Privacy Policy

01The information we handle and our role

We handle personal information in three ways:

• Account holders and their staff. We collect personal information about the people who register for and use the Service on behalf of a business, for our own purposes.
• Merchant customer data. Businesses using the Service may store personal information about their own customers, members and staff, such as contact details, purchase and transaction history, account and tab balances, loyalty program details, and gift card or voucher balances. For this information, the business decides why and how it is handled, and we process it on the business's behalf to provide the Service. If your personal information is held by a business using our Service, please contact that business directly in the first instance.
• Website visitors. We collect limited information about visitors to our websites, as described below.

02What personal information we collect

• Contact and identity details — name, email address, phone number, business name and role.
• Account credentials — email address and password or staff PIN, which we store only in hashed form.
• Billing and account details — billing contact details, subscription status and invoice history. Payment card details are provided directly to our billing provider; we do not collect or store full card numbers.
• Operational and usage data — the sales, product, inventory, customer and other business data you enter into the Service, and logs of how the Service is used, including device and browser information, IP address, timestamps and approximate location derived from your IP address.
• Support communications — information you provide when you contact us for support or otherwise correspond with us.
• Cookies and similar technologies — see section 5.

We do not ask for, and the Service does not require, sensitive information (such as health information). Please do not submit sensitive information to the Service.

03How we collect personal information

We collect personal information directly from you when you register, configure or use the Service, or contact us; automatically as you use the Service and our websites (through logs, cookies and analytics); and from third parties where relevant, such as our billing provider (for subscription and payment status) and payment terminal providers you choose to connect (for payment transaction outcomes).

04Why we collect, hold and use personal information

• to provide, operate, maintain and secure the Service, including synchronising data across your devices;
• to create and administer your account, staff access and permissions;
• to calculate fees, issue invoices and manage billing;
• to respond to your enquiries and provide support;
• to send service and transactional communications, such as verification emails, invoices, security alerts and important product notices;
• to monitor and improve the performance of the Service, develop new features and conduct analytics, using aggregated or de-identified data where practicable;
• to send you direct marketing about our products and services in accordance with the Spam Act 2003 (Cth) — you can opt out at any time (see section 12);
• to detect, prevent and address fraud, security incidents and misuse of the Service; and
• to comply with our legal obligations and enforce our agreements.

05Cookies, local storage and analytics

We use cookies, browser local storage and similar technologies to manage your sessions, remember preferences and keep the till working offline — the Service stores operational data locally on your device so it can keep trading without connectivity, and synchronises when reconnected. We use privacy-conscious website analytics to understand aggregate usage of our websites and Service. You can control cookies through your browser settings, but disabling some technologies may prevent parts of the Service from working.

06When we disclose personal information

We disclose personal information to third-party service providers who help us deliver the Service, including providers of: cloud application hosting and content delivery; database hosting and data synchronisation; transactional email delivery; subscription billing and invoicing; website analytics; and payment terminal and payment integration services (at your direction, to process the in-person payments you initiate). These providers are engaged to handle personal information only for the purpose of providing their services to us and are required to protect it.

We may also disclose personal information to our professional advisers (such as lawyers and accountants); to regulators, law enforcement or courts where required or authorised by law; to establish, exercise or defend legal claims; and to a prospective buyer of our business or assets, subject to appropriate confidentiality protections.

We do not sell or rent personal information to anyone.

07Overseas disclosure

Our primary databases are hosted in Australia. However, some of our service providers process or store personal information outside Australia, including in the United States and other countries where those providers operate. Where we disclose personal information overseas, we take reasonable steps to ensure the recipient handles it in accordance with the APPs or is otherwise subject to substantially similar protections, for example through contractual arrangements. By using the Service, you acknowledge and consent to these overseas disclosures.

08How we secure personal information

We take reasonable steps to protect personal information from misuse, interference, loss and unauthorised access, modification or disclosure. These steps include encryption in transit and at rest, isolation of each business's data enforced at the database level, hashed credentials, role-based access controls and least-privilege internal access, and logging and monitoring of our systems. No method of transmission over the internet or electronic storage is completely secure, so we cannot guarantee absolute security.

09Data breaches

We comply with the Notifiable Data Breaches scheme under the Privacy Act 1988 (Cth). If we suspect an eligible data breach, we will assess it promptly. Where the law requires, we will notify affected individuals and the Office of the Australian Information Commissioner, and include recommendations about the steps individuals should take.

10Retention and deletion

We keep personal information for as long as your account is active and as needed for the purposes described in this Privacy Policy. When an account is closed, we delete or de-identify personal information within a reasonable period, subject to backup cycles and any retention required by law (for example, tax and financial record-keeping obligations, which can require retention for up to five years). Trial or long-inactive accounts may be deleted after we give notice to the account email address. You may ask us to delete your personal information at any time; if the information forms part of a business customer's data, we may direct you to that business.

11Access and correction

You may request access to, or correction of, the personal information we hold about you by contacting us using the details in section 16. We do not charge for making a request, and we will respond within a reasonable period, generally within 30 days. We may need to verify your identity before actioning a request. If we refuse a request, we will tell you why and how you can complain.

12Direct marketing

We may send you emails about our products, features and offers. Every marketing email includes a way to unsubscribe, and you can also opt out at any time by emailing us. We comply with the Spam Act 2003 (Cth). Opting out of marketing does not affect service and transactional communications that are necessary for your account.

13Children

The Service is intended for business users aged 18 and over, and is not directed at children. We do not knowingly collect personal information from children under 18. If you believe a child has provided us with personal information, please contact us so we can delete it.

14Complaints

If you believe we have breached the Privacy Act 1988 (Cth) or the APPs, please contact us first using the details in section 16. We will investigate your complaint and respond within a reasonable period. If you are not satisfied with our response, you may complain to the Office of the Australian Information Commissioner (OAIC) at www.oaic.gov.au or on 1300 363 992.

15Changes to this Privacy Policy

We may update this Privacy Policy from time to time. The current version will always be posted on this page with a revised effective date, and if we make material changes we will notify you through the Service or by email. Your continued use of the Service after the effective date of an updated policy acknowledges the updated policy.

16Contact us

For privacy enquiries, access and correction requests, and complaints, contact us at privacy@nextexperience.com.au. For general support, contact support@nextexperience.com.au. Next Experience Pty Ltd (ABN 61 673 229 126) is located in Sydney, New South Wales, Australia.