Privacy Policy

APS currently operates as an intermediary and referral onboarding business. In that role, APS may collect, review, organise and transmit merchant application and identity-verification material to acquiring, payment or related service providers. APS facilitates onboarding and related administration; APS does not, in its ordinary current operations, act as the primary payment processor or hold or settle customer funds. Where a regulated provider, acquiring bank, payment processor or other partner is the primary service provider, that provider may have its own privacy policy and direct obligations to the individual or merchant. APS may disclose relevant information to that provider to facilitate the service requested.

• Identity and contact details: name, job title, business name, business address, email address, phone number and other contact details. • Merchant and business information: ABN or other registration details, ownership or director information, beneficial ownership information, trust or corporate documents, trading information and onboarding records. • Verification and supporting documents: copies, extracts or details from identity documents, bank account confirmation material, proof-of-address material, trust deeds, company extracts and related onboarding evidence where reasonably necessary. • Transaction or service-administration information: merchant application status, correspondence with providers, account notes, service requests, complaints, issue logs and implementation information. • Technical and website information: IP address, device or browser information, usage logs, cookies or analytics data and similar technical information generated when people use APS online channels. • Marketing and communications preferences: subscription choices, event participation, enquiry history and records of consent or opt-out requests. • Compliance, security and incident information: privacy requests, correction requests, complaints, suspected data-breach information, access-review records and investigation notes where relevant to APS governance obligations.

• Directly from individuals or merchant representatives through website forms, email, telephone, online meetings, onboarding packs, support tickets, portal uploads and other direct interactions with APS. • From authorised representatives such as directors, owners, employees, contractors, brokers, referral partners or other representatives acting for a merchant or prospective client. • From service providers or partners such as acquiring banks, payment processors, technology providers, identity or business-verification providers, advisers or other parties involved in a proposed or active service. • Automatically from cookies, analytics tools, log files and similar technologies used on APS websites and digital channels.

• Respond to enquiries and provide information about APS services. • Assess, prepare, submit and manage merchant or client onboarding requests. • Verify identity or business details to the extent reasonably necessary for onboarding support, fraud prevention, record quality and lawful operations. • Communicate with merchants, applicants, clients, partners and service providers about applications, services, complaints, incidents or support requests. • Operate, maintain, secure and improve APS systems, websites, document-submission channels and internal records. • Manage legal, regulatory, contractual, audit, risk and governance requirements. • Investigate suspected fraud, security issues, misuse, policy breaches or unlawful conduct. • Send updates or marketing materials where permitted by law and where the recipient has not opted out.

APS uses approved systems and repositories to handle different types of personal information. These may include customer relationship management systems, workflow and integration tools, business email and communications platforms, restricted document repositories, and approved submission channels used to communicate with payment and acquiring partners.

• Acquiring banks, payment processors, payment facilitators, merchant-service providers, gateway providers, POS or related service providers involved in the relevant application or service. • Technology, hosting, CRM, communications, document-management, analytics, support, security or verification providers engaged by APS. • APS personnel, authorised contractors and agents who need access to perform their duties and who are subject to confidentiality and security obligations. • Professional advisers, auditors, insurers, financiers or prospective transaction counterparties where appropriate and lawful. • Courts, tribunals, regulators, law-enforcement bodies or government agencies where disclosure is required or authorised by law. • Other parties where the individual has directed APS to share the information or has otherwise consented.

APS seeks to keep personal information within controlled environments and to use providers with appropriate safeguards. However, some APS service providers, support arrangements, cloud platforms or partner ecosystems may involve overseas access, storage, processing or onward disclosure. Where APS discloses personal information to an overseas recipient, APS will take the steps required under the Privacy Act that are reasonable in the circumstances. APS will provide information about relevant overseas recipient countries or regions where required and practicable.

APS may use contact information to send service updates, business communications or marketing materials about APS products and related offerings where permitted by law. Individuals can opt out of marketing communications at any time by using the unsubscribe facility, following the instructions in the communication or contacting APS directly.

APS seeks to keep personal information accurate, up to date, complete, relevant and not misleading having regard to the purpose for which it is held.

APS uses technical and organisational measures designed to protect personal information from misuse, interference and loss, and from unauthorised access, modification or disclosure. Depending on the information and systems involved, these measures may include role-based access restrictions, multi-factor authentication, encryption, secure transmission methods, logging, monitoring, staff and contractor obligations, incident response procedures and controlled deletion practices. No method of transmission or storage is completely risk free. Individuals and merchant representatives should use only the approved channel identified by APS when providing sensitive information, especially identity or onboarding documents.

APS keeps personal information only for as long as it is reasonably required for the purpose for which it was collected, for associated governance and evidentiary purposes, or for any legal, regulatory, insurance, contractual or dispute-related requirement. Where identity documents or onboarding materials are collected only to facilitate submission to a provider, APS aims to limit working copies and delete or de-identify them once they are no longer required for that purpose, subject to any legal hold, dispute, incident, minimal record-keeping requirement or provider/partner requirement.

Individuals may request access to personal information APS holds about them and may ask APS to correct information that is inaccurate, out of date, incomplete, irrelevant or misleading. APS may need to verify the requester's identity and authority before processing a request, especially where the request relates to business, merchant or identity-verification material. Requests should be sent to compliance@aps.business. APS may ask for the request to be made in writing so that it can be handled accurately and efficiently.

If an individual believes APS has mishandled personal information, they may make a complaint to APS at compliance@aps.business. APS will acknowledge the complaint, review the relevant facts and respond within a reasonable period. Where APS needs more time because the matter is complex, APS will let the complainant know. If the individual is not satisfied with APS's response, they may be able to complain to the Office of the Australian Information Commissioner (OAIC).

Suspected unauthorised access to, disclosure of, or loss of personal information should be escalated immediately to compliance@aps.business or the APS Privacy & Incident Lead. APS maintains internal processes to support containment, assessment, remediation and notification decisions.

APS websites may use cookies, pixels, analytics tools and similar technologies to operate online services, remember preferences, measure usage, improve functionality, support campaigns and manage security. Individuals can usually control cookies through browser settings, although disabling some cookies may affect site functionality.

APS uses workflow tools, including CRM-related workflows and integrations, to support operational administration. APS reviews its use of computer programs and automated workflows to assess whether they make, or substantially assist in making, decisions that could significantly affect an individual's rights or interests. Where applicable law requires specific information about such decisions to be included in this Privacy Policy, APS will provide that information.

APS may update this Privacy Policy from time to time to reflect legal, operational, technology or service changes. The current version will be published through APS's usual channels.

For privacy enquiries, access and correction requests, privacy complaints, or questions about APS's handling of personal information, contact compliance@aps.business.