Privacy Policy

1. Who We Are (APP 1)

FinSeeker Pty Ltd ACN 697 193 909 ("FinSeeker", "we", "us", or "our") operates the online finance matching platform at finseeker.com.au (the "Platform").

We maintain a publicly available privacy policy (this document) in accordance with APP 1.3 and take our obligations under the Privacy Act 1988 (Cth) seriously. If you have any questions about how we handle your personal information, please contact our Privacy Officer at contact@finseeker.com.au.

2. What Is Personal Information?

Under the Privacy Act, "personal information" means information or an opinion about an identified individual, or an individual who is reasonably identifiable, whether true or not, and whether recorded in a material form or not (s 6).

"Sensitive information" (s 6) — such as health, racial or ethnic origin, and financial details beyond what is necessary for our service — attracts heightened protection. We do not intentionally collect sensitive information unless you provide it voluntarily and we have your express consent, or collection is required or authorised by law.

3. Collection of Personal Information (APP 3)

We collect personal information that is reasonably necessary for our functions and activities. The types of information we collect include:

• Identity & contact details: full name, email address, phone number, company name, and ABN/ACN.
• Funding request details: loan amounts, finance types, security types, and business descriptions submitted through the Platform.
• Account credentials: email address and hashed (bcrypt-encrypted) password. We never store passwords in plain text.
• Payment information: FinSeeker is currently in beta trial and no payment information is required to access or use the Platform during this period. When paid subscriptions are introduced for lenders in the future, credit/debit card processing will be handled entirely by Stripe Inc. (PCI DSS compliant). We will not store, transmit, or have access to your full card number, CVV, or banking credentials.
• Usage & technical data: IP address, browser type, device identifiers, pages visited, session data, and anonymised analytics collected via Vercel Analytics.
• Communications: content of messages submitted via our contact form, email correspondence, and support requests.

How we collect: We collect personal information directly from you when you register, submit a funding request, pitch on a request, contact us, or otherwise interact with the Platform. We may also collect information from publicly available sources (e.g. ASIC Connect, ABN Lookup) to verify information you provide.

Consequences of not providing: You are not required to provide personal information, but if you choose not to, we may be unable to provide you with access to the Platform, process your registration, or respond to your enquiries (APP 3.6).

Anonymity: Where practicable and lawful, you may interact with us anonymously or using a pseudonym. However, most Platform functions require you to identify yourself (APP 2).

4. Notification of Collection (APP 5)

At or before the time of collection (or as soon as practicable), we notify you of:

• Our identity and contact details.
• The fact and circumstances of the collection.
• Whether collection is required or authorised by law.
• The purposes for which we collect the information.
• Any third parties to whom we usually disclose the information.
• Whether we are likely to disclose information to overseas recipients and, if so, which countries.
• Your right to access and seek correction of your personal information.
• How to complain about a breach of the APPs and how we will deal with such a complaint.

This Privacy Policy fulfils our APP 5 notification obligations. Additional notice is provided at registration and at each collection point on the Platform.

5. Use and Disclosure of Personal Information (APPs 6 & 8)

We use and disclose personal information only for the primary purpose for which it was collected, or for a secondary purpose where:

• You would reasonably expect us to do so, and the secondary purpose is related (or, for sensitive information, directly related) to the primary purpose; or
• You have consented; or
• Use or disclosure is required or authorised by law.

We use your personal information to:

• Provide, operate, maintain, and improve the Platform and its services.
• Match seekers of finance with relevant registered lender BDMs.
• Manage your account and, when activated, process subscription payments.
• Send transactional emails (registration confirmations, password resets, pitch notifications).
• Send marketing updates, platform news, and commercial finance industry updates where you have expressly consented.
• Respond to enquiries and provide customer support.
• Comply with legal and regulatory obligations, including under the AML/CTF Act 2006 (Cth) where applicable.
• Detect, investigate, and prevent fraud, unlawful activity, and breaches of our Terms of Use.

We may disclose your personal information to:

• Lender BDMs on the Platform — when a seeker accepts a lender BDM's pitch, the seeker's name, email address, phone number, and funding request details are disclosed to that lender BDM. This disclosure occurs solely at the seeker's discretion and only upon acceptance.
• Third-party service providers — we engage third-party providers to support the operation of the Platform, including for email delivery, hosting, analytics, customer relationship management, and (when activated) payment processing. These providers act as data processors on our behalf and are bound by contractual obligations to handle personal information securely and only as directed by us. Current key providers include Resend Inc. (email delivery), Vercel Inc. (hosting and analytics), Supabase Inc. (database infrastructure), and HubSpot Inc. (CRM), all of which may process data on servers located in the United States or other overseas jurisdictions. When paid subscriptions are introduced, Stripe Inc. (payment processing) will also be engaged.
• Professional advisers — lawyers, accountants, and insurers, on a confidential basis.
• Regulatory & law enforcement bodies — including ASIC, the ATO, AUSTRAC, and police, where required or authorised by law.
• Successors in business — in connection with a merger, acquisition, or sale of all or substantially all of our business, subject to the acquirer maintaining equivalent privacy protections.

We do not sell, rent, or trade personal information to third parties for their own marketing purposes.

6. Overseas Disclosure (APP 8)

We engage third-party service providers whose servers may be located overseas, including in the United States. Current overseas recipients include Resend Inc., Vercel Inc., Supabase Inc., and HubSpot Inc. (all United States). When paid subscriptions are introduced, Stripe Inc. (United States and other jurisdictions) will also be an overseas recipient.

Before disclosing personal information overseas, we take reasonable steps to ensure the recipient does not breach the APPs in relation to that information (APP 8.1). We do this primarily through contractual means (Data Processing Agreements).

Where we are unable to ensure an overseas recipient complies with the APPs, APP 8.2(a) applies: you acknowledge that we may not be accountable under the Privacy Act for that recipient's handling of your information. We will inform you if this situation arises.

7. Direct Marketing (APP 7)

We will only use or disclose your personal information for direct marketing — including marketing updates, platform news, and commercial finance industry updates — if you have expressly consented (for example, by joining our mailing list). Each marketing communication will include a simple, free opt-out mechanism. You may withdraw consent at any time by:

• Clicking "unsubscribe" in any marketing email; or
• Emailing contact@finseeker.com.au with the subject "Unsubscribe".

We comply with the Spam Act 2003 (Cth) and do not send unsolicited commercial electronic messages. We will action opt-out requests within 5 business days (APP 7.3).

8. Data Quality (APP 10)

We take reasonable steps to ensure personal information we collect, use, and disclose is accurate, up to date, complete, and relevant for the purpose of its use. You can update your account information at any time by logging in or contacting us at contact@finseeker.com.au.

9. Security of Personal Information (APP 11)

We take reasonable steps to protect personal information from misuse, interference, loss, unauthorised access, modification, and disclosure. Our security measures include:

• HTTPS/TLS encryption for all data transmitted to and from the Platform.
• Bcrypt hashing of all user passwords — we never store passwords in plain text.
• Role-based access controls restricting access to personal information to authorised personnel only.
• When paid subscriptions are introduced, payment processing will be handled by Stripe Inc. (PCI DSS compliant) — we will not handle raw card data.
• Regular review of our data security practices.

When personal information is no longer needed for any purpose, we will take reasonable steps to destroy or de-identify it, unless we are required by law to retain it (APP 11.2).

Notifiable Data Breaches (NDB): In the event of an eligible data breach under Part IIIC of the Privacy Act, we will notify affected individuals and the Office of the Australian Information Commissioner (OAIC) as required by law, as soon as practicable.

10. Cookies & Analytics (APP 3)

We use cookies and similar technologies to improve your experience and collect anonymised usage analytics. Cookies are small text files stored on your device. You may configure your browser to refuse cookies; however, doing so may affect Platform functionality.

We use Vercel Analytics for aggregated, anonymised usage statistics. No personally identifiable information is shared with Vercel Analytics beyond standard server log data (IP address, browser type).

11. Access to Personal Information (APP 12)

You have the right to request access to personal information we hold about you (APP 12.1). To make a request, contact our Privacy Officer in writing at contact@finseeker.com.au. We will respond within 30 days.

We may decline access in limited circumstances permitted by the Privacy Act (APP 12.3), including where:

• Providing access would pose a serious threat to health or safety.
• Access would unreasonably impact another individual's privacy.
• The information relates to existing or anticipated legal proceedings.
• Providing access would be unlawful.

If we decline access, we will provide written reasons and information about how to complain (APP 12.9). We will not charge a fee for making an access request, but may charge a reasonable fee to cover the cost of providing access (APP 12.5).

12. Correction of Personal Information (APP 13)

If you believe personal information we hold about you is inaccurate, out of date, incomplete, irrelevant, or misleading, you have the right to request correction (APP 13.1). Contact us at contact@finseeker.com.au. We will respond within 30 days and, if we refuse a correction request, will provide written reasons and advise how to complain (APP 13.3).

13. Complaints (APP 1)

If you believe we have breached the APPs or any applicable privacy obligation, you may lodge a complaint with our Privacy Officer:

• We will acknowledge your complaint within 5 business days.
• We will endeavour to resolve your complaint within 30 days. If more time is required, we will advise you of the reason and expected timeframe.

If you are not satisfied with our response, you may escalate to the Office of the Australian Information Commissioner (OAIC):

• Website: oaic.gov.au
• Phone: 1300 363 992
• GPO Box 5218, Sydney NSW 2001

14. Children's Privacy

The Platform is intended for use by businesses and adults aged 18 and over. We do not knowingly collect personal information from children under 18. If you believe we have inadvertently collected such information, please contact us immediately and we will take steps to delete it.

15. Changes to This Policy

We may update this Privacy Policy to reflect changes in our practices or the law. We will post the updated policy with a revised "Last updated" date. For material changes, we will notify registered users by email with at least 14 days' notice before the change takes effect. Your continued use of the Platform after that date constitutes acceptance of the updated policy.