BPAY Pty Ltd ABN 69 079 137 518 (BPAY) is a leading payment service provider in Australia. In 1997, BPAY launched BPAY Payments which allows customers to make bill payments over the internet through their financial institution’s online banking service. BPAY Payments was enhanced in 2002, with the introduction of BPAY View which allows customers to view, pay and store their bills from a single location.
In 2017, BPAY launched a new payment service called Osko which allows users to transfer funds to and from their accounts. Osko leverages the new infrastructure for Australia’s payments called the “New Payments Platform” which is provided by NPP Australia Limited.
Both BPAY Payments and Osko (each, a Scheme Product) are provided as part of the scheme operated by BPAY (the Scheme).
BPAY, along with BPAY Group Limited ABN 60 003 311 644 (BPAY Group), and their other group companies (together, the BPAY Entities) also provide a range of other products and services (each, an Other Product).
The BPAY Entities recognise the trust you are placing in us through your dealings with us. We do everything we can to maintain that trust. We are committed to the protection of your personal information. Our policies comply with our legal obligations (including those set out in the Australian Privacy Principles) and are intended to protect your privacy as we collect, use, disclose, transfer, store or otherwise handle information we gather about you. Our staff and service providers are well trained in these policies.
In this policy:
• "our service providers" refers to third party service providers who we engage to provide goods or services to us or to participants in the Scheme;
• "Products" refers to Scheme Products and Other Products;
• “us" or "we" refers to the BPAY Entities;
• “your service providers” refers to third parties that provide goods or services to you. In the case of Scheme Products, your service providers include Billers and other persons to whom you send money or from whom you receive money using a Scheme Product.
We may collect personal information directly from you in some circumstances. In the case of Scheme Products, we will, in most cases, obtain information about you through your financial institution or your service providers in the course of managing and operating the Scheme.
The following sections describe the kinds of information that we receive, collect and hold and the purposes for which we receive, collect, use and disclose that information.
While you are under no obligation to provide us with your personal information, we may, unfortunately, not be able to provide you with the products, services or information which you require if you do not provide us with:
• the personal information we ask you; or
When you make a general enquiry directly to us or our service providers about the BPAY Entities our Products or our service providers, or when you participate in any marketing or promotional activities which we run (such as competitions), you may provide us with a range of personal information including:
• your name
• your contact number
• your email address, and
• details about your financial institution and your service providers.
If your enquiry requires us to liaise with your financial institution or your service providers, we will pass on any personal information you provide in relation to your enquiry to your financial institution or service provider (as the case may be) for the purpose of responding to your enquiry.
We will retain a record of your personal information for backup or administrative purposes. Section 10 sets out more information about your rights to request access to information which the BPAY Entities hold about you, and how you can ask us to correct it if you believe it is inaccurate or out of date. You can also contact us using the details set out in section 10 if you would like to discuss your privacy rights further.
3 Operation of the BPAY Scheme
If you or your organisation elects to subscribe to a Scheme Product offered under the Scheme, we may receive a range of personal information about you in the course of managing and operating the Scheme.
For example, if you or your organisation participate in BPAY Payments, we may receive personal information about you:
• from your financial institution, if you choose to become a registered user of BPAY View; or
– directly from you through the BPAY Operations Portal or other means such as email; or
– from your financial institution or your service providers,
in the course of:
– managing transactions; and
– conducting investigations and adjustments (for example investigating disputes, mistaken payments, fraud, etc.).
We will not ordinarily receive personal information about you in the course of providing Osko, as Osko transactions are not processed directly by us. However, your financial institution may provide us with personal information in some circumstances. For example we may receive personal information if we are required to investigate fraud in connection with Osko.
We will receive and process personal information referred to in this section 3 for the purposes of managing and operating the Scheme. We may also disclose such personal information to third parties like our Scheme Members, our service providers and your service providers (or their contractors) if we need to do so to manage and operate the Scheme. Some recipients of your personal information or their processing agents may be located overseas.
4 Other Services
If you elect to use a Other Services offered by a BPAY Entity, we may receive a range of personal information about you, either directly from you or from third parties in the course of providing that Other Service.
For example, if you use the "BatchMaker App", we may collect personal information from third parties such as the provider of the accounting software through which we make the App available.
We will receive and process personal information referred to in this section 4 for the purposes of providing you with the Other Services.
5 How your personal information is used
In addition to the uses described above in sections 2, 3 and 4:
• where we provide you with a privacy collection statement which indicates that we may use your personal information to promote our goods and services and those of third parties which we believe may be of interest to you, we may do so in accordance with that privacy collection statement. You can opt out of receiving such notifications at any time by using the unsubscribe method set out in the relevant communication, or by contacting our Privacy Officer (contact details are set out in section 10 below); and
• we may also use your personal information in an aggregated and de-identified form for statistical, analytical, research, quality assurance, product improvement and other purposes, provided that no details regarding you (including your identify, financial institution account details or otherwise) can reasonably be derived from the information.
6 How your personal information is stored
We take reasonable steps to protect your personal information from misuse, interference, loss, unauthorised access, and modification. For example, our service providers use firewalls (security measures for the Internet) and other systems such as user identifiers and passwords to control access to our computer systems.
7 Disclosing your information to other third parties
In addition to the disclosures described in sections 2 and 3, we may disclose your personal information to:
• other BPAY Entities (who will only use such personal information in the same manner that we may);
• our service providers, but only for the purpose of providing goods or services to us. We require our service providers to agree to appropriate privacy restrictions, and only permit them to access personal information to the extent needed to provide goods or services to us; and
• third parties (including government agencies and regulators) in order to comply with applicable laws or regulations, or in order to comply with a court order, subpoena or other legal process, or to comply with a request by a government authority, law enforcement agency or similar body (whether situated in Australia or elsewhere).
8 Transfer of your information to third parties
We may transfer your personal information to a third party in connection with the reorgansiation, transfer or sale of some or all of our business.
9 Other information we collect
When you use our website or applications, we may also collect the information in a way in which we cannot identify you. For example, we may collect information such as:
• the date and time you access our website and applications;
• the internet address of the website from which you linked directly to our site or application; and
• the web browser that you are using and the URL.
We may obtain this information directly or from third parties (such as our internet service providers). We use this information to develop a more user friendly information website and applications and to improve our service offerings to you.
10 Tips on sending us information
While we do all we can to guard your privacy, no data transfer over the Internet is 100% secure. When you share your information with us, it is at your own risk. There are ways you can help maintain the secrecy of your information. For example, you should:
• always close your browser or application when you have finished your user session;
• ensure others cannot access your personal information and emails if you use a public computer;
• not share user name, password or other access credentials which you use to access BPAY’s systems with anyone else.
11 How you can update, correct, or delete your personal information or make a complaint if something goes wrong
If your personal information was collected by your financial institution or your service providers, they will be best placed to assist you with any enquiries regarding that information. Accordingly, you should contact the relevant financial institution, service provider or appropriate third party in the first instance if you believe that your information is incorrect or if you suspect someone has gained access to that information without your permission. Of course, you can also contact us and we will attempt to assist you where we are able to do so.
If you have provided your personal information directly to us and you would like to update, correct or delete the personal information we hold about you, you can contact our Privacy Officer by emailing firstname.lastname@example.org or writing to us at PO Box H124, Australia Square NSW 1215.
You can also contact us directly if you believe:
• we have breached our privacy obligations or your privacy rights in any way, or
We will try to satisfy any questions that you have and correct any errors on our part.
If you are not satisfied with our response, you may make a complaint to the Office of the Australian Information Commissioner by phoning 1300 363 992 or by email at email@example.com
Last updated: 15 March 2018