Last reviewed: May 2026
This privacy policy (the “Privacy Policy”) applies to Paytime Services Pty Ltd ACN 647 450 137, and its affiliates and related companies (together, “Paytime”, “we”, “us” or “our”). It explains how we collect, hold, use, disclose and protect personal information, including personal information collected through our websites, mobile applications, email, cloud-based services, and any widgets we embed in third-party platforms with a link to this Privacy Policy (“Websites”).
Paytime is bound by the Privacy Act 1988 (Cth) (“Privacy Act”), including the Australian Privacy Principles (“APPs”) in Schedule 1, the Notifiable Data Breaches scheme, and the amendments made by the Privacy and Other Legislation Amendment Act 2024. This policy is published to satisfy our obligations under APP 1.
By “personal information” we mean information or an opinion about an identified individual, or an individual who is reasonably identifiable, whether the information is true or not and whether it is recorded in a material form or not. Personal information does not include information that has been effectively de-identified.
Our third-party suppliers and commercial partners (“our Partners”) are independent of Paytime and have their own privacy practices. We are not responsible for their handling of personal information. Where our Websites contain links to third-party sites, those sites are not under our control and this Privacy Policy does not apply to them.
We may amend this Privacy Policy from time to time. The current version is always available on our Website and the date at the top of this policy will be updated. Where changes are material, we will give you reasonable advance notice by email or in-product notification before they take effect.
We collect the following categories of personal information. We will not use your personal information for a purpose other than one of these primary purposes (or a closely related secondary purpose you would reasonably expect) unless you consent, or we are required or authorised by law to do so.
Examples:
Why we collect it:
Examples:
Why we collect it:
Examples:
Why we collect it:
Examples:
Why we collect it:
Examples:
Why we collect it:
Examples:
Why we collect it:
Examples:
Why we collect it:
If you do not provide some of the information described above, or we cannot verify it, we may be unable to provide you with Paytime Services, verify your identity, comply with our legal obligations, or otherwise do business with you.
Some of the information we collect (for example, government identifiers, biometric information used in an identity check, or health information provided in support of a hardship request) is “sensitive information” under the Privacy Act. We collect sensitive information only where it is reasonably necessary for one of our functions or activities and either you have consented, or the collection is required or authorised by law. We will not use or disclose sensitive information for any purpose other than the purpose for which it was collected, unless you consent or an exception in the Privacy Act applies.
We collect personal information in the following ways:
We use personal information for the specific purposes set out in section 1. In summary, we use personal information to:
Paytime uses automated processes (for example, rules-based fraud monitoring and identity verification scoring) to support some decisions about the Paytime Services we provide to you. These automated processes inform human decision-makers; they are not, on their own, used to make decisions that significantly affect your rights or interests.
From 10 December 2026, the Privacy and Other Legislation Amendment Act 2024 will require us to publish additional information about any automated decision-making that does significantly affect individuals’ rights or interests (new APP 1.7). Ahead of that commencement, we are reviewing every decision in the Paytime Services pipeline and will update this section by that date. If we begin using automated decision-making within scope of APP 1.7 before then, we will tell you about it in this policy and in a collection notice.
We may disclose personal information to:
Your personal information is stored on Amazon Web Services infrastructure located in Sydney, Australia. Some of our service providers (for example, communications, support, analytics and security vendors) are located in, or may access information from, countries outside Australia, including the United States, the United Kingdom, the European Union, the Philippines and India. Before disclosing personal information to an overseas recipient, we take reasonable steps to ensure the recipient handles it in a way consistent with the APPs, either through contractual commitments or because the recipient is bound by a substantially similar privacy regime.
Where you have consented to a disclosure, or where the disclosure is required or authorised by Australian law, the additional accountability that APP 8.1 imposes on us may not apply. We will tell you, in a collection notice or in this policy, about any new categories of overseas recipient before we begin disclosing to them.
We retain personal information only for as long as we need it for the purposes set out in this policy, or for as long as we are required to retain it by law. As a financial services provider, we are required by laws including the Anti-Money Laundering and Counter-Terrorism Financing Act 2006 (Cth), the Corporations Act 2001 (Cth) and tax laws to retain certain transaction and identity records for up to seven years after the end of your relationship with us.
When personal information is no longer needed and we are not required to retain it, we will destroy it or de-identify it as soon as reasonably practicable. You can ask us to delete your personal information at any time using the contact details in section 14; we will tell you what we can delete, what we are required to keep, and for how long.
We take reasonable steps to protect personal information from misuse, interference, loss, and unauthorised access, modification or disclosure. Those reasonable steps include both technical and organisational measures, consistent with APP 11.3 as amended by the Privacy and Other Legislation Amendment Act 2024.
Technical measures include:
Organisational measures include:
Despite these measures, no system is impenetrable. If a data breach occurs, we will respond in accordance with our internal data-breach response plan and our obligations under the Notifiable Data Breaches scheme described in section 10.
Paytime is bound by the Notifiable Data Breaches (NDB) scheme in Part IIIC of the Privacy Act 1988 (Cth). The scheme applies to all APP entities, including Paytime as a financial services provider.
If we have reasonable grounds to suspect that an eligible data breach has occurred, we will:
The notification will include our name and contact details, a description of the breach, the kinds of personal information involved, and the steps we recommend you take in response. You can read more about the NDB scheme on the OAIC website at oaic.gov.au/privacy/notifiable-data-breaches.
You can ask us, at any time, to give you access to the personal information we hold about you, to correct it, or to delete it. You do not need to use any particular form, but giving us the following information helps us respond quickly:
We may need to verify your identity before we act on the request, particularly for access and deletion requests. We will use the least intrusive method of verification reasonably available.
Our Privacy Officer is responsible for responding to privacy requests and complaints. Please put “Privacy request” in the subject line of any email so it is routed to the right place.
Access to your personal information (APP 12)
We will acknowledge your request within 7 days and give you access within 30 days of receiving enough information to identify you. We will not charge you to make the request. If we charge to give you access (for example, where the volume of information makes this necessary), the charge will be reasonable and we will tell you what it will be before we incur it.
Correction of inaccurate information (APP 13)
We will acknowledge your request within 7 days and correct the information, free of charge, within 30 days. If we have disclosed the incorrect information to a third party (e.g. your employer), we will, on your request, take reasonable steps to notify them of the correction.
Deletion of your personal information
We will delete or de-identify your personal information when it is no longer needed for any purpose described in this policy, unless we are required by law to retain it (for example, transaction records retained under tax or AML/CTF laws). You can ask us to delete your data at any time; we will tell you what we are able to delete and what we are required to keep, and why.
Statement attached to your record if we refuse to correct
If we do not agree that the information should be corrected, we will tell you why in writing. On your request, we will associate a statement with the information noting that you consider it to be inaccurate, out of date, incomplete, irrelevant or misleading.
If we refuse your request
If we refuse access or correction, we will give you written reasons (except where giving reasons would itself be unreasonable), and tell you how to complain.
If you think we have breached the Privacy Act or the APPs, or you are unhappy with how we have handled your personal information, please tell us. Email your complaint to info@paytime.com.au or write to the Privacy Officer at the postal address above. Our process is:
If you are still not satisfied, you can complain to the Office of the Australian Information Commissioner (OAIC):
Since 10 June 2025, individuals also have a statutory cause of action for serious invasions of privacy under Schedule 2 to the Privacy Act. This is a separate right that you may be able to enforce in court, in addition to the OAIC complaints process. We mention it here for completeness; we encourage you to raise concerns with us first so we have an opportunity to put things right.
We may send you marketing material about Paytime products, and the products of our Partners, using the contact details you have provided. You can opt out at any time by:
We will action electronic marketing opt-outs within 5 business days and other marketing requests within 30 days. Even after you opt out, we will still send you transactional and service messages (for example, payment confirmations, security alerts and important account notices).
When you visit our Websites or use Paytime Services, we and our service providers place cookies, pixels, local storage and similar technologies on your device. We use them to:
We use Google Analytics and may use other analytics providers. We do not share information that directly identifies you with Google or other analytics providers. You can control cookies through your browser settings or through any in-product cookie controls we provide. Blocking cookies may affect the functionality of the Websites.
Most browsers offer a “Do Not Track” signal. The interpretation of that signal across the industry is not uniform; we currently do not respond differently to “Do Not Track” signals, but we treat the opt-out controls described above as effective expressions of your preference.
Privacy Officer, Paytime Services Pty Ltd
We aim to acknowledge all privacy-related enquiries within 7 days.
Paytime Services Pty Ltd ACN 647 450 137
