1. bolttech Privacy Notice

bolttech Digital Services ANZ Pty Ltd and bolttech Brokerage ANZ Pty Ltd (together, “bolttech”, “we”, “us” or “our”) are committed to protecting your privacy in accordance with the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs) and other applicable laws and regulations as amended, replaced or superseded from time-to-time. For Australian privacy purposes, the APP entity or entities responsible for the relevant handling of personal information are identified in the applicable collection notice.

In this Notice, you can find out more about:

• How and when we collect personal information, the types of personal information we collect and the purposes for which personal information is collected
• Direct Marketing and how you can manage your marketing preferences
• How we share information within bolttech and with our service providers, regulators and other third parties
• Overseas disclosure of personal information
• Cookies and third-party links
• How we store and protect personal information
• Accessing or correcting your personal information
• Modifications to this Notice
• How you can contact us for more support and our complaints process.

Personal Information is information or an opinion about an identified individual, or an individual who is reasonably identifiable:

• a) whether the information or opinion is true or not;
• b) whether the information or opinion is recorded in a material form or not.

It includes Sensitive Information as defined in the Privacy Act which includes, amongst other things, information about an individual’s racial or ethnic origin, political opinions, membership of a political organisation, religious beliefs or affiliations, philosophical beliefs, membership of a professional or trade association, membership of a trade union, sexual orientation or practices, criminal record, health information about an individual, genetic information, biometric information or templates.

2. How and when we collect personal information

We only collect personal information by lawful and fair means and where it is reasonably necessary for, or directly related to, one or more of our functions or activities. Unless it is unreasonable or impracticable for us to do so, or as provided otherwise under this Privacy Policy, we will collect your information directly from you or your representatives. If we collect details about you from someone else, we will, take reasonable steps to make you aware of the collection in accordance with the APPs.

We may collect personal information indirectly and who it is from can depend on the circumstances. We will usually obtain it from related bodies corporate, referrals, your previous insurers or insurance intermediaries, witnesses to claims, health care workers, publicly available sources, premium funders and persons who we enter into business alliances with. We attempt to limit the collection and use of sensitive information from you unless we are required to do so in order to carry out the services provided to you. However, we do not collect sensitive information without your consent. Where practicable, the applicable collection notice will identify the relevant source or category of source and the purposes for which the information is collected.

We usually collect personal information about you if you:

• use one of our websites or online services, you are a registered user, or you choose to register on our websites (Website Users);
• obtain one of our services (Customers); or
• work with us as a business partner (Business Partners).

We may use artificial intelligence and automated technologies in connection with our functions and activities, including to support customer service, operational processes, fraud detection, claims administration, analytics, quality assurance and other business processes. Where AI or automated technologies process personal information, we will do so in accordance with applicable privacy and other laws, including requirements concerning collection, use, disclosure, security and overseas disclosure. We will not use sensitive information in an AI system unless the collection and use is permitted under the Privacy Act and our applicable controls and notices. Where an external AI provider processes personal information on our behalf, we will assess and manage the provider consistently with our privacy, security and contractual requirements.

3. The types of personal information we collect and hold and how we use personal information

We will use personal information only for the purposes described in the applicable collection notice, or otherwise as permitted or required by law.

Website Users

When you use our website, bolttech collects metadata that results from your usage of our websites including referral page, date and time of access, type of web browser, IP-address, geographic location as determined by your IP address, operating system and interface, language and version of browser software, session information (such as download errors and page response times).

Your IP address will be used to enable your access to our websites. The metadata will be used to improve the quality and services of our websites by analyzing the usage behavior of our users.

If you commence direct communications via our websites enquiry form, by telephone or writing to us, the nature of the enquiry (e.g., as tick box selection from service type/careers/other) and your message will also be collected and handled to respond to your communications and to improve our services. If you are a registered user or choose to register on a bolttech website, you may be asked to provide the following personal information about you: first and last name, work phone number, company name, email address, personal telephone number, address, and primary usage.

Bolttech will handle this personal information to provide you with the services for registered users, verify the legitimacy of your account, to avoid fraudulent accounts being opened, provide you with the products and services requested by you, customer support, contact forms, marketing materials as selected by you, inform you about system issues, comply with legal obligations, and defend, establish and exercise legal claims.

The personal information collected from Website Users is also used to personalize your experience of our websites. We may use such information in the aggregate to understand how you use our services and the resources provided on our websites. We may also use the feedback you provide to improve our services.

Customers

If you obtain products or services from or through bolttech, you may be asked to provide, among other things, the following personal information about you (including your representative and/or your contact person):

• Information about you (such as name, gender, nationality, race, occupation), contact information (such as residential address, email address, mobile phone number), family background (such as spouse and children’s information)
• Information about your product (such as make, model, device ID, and purchase date)
• Your health and medical information (such as pre-existing medical condition, medical history, health records)
• Your financial information (such as credit card details, bank account number)
• Your account user information (such as user name, password)
• Your personal government-issued identification document numbers such as government-issued identification information, including driver’s licence numbers, passport numbers, Medicare identifiers and other identification information reasonably required to verify identity or comply with legal requirements
• Your other information relevant to your insurance application or claim (such as motor vehicle licence number, photos, videos, travel history, device information, previous claim history)
• Your CCTV images when you visit our offices
• Your academic and employment history, professional and work experience, and other relevant information usually provided in the Curriculum Vitae

bolttech will use such personal information to handle your order, deliver the products or services ordered, provide customer care services, provide you with marketing materials as selected by you, provide you with bolttech updates and/or newsletters, to maintain our client relationship management systems, to investigate any complaint you may make, provide evidence in any dispute or anticipated dispute between you and us, to detect, investigate, report and seek to prevent fraud and anti-money laundering, for example through know-your-customer (KYC) checks, anti-money laundering (AML) and counter terrorism financing (CTF), economic and financial sanctions screening and other identity checks, comply with other legal obligations, defend, establish and exercise legal claims, and aggregate it on an anonymous basis with other data for data analytic and reporting purposes. We may also need to conduct credit and fraud checks on business customers and certain officers of your business, such as your directors.

In addition to the above and in connection with device protection programmes, we may collect, use and handle your personal information for the following purposes:

• administering and operating the device protection programme, including enrolment, eligibility checks and account management;
• providing/facilitating device repair, replacement and support services;
• coordinating with manufacturers and authorised service providers for diagnosis, repair and fulfilment;
• facilitating, administering and verifying insurance claims, including collecting repair information, repair costs and deductible amounts;
• sharing such information with insurers to enable the assessment and payment of claims, including direct payment to service providers;
• enabling a “cashless” repair experience where applicable;
• handling customer service, complaints, and regulatory obligations;
• complying with applicable legal and regulatory requirements, including the Privacy Act 1988 (Cth) and other applicable Australian laws.

Business Partners

If you work with us as a Business Partner or a service provider, we will collect personal information from you, your representative and/or your contact person such as your full name, job title, email address, phone number.

Most of the personal information is obtained directly from you. In addition, we will collect personal information from other public sources such as credit reference agencies.

We use this information to review/assess your suitability as a Business Partner or service provider, to comply with our legal obligations, to detect investigate, report, and seek to prevent fraud and anti-money laundering, for example through know-your-customer (KYC) checks, economic and financial sanctions screening and other identity checks and to meet our obligations under any contracts we have with you, we may also need to conduct credit and fraud checks on your business and certain officers of your business, such as directors.

What if you do not provide some personal information or your consent to us?

If you do not provide personal information that is reasonably necessary for us to provide a product or service, we may be unable to provide that product or service. Where we require your consent for a particular collection, use or disclosure, we will explain the purpose of the consent and the consequences of not providing it.

4. Emails

If you send to, or receive emails from us, we may monitor their content to ensure compliance with our internal policies and to protect our business.

5. How we manage the collection and handling of your personal information

bolttech collects, holds, uses and discloses personal information where reasonably necessary for its functions or activities, with consent where required or appropriate, and otherwise as permitted or required by law. We notify individuals of the purposes of collection at or before the time of collection, including by providing a link to this Notice.

If you engage with us on behalf of another individual, you must first obtain consent or otherwise demonstrate that you are authorised to act on behalf of that individual in order for us to collect, use or disclose their personal information.

When you provide us with personal information about other individuals, we rely on you to have made them aware that you will or may provide their information to us, how we collect, use, disclose and handle it in accordance with this Privacy Policy and our relevant Privacy Statements. If it is sensitive information we rely on you to have obtained their consent to the above.

If we give you personal information, you must only use it for the purposes we agreed to.

Unless otherwise agreed, you must meet the requirements of the Privacy Act, when collecting, using, disclosing and handling personal information on our behalf.

You must also ensure that your representatives, employees and contractors meet the above requirements.

If you have not done or will not do these things, you must tell us before you provide us with the relevant information.

You may contact us to withdraw your consent upon reasonable notice by contacting us through the bolttech Data Subject Request Web Portal or [email protected]. Please be aware that by withdrawing your consent you may no longer receive important information from us about our products or services, and in certain circumstances we may no longer be able to offer you our services at all.

6. Direct marketing and how you can manage your marketing preferences

How we use personal information to keep you up to date with our products and services

We may use personal information to let you know about our products or services that we believe will be of interest to you and/or provide you with our newsletters. We may contact you by email, post, or telephone or through other communication channels that we think you may find helpful. In all cases, we will respect your preferences for how you would like us to manage marketing activity with you.

We will use or disclose personal information for direct marketing only where permitted by APP 7 and other applicable laws, including the Spam Act 2003 (Cth) and the Do Not Call Register Act 2006 (Cth), as applicable.

How you can manage your marketing preferences

To protect privacy rights and to ensure you have control over how we manage marketing with you:

• we will take steps to limit direct marketing to a reasonable and proportionate level and bolttech will only send you communications which we believe may be of interest or relevance to you;
• you can ask us to stop direct marketing at any time. You can ask us to stop sending email marketing, by following the “unsubscribe” link you will find on all the email marketing messages we send you. Alternatively, you can submit a request through the bolttech Data Subject Request Web Portal or by email to [email protected]. Please specify whether you would like us to stop all forms of marketing or just a particular type (e.g. email); and
• you can change the way your browser manages cookies, which may be used to deliver online advertising, by following the settings on your browser as explained in the section on Cookies.

We do not use sensitive information to send you direct marketing communications without your express consent.

We will comply with the Spam Act 2003 (Cth) when sending electronic marketing communications.

7. How we share information within bolttech group and with our service providers, regulators and other third parties

We share your personal information in the manner and for the purposes described below:

• With other bolttech entities within our group: Your personal information will be received by different recipients such as other bolttech entities. We make such transfers where it is necessary to provide you with our products or services or to manage our business.
• With third parties who help manage our business and deliver services: bolttech engages external service providers such as legal services, website service providers, marketing service providers, IT support service providers, email administrators, payment processors, insurance companies, reinsurance companies, insurance intermediaries, credit providers, insurance reference bureaus, loss adjuster or assessors, banks, underwriters, repair service providers, manufacturers, distribution partners (including retailers, telcos or platform providers, where relevant to your subscription), logistics companies, and customer service providers. When providing such services, the external service providers may have access to and handle your personal information. We request those external service providers to implement and apply security safeguards to ensure the privacy and security of your personal information. These third parties have agreed to confidentiality restrictions and to use of any personal information we share with them or which they collect on our behalf solely for the purpose of providing the contracted service to us.
• With clinics and hospitals.
• Where bolttech is acting as a broker or a data processor for a third party, your personal information may be shared with the insurer and/or business partner for the purposes of enrolling you in the service and handling your claim and otherwise facilitating the business relationship (such as invoicing or reporting on product or financial performance).
• With regulatory authorities and government agencies e.g. Australian Securities and Investments Commission (ASIC), Australian Prudential Regulation Authority (APRA), Australian Transaction Reports and Analysis Centre (AUSTRAC), the Office of the Australian Information Commissioner (OAIC), courts, tribunals and other government authorities.
• In the event of a corporate merger and acquisition, your personal information may be provided in relation to that merger and acquisition (e.g as part of due diligence) and ultimately transferred to the relevant party on in accordance with applicable law.

We will take reasonable steps to ensure that recipients use personal information only for the purposes for which it was disclosed or as otherwise permitted by law.

8. Overseas disclosure of personal information

The personal information that we collect or receive about you may be transferred to and handled by recipients who are located within and outside of Australia (such as our offices in Singapore, Malaysia, Hong Kong, or the EU), where the level of data protection may not be equivalent to the level of protection applicable in Australia. You can contact us for details. Where bolttech discloses personal information to overseas recipients, bolttech will take reasonable steps in the circumstances to ensure those recipients handle the personal information in a manner consistent with the APPs. This may include entering into contractual arrangements with overseas recipients. However, you should be aware that overseas recipients may be subject to different laws from those applying in Australia, and in some cases Australian privacy law may not require an overseas recipient to handle your personal information in a manner consistent with the Privacy Act 1988 (Cth).

9. Cookies

A cookie is a small piece of data (text file) that a website – when visited by a user – asks your browser to store on your device in order to remember information about you, such as your language preference or login information. Those cookies are set by us and called first-party cookies. We also use third-party cookies – which are cookies from a domain different than the domain of the website you are visiting – for our advertising and marketing efforts.

Our Australian website may use cookies and similar technologies. The types of cookies, providers, purposes and retention periods used on the Australian website are described in our current cookie notice/consent tool.

Strictly Necessary Cookies

These cookies are necessary for the website to function and cannot be switched off in our systems. They are usually only set in response to actions made by you which amount to a request for services, such as setting your privacy preferences, logging in or filling in forms. You can set your browser to block or alert you about these cookies, but some parts of the site will not then work. These cookies do not store any personally identifiable information.

Performance Cookies

These cookies allow us to count visits and traffic sources so we can measure and improve the performance of our site. They help us to know which pages are the most and least popular and see how visitors move around the site. All information these cookies collect is aggregated and therefore anonymous. If you do not allow these cookies we will not know when you have visited our site, and will not be able to monitor its performance.

Targeting Cookies

These cookies may be set through our site by our advertising partners. They may be used by those companies to build a profile of your interests and show you relevant adverts on other sites. They do not store directly personal information, but are based on uniquely identifying your browser and internet device. If you do not allow these cookies, you will experience less targeted advertising.

10. Third-party links

Our websites contain links to websites operated and maintained by third parties over which bolttech has no control. Any information you provide to third-party websites will be governed under the terms of each website’s privacy policy, and we encourage you to investigate and ask questions before disclosing any information to the operators of third-party websites. We have no responsibility or liability whatsoever for the content, actions, or policies of third-party websites. The inclusion of third-party websites on our site in no way constitutes an endorsement of such websites’ content, actions, or policies.

11. How we store and protect personal information

How long does bolttech keep your personal information?

In line with our data retention policies, we will only retain your personal information for as long as reasonably necessary to fulfil the purposes we collected it for, including for the purposes of satisfying any legal, regulatory, tax, accounting or reporting requirements. We may retain your personal information for a longer period in the event of a complaint or if we reasonably believe there is a prospect of litigation in respect to our relationship with you or as otherwise permitted or required by applicable law.

To determine the appropriate retention period for personal information, we consider the amount, nature and sensitivity of the personal information, the potential risk of harm from unauthorised use or disclosure of your personal information, the purposes for which we handle your personal information and whether we can achieve those purposes through other means, and the applicable legal, regulatory, tax, accounting or other requirements.

Details of retention periods for different aspects of your personal information are available in our retention policy. For queries about bolttech data retention processes please submit an Information Request through the bolttech Data Subject Request Web Portal or by contacting [email protected].

In some circumstances we will anonymise your personal information (so that it can no longer be associated with you) for research or statistical purposes, in which case we may retain this information indefinitely without further notice to you.

We take reasonable steps to ensure that your personal information is safe. We have adopted appropriate data collection, storage and handling practices, technical, organisational and security measures designed to protect against unauthorised access, alteration, disclosure or destruction of the personal information that you share with us. For example, such measures include:

• placing confidentiality requirements on our staff members and service providers;
• permanently removing personal information if it is no longer needed for the purposes for which it was collected;
• following security procedures in the storage and disclosure of your personal information to prevent unauthorised access to it; and
• using secure communication channels such as SSL (“secure sockets layer”) for transmitting data that is sent to us. SSL is an industry standard encryption protocol used to protect online transaction channels.

As the security of information depends in part on the security of the computer you use to communicate with us and the security you use to protect user IDs and passwords, please take appropriate measures to protect this information.

Where required by law, we will notify affected individuals and the Office of the Australian Information Commissioner of eligible data breaches in accordance with the Notifiable Data Breaches scheme under the Privacy Act 1988 (Cth).

12. Accessing or correcting your personal information

We will take steps in accordance with applicable legislation to keep your personal information accurate, complete and up-to-date. Depending on the purposes of the handling, you have the right to have incomplete personal information completed, including by means of providing a supplementary statement. You also have the right to request access to your personal information as well as additional information about the handling and to request us to erase the personal information we hold about you that is inaccurate, out of date, incomplete, irrelevant or misleading. We will deal with access and correction requests in accordance with the Privacy Act and applicable exceptions. We may also delete or de-identify information where appropriate, but the Privacy Act does not provide a general right to erasure.

To make a request to access or correct your personal information, please visit the bolttech Data Subject Request Web Portal or contact [email protected]. We endeavor to fulfil data subject request within 30 days of their receipt and verification of the individual.

We may ask you for additional information to confirm your identity and for security purposes, before disclosing the personal information requested to you. We reserve the right to charge a fee where permitted by law, and may do so, for example, in cases where giving access would impose an unreasonable burden in the circumstances or is otherwise chargeable under applicable law.

We may not always be able to fully address your request, for example if it would impact the duty of confidentiality we owe to others, or if we are legally entitled to deal with the request in a different way.

Where lawful and practicable, you may choose to deal with us anonymously or by using a pseudonym. This may not be practicable where we need to identify you, administer an insurance product or claim, prevent fraud, comply with law, or perform other functions that require identification.

13. Modifications to this notice

bolttech reserves the right to change this Notice at any time. Any changes to this Notice will be effective immediately upon notice, by posting the latest version on our websites.

14. Contact us

If you have any questions, concerns or complaints regarding our compliance with this Notice, the information we hold about you or if you wish to exercise your rights, we encourage you to first submit an Information Request or File a Complaint through the bolttech Data Subject Request Web Portal or contact [email protected].

We will acknowledge and handle privacy complaints in accordance with our privacy complaints procedure and applicable legal requirements, and will endeavour to respond within a reasonable period and within the applicable statutory timeframe.

If you believe we have breached the Privacy Act 1988 (Cth) or the Australian Privacy Principles, you may lodge a complaint with us using the contact details above.

We will investigate your complaint and respond within a reasonable period.

If you are dissatisfied with our response, you may contact the Office of the Australian Information Commissioner (OAIC).