Privacy Policy

1. Who this policy covers

This policy applies to three groups of people whose information we may handle in different ways:

• Website visitors and prospects, people who browse our marketing site or submit a demo or contact request.
• Provider users, staff of the lenders, brokers, and underwriting agencies that license the platform.
• Applicants and their representatives, businesses applying for trade credit, and the directors or guarantors who provide details and sign documents during onboarding.

2. Information we collect

The information we collect depends on how you interact with us. We aim to collect only what we need for the purpose at hand.

If you choose not to provide certain information, we may be unable to respond to your enquiry or, for platform users and applicants, to complete onboarding or a credit assessment. Some collection is required or authorised by law.

• Contact and enquiry details you provide through forms, such as your name, business name, email address, phone number, and the message or demo request you send us.
• Account and usage information for platform users, such as login identifiers, role and permission settings, and records of actions taken in the platform (our audit log).
• Application and onboarding information submitted by or about applicants, such as company identifiers, director and guarantor details, supporting documents, and consents.
• Credit-related information processed on behalf of providers, such as bureau report data, security register results, and credit decision records. We handle this on behalf of, and under the instructions of, the relevant provider, while remaining responsible under the Privacy Act for keeping it secure.
• Technical information collected automatically, such as IP address, device and browser type, and pages visited, gathered through cookies and similar technologies.

3. How we collect it

We collect personal information directly from you when you complete a form, correspond with us, or use the platform. Where a provider uses TripleC to onboard an applicant, we may receive information about that applicant from the provider or from the applicant’s own submission through a provider-branded onboarding form.

Some credit information is obtained from third-party sources, such as credit reporting bodies and government registers, but only when a provider initiates a search and a valid consent authority has been recorded.

4. Why we use your information

We use personal information to:

• Respond to your enquiries, arrange demonstrations, and provide information you request.
• Provide, operate, secure, and improve the platform and our website.
• Enable providers to assess and govern trade credit decisions, including onboarding, searches, and approvals initiated by them.
• Maintain audit trails and meet record-keeping, security, and legal obligations.
• Communicate service and account information. We send marketing communications only where permitted, and you can opt out at any time.

5. Direct marketing

We may send you information about TripleC where you have asked us to, provided your details, or otherwise consented, and only where permitted by the Privacy Act and the Spam Act 2003 (Cth).

Every marketing email we send identifies us as the sender and includes an unsubscribe link. You can opt out at any time using that link or by emailing us with “unsubscribe” in the subject line, and we will action your request within 5 business days. On request, we will tell you the source of the contact details we hold for you. We do not use information for marketing where it was provided to us by a provider in connection with an application.

6. Consent and credit information

Where the platform is used to obtain or handle credit-related information, that activity depends on a specific, recorded consent authority captured during onboarding. We do not initiate paid bureau searches without a provider’s instruction and a corresponding consent.

Applicants can ask the relevant provider about the consents recorded for them and may withdraw consent for future searches. We retain records of consents and withdrawals as part of the audit trail, as required to evidence how information was handled.

7. Credit reporting information

Where the platform handles credit-related information, it generally does so on behalf of the relevant provider, who is the credit provider for that assessment. Individuals exercise their credit-reporting rights (including access, correction, complaints, and any ban or freeze on their credit information) through the relevant provider and the credit reporting body involved.

We handle credit information consistently with Part IIIA of the Privacy Act and the Privacy (Credit Reporting) Code where they apply, and we keep records of consents and searches as part of the audit trail. If you are unsure who holds your credit information or how to exercise a right, contact us and we will help direct your request.

8. When we disclose information

We do not sell personal information. We disclose it only as needed to operate the service or where required by law, including to:

• The provider on whose behalf an application or search is processed.
• Service providers that help us run the platform, such as cloud hosting, document management, e-signature, and communication tools, under contractual confidentiality and security obligations.
• Credit reporting bodies and registers, where a provider initiates a search under a valid consent.
• Professional advisers, regulators, or law enforcement where we are permitted or required to disclose.

9. Overseas disclosure

We host platform and credit-related data in Australia (AWS, Sydney region). Enquiries you send through this website are delivered by email to us, not to any third-party form service.

Some operational service providers we rely on (for example, e-signature, document management, or communication tools) may store or process limited information outside Australia. Where that occurs, we take reasonable steps to ensure the information is handled consistently with the APPs, and we will identify the relevant providers and countries here as those arrangements are confirmed.

10. Security and retention

We take reasonable technical and organisational measures to protect personal information against loss, misuse, and unauthorised access, including access controls, encryption in transit, tenant isolation, and tamper-evident audit logging.

We keep personal information only as long as needed for the purposes described here or as required by law. Credit and decision records may be retained for extended periods to meet evidentiary and regulatory obligations, after which they are securely deleted or de-identified.

11. Cookies and analytics

Our website uses only the cookies needed to operate essential functions. We do not currently use third-party analytics or advertising cookies, and we do not track you across other websites. If we introduce analytics in future, we will update this policy and, where consent is required, ask for it. You can control cookies through your browser settings; disabling some cookies may affect site functionality.

12. Your rights

You may request access to the personal information we hold about you and ask us to correct it if it is inaccurate, out of date, or incomplete. To make a request, contact us using the details below; we may ask you to verify your identity first. We will respond within a reasonable time (usually within 30 days). Access is normally free; if a charge applies for a more involved request, we will tell you first and keep it reasonable. If we cannot give access or make a correction, we will explain why and how you can complain.

Where information was provided to us by a provider in connection with an application, that provider controls how it is used, so we may also refer your request to them. We remain responsible for the security of the information while it is in our systems.

13. Complaints

If you believe we have mishandled your personal information or breached the APPs or the CR Code, contact our privacy contact (details below) with “Privacy complaint” in the subject line. We will acknowledge your complaint within 5 business days and aim to resolve it within 30 days.

If you are not satisfied with our response, you can complain to the Office of the Australian Information Commissioner (OAIC) at oaic.gov.au or on 1300 363 992.

14. Changes to this policy

We may update this policy from time to time to reflect changes in our practices or legal obligations. We will post the updated version here and revise the “last updated” date above.

15. Contact us

If you have questions about this policy or how we handle personal information, contact our privacy contact, Jason Cena (Founder), at hello@triplec.ai. Our postal address for privacy enquiries is Tenacious Data Miners Pty Ltd, Suite 103, 139 Cardigan St, Carlton VIC 3053.