Privacy Policy

1. Introduction

Jet Support Pty Ltd (ABN 89 090 381 196), trading as Tap Advertising ("we", "us", "our", or "Tap"), is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your personal information across everything we do.

Tap has two merchant pathways, and this one policy covers both:

• Tap Payments - we supply a payment terminal and you process card payments through one of our partner acquirers.
• Tap Ads - you show Tap ads on your own point-of-sale or customer-display hardware, or on a device we supply for the purpose (a Tap Device, currently the Tap Ads Tablet), and earn a cash rebate.

It also covers our websites (including tappayments.com.au and tapads.com.au) and the Tap Ads mobile app (together with the pathways above, the "Services").

We comply with the Australian Privacy Principles ("APPs") contained in the Privacy Act 1988 (Cth) and any applicable state or territory privacy legislation.

If you do not agree with the terms of this Privacy Policy, please do not access or use our Services.

2. Information We Collect

We collect different types of information depending on how you interact with Tap. The categories below describe the information we collect from each type of user.

2.1 Merchants on Tap Payments

When you register for a payment terminal, we collect:

• Business information: legal business name, trading name, Australian Business Number (ABN), business address, business type, and merchant category
• Contact information: name, email address, phone number, and business address of the primary account holder and any authorised representatives
• Transaction data: details of payment transactions processed through our terminals, including transaction amounts, dates, times, card type (but not full card numbers), and terminal identifiers
• Terminal information: terminal serial numbers, location data, software versions, and usage metrics

Identity documents and bank details. Your identity verification documents (for example, a driver's licence or passport) and your settlement bank details are collected by our partner acquirer directly from you, under your separate agreement with them, for their identity, anti-money-laundering and credit checks. Tap does not collect or hold these as a matter of course. Occasionally, you may send these documents to us so we can upload them to the acquirer's portal on your behalf; where that happens, we handle them only to submit your application and do not retain a copy.

2.2 Merchants on Tap Ads

When you join the Tap Ads programme, we collect:

• Account details - your name, business name, email address, mobile phone number, business address, and the bank account where we pay your rebates.
• Verification photos - where your device type requires it, you submit photos through the Tap Ads app showing Tap ads are displaying correctly on your hardware. Photos are retained as evidence supporting your rebate payments. Devices we supply and manage verify by automatic placement check (see 2.3), so those locations may not need merchant-submitted photos.
• Monthly transaction statements - where your device type requires it, files or figures you provide from your point-of-sale or payment provider so we can calculate your rebate and set your activity band. We only read the totals and date ranges; we do not retain card numbers or individual customer transaction details.
• Device information - when you use the Tap Ads app, we store an authentication token on your device using the operating system's secure storage (Keychain on iOS, KeyStore on Android). We collect basic technical information such as app version and device model for support and crash diagnostics.

The Tap Ads app may request camera permission so you can take verification photos, and push notification permission so we can remind you about verification checks. Both are optional and can be turned off in your device's settings at any time.

2.3 The Tap Device camera

Where you host a device we supply for showing ads (a Tap Device, currently the Tap Ads Tablet), the device is centrally managed by Tap. We may activate its camera to take occasional still images, which may be taken during your trading hours, for two purposes only: (a) to confirm the Tap Device is in its approved position and is not obscured, by comparing a placement check image against a reference image; and (b) to investigate suspected misuse. A reference image is taken when you confirm the Tap Device is in position. If you move the Tap Device, or its surroundings change so that the reference no longer reflects its position, tell us through the Tap Ads app and a new reference image will be taken; we may also refresh the reference image ourselves.

The comparison is carried out by automated image analysis, which may be performed by a third-party processor. If a check fails or is missing, the rebate for that Location may be held and, if no later check passes within the period set out in clause B10 of your Tap Merchant Agreement, forfeited; you will be told in the app and may ask us to have a person review the result. This is the only automated decision we make with these images. We use the camera only for these purposes. Specifically:

• we do not capture video or audio;
• we do not use the images for facial recognition or any other biometric purpose;
• we keep a reference image for as long as the Tap Device is hosted at that Location and delete it within 90 days after the device is returned, the reference is re-baselined, or you leave Tap Ads at that Location, subject to the misuse exception below;
• we delete placement check images within 90 days, except that where an image is needed to investigate suspected misuse we keep that image only for as long as the investigation or any related dispute requires, and then delete it.

Because the camera may capture your premises, you consent to this use when you enrol a Tap Device. You are responsible for displaying any notice your state or territory's surveillance-devices law requires, and for informing your staff. This applies only to a device we supply and manage - it does not apply to your own device.

If you are a customer or staff member in a merchant's premises: a Tap Device in that premises may capture your image in an occasional still photo. We use these photos only to confirm the Tap Device is in its approved position and to investigate suspected misuse. We do not identify you from them, and we do not use them for facial recognition or any other biometric purpose. A reference image of the premises is kept for as long as the Tap Device is hosted there; check images are deleted within 90 days. We delete them as described above (keeping an image longer only where it is needed as evidence of misuse). We require the merchant who hosts the Tap Device to display any notice the law requires. To ask what we hold about you or to raise a concern, contact us at privacy@tappayments.com.au.

2.4 Advertisers

When you register as an advertiser, we collect:

• Company information: company name, ABN or ACN, registered address, and industry
• Contact information: name, email address, and phone number of the primary contact and any authorised representatives
• Billing information: payment method details for prepaid balance top-ups and invoicing
• Campaign data: advertising creative assets, targeting preferences, campaign budgets, and scheduling information
• Performance data: ad impression counts and display duration, reported to advertisers only in aggregate at the Location level - never tied to an individual cardholder or an individual transaction

2.5 Website and app visitors

When you visit our websites or use the Tap Ads app, we may collect:

• Device information: browser type and version, operating system, device type, and screen resolution
• Usage data: pages visited, time spent on pages, referral source, click patterns, and navigation paths
• Analytics events: anonymous events such as page views, scroll depth, and calls-to-action clicked, tied to a pseudonymous session identifier stored in browser session storage. Your IP address is hashed with a daily-rotating salt before storage - we don't retain raw IPs, and the websites honour the Do-Not-Track browser header.
• Cookies and similar technologies: as described in Section 8 below
• Form submissions: any information you voluntarily provide through contact, enquiry, register-interest, or newsletter forms, including your name, email address, and message content

2.6 Customers (Cardholders)

When you make a payment at a merchant using a Tap payment terminal, please note:

• We do not store full card numbers. All card data is processed in compliance with PCI DSS (Payment Card Industry Data Security Standard) requirements.
• We collect truncated card information (last four digits), transaction amount, date and time, merchant location, and card type for transaction processing and reporting.
• Advertising displayed on the payment terminal does not collect personal information from cardholders. The payment terminal does not use cameras, microphones, or biometric sensors. (A Tap Device described in 2.3 is a separate ad-display device, not a payment terminal.)

3. How We Use Information

We use the information we collect for the following purposes:

• Payment processing: To support the Acquirer's processing of card payments taken on your terminal. The Acquirer, not Tap, processes and settles those transactions and holds the settlement funds.
• Account management: To create, maintain, and manage your Tap account, verify your identity, and communicate with you about your account
• Advertising delivery: To display relevant advertising content on payment terminals and Tap Ads devices based on merchant category, location, and advertiser targeting preferences
• Rebates and verification: To confirm that Tap ads are displaying on your hardware, including by comparing Tap Device placement check images against a reference image, calculate your Tap Ads cash rebate, and pay it into your nominated bank account
• Tax invoicing: To issue Recipient-Created Tax Invoices (RCTIs), or a remittance advice where you are not registered for GST, for each rebate payment, as required by Australian tax law
• Reporting and analytics: To provide merchants with transaction reports and advertisers with campaign performance data
• Rebate settlement: To calculate and pay your Tap Ads rebate into your nominated bank account. Tap does not hold or settle card-payment funds - the Acquirer settles those directly to you.
• Rebate integrity: For performance-based ad campaigns, to identify invalid, duplicate, automated, or fraudulent customer actions and to reverse or recover (claw back) any rebate paid on them
• Platform improvement: To monitor, analyse, and improve our Services, including terminal software, the Tap Ads app, website functionality, and user experience
• Compliance: To comply with legal obligations, including anti-money laundering (AML) and counter-terrorism financing (CTF) requirements, tax reporting, and card scheme rules
• Communication: To send you service-related communications (for example settlement confirmations, verification reminders, platform updates, security alerts) and, where you have consented, marketing communications
• Security and fraud prevention: To detect, investigate, and prevent fraud - for example, detecting fake verification photos or duplicate accounts - and to prevent unauthorised access and other illegal activities
• Dispute resolution: To manage chargebacks, disputes, and complaints

4. How We Share Information

We may share your personal information with the following categories of recipients:

• Payment processing partners: Acquiring banks, card schemes (Visa, Mastercard, eftpos), and payment gateway providers who are necessary to process transactions
• Terminal and device providers: Our hardware providers, for terminal and device provisioning, maintenance, and software updates
• Banking partners: The banking provider we use to pay your Tap Ads rebates
• Verification-photo and placement-image analysis: Our AI processing provider, which analyses verification photos for authenticity and Tap Device placement check images against a reference image. Only the image content is shared for the authenticity or placement check, not your identity.
• Acquirer (suspected verification fraud): Where we suspect verification fraud on the Tap Ads pathway, we may share relevant information about the suspected conduct with our partner Acquirer
• Notification providers: The push notification services operated by Apple and Google for the Tap Ads app
• Advertisers: We provide advertisers with aggregated, anonymised campaign performance data. We do not share personally identifiable information about individual merchants or cardholders with advertisers without consent.
• Service providers: Third-party vendors who assist us in operating our platform, including cloud hosting providers, email service providers, analytics tools, and customer support platforms
• Legal and regulatory: Government agencies, law enforcement, regulators, or other parties when required by law, subpoena, or court order, or when we believe disclosure is necessary to protect our rights, your safety, or the safety of others
• Business transfers: In connection with a merger, acquisition, reorganisation, or sale of assets, your information may be transferred to the acquiring entity
• With your consent: We may share your information with other parties when you have given us explicit consent to do so

All third parties who handle your data on our behalf do so under contract and subject to confidentiality obligations. We do not sell your personal information to third parties.

5. Data Security

We take the security of your personal information seriously and implement appropriate technical and organisational measures to protect it, including:

• Encryption of data in transit (TLS 1.2+) and at rest (AES-256)
• PCI DSS compliance for all card payment data handling
• Authentication tokens on the Tap Ads app stored using the operating system's secure storage
• Role-based access controls limiting who can access personal information within our organisation
• Regular security audits and vulnerability assessments
• Secure development practices and code review processes
• Incident response procedures for data breaches, in compliance with the Notifiable Data Breaches (NDB) scheme under the Privacy Act
• Staff training on data protection and privacy obligations

While we take reasonable steps to protect your information, no method of electronic transmission or storage is 100% secure. We cannot guarantee absolute security of your data.

6. Data Retention

We retain personal information only for as long as necessary to fulfil the purposes for which it was collected, or as required by law. Our retention periods are as follows:

• Transaction records: 7 years from the date of the transaction, as required by Australian tax law and card scheme rules
• Merchant account data: For the duration of the merchant relationship plus 7 years after account closure
• Tap Ads rebate records: The rebate ledger and RCTIs are kept for the duration of your participation in the programme and for 7 years after your last payment, as required by Australian tax record-keeping rules
• Tap Ads verification photos: Kept for up to 2 years, then deleted or de-identified
• Tap Device reference images: Kept for as long as the Tap Device is hosted at that Location, then deleted within 90 days after the device is returned, the reference is re-baselined, or you leave Tap Ads at that Location, subject to the misuse exception in 2.3
• Tap Device placement check images: Deleted within 90 days, except an image needed to investigate suspected misuse, which is kept only for as long as that investigation or any related dispute requires (see 2.3)
• Advertiser account data: For the duration of the advertiser relationship plus 7 years after account closure
• Contact and enquiry form submissions: 2 years from the date of submission, unless the enquiry leads to an ongoing business relationship
• Website analytics data: Up to 26 months from the date of collection
• Terminal logs: 12 months from the date of the log entry

You can ask us to delete your data earlier where we are not required by law to keep it. When personal information is no longer required, we securely delete or de-identify it in accordance with our data disposal procedures.

7. Your Rights

Under Australian privacy law, you have the following rights in relation to your personal information:

• Access: You have the right to request access to the personal information we hold about you. We will respond to access requests within 30 days.
• Correction: You have the right to request correction of any personal information that is inaccurate, incomplete, out-of-date, or misleading.
• Deletion: You can ask us to delete your personal information and account where we are not required by law to keep it. Tap Ads users can start this from the delete your account page.
• Complaints: If you believe we have breached the Australian Privacy Principles, you may lodge a complaint with us. We will investigate and respond to complaints within 30 days. If you are not satisfied with our response, you may lodge a complaint with the Office of the Australian Information Commissioner (OAIC) at www.oaic.gov.au.
• Opt-out of marketing: You can opt out of receiving marketing communications at any time by clicking the unsubscribe link in our emails or contacting us directly.
• Anonymity: Where practicable, you have the option of interacting with us anonymously or using a pseudonym. However, if you choose not to provide certain information, we may not be able to provide you with our Services.

To exercise any of these rights, please contact us at privacy@tappayments.com.au.

8. Cookies and Tracking

Our websites use cookies and similar tracking technologies to enhance your browsing experience, analyse website traffic, and understand where our visitors are coming from. The types of cookies we use include:

• Essential cookies: Required for the website to function properly (for example, session management and security tokens). These cannot be disabled.
• Analytics cookies: Help us understand how visitors interact with our website by collecting anonymous usage data.
• Functional cookies: Remember your preferences and settings to provide a more personalised experience.
• Marketing cookies: Used to deliver relevant advertising and track the effectiveness of our marketing campaigns.

You can manage your cookie preferences through your browser settings. Most browsers allow you to block or delete cookies. However, disabling certain cookies may affect the functionality of our website.

Our payment terminals and Tap Ads devices do not use cookies or web tracking technologies. Advertising displayed on them is delivered based on merchant category and location, not individual cardholder behaviour.

9. Third-Party Links

Our websites and Services may contain links to third-party websites, applications, or services that are not operated by us. If you click on a third-party link, you will be directed to that third party's site. We strongly advise you to review the privacy policy of every site you visit.

We have no control over and assume no responsibility for the content, privacy policies, or practices of any third-party sites or services. This includes payment card schemes, hardware providers, and any advertisers whose content may be displayed on our terminals or devices.

10. Children's Privacy

Our Services are intended for business owners and operators and are not directed to individuals under the age of 18. We do not knowingly collect personal information from children. If we become aware that we have collected personal information from a child without parental consent, we will take steps to delete that information as soon as possible.

If you are a parent or guardian and you are aware that your child has provided us with personal information, please contact us at privacy@tappayments.com.au so that we can take appropriate action.

11. International Transfers

Tap primarily stores and processes personal information in Australia. However, some of our service providers (such as cloud hosting, analytics, and verification-photo and placement-image analysis providers) may store or process data in other jurisdictions, including the United States, the European Union, and Singapore.

Where personal information is transferred overseas, we take reasonable steps to ensure that the overseas recipient handles the information in accordance with the Australian Privacy Principles. This may include entering into contractual arrangements that require the recipient to comply with privacy obligations substantially similar to those under Australian law.

12. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. When we make changes, we will:

• Update the "Last updated" date at the top of this page
• Post the revised Privacy Policy on our website
• For material changes, notify you by email or through the Services before the changes take effect

We encourage you to review this Privacy Policy periodically. Your continued use of our Services after any changes to this Privacy Policy constitutes your acceptance of those changes.

13. Contact Us

If you have any questions, concerns, or complaints about this Privacy Policy or our handling of your personal information, please contact us:

We will respond to all privacy-related inquiries and complaints within 30 days. If you are not satisfied with our response, you may contact the Office of the Australian Information Commissioner (OAIC):