Privacy policy

1. Who we are

In this policy, “Dinetap”, “we”, “us” and “our” means Dinetap Australia Pty Ltd (ABN 23 679 041 537, ACN 679 041 537), of Level 18, 324 Queen Street, Brisbane City QLD 4000.

We are part of a group of companies. Our related companies in Singapore (Dinetap Holdings Pte. Ltd., the main company, and Dinetap SG Pte. Ltd.) build and operate the technology behind the Dinetap products. When they handle personal information for our Australian services, they do so for us and under this policy (see section 9).

2. Who this policy applies to

This policy applies to personal information about:

• Merchants: owners, directors, beneficial owners, authorised representatives and staff of restaurants and businesses that use the Dinetap POS, payments app, payment terminal, back office, payment links or WooCommerce plugin;
• Dinetap app users: people who use the Dinetap app to find restaurants, cafés and other places to eat;
• Shoppers: people who pay a business through a Dinetap payment terminal, payment link or the Dinetap WooCommerce plugin; and
• Website visitors and enquirers: people who visit our website, fill in a form, or contact us by phone, email or WhatsApp.

If you apply for a job with us or supply services to us, we handle your information under this policy too, for those purposes.

3. When we act for a business, and when our payment partners do

Information a business collects about its own customers. When a restaurant uses Dinetap to take orders and payments, it collects information about its customers (for example an order, a table number, a name or email for a receipt). The restaurant is responsible for that information and its own privacy policy applies. We store and process it on the restaurant’s behalf, to provide our services to the restaurant, and we do not use it for our own marketing.

Card payments. Card payments made through Dinetap are processed by our payment partners: Adyen Australia Pty Limited (ABN 55 162 682 411, AFSL 516550), Stripe and Airwallex. They receive your card details directly and handle them under their own privacy policies, available at adyen.com, stripe.com and airwallex.com. We never receive or store full card numbers, card security codes (CVV/CVC) or PINs. We receive payment results and limited card details, such as the card type, the last four digits and a transaction reference.

4. The personal information we collect

4.1 Merchants and their staff

• names, job titles, email addresses, phone numbers and business contact details;
• business details: legal and trading name, ABN or ACN, business address, venue locations, industry, trading history and expected sales volumes;
• identity verification information about owners, directors, beneficial owners and authorised signatories, which may include date of birth, residential address and identity documents, as required by our payment partners and by anti-money laundering and counter-terrorism financing laws;
• bank account details used for payouts;
• staff names, roles, permissions, login details and activity in the POS and back office;
• transaction, order, refund, payout, fee and reconciliation records;
• terminal and device identifiers, location of devices and usage logs; and
• records of your communications with us, including support requests and call notes.

4.2 Dinetap app users

• account details: name, email address, username and login details, or the details Google or Apple share with us if you sign in with them (which may include an Apple private relay email address);
• profile information you choose to add;
• location information: your device location if you allow it, an approximate location based on your IP address, and areas you choose yourself (see section 13);
• cuisine, dietary, facility and other preferences you select;
• searches, filters, saved and recent locations, and the restaurants, menus, photos and offers you view;
• photos and other content you upload (see section 14);
• notification and marketing preferences; and
• messages you send us and feedback you give.

4.3 Shoppers

• the amount, currency, date and business you paid, and what the payment was for;
• the payment method type (for example Visa or Apple Pay), the last four digits of the card, and whether the payment succeeded, failed or was refunded;
• your name, email address or phone number, if you enter them at checkout or ask for a receipt;
• a transaction reference and fraud-prevention signals; and
• technical details of the device and browser used to pay, including the IP address.

4.4 Website visitors and enquirers

• the details you enter in our forms: your name, business name, phone number, email address and anything you write in the message;
• the details of calls, emails and WhatsApp messages you send us; and
• technical information about your visit (see section 12).

4.5 Technical information from all users

Our apps, terminals and website may automatically collect information such as IP address, device type and identifiers, operating system and app version, language, time zone, network information, crash logs, diagnostics and security events.

5. Sensitive information

We do not ask for sensitive information such as health information, religious beliefs or racial or ethnic origin.

Some dietary preferences you can choose in the Dinetap app (for example vegetarian or halal) could suggest something about your health or beliefs. Choosing them is optional. By selecting them you consent to us using them to filter your results, and you can remove them at any time.

We do not use government identifiers, such as a driver licence or passport number, as our own identifier for you.

6. How we collect personal information

We collect personal information:

• from you, when you sign up, use our products, fill in a form, or contact us;
• automatically, through our apps, terminals and website (see section 12);
• from the business you work for or pay, for example when a merchant adds you as a staff member, or when a payment you make passes through Dinetap;
• from third parties, including our payment partners (Adyen, Stripe and Airwallex) and identity verification providers (for merchant onboarding and payouts), Google and Apple (if you sign in with them), Google Maps Platform (for place and map information), and publicly available sources such as the ABN register; and
• from related companies in our group, where they collected it for the purposes in this policy.

If we receive personal information we did not ask for, we decide whether we could have collected it under the APPs. If not, we destroy or de-identify it where it is lawful and reasonable to do so.

7. Why we collect, use and disclose personal information

We use personal information to:

• provide, operate and support our products, including the POS, payments, payouts, back office, payment links, WooCommerce plugin and Dinetap app;
• verify the identity of merchants and their owners, and assess applications, as our payment partners and the law require;
• process payments, refunds, chargebacks and payouts, and keep financial records;
• show Dinetap app users restaurants near them and results that match their choices;
• respond to enquiries and send quotes and information you ask for;
• provide customer support and handle complaints;
• detect, prevent and investigate fraud, misuse, security incidents and breaches of our terms;
• maintain, test and improve our products, including by analysing how features are used;
• send service messages, such as receipts, security alerts and changes to our terms;
• send marketing where the law allows and in line with your choices (section 11); and
• meet our legal obligations, including tax, financial record-keeping, anti-money laundering and counter-terrorism financing laws, and to establish or defend legal claims.

We use and disclose personal information for the purpose we collected it, for related purposes you would reasonably expect, with your consent, or where the law requires or allows it.

If you do not give us the information we ask for, we may not be able to provide what you want. For example, we cannot open a merchant account or make payouts without identity and bank details, and we cannot reply to an enquiry without a way to contact you.

8. Who we disclose personal information to

We disclose personal information only as needed for the purposes in section 7. Recipients include:

• our payment partners (Adyen, Stripe and Airwallex), card schemes (such as Visa, Mastercard, American Express and eftpos), and the banks and financial institutions involved in a payment or payout;
• identity verification and fraud-prevention providers;
• our related companies (see section 9);
• service providers that host, store, secure, monitor and support our systems, including cloud hosting (Amazon Web Services, Singapore region), analytics (PostHog), error monitoring (Sentry), maps and places (Google Maps Platform), sign-in (Google and Apple), email, SMS and push notification services, and customer support tools;
• the business you work for or paid, for transactions and accounts linked to it;
• professional advisers, auditors and insurers;
• a buyer, investor or successor if all or part of our business is sold, merged or restructured, under confidentiality obligations; and
• government agencies, regulators, courts and law enforcement, where the law requires or allows it, including AUSTRAC, the ATO, the OAIC and the police.

Our service providers may use personal information only to provide services to us and must protect it. We do not sell personal information.

9. Overseas disclosure

Some recipients are outside Australia. We are likely to disclose personal information to recipients in these countries:

• Singapore: our related companies, which build and operate our technology, and Amazon Web Services, which hosts our data;
• Sri Lanka: engineering and support staff of our group, only when needed to support, maintain or fix our services, with access limited by role;
• the Netherlands and other countries where our payment partners (Adyen, Stripe and Airwallex) operate: payment processing; and
• the United States: providers of sign-in, maps, analytics, error monitoring and communications services. [confirm whether PostHog and Sentry hold our data in the United States or the European Union]

Before we disclose personal information overseas, we take reasonable steps to make sure the recipient protects it in line with the APPs, usually through a written agreement. We remain accountable under the Privacy Act for how overseas recipients handle the information we disclose to them, except where the law provides otherwise.

10. Card and payment information

Card details are entered into a payment terminal or checkout run by one of our payment partners (Adyen, Stripe or Airwallex) and go directly to that partner. Each is certified to the Payment Card Industry Data Security Standard (PCI DSS) and holds payment data under its own privacy policy. Dinetap, the POS, the WooCommerce plugin and the merchant’s website do not receive or store full card numbers, security codes or PINs.

We keep payment records (amounts, dates, outcomes, references, the card type and last four digits) so merchants can reconcile sales, handle refunds and disputes, and so we can meet our record-keeping obligations.

11. Marketing

We may send you information about Dinetap products and offers by email, SMS, phone or in-app message where you have agreed to it or where the law allows it (for example, to existing merchant customers about related services).

Every marketing email and SMS we send identifies us and includes a free way to unsubscribe. We act on unsubscribe requests within five working days. You can also opt out at any time by contacting us. You will still receive service messages about your account and transactions.

We do not disclose your personal information to other businesses for their own marketing.

12. Cookies, SDKs and analytics

Our website and apps use cookies, local storage, software development kits (SDKs) and similar technologies to keep you signed in, remember preferences, keep our services secure, prevent duplicate payments, diagnose errors and understand how features are used.

Our website uses PostHog to understand how visitors use it. The Dinetap app uses PostHog for usage analytics and Sentry for crash reporting. The WooCommerce plugin can send error reports to Sentry if the merchant turns this on. Our own systems keep logs and monitoring data in Amazon Web Services CloudWatch in Singapore.

We do not use advertising or social media tracking pixels on our website. If we start to, we will update this policy first and give you a way to opt out.

You can block or delete cookies in your browser settings, and limit tracking and permissions in your device settings. Some features may not work properly if you do.

13. Location in the Dinetap app

The Dinetap app uses location to show restaurants and areas near you. You choose whether to share your device’s location, and whether it is precise or approximate, in your device settings. You can turn it off at any time.

If you do not share your location, you can still choose an area yourself. We collect location only while you use location-based features, in the way your device permission allows. We do not track your location in the background.

14. Photos and content you upload

If you upload photos or other content to the Dinetap app, it may be shown to other users on the restaurant’s page, together with your display name. Please do not upload images of other people without their permission, or anything that reveals personal information about others.

You can ask us to remove content you uploaded. We may also remove content that breaches our app terms. How we use uploaded content is set out in the Dinetap app terms.

15. Automated decisions

Some decisions are made or assisted by computer programs:

• Payment fraud checks. Our payment partners’ systems assess each payment for fraud risk and may decline or hold a payment automatically, using transaction, card and device information.
• Merchant onboarding and risk. Identity checks and risk assessments for merchant applications may be assisted by automated verification tools. Dinetap does not make approval, payout hold or suspension decisions automatically. Our payment partners (Adyen, Stripe and Airwallex) run automated checks, such as identity verification and risk screening, which can lead to an approval, a payout hold or a suspension under their own terms.
• Dinetap app results. The order of restaurants and suggestions is worked out by software using your location, filters and searches. This does not significantly affect your rights or interests.

If an automated decision affects you, you can contact us to ask about it and to have it reviewed by a person.

16. Using a pseudonym or staying anonymous

You can browse our website and make general enquiries without telling us who you are. You can use a display name rather than your real name in the Dinetap app. We need to identify merchants and their owners, because the law and our payment partners require it.

17. Children

The Dinetap app is not designed for children. You must be at least [16 (confirm, and align the App Store and Google Play age ratings)] to create an account. If you believe a child has given us personal information, contact us and we will deal with it promptly. We will update this policy to meet the Children’s Online Privacy Code when it takes effect.

18. How we protect personal information

We take reasonable technical and organisational steps to protect personal information from misuse, interference, loss and unauthorised access, change or disclosure. They include encryption of data in transit, access controls and role-based permissions, multi-factor authentication for administrative access, logging and monitoring, secure development practices, staff training and confidentiality obligations, and controls on our service providers.

No system is completely secure. Please keep your passwords and devices safe and tell us straight away if you think your account has been misused.

19. Data breaches

We have a plan for responding to data breaches. If we suspect a breach, we assess it promptly and within 30 days. If a breach is likely to result in serious harm, we notify the people affected and the Office of the Australian Information Commissioner, as the Notifiable Data Breaches scheme requires, and tell you what you can do to protect yourself.

20. How long we keep personal information

We keep personal information only for as long as we need it for the purposes in this policy or as the law requires. Then we securely destroy it or de-identify it. As a guide:

• merchant account, identity verification, transaction and payout records: 7 years after the account closes or the transaction occurs, to meet tax, corporate and anti-money laundering record-keeping laws;
• payment records for shoppers: 7 years, for the same reasons;
• Dinetap app account information: while your account is open, and deleted within 30 days after you delete your account, except anything we must keep by law;
• enquiries from people who do not become customers: [2 years];
• system logs: about 30 days; error reports: about 90 days; temporary checks that prevent duplicate payments: a few minutes.

Backup copies may remain for a short time until they are overwritten.

21. Deleting your Dinetap app account

You can delete your Dinetap app account in the app, or by following the steps on our delete account page. When you do, we delete or de-identify your account information, except anything we must keep by law or to resolve a dispute.

22. Accessing and correcting your information

You can ask for access to the personal information we hold about you, and ask us to correct it if it is inaccurate, out of date, incomplete, irrelevant or misleading. Contact us using the details in section 25. We may need to verify your identity first.

There is no fee to make a request. We respond within a reasonable time, usually within 30 days. If we refuse, we will tell you why in writing and how to complain. If we will not correct information, you can ask us to attach a statement to it. If we correct information we gave to others, we will tell them if you ask.

Merchants can view and update most of their business and staff details in the back office. App users can update their details in the app.

23. Complaints

If you think we have mishandled your personal information, please write to our Privacy Officer using the details in section 25 and tell us what happened. We will acknowledge your complaint within 7 days and aim to respond in full within 30 days.

If you are not satisfied with our response, or we do not respond within 30 days, you can complain to the Office of the Australian Information Commissioner (OAIC):

• online at www.oaic.gov.au;
• by phone on 1300 363 992; or
• by post to GPO Box 5288, Sydney NSW 2001.

24. Credit information

We are not a credit provider and we do not collect information from credit reporting bodies. We do not offer hardware instalments or deferred payments, and we do not run credit checks when you apply.

25. Contact us and changes to this policy

Privacy Officer
Dinetap Australia Pty Ltd (ABN 23 679 041 537, ACN 679 041 537)
Level 18, 324 Queen Street, Brisbane City QLD 4000
Email: support@dinetap.com
Phone: +61 403 111 317

We may update this policy when our products, practices or the law change. We will publish the new version here with a new date. If a change is significant, we will also tell you by email or in the app before it takes effect.