SMOOTT Privacy Policy

1. Who we are

This Privacy Policy describes how SMOOTT Pty Ltd (ACN 701 985 319) (referred to as “SMOOTT”, “we”, “us” and “our”) collects, holds, uses and discloses personal information. SMOOTT operates an online marketplace where Service Sellers list services and Service Buyers book them. SMOOTT Pty Ltd is responsible for the personal information described in this policy.

This policy should be read together with the SMOOTT User Agreement (Terms & Conditions). Words defined in the User Agreement (Terms & Conditions) have the same meaning here unless the context requires otherwise. This policy explains SMOOTT's privacy practices and does not itself limit any rights or obligations that cannot lawfully be limited.

We handle personal information in accordance with Privacy Act 1988 (Cth) (Privacy Act) and the Australian Privacy Principles (APPs) to the extent they apply to SMOOTT. In this policy, “personal information” has the meaning given in section 6(1) of the Privacy Act. Where the Privacy Act does not apply to a particular entity, we aim to handle personal information consistently with this policy.

This policy is available free of charge on the SMOOTT website. If you require a copy in another form, contact us and we will take reasonable steps to provide it in that form.

2. Information we collect

We collect only personal information that is reasonably necessary for one or more of our functions or activities. This includes:

• Account information: such as your name, email address, password (stored only as a secure hash), profile picture if you upload one, and your communication preferences.
• Business information: (for sellers), such as your business name, business number, registered address, contact email and phone, logo, vanity URL, and the public payment options and private payment instructions you publish.
• Listing and resource information: such as the services, prices, availability calendars, qualifications, terms and add-ons you create.
• Booking information: such as the services you book or sell, slot dates and times, quantities, and the booking numbers generated for each transaction.
• Payment-status records: such as the markers a seller records about whether a buyer has paid, partly paid, received a refund or had an amount waived, together with the method (cash, bank, card, EFTPOS, other) and any note. We record a payment status and related transaction information, not the underlying card or bank credentials.
• Reviews and messages: such as ratings, review text, seller replies, messages, suggestions and feedback you submit.
• Usage and device information: such as your IP address, browser type, device information, pages visited and timestamps, collected through server logs, cookies and similar technologies to operate, secure and improve the SMOOTT Services.

You can browse the public marketplace without an account and, where it is lawful and practicable, you may deal with us without identifying yourself or by using a pseudonym. Some features, including registering an account, listing a service and making or managing a booking, require identifying or contact information because we cannot practicably provide those features without it.

We usually collect personal information directly from you. We may also collect information from another SMOOTT user where that person records booking, payment-status or transaction information about you; from our payment provider in relation to seller recharge top-ups; and automatically through server logs, cookies and similar technologies when you use the SMOOTT Services.

If you do not provide personal information that is required for a particular feature, we may be unable to create or maintain your account, publish a listing, process or manage a booking, provide support, or perform the relevant part of the SMOOTT Services.

We do not generally seek to collect sensitive information. If we need to collect sensitive information, we will do so only where permitted by the Privacy Act, including obtaining consent where required and only where the information is reasonably necessary for our functions or activities.

If we receive personal information that we did not solicit, we will assess whether we could have collected it under APP 3 and, where required by APP 4, take reasonable steps to destroy or de-identify it as soon as practicable.

3. How we use your information

We use personal information to:

• create and manage your account and any Business you own or help manage;
• publish your listings and show availability to buyers;
• process bookings and connect buyers and sellers so they can complete the transaction directly;
• calculate and charge seller commission against the recharge balance, and keep the ledger that goes with it;
• send transactional emails such as booking confirmations, cancellations, payment reminders and account notices;
• display reviews and ratings, and let sellers reply to them;
• keep the marketplace safe, prevent fraud and abuse, and enforce the User Agreement;
• respond to your enquiries, suggestions and complaints;
• meet our legal and record-keeping obligations.

We use and disclose personal information for the purpose for which it was collected, or for another purpose where you have consented, where you would reasonably expect that use or disclosure and the purpose is related to the primary purpose of collection (or directly related where sensitive information is involved), or where another exception under the Privacy Act applies.

4. Payments and what we don't hold

SMOOTT does not process payments between buyers and sellers. When a buyer confirms a booking, the seller's published payment options and private payment instructions are shown to that buyer so they can pay the seller directly, by bank transfer, card reader, cash or any method the seller accepts.

Because of this, we do not collect or store buyers' card numbers, bank login details or other payment credentials. We only store the payment-status records described above, which tell sellers and buyers how much of a booking has been settled. A seller's recharge-balance top-ups are handled by our payment provider. The payment provider may collect personal and payment information directly from the seller under its own privacy terms, and SMOOTT receives transaction confirmation and amount information but not the full card details.

5. When we share information

We do not sell your personal information. We share it only in these situations:

• With the other party to a transaction. When a buyer books a service, the seller receives the buyer's name and contact information reasonably necessary to deliver the service and reconcile payment, and the buyer receives the seller's contact and payment information reasonably necessary to complete the transaction. Seller contact details are shown only to signed-in users.
• With service providers who help us operate SMOOTT, such as hosting, email delivery, security, analytics and payment processing for top-ups. We disclose only the personal information reasonably necessary for the relevant service and take reasonable steps to require service providers to protect personal information and use it only for the authorised purpose.
• For legal and regulatory reasons, where the use or disclosure is required or authorised by an Australian law or a court or tribunal order, where a permitted general situation applies, or where we reasonably believe disclosure is reasonably necessary for an enforcement-related activity of an enforcement body.
• In a business transfer, in connection with an actual or proposed merger, acquisition, restructure, financing, sale or transfer of all or part of SMOOTT's business or assets, where the disclosure is permitted by law. Where appropriate, we will take reasonable steps to require recipients involved in the transaction to protect the information and use it only for the relevant transaction purpose.

We may also use or disclose personal information with your consent or where otherwise permitted by the Privacy Act.

6. Reviews and Public Content

Reviews you leave are published on the relevant service page with your first name and last initial, your rating and any text you add. Profile pictures, business logos and listing content you upload may also be public. Public content can be viewed, indexed, copied or shared by third parties outside SMOOTT's control. Avoid including sensitive information or unnecessary personal information about yourself or another person in reviews, listings or other public content unless you are authorised to do so.

7. Cookies and Analytics

We use cookies and similar technologies to keep you signed in, remember your preferences, protect against cross-site request forgery, understand how the service is used, and improve and secure the SMOOTT Services. Cookies and similar technologies may collect information such as IP address, device and browser information, pages viewed and timestamps. Essential cookies are needed for the site to work. You can control or delete cookies through your browser settings, although some features may not work properly without them. Personal information collected through cookies and similar technologies is handled in accordance with this policy.

8. Email and Notifications

We send transactional emails that are part of the service, such as booking confirmations, cancellation notices, payment reminders and security notices. These are not marketing and you cannot opt out of service communications that are reasonably necessary to operate your account or bookings while you continue to use the relevant service. If we send optional updates or direct marketing, we will use personal information for that purpose only where permitted by applicable law, provide a simple way to opt out, and honour opt-out requests. We will not use sensitive information for direct marketing without consent.

9. Where your Data is Stored

We may use service providers that store or process personal information in Australia and overseas. Where we are likely to disclose personal information to an overseas recipient, we will identify in this policy the countries in which those recipients are likely to be located where it is applicable to do so. Before disclosing personal information to an overseas recipient, where APP 8 applies, we take reasonable steps in the circumstances to ensure that the recipient does not breach the APPs in relation to that information, subject to the exceptions in APP 8.2.

10. How long we keep it

We keep personal information only for as long as it is reasonably needed for a purpose for which we may use or disclose it under the Privacy Act, or for as long as we are required by an Australian law or a court or tribunal order to retain it. This may include legal, accounting, tax, fraud-prevention and dispute resolution processes. Booking and ledger records may therefore be retained for limited period for restoration, security, audit or system integrity purposes. When personal information is no longer needed for a permitted purpose and is not required to be retained by law or court or tribunal order, we take reasonable steps to destroy it or ensure that it is de-identified.

11. How we protect it

We take reasonable technical and organisational measures to protect personal information from misuse, interference and loss, and from unauthorised access, modification or disclosure. These measures include storing passwords only as secured hashes, restricting access to systems and logging sensitive actions. No system is perfectly secure, so we cannot guarantee absolute security, but we regularly consider the security risks relevant to the personal information we hold and take reasonable steps to address them.

Where the Notifiable Data Breaches scheme in Part IIIC of the Privacy Act applies to SMOOTT, we will assess suspected eligible data breaches and notify the Office of the Australian Information Commissioner (OAIC) and affected individuals where the Privacy Act requires us to do so.

12. Access, Correction and Deletion

You can view and update most of your information directly from your profile, your business settings and your listings. You may ask us to give you access to the personal information we hold about you or to correct information that is inaccurate, out-of-date, incomplete, irrelevant or misleading. You may also ask us to delete personal information, although the Privacy Act does not create a general right to erasure and we may need or be permitted to retain information for the purposes described in section 10 (How long we keep it). To make a request, use the contact form linked from the footer of the website. We will respond within a reasonable time and may need to verify your identity before giving access or making a correction.

If the Privacy Act applies to the request and we refuse access or correction, we will provide a written notice setting out the reasons for the refusal to the extent required by law and the available complaint mechanisms. If we refuse a correction request, you may also ask us to associate a statement with the information recording your view that it is inaccurate, out-of-date, incomplete, irrelevant or misleading. If we correct personal information that we previously disclosed to another APP entity, you may ask us to take reasonable steps to notify that entity of the correction, unless doing so would be impracticable or unlawful.

Some information may need to be retained after you ask for deletion where it is still required for a purpose for which we may use or disclose it under the Privacy Act, or where we are required by or under an Australian law or a court or tribunal order to retain it. Where APP 11.2 applies and the information is no longer needed for such a purpose, we will take reasonable steps to destroy or de-identify it.

13. Children

The SMOOTT Services are intended for adults. You must be at least 18 years old, or the age of majority where you live, whichever is higher, to create an account. We do not knowingly permit children to create accounts and do not intentionally seek personal information from children. The public parts of the SMOOTT Services may nevertheless collect limited technical information from visitors through server logs, cookies and similar technologies as described in this policy. If you believe a child has provided us with personal information outside the intended use of the SMOOTT Services, contact us and we will take appropriate steps, including deletion or de-identification where required or appropriate.

14. Changes to this Policy

We may update this Privacy Policy from time to time to keep it accurate and up to date. When we do, we will post the updated version on the SMOOTT website with a new effective date. Where a change materially affects how we collect, hold, use or disclose personal information, we will take reasonable steps to notify affected users and, where required by law, obtain any consent required before using or disclosing personal information for a new purpose. This policy is a statement of our privacy practices and does not depend on you “accepting” an updated policy by continuing to use the SMOOTT Services.

15. Complaints and Contact

If you have a question about this policy, or you think we have mishandled your personal information or breached the APPs, please contact our Privacy Officer using the form linked from the footer of the website and identify the matter as a privacy complaint. Please provide enough information for us to understand and investigate the issue. We will acknowledge and investigate the complaint and aim to provide a substantive response within 30 days, or otherwise within a reasonable period having regard to the circumstances.

If you are not satisfied with our response, or we do not respond within a reasonable period, you may be able to make a privacy complaint to the Office of the Australian Information Commissioner (OAIC). Information about making a complaint is available at oaic.gov.au. The OAIC can only deal with complaints within its jurisdiction under the Privacy Act.