, loss and theft.
10. Access to your personal information
- You may request details of personal information that we hold about you in accordance with the provisions of the Privacy Act, and to the extent applicable the EU GDPR. If you would like a copy of the information which we hold about you or believe that any information we hold on you is inaccurate, out of date, incomplete, irrelevant or misleading, please email us at GDPR@indebted.co.
- We reserve the right to refuse to provide you with information that we hold about you, in certain circumstances set out in the Privacy Act, the GDPR or any other applicable law.
11. Retention of your personal information
- We will keep your personal information for as long as required by InDebted in compliance with its Privacy Act and GDPR legal obligations. We also generally retain your personal information for at least seven years after we have stopped interacting with you to comply with our legal obligations and so that we can respond to any questions or complaints regarding our interactions with you.
- We may also need to keep your personal information for a longer period, where required for legal or regulatory reasons.
- We will keep your data safe and secure for as long as we hold it.
- If we no longer need to use your personal information for the purposes set out in this policy, we will take reasonable steps to destroy, de-identify or anonymize it so that your identity cannot, by any reasonable means, be revealed from the information that we hold about you.
12. Complaints about privacy
- If you have any complaints about our privacy practices, please feel free to send in details of your complaints to GDPR@indebted.co. We take complaints very seriously and will respond shortly after receiving written notice of your complaint. We will let you know if we need any additional information from you.
- If you displeased with the way we are or have handled your personal information, you can contact the Information Commissioner’s Office (ICO) in the relevant EU Member State.
When you visit our website
When you come to our website www.indebted.co we may collect certain information such as browser type, operating system, website visited immediately before coming to our site, etc. This information is used in an aggregated manner to analyse how people use our site, such that we can improve our service.
Third party sites
Our site may from time to time have links to other websites not owned or controlled by us. These links are meant for your convenience only. Links to third party websites do not constitute sponsorship or endorsement or approval of these websites. Please be aware that InDebted Holdings Pty Ltd is not responsible for the privacy practices of other such websites. We encourage our users to be aware, when they leave our website, to read the privacy statements of each and every website that collects personal identifiable information.