Privacy Policy

We are committed to managing personal information in an open and transparent way. This Privacy Policy sets out how we collect, hold, use, and disclose personal information. A copy of this policy is available on our website and will be provided to any person who requests it.

We collect personal information that is reasonably necessary for our business functions. We will notify you of the collection at or before the time of collection. Categories of information collected: • Identification Data: Name, email address, phone number, company name. • Payment Data: We do not store raw card data. Payments are tokenised via our PCI DSS-compliant payment processor. We store only the last 4 digits of your card and a payment token. • Usage Data: IP address, browser type, pages visited, time on pages, referral source. • Communications: Messages submitted through our contact form or support channels. We collect information directly from you where practicable. Where we collect information from a third party, we will take reasonable steps to notify you.

We use your personal information only for the primary purpose for which it was collected, or for a directly related secondary purpose, unless you consent or an exception under the Privacy Act applies. We use your data to: • Provide and improve our services • Process payments and send order confirmations • Respond to support requests • Send transactional emails (invoices, refund confirmations) • Comply with legal obligations • Prevent fraud and maintain security We do NOT sell, rent, or trade your personal information to third parties. We may share data with: • Service Providers: Vetted third-party vendors who assist in delivering our services (e.g., payment processors, cloud infrastructure). All are bound by data processing agreements. • Legal Requirements: Where required or authorised by Australian law (e.g., court order, subpoena). • Business Transfers: In the event of a merger or acquisition, with prior notice to you.

We use cookies to provide and improve our services. Essential Cookies: Required for basic site functionality (session management, security). Cannot be disabled. Analytics Cookies: Privacy-first analytics to understand site usage. Data is aggregated and anonymised. Preference Cookies: Remember your settings and preferences. You can control cookie settings through your browser. Disabling essential cookies may affect functionality. A cookie consent notice will appear on your first visit.

We take reasonable steps to ensure personal information we hold is accurate, up-to-date, complete, and relevant. We implement industry-standard security measures including AES-256 encryption at rest, TLS 1.3 for data in transit, access controls and least-privilege principles, and regular security reviews. We retain personal data for as long as necessary to provide services and meet legal obligations: • Account data: deleted within 90 days of account closure. • Payment records: retained for 7 years for GST and tax compliance. • Anonymised analytics: may be retained indefinitely.

You have the right to: • Access: Request a copy of the personal information we hold about you. • Correction: Request correction of inaccurate, out-of-date, or incomplete information. • Deletion: Request deletion of your personal information (subject to legal retention obligations). • Portability: Receive your data in a structured, commonly used format where technically feasible. • Opt-Out: Unsubscribe from marketing communications at any time. We will respond to access and correction requests within 30 days. We will not charge an excessive fee for access requests. To exercise these rights, email: contact@nationaltallytech.com

We comply with the Notifiable Data Breaches (NDB) scheme under the Privacy Amendment (Notifiable Data Breaches) Act 2017 (Cth). If we experience a data breach that is likely to result in serious harm to any affected individual, we will: • Notify the affected individual(s) as soon as practicable. • Notify the Office of the Australian Information Commissioner (OAIC). • Take immediate steps to contain the breach and prevent further harm.

For customers located in the European Economic Area (EEA), we also comply with the EU General Data Protection Regulation (GDPR). Our lawful bases for processing include contract performance, legitimate interests, and your consent where required. You may exercise your GDPR rights (including the right to erasure and data portability) by contacting us at contact@nationaltallytech.com.

If you believe we have breached the Australian Privacy Principles, please contact us first at contact@nationaltallytech.com. We will respond within 30 days. If you are not satisfied with our response, you may lodge a complaint with the Office of the Australian Information Commissioner (OAIC) at oaic.gov.au.

Privacy enquiries: INNOVATIVE NATIONAL TAX & UPKEEP INTERNATIONAL TALLY PTY LTD (trading as National Tally Tech) | ABN 75 696 801 895 U905, 6 Tonga Place, Parkwood QLD 4214, Australia contact@nationaltallytech.com | +61 447 180 277