Beforepay | Privacy Policy - we are committed to protecting you

Our Privacy Policy

1. About Us

Beforepay Group Limited (ACN 633 925 505) and its wholly owned subsidiaries - Beforepay Finance Pty Ltd (ACN 636 670 525), Beforepay Ops Pty Ltd (ACN 633 930 159), BPG Credit Pty Ltd (ACN 673 570 575) is a mission driven organisation that aims to provide safe and affordable financial products to customers in Australia and AI-powered credit decisioning and lending solutions to customers around the world.

Any reference to:

"we", "us" , "our" or “Beforepay” should be understood as a reference to Beforepay Group Limited or the other subsidiaries within the group; and
"you" or "your '' should be understood as a reference to a data subject whose personal information we control or process for the purposes described in this privacy policy.

2. About this Policy

This Policy sets out how we collect, use, store and disclose your personal information. By ‘personal information’ we mean information that is associated with a specific person and can be used to reasonably identify that person. Personal information does not include information that has been made anonymous, and cannot reasonably identify a specific person. We are committed to respecting the privacy of your personal information.

We are bound by the Australian Privacy Principles (“APPs”) and the Privacy Act 1988 (Cth) (“Privacy Act”) for personal information relating to Australian customers, the General Data Protection Regulation (“GDPR”) for personal information relating to UK/EU customers, and the California Consumer Privacy Act (“CCPA”) for personal information relating to California customers.

We may change this Policy from time to time. The updated version will be available by following the ‘Privacy Policy’ link on our website. We encourage you to check our website periodically to ensure that you are aware of our current Privacy Policy.

3. What personal information do we collect?

The types of personal information we may collect includes the following:

Types of personal information	What kinds of personal information might be involved
Personal and contact information	This includes your name, address, email address, phone number, and date of birth.
Australian Government related identifiers	This includes your Medicare card, Australian passport, driver licence, citizenship and birth certificates. Please note that we will only collect and use your Australian Government related identifiers where it is reasonably necessary to verify your identity or as required by Australian law or a court/tribunal order.
Financial and transaction information	This includes details of your current and previous employment, bank account, income and transactions.
Behavioral information	This includes information that we generate about how you use our products and services. For example, if you use our budgeting and expense tools, we may generate information about your spending patterns.
Sensitive information	On occasion, we may collect and use your sensitive information. This may include health information where it is relevant to a claim for financial hardship. We will only collect and use sensitive information when it is reasonably necessary and where we have your consent.
Information about your personal circumstances	On occasion, we may ask you to provide information about your personal circumstances where it is relevant to a claim for financial hardship. This may include information about significant life events, where you have been impacted by an emergency event or a natural disaster, any unexpected changes to your financial situation, and details of injury, illness, gambling or addiction.
Interaction information	This includes details of your interaction with us, including details of the products and services we provide to you or that you have enquired, provided feedback or lodged a complaint about. It may also include any additional information necessary to deliver those products and services and respond to your enquiries, feedback and complaints.
Digital information	We collect digital information from you when you use our mobile applications and website. This may include your device ID, device type, geo-location information, computer and connection information, app use data, statistics on page views, traffic to and from the sites, advertising source, IP address and standard web log information.

‘Addendum 1 Additional information for individuals in the UK/EU’ details the legal basis for the collection and use of personal information for individuals based on the UK/EU.

4. Trends and derived information

We may compile, derive, and draw aggregate insights from the categories above. This data might be supplemented and enhanced from other sources to provide additional and/or more relevant insights for uses outlined in this Privacy Policy. The data we compile may be shared with associated entities and then enhanced with additional third party data. When we produce insights that we share with third parties from your data, we do so on an aggregated, anonymous basis.

5. How do we collect personal information?

We may collect your personal information either directly from you, or indirectly from third parties or our clients.

We may collect this information when you:

create an account with Beforepay via our mobile application or website and access or use our financial products and services, including our budgeting and expense tools;
use our websites to understand our products, contacting us or accessing our blog articles;
use the services offered by one or more of our clients that use our AI-powered credit decisioning and lending solutions and share your personal information with us;
register to receive emails about our products, services and events.

If you do not provide the information requested by us, we may not be able to provide you with our products and services.

There may be occasions when information is collected from third parties for example through our business partners, third party identity verification services providers or from publicly or commercially available sources for the purposes of complying with applicable laws and regulations, for example, anti-money laundering laws.

We may also collect personal information if you enter a promotion we run or if you apply for employment with us either directly or through a recruitment or employment agency.

We may also collect the personal information of our third party service providers and their staff during the course of our business activities. This information may include your name, contact details and position. We will collect this information directly from you, or from the applicable third party service provider.

6. Why do we collect your personal information?

Beforepay only collects your personal information to provide our products and services to you, including to enable us to verify your identity and details so we can provide our service to you, where it is otherwise reasonably necessary for our business activities (including those business activities described in this Privacy Policy), for any required regulatory or legal disclosure, any other purpose you have consented to and any other purpose permitted under the Privacy Act and APPs.

We may enter into arrangements with related body corporates and/or third parties to enrich data and produce insights for our partners or for the general public. Any insights are aggregated, anonymised information . No personally identifiable information is shared.

7. How do we use your personal information?

Beforepay only uses your personal information for the purpose for which it has been provided, where it is otherwise reasonably necessary for our business activities, any other purpose you have consented to and any other purpose permitted under the Privacy Act and APPs. This may include using your personal information for the following purposes:

to enable you to access and use our products and services;
to be used for identity verification purposes, which may involve the use of third-party systems;
to operate, protect, improve and optimise our website, app, business and our users’ experience, such as to perform analytics, conduct research and for advertising and marketing;
to send you service, support and administrative messages, reminders, technical notices, updates, security alerts, and information requested by you;
to send you marketing and promotional messages and other information that may be of interest to you, including information sent by, or on behalf of, our business partners that we think you may find interesting; and
to comply with our legal and regulatory obligations, resolve any disputes that we may have with any of our users, and enforce our agreements with third parties;
to consider you for a position with Beforepay for which you have applied;
to acquire goods or services from you or from your employer;
to create aggregated, anonymized insights for our partners or for the general public, without sharing any personally identifiable information;
to merge, contribute to, and enrich datasets of Beforepay, third parties, or partners to create insights and services;
for other purposes for which you have consented;
as required or permitted by relevant laws and regulations; and
for statistical and analytical purposes to enhance the products and services offered by Beforepay, partners, and/or third parties, including comparative data.

By agreeing to our Privacy Policy, you agree that we may use your personal information for the purposes for which we collect it and for related purposes which would be reasonably expected of you.

8. Do we use your personal information for direct marketing?

From time to time, we and/or our carefully selected business partners may send you direct marketing communications and information about our products and services that we think may be of interest and value to you.

This may take the form of emails, SMS, mail or other forms of communication, in accordance with the Spam Act 2003 (Cth), Privacy Act and APPs. By providing us with your personal information, you consent to us and our business partners using your information to contact you on an ongoing basis for this purpose, including by mail, email, SMS and telephone.

If you do not wish to receive direct marketing communications from us, you may opt-out by contacting us using the details at the bottom of this page or by using the opt-out facilities provided in the relevant communication(e.g., an unsubscribe link).

To whom do we disclose your personal information?

We may disclose personal information for the purposes described in this Privacy Policy to:

our employees and related bodies corporate;
your agents;
existing or potential third party suppliers and service providers, including providers for the operation of our websites and/or our business or in connection with providing our products and services to you, provided that any potential third parties suppliers and service providers agree that they will keep the information confidential and comply with privacy laws in relation to any data provided by Beforepay;
professional advisers, dealers and agents;
payment systems operators (e.g. merchants receiving card payments);
anyone to whom our assets or businesses (or any part of them) are transferred;
Beforepay related body corporates and/or third parties we have entered into a commercial relationship with to share data in order to produce insights as part of our business activities, provided that the related body corporate and/or third parties agree that they will keep the information confidential and comply with privacy laws in relation to any data provided by Beforepay;
specific third parties authorised by you to receive information held by us; and/or
other persons, including government agencies, regulatory bodies and law enforcement agencies, or as required, authorised or permitted by law.

We may also disclose your personal information to a trusted third party who also holds other information about you, for example where our third party providers provide data aggregation services or identity verification services for which you are a customer. This third party may combine that information in order to enable it and us to develop anonymised consumer insights so that we can better understand your preferences and interests, personalise your experience and enhance the products and services that you receive.

We will only disclose your personal information with third parties as described in this Privacy Policy or as otherwise notified to you at the time of collection or with your consent.

9. Disclosure of personal information outside Australia

We may disclose personal information outside of Australia to our partners and third party service providers located in the Philippines, Sri Lanka, India, Serbia, Ukraine, Germany, Canada, Bangladesh, US and the UK. When we disclose your personal information overseas, we will take all reasonable steps to ensure that your personal information is held, managed and accessed in accordance with appropriate standards for the handling of personal information.

10. Cookies and third party analytics services

We use ‘cookies’ or other similar tracking technologies on our website to help us improve our products and services and enhance your user experience. When you access our website or use our products and services, we and/or our third party service providers place small files on your computer, mobile or other device that store information about your internet browsing activity. We use cookies to ascertain which web pages are visited and how often, to make our website more user friendly, to give you a better experience when you return to our website and to target advertising to you that we think you may be interested in.

In addition to using cookies or other similar tracking technologies, we may also use third party analytics services to measure and analyse the effectiveness of our marketing campaigns, assess risk, optimise experiences, and understand usage.

We handle any personal information collected by cookies, other similar tracking technologies or third party analytics services in the same way that we handle all other personal information in accordance with this Privacy Policy.

‘Addendum 1 Additional information for individuals in the UK/EU’ to this Policy details the types of cookies we may collect from individuals based in the UK/EU.

11. Security

We hold your personal information in electronic form and may store your personal information with trusted third-party service providers. We take reasonable steps to protect your personal information from misuse, interference and loss, as well as unauthorised access, modification or disclosure. We use a number of physical, administrative, personnel and technical measures to protect your personal information.

Measures we take to protect your personal information include:

using appropriate information technology and processes;
restricting access to your personal information to our employees and those who perform services for us who need your personal information to do what we have engaged them to do;
using computer and network security systems with appropriate firewalls, encryption technology and passwords for the protection of electronic files; and
securely destroying or “de-identifying” personal information if we no longer require it subject to our legal obligations to keep some information for certain prescribed periods.

We do our best to protect the security of your personal information.

12. Links

Our website, apps, and platforms may contain links to websites operated by third parties. Those links are provided for convenience and may not remain current or be maintained. Unless expressly stated otherwise, we are not responsible for the privacy practices of, or any content on, those linked websites, and have no control over or rights in those linked websites. The privacy policies that apply to those other websites may differ substantially from our Privacy Policy, so we encourage you to read them before using those websites.

13. Accessing or correcting your personal information

You can access the personal information we hold about you by contacting us using the details at the bottom of this page. Sometimes, we may not be able to provide you with access to all of your personal information and, where this is the case, we will tell you why. We may also need to verify your identity when you request your personal information.

If you think that any personal information we hold about you is inaccurate, incomplete or out-of-date please contact us and we will take reasonable steps to ensure that it is corrected and/or updated. We will generally rely on you to assist us in informing us if the personal information we hold about you is inaccurate, incomplete or out-of-date.

14. Making a complaint and correcting your information

If you think we have breached the Privacy Act or APPs, or you wish to make a complaint about the way we have handled your personal information, you can contact us using the details at the bottom of this page.

If you think that we have failed to resolve the complaint satisfactorily, you can lodge a complaint through the Office of the Australian Information Commissioner (if your complaint is about your privacy) or the Australian Financial Complaints Authority using the details at the bottom of this page.

15. Referral program

Beforepay allows users to invite friends and family to sign up for its products and services. Sometimes we offer a promotional value for every friend or family member who signs up through your referral link or code. To help you do this, we may request you to grant us access to your mobile device address book. You can then direct us to send referral messages to contacts you select in your address book. By sending a referral, you also consent to Beforepay sending your public profile image to the contacts you select to receive a referral link. By choosing to invite a friend you represent that you have received the friend’s consent to provide their email address and/or phone number with us. Beforepay will use that information to send an email inviting him or her to visit the site and will store that information to track the success of the referral program and may send marketing emails. You can also send an SMS with a referral link or code to your contacts. If you use this option, you understand that Beforepay does not control the timing, content, or recipients of these SMS messages.

Users may not send, publish, or share any false, misleading, or deceptive communications in connection with participation in the Referral Program. Users may not send any referral emails, SMS messages, or other communications to persons under the age of 18.

If you are referred to Beforepay through one of our referral programs, or if someone attempts to refer you, we may contact you using the details provided to us, whether you have already signed up for Beforepay or not.

16. For more information

If you have any questions or would like us to use your data in a more limited way than described in this Privacy Policy, please contact us at privacy@beforepay.com.au.

For further information about our Privacy Policy or practices, or to access or correct your personal information, or make a complaint, please contact us using the details set out below:

Beforepay Group Limited (formerly Cheq Limited)

Email: privacy@beforepay.com.au

Mail: Suite 1.09, 77 Castlereagh Street, Sydney NSW 2000

Office of the Australian Information Commissioner

Visit: www.oaic.gov.au

Email: enquiries@oaic.gov.au

Phone: 1300 363 992

Mail: GPO Box 5218, Sydney NSW 2001

Australian Financial Complaints Authority

Visit: www.afca.org.au

Email: info@afca.org.au

Phone: 1800 931 678 (free call)

Mail: GPO Box 3, Melbourne VIC 3001

Addendum 1 - Additional information for individuals in the UK/EU

1. Legal basis for collection and use of your personal information as a Data Controller

In this section, we describe our legal justifications (commonly referred to as “legal basis”) for the collection and use of your personal information. This section is relevant when we collect your personal information for services offered via Carrington Labs, our AI-powered credit decisioning and lending solutions business.

Based on our contract with our clients:
- We may collect your personal information to provide our services to our clients, and to meet our responsibilities under the applicable contracts that we have in place with our clients. Generally, if we cannot obtain the necessary personal information from you in this context, we may not be able to provide our client with our products and services.
- We may also use your personal information to resolve any issues that our clients may have with our products or services.
Based on your prior consent (where permitted or required by law)
- We may use your personal information in the context of marketing and sales to propose similar offers or inform you about upcoming products and send newsletters. From time to time, we and/or our carefully selected business partners may send you direct marketing communications and information about our products and services that we think may be of interest and value to you. By providing us with your personal information, you consent to us and our business partners using your information to contact you on an ongoing basis for this purpose, including by mail, email, SMS and telephone.

- If you share your contact details with us, e.g by completing the “Contact Us” form on our website or sharing them with a Carrington Labs/Beforepay representative at an event, we will process your personal information to register your details and contact you based on your request, which is in our legitimate interest.

- If you interact with us on our social media pages, we will process your personal information as joint controllers with the social media provider and to respond to your request and record the interaction. This is our legitimate interest, to ensure that we respond to your demands and feedback and improve our product and service offerings.

- When you interact with our websites or use our products and services, we collect and use ‘cookies’ or other similar tracking technologies on our website to help us improve our services and enhance your experience. The cookies management and consent process is described in Section 4 below.

Promoting the security of our services

We use your Personal Data to monitor the use of our websites and services, verifying accounts and user activity, investigating suspicious activity, and enforcing our information security policies. We carry out these activities pursuing our legitimate interest in promoting the security of the services, websites, systems, applications and premises, and in protecting our rights and the rights of others.

To comply with our legal obligations and for legal and administrative purposes

To comply with our legal and regulatory obligations and for legal and administrative purposes such as, verifying and processing payment, screening against fraud, money laundering and other criminal or unlawful activities, accounting, billing and audit purposes, developing, maintaining and testing our systems, and for understanding, exercising, enforcing or protecting our legal rights and those of others.

2. Cookies

Types of cookies used by Beforepay:

Strictly Necessary Cookies

Strictly Necessary cookies are required to enable the basic features of our websites, such as providing secure log-in or adjusting your consent preferences. These cookies do not store any personally identifiable data.

Functional Cookies

Functional Cookies enable us to analyse the use of the website in order to measure and improve performance. Functional cookies help perform certain functionalities like sharing the content of the website on social media platforms, collecting feedback, and other third-party features.

Analytics Cookies

Analytical cookies are used to understand how visitors interact with the website. These cookies help provide information on metrics such as the number of visitors, bounce rate, traffic source, etc.

Performance Cookies

Performance cookies are used to understand and analyse the key performance indexes of the website which helps in delivering a better user experience for the visitors.

Advertisement Cookies

Advertisement cookies are used to provide visitors with customised advertisements based on the pages you visited previously and to analyse the effectiveness of the ad campaigns.

Uncategorised Cookies

Other uncategorised cookies are those that are being analysed and have not been classified into a category as yet.

Other tracking technologies

When you use third-party web-based software, websites or mobile apps, the technology may involve certain built-in tracking technologies. This can include:

Tracking Pixels – Our Website uses Google, LinkedIn and Facebook Pixel Tags which we may include an image in our communications with you. This may allow us to understand when you read electronic communications we send you, deliver more accurate and relevant content, and improve our communications to you. When using this technology, we may receive aggregated or anonymised information. In certain cases, we may collect Personal Information from you, for example:
- location data (such as city, region and where you opened your email);
- your IP address;
- browser and device information: for example, your mobile or desktop operating system (OS), type of email software, device, and user agent; or
- the date and time you open our electronic communications.

You can disable cookies through your internet browser unless they are required to prevent fraud or ensure the security of our website. If you decline our cookies, our website and products and services may not work as intended for you. We handle any personal information collected by cookies, other similar tracking technologies or third party analytics services, in the same way that we handle all other personal information in accordance with this Privacy Policy.

3. Automated decision making

As a Data Controller, we may use your personal information to make automated decisions about you on behalf of our clients. We will provide you with the necessary information to keep you informed about the decisions made about you as required by the GDPR.

Addendum 2 - Additional information for individuals resided in California

Under the California Consumer Privacy Act 2018 (CCPA) and the California Privacy Rights Act (CPRA), residents of the American state of California have specific rights regarding their personal information. If you are a California resident, this section applies to you in addition to the rest of the Privacy Policy. It provides more detail on how we collect, use and share the personal information of California residents in operating our business, and their rights with respect to that personal information.

For the purposes of this section, personal information has the meaning given in the California Consumer Privacy Act of 2018, as amended by the California Privacy Rights Act of 2020 (“CCPA”). However, this section does not apply to:

information exempted from the scope of the CCPA;
Personal Information we collect, use, and share on behalf of our customers as a “service provider” under the CCPA for the purposes of providing our Services to them; or
Personal Information processed by advertising vendors on our website through the use of cookies.

In particular, we do not:

sell any personal information from individuals located in California;
share any such personal information with third parties for their own commercial benefits; or
discriminate against you in any manner.

1. California Privacy Rights

In addition to the above mentioned rights, under California law you have the right to (subject to legal restrictions):

request access to/disclosure of the personal information (that is, disclosure of our collection and use of your personal information) over the past 12 months from the date we receive the request;
request that we delete all of your personal information collected from you;
opt-out of the “sharing” of your personal information for cross-context behavioural advertising.
all personal information that is collected from you be treated in accordance with this policy, including the use of different categories of your personal data that has been collected from you, and the disclosure of your personal information.

2. Exercising Your rights as a California Resident

We use services that employ cookies and other technologies to collect personal information (including identifiers and internet activity information) about your use of our websites and other online services over time, which helps us to deliver targeted ads. In addition, we may share your contact details with our advertising vendors for the placement of targeted ads. Our use of some of these services may constitute the “sale” or “sharing” of personal information as defined under the CCPA to/with third party advertisers. You may opt-out of such sales or sharing at any time.

3. Children’s Privacy

The service is intended for a general audience and not directed to children less than 13 years of age. We do not intend to collect personal information as defined by the U.S. Children’s Online Privacy Protection Act (“COPPA”) (“Children’s Personal Information”) in a manner that is not permitted by COPPA. If we obtain knowledge that we have collected Children’s Personal Information in a manner not permitted by COPPA, we will remove such data to the extent required by COPPA.