Privacy Policy

This policy applies to Rewardco International Pty Ltd (ABN 84 169 704 938), trading as RewardCo (RewardCo, we, us, our).

It covers personal information about:

• visitors to rewardco.com;
• people who book a demo, sign up for our newsletter or contact us;
• the staff of our clients, agencies and suppliers we deal with; and
• Participants in Programs that run on the RewardCo platform.

We have chosen to handle personal information in line with the Privacy Act 1988 (Cth), including the APPs, whether or not the law requires it of us, and we follow the Spam Act 2003 (Cth).

Personal information means information or an opinion about an identified individual, or an individual who is reasonably identifiable.

Where we decide. For information about website visitors, people who contact us, our newsletter subscribers, and our clients', agencies' and suppliers' staff, we decide what we collect and why. This policy applies in full.

Where the Organisation decides. For Program Information, the Organisation decides who takes part, what information the Program uses and what it is used for. We handle Program Information on the Organisation's behalf, under our agreement with it, to provide the Program. The Organisation's own privacy policy also applies, and the Organisation is usually the best first contact for questions about your Program Information. In the language of some overseas laws, the Organisation is the controller and RewardCo is the processor.

Managed Programs. When RewardCo runs a Program for an Organisation, we do more with Program Information: we check Claims against the Program Rules, pay out Rewards, answer Participants' questions and report to the Organisation. We still do this on the Organisation's behalf and under its Program Rules.

Consumer promotions. In a consumer claims or cashback promotion, the Organisation is the promoter. Its Promotion Terms and privacy notice explain how it uses your information. We collect and check Claims and pay out Rewards on its behalf.

Even where we act on an Organisation's behalf, we still protect Program Information as this policy describes, and we answer privacy requests that come to us (see section 15).

Website and enquiries. When you visit our website or contact us, we may collect:

• your name, job title, organisation, email address, phone number and country;
• details about your program needs and anything else you tell us, including on the Book a demo form (and, if you are an agency, the number of clients you have and your website);
• when you send the Book a demo form, the time zone your browser reports and the IP address you sent it from, which we pass to our sales team with your request to help us follow it up and to spot spam;
• your newsletter subscription and preferences; and
• information about your visit, such as your IP address, browser and device type, pages viewed and how you arrived, collected through cookies only as described in section 11.

Participants. In a Program, depending on how the Organisation has set it up, we may collect:

• Profile: name, email address, phone number, employee or dealer number, role, team, location, start date and other details the Organisation provides, and a profile photo if you add one;
• Sign-in: if the Organisation uses Microsoft Entra ID (Azure AD) single sign-on, the identifiers and profile details Microsoft passes to us when you sign in;
• Activity: Points earned, redeemed and, where your Program's rules provide for it, expired; recognition you give and receive; nominations; KPI and target results; milestones; event attendance; survey and quiz responses; and messages and comments you post;
• Claims: the details you enter, and the Evidence you upload, such as receipts and invoices. Evidence can include other information printed on it, such as the seller's details, prices, and sometimes your address or partial card number;
• Referrals: the name and contact details of people you refer;
• Rewards: your redemptions and the Gift Cards issued to you; and, where the Organisation supplies a physical item, the delivery address it needs;
• Payouts: the bank details you enter for a Payout (account name, account number or IBAN, bank or branch code, currency and country), and the amount and status of each Payout. We store your bank details encrypted and use them only to make Payouts to you through our payment provider, Airwallex, which also receives them. We keep a record of each change to your bank details; and
• Support: your messages to us, and our notes about your request.

Survey responses. Surveys on the platform are not anonymous. Your survey and quiz responses are stored against your account, and the Organisation's administrators can see who gave each response. Where an Organisation sends a customer survey through a single-use link, we store the customer's name, email address and phone number, the staff member and dealer the survey is about, and the answers.

Sensitive information. We do not ask for sensitive information, such as health information, racial or ethnic origin, or religious beliefs, unless a Program genuinely needs it and you consent. Please do not include sensitive information in recognition messages, comments or survey answers.

Payout checks. Airwallex checks your bank details when a Payout is set up and sent, and runs its own screening, such as sanctions and fraud checks. We do not ask you for identity documents, and we do not collect or store them. When your bank details change, we tell you, so that you can act quickly if you did not make the change.

If you do not give us information. If you do not give the information a Program needs, you may not be able to take part, lodge a Claim or receive a Reward.

Anonymity. You can browse our website without telling us who you are. You cannot take part in a Program anonymously, because we need to know who earns and receives Rewards.

We use personal information to:

• provide, run and support Programs, including showing Points, processing Claims, issuing Rewards and making Payouts;
• check Claims, detect duplicates, and prevent and investigate fraud and misuse;
• send Program emails and notices, such as Claim decisions, Points notices and, where a Program has Points expiry, expiry notices, on the Organisation's behalf;
• report to the Organisation on its Program, and, where the Organisation allows, to its Agency;
• respond to enquiries and demo requests, and manage our relationships with clients, agencies and suppliers;
• send our newsletter and marketing where you have agreed (see section 12);
• keep our platform secure, fix problems and improve our services; and
• meet our legal, tax, accounting and audit obligations.

We use Program Information only to provide the Program and for the purposes in our agreement with the Organisation. We do not sell personal information, and we do not use Program Information to market our own services to Participants.

We may use information that has been de-identified or combined, so that no individual can be identified, to understand and improve how the platform is used.

We may share personal information with:

• the Organisation that owns your Program, which can see Program Information about its own Participants;
• an Agency, only as section 8 describes;
• our reward and payment Suppliers, such as GiftPay and Gifted for Gift Cards and Airwallex for Payouts. Our Suppliers page (/legal/suppliers/) lists each one, what it does, the information it receives and where it is. Where an Organisation pays Payouts from its own connected Airwallex account, Airwallex receives your Payout details as the Organisation's provider;
• service providers that help us run our business and the platform, such as our hosting providers (Hetzner and DigitalOcean), Cloudflare, which hosts and protects our website and stores website form submissions, Resend, which sends our website's emails, our email and business software providers (Google and Microsoft) and other IT providers. We can give you a list of our main service providers on request;
• professional advisers, such as our accountants, auditors, lawyers and insurers;
• a buyer or successor, if all or part of our business is sold or restructured, under confidentiality obligations; and
• government agencies, regulators, courts and law enforcement, where the law requires or allows it.

Our service providers may use personal information only to provide services to us.

Some Programs are provided to an Organisation by an Agency that offers RewardCo under its own brand. Agencies never own an Organisation's Program Information.

Before an Agency is given access to any Program Information, the Organisation and RewardCo agree in writing which information the Agency can see, for example usage figures or Participant lists. An Agency sees only what the Organisation has agreed to share.

An Agency handles any Program Information it sees under its own privacy policy and its agreement with the Organisation.

The platform always flags a Claim that may duplicate another one. It can also check a Claim's product, date or amount against the Program Rules.

Each Organisation decides, for each Program, how Claims are reviewed: by a person, by automatic checks, or both. In some Programs, a Claim that passes the automatic checks may be approved, or a Claim that fails them rejected, without a person reviewing it. The Program Rules say how your Program works.

If you think an automatic check has affected a decision about you unfairly, contact the Program's support contact or us, and a person will review it.

We may disclose personal information to people and businesses outside Australia, including:

• Suppliers, to deliver Gift Cards and Payouts. Rewards and Payouts go to the country where the Participant is, and our Suppliers may process information in other countries. Our Suppliers page (/legal/suppliers/) says where each one is;
• service providers that host, back up or process data for us, including our hosting providers, whose data centres are outside Australia, and email and software providers whose systems operate in several countries;
• Organisations and Agencies located outside Australia, for their own Programs; and
• our own staff and contractors who work in the Philippines and help us run and support Programs.

The countries involved depend on the Program. They include the countries where Participants receive Rewards, which at the date of this policy include Australia, New Zealand, Singapore, the United Kingdom, the United States, Canada, the Philippines and countries in Europe.

Before we disclose personal information overseas, we take reasonable steps to make sure the recipient protects it in a way consistent with the APPs, for example through privacy terms in our agreements with them, including the providers' own terms that commit them to protect personal information as the law requires.

What cookies are. Cookies are small files that a website stores on your device. Similar tools include pixels and tags.

Our approach. On rewardco.com, we use Google Tag Manager and Google Consent Mode. Analytics and advertising tools are off by default. When you first visit, a banner lets you accept all, reject all, or choose settings. You can change your choice at any time using the Cookie settings link in the footer.

Categories.

• Necessary: needed for the site to work, for example remembering your cookie choice and your region. These are always on.
• Analytics: tools such as Google Analytics, added through Google Tag Manager, to understand how visitors use the site, such as which pages are visited and where visitors come from. These load only if you accept analytics cookies. At the date of this policy, no analytics tags are in use.
• Marketing: the Meta (Facebook) pixel, to measure our advertising and show you relevant ads on other sites. It loads only if you accept marketing cookies. We do not use any other advertising or tracking tool.

When cookies are declined. With Consent Mode, if you decline analytics or advertising cookies, Google's tags do not store cookies on your device but may send Google limited signals without cookies, such as that a page was viewed, which Google may use to model overall traffic.

Program Sites. Program Sites use cookies needed to sign you in and keep your session secure. Registration forms on Program Sites use Google reCAPTCHA to block automated sign-ups, and Google may set its own cookies when it runs. Program Sites do not use analytics or advertising cookies.

Your browser. You can also block or delete cookies in your browser settings. Some parts of the website may not work without necessary cookies.

We send our newsletter and marketing emails only to people who have signed up or otherwise agreed, or where the law allows, such as to a business contact about services relevant to their role.

Every marketing email has an unsubscribe link. You can also ask us to stop by emailing hello@rewardco.com.

Program emails, such as Points notices and Claim decisions, are sent for the Organisation and are part of the Program, not RewardCo marketing. The Organisation decides which Program emails are sent, and some Programs let you choose which ones you receive.

We take reasonable steps to protect personal information from misuse, interference and loss, and from unauthorised access, change or disclosure. These include:

• keeping each Organisation's Program and data logically separate from every other Organisation's within our shared database, so that each Organisation sees only its own;
• limiting RewardCo access to administrator accounts held by staff who need it for their work;
• single sign-on through Microsoft Entra ID (Azure AD) where the Organisation uses it;
• using encrypted connections (HTTPS) for our website and every Program Site;
• encrypting bank details and other sensitive profile details where they are stored;
• keeping encrypted backups away from the live system; and
• using reputable providers for hosting, Gift Cards and Payouts.

We store bank details for Payouts encrypted, and use them only to make Payouts through Airwallex (see section 4.2).

No system is completely secure. If we have a data breach that is likely to result in serious harm, we will notify the people affected and the Office of the Australian Information Commissioner under the Notifiable Data Breaches scheme, and will tell the affected Organisation.

We keep personal information only as long as we need it for the purposes in this policy, or as the law requires.

For Program Information, our agreement with the Organisation sets how long we keep it. When a Program ends, the Organisation can export its data, and we then delete or de-identify Program Information within 90 days, except where we must keep records longer. Copies in our backups are deleted as those backups reach the end of their normal retention, within 12 months.

We keep records of Points, Claims, Rewards and Payouts for 7 years from the end of the financial year in which each transaction happened, to meet tax, accounting and audit obligations, and then delete them. These records are kept as they are until then, including after a Participant's account is closed.

Where a Program collects a delivery address so the Organisation can send a physical item, it is kept as our agreement with the Organisation sets out.

Access and correction. You can ask to see the personal information we hold about you and ask us to correct it. Participants can update many of their details on the Program Site. For Program Information, you can ask the Organisation or us. If you ask us, we may tell the Organisation and work with it on the request.

How we respond. We will need to confirm your identity. We will respond within 30 days. There is no charge to ask for access or correction; if a request is complex, we may charge a reasonable fee for providing access and will tell you first.

If we say no. If we refuse access or correction, we will tell you why in writing and how to complain. If we do not correct information, you can ask us to attach a statement that you believe it is wrong.

Export and deletion. Organisations can export their Program data. Participants can ask for a copy of their information, or ask for their account to be closed and their information deleted. Some information, such as records of Rewards and Payouts, may need to be kept for legal or financial reasons, and we will tell you if that applies.

If you are in the United Kingdom, the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018 may apply to our handling of your personal information.

Who is responsible. For our website, enquiries and newsletter, RewardCo is the controller. For Program Information, the Organisation is the controller and RewardCo is its processor.

Our lawful bases. We rely on:

• consent, for analytics and marketing cookies and our newsletter;
• contract, to deal with you or your organisation as a client, agency or supplier, and to provide a Program you have joined;
• legitimate interests, to respond to business enquiries, keep our services secure, prevent fraud and improve our services; and
• legal obligation, to keep financial records and respond to lawful requests.

Your rights. You can ask us to give you a copy of your information, correct it, delete it, restrict or object to how we use it, or move it to another provider. You can withdraw consent at any time. For Program Information, we will pass your request to the Organisation and help it respond.

International transfers. Your information may be transferred outside the UK, including to Australia and to the other countries where our staff and service providers work. Where the UK has not found a destination's protections adequate, we will rely on safeguards recognised by UK law, such as the UK International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses.

Complaints. You can complain to the UK Information Commissioner's Office (ico.org.uk). We would welcome the chance to deal with your concern first.

European Union. If you are in the European Union, the EU General Data Protection Regulation (EU GDPR) may also apply. This section then applies to you in the same way, with the EU GDPR in place of the UK GDPR and the EU Standard Contractual Clauses in place of the UK safeguards, and you can complain to the data protection authority in your country.

Representatives. Where the UK GDPR or the EU GDPR requires us to appoint a representative in the UK or the European Union, we will do so and name them on this page.

If you have a concern about how we have handled your personal information, contact our Privacy Officer (section 19). Tell us what happened and how you would like it resolved.

We will acknowledge your complaint within 5 business days, look into it, and give you a written response within 30 days. If we need longer, we will tell you why.

If you are not satisfied with our response, you can complain to the Office of the Australian Information Commissioner (OAIC) at www.oaic.gov.au or on 1300 363 992.