Privacy Policy

Zenith Payments | Effective 27 August 2026

1.Background

This Privacy Policy is issued by ZenPay Pty Ltd (ABN 63 056 881 942), the holder of Australian Financial Services Licence number 528678, trading as Zenith Payments. References to Zenith’s related bodies corporate and trading names (including Pay & Earn) are to entities and brand within the same corporate group; Zenith remains the entity accountable for personal information handled under this Policy. Staff, contractors, officers and directors of Zenith are bound by confidentiality and this Policy in performing their roles but are not themselves the accountable entity under the Privacy Act 1988 (Cth) (Privacy Act).

We are bound by, and this Policy is written to be consistent with, the Australian Privacy Principles (APPs) in Schedule 1 to the Privacy Act, and with the other laws summarised in Schedule 1 to this Policy.

This Policy applies across Zenith websites, mobile applications and other services generally. Where a specific Zenith product has its own customer terms or privacy notice (for example, the Pay & Earn Customer Terms and Conditions), that product-specific notice applies in addition to this Policy and prevails over it to the extent of any inconsistency for that product.

We may update this Policy from time to time. The current version will always be available on our website. Where a change materially affects how we handle your personal information, we will take reasonable steps to notify you for example, by email or a prominent notice on our website in addition to posting the updated Policy.

2. What is Personal Information

Personal Information means information or an opinion about an identified individual, or an individual who is reasonably identifiable, whether or not the information is true and whether or not it is recorded in a material form. Sensitive Information (for example, health information or, in limited cases, information derived from an identity document) is a special category of Personal Information that we only collect with consent or where the Privacy Act otherwise allows.
Personal Information we collect includes:
• your name;
• your postal address;
• your email address;
• your telephone number(s);
• identification information, which we require to meet sanctions, anti-money laundering and counter-terrorism financing obligations under the Anti-Money Laundering and Counter-Terrorism Financing Act 2006 (Cth) and other regulatory requirements. This may incidentally include Sensitive Information (for example, a photograph on an identity document), which we only use for verification purposes;
• records of your communications and interactions with us;
• information from enquiries you make via our Contact Us form or by phone;
• your credit or debit card number, which we handle in accordance with clause 8 (Security); and
• your history of preferences, interests and behaviour relating to transactions, products and services on any Zenith website.

We also collect information that, on its own, may not identify you, including your computer’s IP address, device type, browser type, details of the site from which you accessed a Zenith site, the pages you visit, and the time spent on those pages, items and information searched, access times, dates and other statistics. We treat this information as Personal Information where it is reasonably capable of identifying you, including where it is combined with other information we hold.

In certain circumstances, such as when you purchase a gift card for another individual, we may collect Personal Information you provide about that individual, including their name, email address and postal address. You warrant that you are authorised to provide the Personal Information you give us and agree it may be used in accordance with this Policy.

3. How We Collect Personal Information
We may collect your Personal Information when you:
• browse a Zenith website;
• register on a Zenith website;
• verify your identify using biometric-enabled technology (such as facial recognition, fingerprint or voice recognition) as part of registering for or before using Zenith’s services;
• log into a Zenith website once registered;
• enter information into a form (on a Zenith website or otherwise);
• transact through a Zenith website;
• subscribe to Zenith’s marketing communications;
• click on Zenith website banners, hyperlinks or plugins;
• accept location or notification pop-ups on a Zenith website;
• interact with us on social media;
• participate in onsite, email or social promotions or competitions; or
• have a conversation with any of our team members.

We may also collect your information from third parties, such as business or commercial partners, identity-verification providers, or publicly available sources. If we receive Personal Information, we did not solicit and determine we could not have lawfully collected it, we will destroy or de-identify it as soon as practicable, where it is lawful and reasonable to do so.

4. Using and Disclosing Personal Information

We collect, hold, use and/or disclose Personal Information to:

• provide and improve the products and services you have requested;
• notify you about changes to the products and services you have requested;
• provide customer support;
• detect, prevent and address fraud, and technical or other issues;
• generally, carry out our business;
• comply with laws or regulations, including anti-money laundering, counter-terrorism financing and sanctions obligations; and
• promote and market products, services and special offers that may be of interest to you.

If you do not provide requested Personal Information, we may be unable to open or operate your account, process a payment, or otherwise provide the service, we will tell you where this is the case.

You may opt out of marketing communications at any time by clicking the unsubscribe link in any marketing email, or by contacting us. We comply with the Spam Act 2003 (Cth) for email and SMS marketing, and the Do Not Call Register Act 2006 (Cth) for telemarketing calls. You acknowledge it may take several business days to action an opt-out across all our systems. Where we use Personal Information collected by a third party for our own direct marketing, we only do so where you have consented.

We may disclose your Personal Information to third parties including banks, payment gateways, credit card schemes and processors, identity-verification providers, suppliers, couriers, mailing houses, and government authorities to fulfil our services to you or to meet our legal obligations. We require third parties who handle Personal Information on our behalf to apply standards no less rigorous than those required by Australian law.

5. Sending Information Overseas
Some of the third parties described in clause 4 (for example, identity-verification providers, cloud hosting and analytics providers such as Google, and international payment processors or card schemes) may store or process Personal Information outside Australia such as United States, and all the EU countries. Before disclosing Personal Information to an overseas recipient, we take reasonable steps to ensure that recipient does not breach the APPs in relation to that information for example, through contractual protections. We remain accountable under APP 8 for how an overseas recipient subsequently handles that information.

6. Access and Correction
You may request access to the Personal Information we hold about you and ask us to correct it if it is inaccurate, out of date, incomplete, irrelevant or misleading. Please contact us using the details in clause 10 to make a request.
We will respond within a reasonable period (we aim to respond within 30 days) and will not charge you for making a request, although we may charge a reasonable, non-excessive fee for giving access. We may refuse an access or correction request in the circumstances permitted under the Privacy Act; if we do, we will tell you why (unless the law prevents us from doing so) and how you can complain about the refusal.

7. How to Complain
If you have a concern about how we have handled your Personal Information, please contact our Privacy Officer using the details in clause 10, with enough detail for us to investigate. We will acknowledge your complaint promptly and aim to resolve it within 30 days.

If you are not satisfied with our response, or we have not resolved your complaint within that time, you may take your complaint to:
• the Australian Financial Complaints Authority (AFCA) – an independent external dispute resolution scheme, free of charge to you [insert AFCA member details]; and/or
• the Office of the Australian Information Commissioner (OAIC) – the independent regulator for privacy complaints under the Privacy Act.

8. Security and Retention
We take reasonable technical and organisational steps to protect the Personal Information we hold from misuse, interference, loss, and unauthorised access, modification or disclosure. These steps include encryption of data in transit and at rest, access controls, staff confidentiality obligations, and handling card data in a manner consistent with the Payment Card Industry Data Security Standard (PCI DSS).

Where we no longer need Personal Information for any purpose for which it may be used or disclosed under the APPs, and are not required by law to keep it, we take reasonable steps to destroy or de-identify it. Some records for example, identification records collected for anti-money laundering purposes must be retained for a minimum period set by law (currently at least seven years) before this applies. If we experience a data breach likely to result in serious harm, we will comply with the Notifiable Data Breaches scheme in Part IIIC of the Privacy Act, including notifying the OAIC and affected individuals as required.

No method of transmission over the internet, or method of electronic storage, is completely secure. We use commercially reasonable measures to protect your Personal Information but cannot guarantee its absolute security.

9. Cookies and Online Analytics
We use cookies when you visit a Zenith website to automate access and information-entry functions, and to improve website efficiency by understanding visitor behaviour. Some cookies are essential to the operation of our website; others (for example, analytics and advertising cookies) are not, and, where required by law, we will seek your consent before placing them and will provide a way to manage your preferences.

We use Google Analytics, a service offered by Google that tracks and reports aggregated and de-identified insights into how users behave on our website; this data is shared with other Google services, and Google may use it to contextualise and personalise its own advertising. You can opt out of Google Analytics by installing the Google Analytics opt-out browser add-on. Google’s privacy practices are described at https://policies.google.com/privacy?hl=en. We may use other analytics or advertising providers from time to time.

10. Contact Us

For any question, request or complaint about how we handle your Personal Information, please contact our team:

• Email: [email protected]
• Phone: 02 7248 6884