Australia Privacy Act Notice

Effective: September 18, 2026
Updated: September 18, 2026
Version: 1.1

On this page

This notice explains how Tanqory Inc. (“Tanqory”, “we”) collect, use, disclose, transfer, and safeguard personal information in Australia under the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs) with reference to OAIC guidance. It aligns with Tanqory’s global Privacy Policy so merchants, their customers, developers, and visitors understand their rights and choices.

Purpose, scope, and roles (APP 1, 5)

This notice applies when you: (a) use Tanqory as a merchant or team member; (b) check out or interact as a merchant’s customer; (c) visit our sites, apps, dashboards, or developer portal; or (d) integrate with Tanqory APIs as a partner. We process for stated purposes in line with the APPs and provide collection notices linking to this notice, our Privacy Policy (https://legal.tanqory.com/legal/platform/privacy-policy), and supplementary resources.

What we collect (APP 2–4)

We collect only what is reasonably necessary and in fair ways:

Account and contact: names, business contact details, role, authentication, preferences.
Transactions and payments: orders, payments, refunds, chargebacks, shipping, disputes.
Technical and events: IP, device/browser type, login timestamps, security events, necessary cookies/identifiers, language/time zone, system logs.
Merchant customer data: order and fulfillment details, payment information passed through our platform, communication preferences, and data rights requests.
KYC/AML: identity documents, source of funds, AML/CTF screening outcomes, sanctions checks where required.
Consents and preferences: marketing opt-ins/opt-outs, cookie and communication settings, proofs of consent or withdrawal.
Sensitive data: not intentionally collected unless required by law or with explicit consent; if received unintentionally, we delete or de-identify unless legally required to retain.
Unsolicited data: assessed and deleted or de-identified if not required, consistent with APP 4.
Children/minors: services target businesses; if minor data is processed unintentionally, we delete or de-identify unless retention is legally required.

Why we use personal information (APP 6–7)

We use information for primary purposes disclosed at collection and other uses that are reasonably related, including:

Delivering services: operating the platform, processing payments, shipping integrations, authentication, support, account administration.
Security and fraud prevention: detecting and preventing fraud, abuse, unauthorized access, and term violations using proportionate controls.
Product improvement: monitoring performance, debugging, testing features, and contextual experience tuning without behavioral advertising that conflicts with APPs or the Spam Act.
Legal and compliance: bookkeeping, tax, AML/CTF checks, sanctions screening, and responding to lawful requests.
Direct marketing (where permitted or consented): product updates, offers, or education with clear opt-out in every channel, honoring Do Not Call and Spam Act obligations.
Enforcing rights and managing disputes: chargebacks, collections, claims, or defense of rights.
Secondary uses requiring consent: for new purposes not reasonably related to the original, we seek explicit consent unless a legal exception applies.

We share information with:

Processors/service providers: hosting, cloud, CDN, email delivery, analytics, customer support tools, payment and payout partners, logistics providers, fraud detection services.
Banks and payment networks: to process payments, refunds, chargebacks, risk checks, and AML/CTF obligations.
Government, regulators, and courts: when required by law or binding orders.
Professional advisors: legal, compliance, tax, and auditors when needed to protect our rights or comply with obligations.

Cross-border transfers under APP 8: data may be sent to Singapore, the United States, the European Union, and other provider locations. We use contractual safeguards (DPAs, SCCs or equivalents), reasonable security due diligence, and monitoring to ensure protections comparable to the APPs or rely on permitted exceptions. We do not use or disclose government identifiers such as TFNs or Medicare numbers except as required by law (APP 9).

Cookies, analytics, and tracking

We use strictly necessary cookies for login, security, and core functionality; performance/analytics cookies to improve experience; and marketing cookies only with consent. Controls are available via browser settings and our cookie preference center; some features may be limited if cookies are disabled.

Examples of trackers

Necessary: session management, authentication, non-invasive device fingerprinting for fraud prevention.
Analytics: aggregated performance metrics, feature adoption, and error diagnostics.
Marketing: enabled only after consent and paired with easy opt-out.
Not used: invasive tracking for behavioral advertising that conflicts with the APPs or the Spam Act.

Data quality (APP 10)

We take reasonable steps to keep information accurate and up to date. You may be prompted to review details in your dashboard or support tickets. If data is incorrect, you can request rectification using the channels in “Your rights”.

Retention and security (APP 11)

We retain data only as needed for business and legal purposes, then securely destroy or de-identify. Safeguards include encryption in transit and at rest, role-based access with logging, security monitoring and incident response, regular vulnerability testing, employee privacy training, and supplier due diligence with contractual processor obligations.

Illustrative retention approach

Accounts and contact data: duration of the customer relationship plus statutory accounting/tax periods.
Transaction and payment records: retained to satisfy financial, tax, scheme, and audit requirements.
Security logs: retained for periods necessary for incident investigation and compliance.
Consent and marketing logs: retained to demonstrate compliance with the Spam Act and APP 7.
End of need: data is securely destroyed or de-identified with records of the action.

Your rights under the Privacy Act and APPs

Access: request a copy of your personal information; we aim to respond within a reasonable period (typically within 30 days). If we refuse under a lawful exception, we will explain why.
Correction: request updates where information is inaccurate, incomplete, or out of date. If we decline, we will note the request and provide reasons.
Access: request a copy of your personal information; we aim to respond within a reasonable period (typically within 30 days). If we refuse under a lawful exception, we will explain why.
Correction: request updates where information is inaccurate, incomplete, or out of date. If we decline, we will note the request and provide reasons.
Direct marketing opt-out: opt out at any time via the channel used; we stop non-essential marketing within a reasonable period.
Anonymity and pseudonymity: use an alias where lawful and practical; some services require identification for legal or security reasons.
Right to complain: see “Complaints and contact” below.
Explanation of practices: ask how we collect, use, or disclose your information, including cross-border safeguards and destinations.

Notifiable Data Breaches (NDB) Scheme

If a breach is likely to cause serious harm, we investigate, contain, and mitigate promptly; notify the OAIC and affected individuals; and record remediation. Notification occurs as soon as reasonably practicable based on scope, sensitivity, and potential impact.

Complaints and contact

If you have questions or wish to lodge a privacy complaint, email privacy@tanqory.com with your contact details and a description of the issue. We typically respond within 30 days and will inform you if more time is needed. If dissatisfied, you may escalate to the Office of the Australian Information Commissioner (OAIC):

OAIC complaints: https://www.oaic.gov.au/privacy/privacy-complaints
Contact details are maintained on the OAIC official website.

Relationship to other Tanqory policies

Read this notice alongside our Privacy Policy, Cookie Notice, Data Processing Addendum (where applicable), Subprocessor List, and service terms. If there is conflict, the stricter document or law prevails.

Updates to this notice

We may update this notice to reflect legal developments, industry standards, or product changes. Significant changes will be communicated via our services or your primary contact channels. Continued use after publication constitutes acceptance. Please review the “Last updated” date above.

APPs we emphasize

APP 1: governance, transparency, clear contacts.
APP 2: anonymity/pseudonymity where lawful and practicable.
APP 3–4: collect only what is necessary by fair means; avoid sensitive data unless required; handle unsolicited data properly.
APP 5: timely notices covering purpose, recipients, transfers, and rights.
APP 6–7: use/disclose for primary or related purposes; direct marketing needs lawful basis or consent with clear opt-out.
APP 8: safeguard cross-border transfers via reasonable steps or permitted exceptions.
APP 9: do not use government identifiers unless legally required.
APP 10–11: maintain accuracy, security, and destroy or de-identify when not needed.
APP 12–13: enable access and correction with reasons for any refusal and OAIC escalation.

Authoritative OAIC resources for further reading:

APP overview: https://www.oaic.gov.au/privacy/australian-privacy-principles
APP guidelines (detailed): https://www.oaic.gov.au/privacy/guidance-and-advice/app-guidelines
Notifiable Data Breaches: https://www.oaic.gov.au/privacy/notifiable-data-breaches
Spam Act guidance: https://www.acma.gov.au/avoid-spam-and-scam-emails

If this notice conflicts with official OAIC principles or guidance, the stricter legal requirement prevails. Tanqory will update this notice promptly to reflect any legal or regulatory changes.

Contact

Privacy email: privacy@tanqory.com
Legal email: legal@tanqory.com
Website: https://legal.tanqory.com/
Data rights channel: as published via our forms or help center