Privacy Notice

We at Prizecart Pty Ltd (ABN 47 688 017 692), based in Victoria, Australia, respect the privacy and confidentiality of the personal data of our users, customers, merchants, participating venues, visitors and everyone we interact with while providing our services. Prizecart lets people discover online and physical stores and earn promotional Chances on their purchases, and we understand that the safety of your personal information is a key concern. We are committed to ensuring that all personal data provided to us remains secure and is only used for purposes that you have been informed of and, where required, have consented to.

We only collect information that is reasonably necessary to:

• Provide access to the Prizecart platform (website, apps, retailer integrations and in-store receipt scanning).
• Track and validate your eligible purchases, whether made online through a participating retailer or in person at a participating venue, so we can issue Chances and administer prizes.
• Fulfil our legal obligations to properly conduct trade promotion lotteries, including verifying winners and publishing results.
• Detect and prevent fraud, including the use of receipts that are not genuine.
• Understand how our services are used so we can improve them for users, retailers and venues.

We collect the minimum information required to achieve these purposes. We share with our retail partners, affiliate networks and participating venues only what is necessary to verify purchases, calculate commissions, determine prize eligibility and fulfil prizes.

We do not sell your personal information.

We comply with the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs). If you have questions or need assistance, contact us at:

• General support: support@prizecart.app
• Privacy matters: privacy@prizecart.app

Personal Data Protection Policy

This document explains how Prizecart manages, collects, uses and discloses personal data relating to users of our website, mobile applications, retailer integrations, in-store receipt scanning, prize mechanics and other platforms (collectively, the "Services"). Continued use of our Services constitutes agreement to this policy as updated from time to time.

Definition of Personal Data

"Personal Data" refers to information or opinions about an identifiable individual, whether true or not, including information in our records.

"Sensitive information" (as defined in the Privacy Act) includes health or biometric data. We do not collect sensitive information in the ordinary course of business; if required, we will only do so lawfully and with safeguards.

"De-identified information" refers to data that no longer identifies an individual. We may use or share de-identified or aggregated information (for example, the number of scans at a venue without identifying who made them).

Collection of Personal Data

The data we collect depends on the products, Services and promotions you use. We collect data to ensure platform functionality, issue Chances, calculate prize eligibility, prevent fraud, understand usage and support retailer and venue integrations.

You provide Personal Data when you:

• Use our websites, apps or integrations, or submit enquiries.
• Register for a Prizecart account, or onboard a business as a participating retailer or venue.
• Scan a receipt from a purchase at a participating venue.
• Interact with Prizecart experiences embedded on retailer websites.
• Sign up for alerts, newsletters or promotions.
• Contact support via chat, email or other channels.
• Take part in promotions, prize draws, quests, referrals, beta tests or surveys.
• Claim a prize, including by providing identification and payment details.
• Submit job applications.
• Are referred to us by partners, retailers, venues or other users.

Types of Personal Data Collected

• Identity — Full name, email, phone number, date of birth, country and state of residence. Account identifiers and login data. Device identifiers, IP address and browser data.
• Prize verification — Where you win a prize: proof of identity, age and residency, and any eligibility declaration we ask you to complete. This includes a declaration of whether you own, manage or work at a participating retailer or venue, and if so which one, because people in those positions may be restricted in how they can take part.
• Prize payment — The Australian bank account details you nominate so we can pay a cash prize.
• Receipts — Images of receipts you scan, and the details we read from them, such as the venue's name and ABN, the date, time and total. See "Receipt Scanning at Participating Venues" below.
• Interactions — Communications with us, such as emails and support messages. Interactions with the Prizecart platform.
• Account information — Profile details, Chances, Set Pieces, prize history, achievements and settings.
• Service usage and transactions — Pages viewed, actions taken and timestamps. Transaction details with online retailers (order ID, value, time and limited non-sensitive product data). Fraud-related system-generated signals.
• Preferences — Contact preferences, favourite prize types and categories.
• Location — The approximate area you are in, such as your city, which our analytics tools may work out from your IP address. We do not collect your device's location. See "Location" below.

Prizecart does not collect your search engine history, email content, or browsing data outside the Prizecart platform and Prizecart-enabled retailer sites.

Age. Our Services are intended for people aged 18 and over, and our promotions are open only to people aged 18 and over. If we find we hold data about someone under 18, we will take steps to delete it. Contact us if you believe we do.

Anonymity. You may interact anonymously where lawful and practicable (for example, browsing our website), but identification is required for key services such as prize verification and payment.

Other data sources. We may collect data from retailers, affiliate networks, participating venues, analytics providers, social platforms, fraud-prevention services or public sources, where allowed.

Receipt Scanning at Participating Venues

When you scan a receipt from a purchase at a participating venue:

• We collect an image of the receipt and read details from it, including the venue's name and ABN (or Prizecart venue code), the date and time of purchase, and the total.
• A receipt can contain other information printed by the venue's system, such as the last digits of a payment card or a staff member's name. We do not use that information, and you can cover it before scanning if you prefer.
• We use receipt images and the details read from them only to validate your purchase, issue Chances, check that the receipt is genuine and has not been scanned before, and investigate suspected misuse. We may use automated tools, including software that detects altered, fabricated or artificially generated receipts.
• Where a receipt cannot be read on your device, we may send the image to a third-party service to read it. That service may process the image outside Australia. We require it to use the image only to read it for us and not to retain it.
• We may check a receipt against the issuing venue's own transaction records to confirm it matches a genuine purchase. To do this we share only the details printed on the receipt, such as the date, time and total, and we do not tell the venue who scanned it.
• We keep receipt images only for as long as reasonably necessary to validate the purchase and to investigate any suspected misuse, and then we delete them.

Location

Location access is optional. The app only asks for it when you turn on nearby shop alerts.

Nearby shop alerts tell you when you are at a participating venue where a receipt can earn Chances. For this to work, the app uses your device's precise location, including in the background while the app is closed, so that your phone can notice when you arrive at a shop. Your phone asks for your permission first: Android calls it "Allow all the time" and iOS calls it "Always".

The checking happens on your phone. The app downloads the locations of participating venues, and your phone compares them with where you are and shows the alert itself. Your location is not sent to Prizecart or to anyone else, and we do not store it.

You can turn nearby shop alerts off, or turn off location access in your device settings, at any time. Everything else in Prizecart works without it.

Cookies

We use cookies and similar technologies to:

• attribute online purchases to your account so we can issue Chances;
• keep you logged in;
• remember your preferences; and
• improve performance.

Blocking cookies may prevent us from attributing purchases or providing Services.

Online Retailer Integrations

When you shop with an online retailer through Prizecart, our integration may collect:

• the retailer's name and domain;
• active promotion indicators;
• the order ID, value, time and basic non-sensitive details; and
• browser and device information needed to operate the integration.

We do not collect payment card details or passwords. We do not track browsing on non-Prizecart websites.

Accuracy of Information

You must ensure your Personal Data is accurate, including any eligibility declaration you make. Incorrect data may affect Services or prize eligibility. When providing data about others, you must obtain their consent.

Use of Personal Data

Prizecart does not sell your data. We use Personal Data for:

1. Administering Services. Validating purchases and receipts. Issuing Chances and bonus Chances. Operating collection and instant-win mechanics and prize draws. Verifying winners' identity, age, residency and eligibility. Paying prizes. Reconciliation with retailers and venues. Managing promotions.

2. Direct marketing. Notifications about new seasons, offers, retailers and venues. Targeted and untargeted advertising using hashed identifiers. You can opt out at any time.

3. Improving Services. Handling complaints. Enhancing performance and stability. Understanding user behaviour. Developing new features. Providing retailers and venues with de-identified or aggregated insights.

4. Customer service. Responding to enquiries. Providing guidance. Issuing updates. Managing complaints.

5. Security and compliance. Detecting and investigating fraud, including fabricated or artificially generated receipts. Audits and testing. Meeting our obligations under trade promotion laws. Assisting law enforcement. Risk management.

6. Job applications. Recruitment and HR processing.

We retain Personal Data only as long as legally or operationally necessary. Records of promotions and prize winners are kept for as long as trade promotion laws require, which can be up to seven years.

Sharing of Personal Data

We may share data with:

• Prizecart group companies
• Online retailers, brands and affiliate networks, to verify purchases and commissions
• Participating venues, limited to aggregated scan information and, where we are verifying a receipt, the details printed on that receipt without identifying you
• Payment and payout providers, to pay prizes
• Receipt-reading and fraud-detection service providers
• Cloud and IT partners
• Analytics platforms
• Customer support tools
• Marketing service providers
• Professional advisers (lawyers, auditors)
• State and Territory trade promotion regulators, where required

We may also share data for business transactions (for example, mergers) under confidentiality protections, or with regulators where legally required.

Some disclosures may be to service providers located outside Australia, with safeguards in place.

We do not sell your personal information.

Publication of Winners

Trade promotion laws require us to publish certain details of prize winners. If you win a prize valued at $250 or more, we may publish your last name, first initial and postcode on the Prizecart website. You can ask us not to publish your name and postcode, and we will abide by that request. The full rules are in the applicable promotion's terms and conditions.

Security of Personal Data

We apply safeguards including:

• HTTPS/TLS encryption
• Secure servers
• Access controls
• Verification processes
• Breach monitoring
• Secure destruction or de-identification, including deletion of receipt images once they are no longer needed

If an eligible data breach occurs, we will notify the OAIC and affected individuals under the Notifiable Data Breaches scheme.

Updating Your Personal Data

You may update your data through your account, or email privacy@prizecart.app for assistance.

Access, Use, Disclosure and Withdrawal of Consent

Contact privacy@prizecart.app to:

• access your data;
• request information about how we have used or disclosed your data; or
• withdraw consent.

We may charge a reasonable administrative fee for access. Withdrawing consent may affect our ability to provide Services.

For unresolved complaints, you may contact the Office of the Australian Information Commissioner (OAIC).

Changes to This Policy

We may update this Policy to reflect changes in our practices, industry changes or legal requirements. Updates will be posted on our website.

Governing Law

This Policy is governed by the laws of Victoria, Australia, and complies with the Privacy Act 1988 (Cth) and the APPs.

Prizecart Pty Ltd | ABN 47 688 017 692 | Victoria, Australia | privacy@prizecart.app | prizecart.app