Privacy Policy

August 1, 2026

1. This Privacy Policy

This Privacy Policy applies to the handling of personalinformation collected by Pebl Payments Pty Ltd ABN 47 661 102 030 and any ofits subsidiaries and affiliates (collectively, Pebl, we, us, our). We understand the importance of protecting anindividual’s personal information.

You may be a visitor to one of our Sites, a user of one ormore of our services (User or Pebl User), or a customer of a User(Customer) (together, you). If you do not understand anything in this Privacy Policy, please contactus at support@peblpay.com.au before using the Services or our Sites.

When you access our payment services, access our website (at peblpay.com.au)or any other websites that we own or control and enable internet users toaccess (our Sites), use the Pebl mobile application(s) (Pebl App),the Pebl web Dashboard (Dashboard) or interact with our social mediaaccounts (together, the Services), we may collect, use or otherwisemanage your personal information. Incollecting, holding, using, disclosing and otherwise managing your personalinformation, Pebl will comply with the Privacy Act 1988 (Cth) (PrivacyAct) and the Australian Privacy Principles under the Privacy Act.

We may vary this Privacy Policy at any time in accordance withsection 14 of this Privacy Policy. You should check our website from time totime to view our current policy. If required by law, we will notify you inwriting a reasonable period of time before changes to the Privacy Policy takeeffect.

2. What information we may collect

Personal Information is information or an opinion about anidentified, or reasonably identifiable, individual.

Our Services enable and facilitate Users to manage businesses,conduct transactions and safely accept payments, and may include services thatenable and facilitate persons to pay each other. In conducting our business and providing theServices, we may collect your personal information. While you are not required to provide us withany personal information we request (and can refuse to do so), we cannotprovide you with certain (or any) Services without this information, and we maybe limited in how we can interact with you.

The personal information we collect will vary depending on ourparticular interaction with you. Generally speaking, the kinds of personal information we collect mayinclude but is not limited to:

(a) if you are a User:

(i) your contact information such as your name, address, telephonenumber, email address and date of birth;

(ii) information necessary to verify your legal and beneficialownership of the business (which may include copies of government-issuedidentifiers, financial statements or documents, business invoices);

(iii) business information such as ACN, ABN, ACNC registration, address,website and phone number;

(iv) proof of identity, such as your contact information andgovernment identifiers;

(v) information regarding your preferences regarding our productsand services; and

(vi) in order for us to provide our services to you, your financialinformation, including your bank account credentials, account numbers andgeneral information about your financial circumstances and objectives;

(b) if you are a Customer:

(i) your full name, email address, phone number, and billing orshipping address, as input by you during the payment process;

(ii) depending on what kind of payment method you choose to utilisefor a particular transaction, we may collect information about your chosenpayment method, including:

(1) for direct transfers: information about your bank account;

(2) for credit and debit card purchases, information about yourcard including CVV / CCV, cardholder details, expiry date and card number;

(3) for purchases using Google Pay and/or Apple Pay, informationabout your use of Google Pay or Apple Pay (and any card or virtual card numbersassociated with these payment methods)

(4) for purchases made using a buy-now-pay-later payment option,information about your use of the buy-now-pay-later service and any informationyou provide as part of that service; or

(5) any other information you provide in the course of completinga transaction;

(iii) details regarding the transactions using our Services betweenyou and each Pebl User, including the transaction date, payment methodutilised, name of the merchant and which may in some cases include informationabout your purchase; and

(iv) information regarding your purchasing history utilising thePebl Services; and

(c) if you are a general user of our Sites or social mediaaccounts or if you make an inquiry or contact us through our Sites, your name,email address, and anything else you tell us about your business, transactionsand needs in the body of your correspondence.

You may also choose to provide us with additional personalinformation via other methods, which include your voluntary participation inany promotion or program we may be running, in connection with an actual orpotential business relationship with us, in response to marketing or othercommunications, or as part of interactions at trade shows or other events.

3. Use by minors

The Services we offer are not directed to individuals underthe age of eighteen (18), and we request that they not provide personalinformation through the Services. Wewill promptly destroy any personal information we hold if we become aware thepersonal information relates to a person under the age of eighteen (18) (to theextent permitted by law).

4. How we collect your information

4.1 Information collected fromyou

Generally, we will always collect personal information aboutyou, directly from you. For example, wemay collect your personal information:

● when you register for an account with us, request informationor services from us, or otherwise provide us with your details or details ofany employees or volunteers in the case of charity related or NFP users;

● when you enter into, or propose to enter into, a transactiondirectly with us;

● when you enter into, or propose to enter into, a transactionwith a Pebl User using our Services;

● where you download or use the Pebl App, including in relationto your use of our Services;

● where you use our Sites or otherwise interact with us,including if you post information to our Sites or social media accounts;

● if you attend an event conducted or supported by Pebl; or

● when you complete a survey or enter a promotion or competitionconducted by us or on our behalf.

4.2 Information collected fromsources other than you

There may be occasions when we will collect your personalinformation from someone other than you. This may include:

● from our other service providers or business partners thathelp us provide our services. These mayinclude:

○ any card-payment network provider such as American ExpressTravel Related Payment Services Company, Inc. (American Express),MasterCard International Inc. (MasterCard), Visa Inc. (Visa), JCBCo., Ltd. (JCB), UnionPay International (UnionPay) and theirrespective affiliates;

○ third party payment acquirers and/or providers we havepartnered with to offer the card-payment functionality and the direct accounttransfers functionality of our Services;

○ third party buy-now-pay-later payment providers offeredthrough our Services; or

○ any other third party partners or providers as we may advisefrom time to time;

● from third parties you have authorised to disclose yourinformation to us, such as if you are the representative of a business which isa Pebl User;

● from a publicly maintained record or other publicly availablesources of information including social media and similar websites;

● from our Users in the course of their use of the Services(i.e. our Users may provide us with personal information that they havecollected about you where you are their Customer, as part of our provision ofthe Services);

● when we conduct fraud monitoring, prevention, detection, andfinancial compliance activities or provide such services to our Users, we mayreceive personal information about you from our business partners, financialservice providers, identity verification services, regulators and publiclyavailable sources (e.g., name, address, phone number, country), as necessary toconfirm your identity and prevent fraud; or

● from third parties if you connect to our services or registeran account with us using an external third-party application, such as Facebookor Google.

We will only collect your personal information from sourcesother than you if it is unreasonable or impracticable to collect that personalinformation from you, or where we have your consent to this collection.

We also collect information about your online activities onwebsites and connected devices over time and across third-party websites,devices, apps and other online features and services. We use Google Analyticson our Sites to help us analyse your use of our Sites and diagnose technicalissues.

We will delete, destroy or completely anonymise any personalinformation we hold when it is no longer relevant or necessary for the purposeswhich we collected it subject to our regulatory retention obligations.

5. Cookie Policy

Our Sites use cookies and other technologies to functioneffectively. A cookie is a small file stored on the hard drive of your deviceand sent via a web server so that some information about your browsing activitycan be collected. These technologiesrecord information about your use of our Sites, including:

● browser and device data, such as IP address, device type,operating system and Internet browser type, screen resolution, operating systemname and version, device manufacturer and model, language, plug-ins, add-onsand the language version of the Sites you are visiting;

● usage data, such as time spent on the Sites, pages visited,links clicked, language preferences, and the pages that led or referred you toour Sites.

When you visit our websites or other online services, we mayleave a 'cookie’ in the memory of your web browser - please note that cookiesdo not cause any damage to your device, and they cannot access or read thefiles on your hard drive. These cookiesmake your interactions with our Sites easier, more useful and lesstime-consuming for you because they store information that is reusable eachtime you visit our website (such as your preferences). We may use cookies totarget advertisements for our Services to you on our Sites and other sites youvisit (e.g. using cookies to identify your device and direct ads for ourServices to you).

The majority of web browsers are set to accept cookies.However, you may wish to set your browser to limit the number of cookiesaccepted or to block all cookies, by changing the browser’s settings. Please be aware that by disabling all thecookies on the Site, certain functionalities may not be available.

6. How we use theInformation we collect

In this section, we have set out some of the main ways inwhich we may use personal information we collect or hold about you. In addition to these categories, we may alsouse your personal information for purposes reasonably related to those set outhere, or if we are otherwise required or authorised by law.

If we need to use your personal information in other ways, wewill aim to notify you and obtain your consent where required by applicable law.

6.1 Our Services

Generally, we collect, hold, use and disclose personalinformation so that we can offer our Services to you (including maintaining andimproving on those Services) and to facilitate the business relationships wehave with our Users as part of our legitimate business interests.

Instances where we may handle your personal information andthat of your Customer as part of our legitimate business activities include:

● monitoring, preventing and detecting fraud and unauthorizedpayment transactions (including as part of our legal obligations);

● mitigating financial loss, claims, liabilities or other harmto us, our third party partners and our Users;

● responding to inquiries, sending service notices and providingcustomer support;

● promoting, analysing, modifying and improving our Services,systems, tools and the Pebl App, and to potentially develop new products andservices;

● managing, operating and improving the performance of our Sitesand Services by understanding their effectiveness and optimizing our digitalassets;

● analysing and advertising our Services;

● conducting aggregate analysis and developing businessintelligence that enable us to operate, protect, make informed decisions, andreport on the performance of, our business;

● sharing personal information with third party serviceproviders, regulators and partners that provide services on our behalf orrequire us to comply with certain obligations and which help us operate andimprove our business;

● ensuring network and information security throughout Pebl andour Services; and

● transmitting personal information with our service providersand agents for internal administrative purposes or to otherwise provide youwith our Services.

6.2 Contractual andpre-contractual business relationships

We may use your personal information for the purpose ofentering into business relationships with prospective Pebl Users, and toperform the contractual obligations under the contracts that we have with PeblUsers. Activities that we conduct in this context may include:

● creating and managing Pebl accounts and Pebl accountcredentials;

● accounting, auditing, and billing activities; and

● processing of payments, communications regarding suchpayments, and related customer services.

6.3 Legal and regulatorycompliance

We may use personal information to verify the identity of ourUsers (and in some cases, their Customers) in order to comply with contractual fraudmonitoring, prevention and detection obligations, laws associated with theidentification and reporting of illegal and illicit activity, such as AML(Anti-Money Laundering), KYC (Know-your-Customer) obligations and KYB (Know-your-Business)obligations, and contractual financial reporting obligations.

These obligations may be imposed on us by the operation oflaw, regulators, industry standards, and by our financial partners, and mayrequire us to report our compliance to third parties, and to submit to thirdparty verification audits. We will onlyhandle your personal information in this context as required by law or at therequest of a relevant government authority.

7. Direct marketing

We may send you email or text marketing communications aboutPebl products and services, invite you to participate in our events or surveys,or otherwise communicate with you for marketing purposes. You can opt-out ofreceiving direct marketing information from us at any time by contacting usthrough the contact details set out in this policy. If you receive a marketingor promotional email from us and you no longer wish to receive marketing orpromotional materials or communications from us you may opt-out via theunsubscribe link included in such emails.

We do not sell or rent the personal information of our Users,their Customers or our Site visitors.

8. How weDisclose the Information we Collect

Pebl will only share or disclose your personal informationwith trusted entities that it has partnership or service arrangements in placewith, and for the purposes set out in this Privacy Policy. We may share or disclose your personalinformation to the entities described in this section below.

8.1 Pebl entities

We may share personal information with our related entities oraffiliates (if applicable) in order to provide our Services and for internaladministration purposes.

8.2 Our service providers

We may share personal information with a limited number of ourauthorised service providers that provide services on our behalf, such asidentity verification services, acquiring and payment processing partners, websitehosting, cloud storage facilities, data analysis, information technology andrelated infrastructure, customer service, email and text delivery, and auditingservices. We will only authorise suchservice providers to use or disclose the personal information as strictlynecessary to perform services on our behalf or to enable us to comply with our legalrequirements.

We require all service providers which may receive personalinformation from us to contractually commit to protecting the security,confidentiality and integrity of the personal information they handle on ourbehalf.

8.3 Other third parties

We may disclose personal information with other third partiesto provide our Services to our Users. Below is a list of our main service providers, which we may disclosepersonal information to in order to provide our Services (to both Users andCustomers):

● card-payment network providers such as American ExpressCompany, Inc. (American Express), MasterCard International Inc. (MasterCard),Visa Inc. (Visa), JCB Co., Ltd. (JCB), UnionPay International (UnionPay)and their respective affiliates;

● banks and other authorised financial institutions;

● our third party payment providers, acquirers and processors whichallow us to offer the secure card-payment gateway functionality, and the directaccount transfers (‘Pay ID’ and ‘Pay To’) functionality, as part of ourServices; and

● third party buy-now-pay-later payments providers who we havepartnered with to offer the buy-now-pay-later payment option functionalitythrough our Services.

We require all third parties who receive personal informationfrom us to contractually commit to protecting the security, confidentiality andintegrity of the personal information they handle on our behalf to the extentwe directly contract with such third parties.

8.4 Our Users and thirdparties authorized by our Users

We may disclose personal information to Users as necessary tomaintain a User Pebl account and to allow us to provide the Services. We may also share personal information withparties directly authorised by a User to receive personal information, such aswhen a User authorises a third-party application provider to access that User’sPebl account using Pebl APIs.

The use and handling of personal information by an authorisedthird party is subject to that third party's privacy policy.

8.5 Marketing purposes

We may also disclose personal information to social mediaproviders and other similar marketing providers, in order to conduct themarketing activities set out in section 7.1 of this Privacy Policy.

8.6 Corporate transactions

In the event that we enter into, or intend to enter into, atransaction that alters the structure of our business, such as areorganization, merger, sale, joint venture, assignment, transfer, change ofcontrol, or other disposition of all or any portion of our business, assets orstock, we may disclose personal information with third parties in connectionwith such transaction.

Any other entity which buys us or part of our business willhave the right to continue to use your personal information, but only in themanner set out in this Privacy Policy unless you agree otherwise.

8.7 Legal and professionaladvisors

We may disclose personal information to our legal andprofessional advisors (including legal and accounting firms, auditors,consultants, insurers and other professional advisers).

8.8 Compliance and harmprevention

We may disclose personal information if we reasonably believedisclosure is necessary to:

(a) comply with any applicable law, regulation, direction from agovernment or law enforcement agency or payment processing rules or guidelines;

(b) enforce our contractual rights;

(d) respond to requests from courts, law enforcement agencies,regulatory agencies, and other public and government authorities.

8.9 With your consent or asrequired by law

We may also share or disclose your personal information inother ways, for other purposes or to other entities where we have your consent,or if this disclosure is required by law or by a regulatory authority.

9.Your rights and choices

9.1.Your consent

Where our handling, use or disclosure of your personalinformation is based on your previously given consent, you have the right towithdraw this consent (in whole or in part) at any time, by contacting us. Ifyou withdraw such consent, we may no longer be able to process transactionsthrough your Pebl User account.

9.2 Accessing and correctingyour personal information

We take steps reasonable in the circumstances to ensure anypersonal information we hold is accurate, up-to-date, complete, relevant andnot misleading.

Where you have a Pebl account, you can update, review orcorrect your personal information by contacting Pebl through in app support or support@peblpay.com.au where Pebl will reassess the Peblaccount and, consent to the change, if it is satisfied the change should bemade.

9.3 How to exercise theserights

In order for us to facilitate a request to withdraw or amendyour consent or amend the personal information we hold in relation to you:

● you may be asked to provide proof of identity to ensure thatpersonal information is provided only to the correct individuals and that theprivacy of others is protected;

● we ask that you be reasonably specific about the informationyou require or the request you are making, or that you answer our reasonablequeries to assist us to better understand your request; and

● (in relation to a request for access) we may charge you areasonable administration fee, which reflects and will not exceed the cost toPebl for providing you with certain access to your personal information inaccordance with your request.

We will endeavour to respond to your request within 30 days of our receipt of your request. If we refuse your request (e.g. if we areunable to grant you access to certain personal information) we will provide youwith written reasons for the refusal, where it is reasonably practicable for usto do so, and details of our complaint mechanisms.

If you are a Customer, you must contact the individual Pebluser (i.e. the merchant in your transaction) regarding your privacy rights

We may not be able to facilitate (or respond to) certainrequests if we no longer hold any personal information in relation to you.

10.How do we store and secure your personal information

10.1 Our security measures

Pebl maintains administrative, technical and organisationalsafeguards designed to protect personal information having regard to the natureof the information processed, applicable legal obligations, industry standardsand evolving cybersecurity threats. These safeguards may include encryptiontechnologies, authentication controls, access management, audit logging,monitoring, secure software development practices and periodic security reviewsappropriate to the Services provided. We take steps to ensure the personalinformation we collect and hold is protected from misuse, interference andloss, and from unauthorised access, modification and disclosure. Examples of the security measures we have inplace to secure your personal information include:

● your personal information is only accessible to a limitednumber of Pebl personnel who need access to the information to perform theirduties and provide our Services;

● we require all employees to comply with internal informationsecurity policies and keep information secure, and we have in place proceduresfor training our employees about their obligations under this Privacy Policy;

● we monitor and regularly review our practices against our ownpolicies, our legal obligations and industry best practice;

● we utilise third party identity and access managementtechnologies to control access to systems on which information is processed andstored; and

● we have in place procedures and partnerships to ensure thegeneral security of our technical environments.

Unfortunately, no data transmission or storage system can beguaranteed to be 100% secure. If you have any reason to believe that yourinteractions or communications with us are no longer secure (for example, ifyou feel that the security of your account has been compromised), pleasecontact us immediately using the contact details set out below.

Where you have a Pebl account with us, you are responsible formaintaining the confidentiality and security of your username, password,biometric data, or any such login details, and you must notify us immediatelyif you believe that those log in details or your account generally has beencompromised. You must also comply withany requirements or obligations set out in our Terms and Conditions.

10.2 Data breach response

Pebl maintains procedures for identifying, investigating,responding to and mitigating suspected or actual security incidents involvingpersonal information. Where Pebl becomes aware of an eligible data breachaffecting personal information, Pebl will respond in accordance with applicableprivacy laws, including the Notifiable Data Breaches scheme under the PrivacyAct 1988 (Cth), where applicable. Pebl may also notify affected individuals,regulators, Merchants or other relevant parties where required by law or wherePebl considers such notification appropriate in the circumstances.

10.3 Our retention of personal information

We generally only retain your personal information for as longas we are providing the Services to you, and we will destroy or permanentlyde-identify any personal information we no longer require subject to recordretention obligations imposed by law.

We may retain personal information after we cease providingServices directly or indirectly to you, even if you close your Pebl account orfinalise your transaction with a Pebl User, for the following reasons:

● to the extent necessary tocomply with our legal and regulatory obligations, including our tax,accounting, and financial reporting obligations;

● for the purpose of fraudmonitoring, detection and prevention;

● where we are required toretain the data by our contractual commitments to our financial partners;

● if data retention ismandated by industry rules for the payment methods that we support.

Where we retain data, we will only do so in accordance withany limitation periods and records retention obligations that are imposed byapplicable laws or industry rules.

11. Anonymity

11.1Anonymous information

Information is anonymous if it is not associated with orlinked to personal information and cannot be used to identify an individual.

We may create anonymous data records from personal informationwe collect or hold in relation to you, by anonymising your personal information(e.g. removing your contact details) from those data records. We may use this anonymous data to analyseusage patterns or for other aggregate data analysis so that we may enhance thecontent of our Services. We reserve theright to use anonymous data for any purpose and disclose anonymous data tothird parties in our sole discretion.

11.2 Your anonymity

We will need your personal information in order to provide ourServices to you, and we cannot provide You with our Services if you areengaging with us anonymously or using a pseudonym.

12. Overseas disclosuresof our personal information

We currently operate Pebl in Australia with local and globalacquirers and third parties.

Therefore, personal information may be disclosed to recipientslocated overseas in particular the United Kingdom or United States.

Pebl primarily stores personal information usinginfrastructure located in Australia. In providing the Services, certainpersonal information may be processed, accessed or securely transmitted byauthorised service providers or payment processing partners located outsideAustralia where reasonably necessary to facilitate the Services, comply withlegal or regulatory obligations, or maintain the security and integrity of theServices. Pebl takes reasonable steps to ensure that such recipients protectpersonal information in a manner consistent with applicable privacy laws andPebl's contractual obligations.

We will at all times take reasonable steps to ensure that anysuch overseas recipients do not hold, use or disclose your personal informationin a way that is inconsistent with the obligations imposed under the PrivacyAct and the Australian Privacy Principles in the Privacy Act.

Though we store personal information in Australia, where wetransfer or store personal information outside of Australia to countries otherthan those described above, we will update this privacy policy and notify youof this fact to the extent required by law.

13. GDPR

For the purposes of this section 13, ‘Personal Data’ has themeaning given in Article 4 of the European Union General Data ProtectionRegulations (GDPR).

Pebl is located in Australia and currently as at the date ofthis Privacy Policy provides services within Australia. You must provide us with advance writtennotice of our need to comply with the GDPR in relation to your Personal Data ifyou are located within the European Union at the time at which we will collectPersonal Data or at the time at which we propose to transfer Personal Dataoverseas.

14. Updates to thisPrivacy Policy

We may change this Privacy Policy from time to time to reflectany new services or products we may offer, changes in our personal informationhandling practices or relevant laws. The‘Last updated’ notice at the top of this Privacy Policy indicates when thisPrivacy Policy was last revised. Any changes are effective thirty (30) daysafter we post the revised Privacy Policy on the Sites.

We may provide you with disclosures and alerts regarding thePrivacy Policy or Personal Information collected by posting them on our websiteand, if you are a User, by contacting you through your Pebl App, through youruse of the Pebl Services using the web, email address, mobile and/or thephysical address listed in your Pebl account.

15. Links to other websites

The Services we offer may provide the ability to connect toother websites. These websites may operate independently from us and may havetheir own privacy notices or policies, which we strongly suggest you review. Ifany linked website is not owned or controlled by us, we are not responsible forits content, any use of the website or the privacy practices of the operator ofthe website.

16. Privacy complaints

If at any time you have a complaint or issue with this PrivacyPolicy or how we handle your personal information, please contact us using ourcontact details set out below. At alltimes, your privacy complaints:

● will be treated seriously;

● will be dealt with promptly;

● will be dealt with in a confidential manner (to the extentlawful and practicable); and

● will not affect your existing obligations or affect thecommercial arrangements between you and Pebl.

We will endeavour to respond to your complaint within areasonable time, or within the time required by law, of our receipt of yourrequest.

If you are a Customer, you may need to contact the individualPebl User (i.e. the merchant in your transaction) in relation to certainaspects of your privacy rights and complaint.

As part of our process in addressing your complaint, we maycommence an investigation into your complaint. You will be informed of the outcome of your complaint followingcompletion of the investigation. In theevent that you are dissatisfied with the outcome of your complaint, or anextension to the time within which we may resolve it, you may refer thecomplaint to the Office of the Australian Information Commissioner (OAIC).

You can contact the OAIC on 1300 363 992 or at oaic.gov.au

17. Contacting us

For further information or enquiries regarding your personalinformation, or if you would like to opt-out of receiving any promotional ormarketing communications or make a privacy complaint, please contact us usingany of the following contact details:

Email: contact@peblpay.com.au

‍