Privacy Policy

1.Who We Are and Scope of This Privacy Policy

DAS Financial Pty Ltd, trading as DAS Money (“DAS Money”, “we”, “us” or “our”) is responsible for the personal information collected through the DAS Money Partner website, portal, waitlist, practice adviser and related systems (together, the “Platform”). Our Australian Business Number and Australian Company Number are stated in the Partner Terms of Use and Partner Participation Agreement and are [to be verified before publication].

This Privacy Policy applies to personal information we collect, hold, use and disclose in connection with the Platform, including information about prospective and registered Partners, applicants who join our waitlist, personnel of Partner businesses, and individuals whose information is submitted to us by a Partner or prospective Partner.

This Policy is issued under the Privacy Act 1988 (Cth) and the Australian Privacy Principles (“APPs”) scheduled to that Act. It is a separate document from the DAS Money Partner Terms of Use and Partner Participation Agreement, and does not replace, amend or merge those terms. Where a separate collection notice is given to you at the time of collection, that notice operates alongside this Policy.

The Platform is a business-to-business facility for accounting, bookkeeping and advisory practices. It is not directed at children, and we do not knowingly collect personal information from persons under 18 years of age. If we become aware that we hold such information without an appropriate basis, we will take reasonable steps to delete it.

2.Personal Information We Collect

We collect only the categories of personal information reasonably necessary for the purposes described in this Policy. The categories we currently collect are:

Registration and waitlist information: your full name, the name of your firm or practice, your work email address, an indication of the approximate number of small and medium enterprise clients you service, whether you work with Xero, and your preference regarding marketing communications if you elect to give one.

Account and access information: your email address, securely stored credentials for signing in, your account identifier, the date your account was created, and the records of which Partner Terms version you accepted and when.

Adviser information: the text you choose to describe a client or business finance workflow challenge, and the suggestions the Platform generates in response, each associated with your account and the time of the request.

Technical and security information: approximate internet address data in hashed form, browser and device characteristics, request timing, and the records necessary to detect and prevent automated or abusive submissions.

Client and referral information, where a Partner chooses to submit it: information about a business or individual that a Partner introduces or proposes to introduce, to the extent permitted under the Partner Terms and this Policy.

We do not collect sensitive information as defined by the Privacy Act 1988 (Cth), such as racial or ethnic origin, political opinion, religious beliefs, philosophical beliefs, sexual orientation or health information, and we ask that you do not submit it. We do not collect government identifiers such as tax file numbers. If you volunteer such information, we may hold it for the limited purpose of responding to you and then delete it.

3.How We Collect Personal Information

We collect personal information directly from you, including when you complete the waitlist form, create or update an account, accept the Partner Terms, use the practice adviser, contact us, or correspond with our personnel.

We collect some information automatically when you use the Platform, including technical and security information generated by your browser or device and the records of requests made to our systems.

We may collect information about a business or individual from a Partner or prospective Partner. Where you provide personal information about another person, you confirm that you are authorised to do so and that you have told that person how their information may be used, and we ask that you do not submit information that identifies an individual client or discloses their confidential affairs unless you have a lawful basis and, where required, their consent.

We may collect information from publicly available sources or from a Provider or third party where that is reasonable in the circumstances, for example to verify a business or to process an introduction.

4.Identity Verification and Regulatory Compliance

We may take reasonable steps to verify your identity, your professional standing and the legitimacy of a business or submission. This supports our obligations and expectations around fraud prevention, unlawful-activity reporting, and the requirements of Providers and counterparties with whom we deal.

Where verification is required, we will collect no more personal information than is reasonably necessary for that purpose and will handle verification records in accordance with this Policy.

Some activities contemplated by the Partner Terms may only be undertaken by persons who are appropriately licensed, authorised or exempt. Where regulated activity is to be undertaken through the Platform, we may require evidence of the relevant authorisation and may record the outcome of that verification.

We may disclose information where we are required or authorised to do so by law, by a court, tribunal or competent authority, or by a lawful process, and we may do so without your consent where permitted by law.

5.Why We Collect and Use Information

We collect, use and disclose personal information for the purposes for which it was collected, for related purposes that you would reasonably expect, or where another permission under the APPs applies. Our principal purposes are:

to register you, assess your application, administer your account and provide the Platform and any services you request;

to communicate with you about your account, early access, verification, security, and changes to the Platform, the Partner Terms or this Policy;

to generate practice adviser suggestions and to review, improve and secure that feature;

to prevent fraudulent submissions, inaccurate information, unauthorised access, misuse of the Platform and other unlawful activity;

to monitor compliance with the Partner Terms and with applicable law, licence conditions and Provider requirements;

to conduct business analytics, troubleshooting, testing, research and development, and to maintain the security and performance of the Platform;

to establish, exercise or defend legal or contractual rights, and to meet record-keeping, taxation, audit and reporting obligations; and

for marketing and relationship communications where you have consented, in accordance with the Spam Act 2003 (Cth).

We will not use or disclose your personal information for a purpose that is unrelated to the purpose of collection, or a related purpose you would reasonably expect, unless you consent, an APP permission applies, or we first give you notice of the new purpose.

6.Partner, Client and Referral Information

Where a Partner submits information about a Client or a prospective Client, DAS Money holds that information for the purposes of processing the introduction, administering the relationship between the Partner, the Client and any relevant Provider, and complying with law and the Partner Terms.

Partners remain responsible for having a lawful basis for any disclosure of a Client's personal information to us, for obtaining any consent required by Applicable Law, and for making required disclosures to the Client about commissions, benefits, incentives, relationships and material conflicts of interest.

Partners must not submit fabricated or recycled introductions, must not submit information about a Client that is unnecessary for the purpose, and must not upload passwords, unnecessary identity documents, sensitive information or confidential financial records into unauthorised areas of the Platform.

Submitting information about a Client does not transfer ownership of that information to us. Client and personal information must be handled in accordance with applicable privacy and other legal requirements.

We may reject, investigate or remove submissions that are incomplete, duplicated, fraudulent, unauthorised or otherwise non-compliant.

7.Disclosure to Lenders, Brokers and Third Parties

We may disclose personal information to the following categories of recipients, to the extent necessary for the purposes described in this Policy:

appropriately authorised lenders, brokers, payment providers, financial services providers and other independent businesses that supply products or services through the relevant arrangements, so that an introduction can be assessed, contacted or serviced;

technology, cloud hosting, storage, communications, analytics and support providers who process information on our behalf;

compliance, verification, fraud-prevention, audit and professional advisers, and authorised contractors with a legitimate need to know;

any person to whom our business or a part of it is genuinely restructured, transferred or sold, subject to lawful safeguards; and

courts, tribunals, regulators, law enforcement and other competent authorities where disclosure is required or authorised by law.

Recipients are permitted to use information only for the purposes for which it is given to them and are required to keep it confidential. We do not sell personal information.

Where information is provided to us by a Partner about a Client, we may disclose it to a relevant Provider so that the Provider can contact the Client, assess the introduction and complete its own legal, credit, verification and servicing processes.

8.Overseas Disclosure and International Processing

Some of the recipients described in section 7 operate, or store information, outside Australia. Where we transfer personal information overseas, we take steps to ensure the recipient handles it in a way that is consistent with the Australian Privacy Principles, to the extent required by APP 8.

The countries to which information is most likely to be transferred, and the specific recipients, are [to be confirmed against actual service providers before publication]. We currently rely on hosting and AI processing arrangements whose operational locations have not yet been documented for this Policy.

If you are an overseas recipient of information we disclose, or if you wish to know the countries of our principal overseas recipients, you may contact us using the details in section 17 and we will take reasonable steps to tell you, subject to lawful confidentiality.

Where we transfer information overseas, we remain accountable under the Privacy Act 1988 (Cth) for acts and practices of the recipient that would breach the APPs, to the extent the law so provides.

9.Data Storage, Security and Access Controls

Personal information is stored in managed database and hosting environments. We use administrative, physical and technical safeguards that we consider reasonable in the circumstances, including encryption of credentials in transit and at rest, access controls on a least-privilege basis, isolation of data by account where practicable, and controls that restrict public access to stored records.

Access to personal information within our organisation is limited to personnel and authorised contractors who need it for the purposes described in this Policy, and who are bound by confidentiality obligations.

We do not publish a security certification, accreditation or standard unless and until we hold one. Statements about our security posture in this Policy describe practices we actually operate and are not represented as a certification.

No method of transmission or storage is completely secure. We do not promise absolute security, and you should take care in protecting your own account credentials and in deciding what information you submit.

The specific hosting provider, storage regions and retention infrastructure are [to be confirmed before publication].

10.Security Logs, Monitoring and Fraud Prevention

We monitor the Platform and keep records that help us detect and prevent fraudulent submissions, inaccurate information, unauthorised access, automated abuse and other misuse.

Our current controls include hidden fields that detect automated form filling, minimum submission timing checks, limits on the number of submissions from the same internet address within a period, and rate limits on practice adviser requests. Where a submission is detected as automated, we may return a response that appears normal so that the detection method is not disclosed.

For security and rate-limiting purposes we record an irreversible representation of your internet address together with the time of the request. We do not keep the unhashed address for this purpose.

Where a visible or invisible security check is deployed on a form, the information processed by that check is used to assess whether a submission is made by a person rather than an automated script.

These records are used only for security, fraud prevention, abuse mitigation and the administration of the Platform, and are not used to build profiles about you for unrelated purposes.

11.Artificial Intelligence and Automated Processing

The practice adviser uses an artificial intelligence service to generate suggestions from the text you submit and from descriptions of our published services. The AI provider processes the text you enter for that purpose. The identity of the AI provider and the terms on which it processes information are [to be confirmed before publication].

Suggestions produced by automated processing are general information only. They are not personalised financial, credit, legal, taxation or accounting advice, they do not take any person's objectives, financial situation or needs into account, and they must not be relied on as a recommendation. A Partner remains responsible for the advice it gives its own clients and for verifying that any suggested service is suitable for them.

We do not make decisions that significantly affect you based solely on automated processing without reasonable human review, except where the decision is one you would reasonably expect to be made automatically, such as detecting and blocking an automated or abusive submission.

You should not enter information that identifies a client or discloses their confidential affairs into the practice adviser. Where you describe a client situation, do so in de-identified terms.

We use automated processing for security and fraud prevention as described in section 10, and we may use it to analyse the aggregate performance of the Platform.

12.Cookies, Analytics and Tracking Technologies

The Platform uses browser storage and similar technologies that are strictly necessary for the Platform to work, including to keep you signed in to your account and to remember your preferences during a visit.

We do not currently deploy advertising cookies, third-party marketing trackers, or third-party web analytics on the Platform. If we introduce any such technology, this Policy will be updated before it is used, and where consent is required by applicable law or by the rules of the technology, we will seek it.

Your browser or device may allow you to restrict or clear browser storage. Restricting strictly necessary storage may prevent you from signing in or using parts of the Platform.

The specific analytics and tracking technologies in use, if any, are [to be confirmed before publication].

13.Marketing Communications and Consent

We send marketing and relationship communications only where you have consented, and in accordance with the Spam Act 2003 (Cth). Consent to receive marketing communications is separate from, and is never assumed from, your acceptance of the Partner Terms.

When you join the waitlist you may elect to receive updates about DAS Money early access. That election is recorded separately from your acceptance of the Partner Terms and you may withdraw it at any time.

Marketing messages identify DAS Financial Pty Ltd as the sender and include a means by which you can unsubscribe. You can also ask us to stop sending marketing communications by contacting us using the details in section 17.

We may still send you service, security, verification, administrative or legal notices that are necessary for the Platform, even if you have withdrawn marketing consent.

14.Data Retention, Deletion and De-identification

We hold personal information only for as long as is necessary to fulfil the purposes for which it was collected, including for legal, accounting, reporting, dispute-management and compliance requirements, and then we take reasonable steps to destroy it or to de-identify it so that you are no longer identifiable.

Records of your acceptance of a particular version of the Partner Terms are retained for the life of the relationship and for the period needed to evidence what you agreed to, because that evidence is necessary to administer and defend contractual rights.

Security and abuse-mitigation records are retained for the shorter period needed to operate rate limits and detect abuse.

Specific retention periods for each category of information, and the process by which a Partner may request closure of an account and deletion of information, are [to be confirmed before publication].

Where we cannot lawfully or practically delete particular information — for example because a legal obligation requires us to keep it — we will tell you why.

15.Access, Correction and Privacy Rights

You may ask to obtain access to the personal information we hold about you, and to have that information corrected or updated if you believe it is inaccurate out of date or incomplete. You may also ask us to delete your personal information, or to restrict how it is used.

We will respond to a request for access within a reasonable period and, unless the Privacy Act 1988 (Cth) permits otherwise, we will give you access in the manner you reasonably request. We may ask you to verify your identity before we disclose or correct information, and we will not charge more than a reasonable cost for fulfilling a request.

If we refuse access or refuse to correct information, we will give you written reasons and tell you about your right to complain, unless the law permits us to withhold those reasons.

You may lodge a complaint with us at any time, and you may also contact the Office of the Australian Information Commissioner about a privacy complaint. Details are in section 17.

You are not required to identify yourself in order to browse the public pages of the Platform. Where a feature requires an account, you will need to give us the information described in section 2 in order to use it.

16.Data Breaches and Incident Management

We maintain processes to detect, contain, assess and remediate security incidents that affect personal information, including unauthorised access to, or unauthorised disclosure of or loss of, personal information held by us.

If an eligible data breach occurs — that is, an unauthorised access to or disclosure of, or loss of, personal information in circumstances likely to result in serious harm to individuals — we will take the steps required by the Notifiable Data Breaches scheme in the Privacy Act 1988 (Cth), including notifying the Office of the Australian Information Commissioner and, where required, the individuals affected, and we will tell affected individuals what we are doing to address the harm.

Where a breach affects information a Partner submitted about a Client, we will notify the Partner without undue delay where we are able to do so and where notification is consistent with our legal obligations, and we will cooperate reasonably in investigating and addressing the incident.

Statutory notification and remediation obligations are not limited by any contract, including the Partner Terms.

Partners must promptly notify us of any suspected fraud, material error, security incident or relevant regulatory breach involving the Platform.

17.Privacy Complaints and Contact Information

If you have a privacy concern, question, access or correction request, or complaint, you should contact us. Privacy enquiries are handled through the contact channel confirmed to you during onboarding; the Partner Terms also state contact@das.money as our contact address, and which address is to be used for privacy matters is [to be confirmed before publication].

When you contact us, please tell us what your concern is and how we can reach you. We will acknowledge your complaint, investigate it, and respond within a reasonable period. We may ask you for more information so we can properly assess your complaint.

If you are not satisfied with our response, or if we have not responded within a reasonable period, you may contact the Office of the Australian Information Commissioner, GPO Box 5218 Sydney NSW 2001, telephone 1300 363 992, or through the Commissioner's website at oaic.gov.au.

We will handle your complaint confidentially and will not use a complaint as a reason to treat you unfairly.

18.Changes to This Privacy Policy

We may update this Privacy Policy from time to time, for example when we change the way the Platform operates, when we introduce new services, providers or technologies, or when the law changes.

The current version of this Policy, and its version and status, are shown on this page. Where a change materially affects how we handle personal information, we will take reasonable steps to draw it to your attention, which may include notice in the Platform or by email.

We may keep earlier versions of this Policy so that we can evidence the practices that applied at an earlier time.

You should read this Policy whenever you use the Platform so that you remain aware of how your information is handled.