Privacy Policy

Last Updated: 18 August, 2023

‍

THE USE OF AND ACCESS TO INSTANT SERVICES IS SUBJECT TO THE FOLLOWING PRIVACY POLICY. IF YOU DO NOT AGREE TO THE FOLLOWING, YOU MAY NOT USE OR ACCESS THE SERVICES IN ANY MANNER.

‍

Introduction

‍

At Instant, our aim is to deliver products and services that provide the best possible online shopping experience to merchants and shoppers. 

‍

To do this we use some personal data to provide personalised products and services. 

‍

For instance, Instant collects and uses information about:

• merchants and brands using Instant’s products and services to power their online business;
• customers who shop at an online business which is powered by Instant’s products and services;
• partners and agencies who develop apps for merchants to use, build online stores on behalf of merchants, refer potential entrepreneurs or introductions to Instant, or otherwise help merchants and brands operate or improve their online or Instant-enabled businesses;
• users of Instant products and services like ‘Instant Checkout’, ‘Instant Audiences’ or ‘Instant SMS’;
• visitors to Intant’s websites;
• or anyone contacting Instant Support. 

‍

Instant is highly committed to protecting the privacy and security of your data. 

‍

This Privacy Policy will help you better understand how we process your personal information. 

‍

If we change our privacy practices, we may update this privacy policy. If any changes are materially significant, we will let you know by email if this is your preferred communication method. 

‍

Interpreting how this policy applies

‍

Please note the following interpretations for how this policy applies: 

‍

• This Privacy Policy (‘the Privacy Policy’) applies to Instant Checkout Pty Ltd ACN 642 933 462 and their affiliates and related companies, (together, ‘Instant’, 'Instant Checkout', 'Instant Pay,', ‘we’, ‘us’ or ‘our’), and details how we process Personal Information, including but not limited to Personal Information collected on our websites, mobile applications, via email, cloud-based services, or controlled widgets embedded in communication platforms with a link to this Privacy Policy (“Websites”). 

‍

• Instant as a Data Controller: For purposes of data protection laws, Instant is the “data controller” (or similar term under applicable laws) and is generally responsible for and controls the processing of your personal information collected through your use of our Service. This privacy policy applies only to instances where Instant acts as a data controller.

‍

• Instant as a Data Processor:  In providing our Services, our clients may collect data in our products and services, or we may collect data on their behalf, which may include personal information or data about our clients’ end users (“Client Data”). In such instances, Instant acts as a “data processor” (or similar term under applicable laws), and we have contractually committed ourselves to process Client Data on behalf and under the instruction of the respective client, who is the data controller. This privacy policy does not apply to the processing of Client Data and we recommend you read the privacy policy of the respective client if their processing concerns your personal information.

‍

• By “Personal Information” we mean information that is associated with a specific person and can be used to reasonably identify that person. Personal information does not include information that has been made anonymous, and cannot reasonably identify a specific person. It covers how we collect, use, and share that Personal Information as of the date that this Privacy Policy is posted.

‍

• Instant’s merchant clients (which may include online marketplaces), third party suppliers and commercial partners (together, ‘our Partners’) are independent of Instant and may have privacy policies which differ from ours. Our Partners are responsible for their own privacy policies and privacy practices. Please contact our Partners directly for further information on their privacy policies.

‍

• The Websites may also contain links to third party websites. These linked sites are not under our control and we are not responsible for content on these sites, nor are these sites subject to this Privacy Policy. Before disclosing your personal information on any third party website we recommend that you examine the terms and conditions and privacy policy of that site.

‍

• This Privacy Policy applies when you sign up for, access, or use our services, features, technologies, functions or purchase goods and services offered on our Websites (collectively ‘Instant Services’) and in relation to Personal Information we may otherwise collect during the course of our business as set out in this Privacy Policy.

‍

Why we process your information

‍

Instant may process your personal information for a number of reasons. 

‍

At a high level, our purpose for processing your personal data includes the following justifications and categories of data types: 

‍

• Performance of a Contract: When it's necessary for Instant (or a third party) to process your personal data to comply with obligations under a contract with you. This includes Instant's obligations to provide the Instant Service to you, or to verify information before a new contract with you begins.
  
  
• Legitimate Interest: When Instant or a third party has an interest in using your personal data in a certain way, which is necessary and justified considering any possible risks to you and other Instant users. For example, using your anonymised usage data to improve the Instant Service for all users.
  
  We only process personal information for these ‘legitimate interests’ after considering the potential risks to your privacy and balancing any risks with certain measures—for example, by providing clear transparency into our privacy practices, offering you control over your personal information where appropriate, limiting the information we keep, limiting what we do with your information, who we send your information to, how long we keep your information, or the technical measures we use to protect your information.
  
  These “legitimate interests” include:

• preventing risk and fraud; 
• answering questions or providing other types of support;
• providing and improving our products and services;
• providing reporting and analytics;
• testing out features or additional services;
• assisting with marketing or other communications.
  
  

• Consent: When Instant asks you to actively indicate your agreement to Instant's use of your personal data for a certain purpose. For marketing or advertising where the law requires us to collect your consent. For example, when we use cookies to understand your interests or the law requires consent for email marketing. We may also process your personal information where you have provided your consent. In particular, where we cannot rely on an alternative legal basis for processing, where you direct us to transfer information to a third party, where we receive your data from a third party is sourced and it already comes with consent or where we are required by law to ask for your consent (including in the context of some of our sales and marketing activities).
  
  
• Compliance with legal obligations: When Instant must process your personal data to comply with a law.

‍

At any time, you have a right to withdraw your consent by changing your communication choices, opting out from our communications or by contacting Instant Support.

‍

How we collect personal information

‍

When you interact with us or Instant’s products and services, we are collecting personal information about you. Sometimes we collect personal information automatically when you interact with our Services and sometimes we collect the personal information directly from you. At times, we may collect personal information about you from third parties. We receive and store certain types of information from you to help improve your overall online shopping experience.

‍

Like many other websites, we store “cookies” and other web-based files on user devices to get certain types of information when your web browser, mobile phone, or other device accesses our Website. The information sent to us may include data on the pages you access, your computer IP address, device identifiers, the type of operating system you are using, your location, mobile network information, standard web log data and other information. Web log data includes the browser type you are using and traffic to and from our site. When you visit our Websites or use Instant Services, we may also collect information about your transactions and your activities. Details on our collection of Personal Information through the use of cookies and analytical services is set out below.

‍

We may also collect and process the following personal information you provide in connection with our Service:

‍

• Merchant, Partner and Supplier Account and Profile Information: This includes relevant personal and contract information that you provide when you register for an account, or access and use Instant Services. This information includes your email and password, company name, company URL, phone number and office address, company registration and company banking details. If you apply to be an Instant partner or request to ‘talk to sales’, we may collect personal information that you provide when you sign up. This information includes your name, email, title, business phone number, company name, and company URL. In the provision of contracted services, we may collect Personal Information about our Partners’ staff directly from those staff or from our Partners. We may also collect the Personal Information of our suppliers and service providers’ staff during the course of our business activities. This information may include your name, contact details and position. We will collect this information directly from you, or from the applicable supplier or service provider.
  
  
• Customer, User and Visitor Contact information: Personal information such as your name, address, phone number, email or other identification information or documents to fulfil our product and service delivery obligations. We may also collect and handle sensitive personal information about you to deliver our products or services. We will only collect this information where it is reasonably necessary, or we have your consent, or where it is required by law. In order to help protect you from fraud and misuse of your Personal Information, we may collect information about your use and interaction with our Websites or Instant Services. For example, we may evaluate your computer, mobile phone or other access device to identify any malicious software or activity.
  
  
• Financial, Payment and Transaction Information: If you sign up for one of our Services requiring payment facilitation, we process the relevant financial, payment and transaction information provided in connection with such payment.
  
  Please note that we use third party payment processors to process payments made through Instant Services. As such, all such information is provided directly by you to our third-party processor. The payment processor’s use of your personal information is governed by their privacy notice. We will only receive the last 4 digits of the credit card number along with transaction-related information (i.e., payment date, amount, device type, IP address and card type).
  
  Instant also facilitates payment transactions through payment service providers that use payment tokenisation for data security. Payment tokenisation is a security technique that replaces sensitive payment information, such as credit card numbers, with a unique, random set of characters called a "token". This process helps to keep payment data safe during transactions because the actual card information is not being used or stored. If someone were to access the token, they wouldn't be able to use it to make fraudulent purchases as it doesn't contain the real payment details. By using tokens instead of actual card information, businesses can provide a secure and seamless payment experience for their customers, while reducing the risk of data breaches and fraud.
  
  
• 3rd Party Personal Information: We may also obtain information about you from third parties including our Partners and related companies, as well as credit reporting bodies and identity verification services, and publicly or commercially available sources for the purposes of complying with relevant legislation (eg. anti-money laundering laws). You may also choose to provide us with access to certain Personal Information stored by third parties such as social media sites (e.g. Facebook). The information we may receive varies by site and is controlled by that site. By associating an account managed by a third party with your Instant account and authorising Instant to have access to this information, you agree that Instant may collect, store and use this information in accordance with this Privacy Policy. The data we receive is dependent upon an individual’s privacy settings with the social network. Individuals should always review and, if necessary, adjust their privacy settings on third-party websites and social media networks and services before sharing information and/or linking or connecting them to other services.
  
  
• Service Providers: Our service providers that perform services solely on our behalf, such as payment processing and marketing providers, collect personal information and often share some or all of this information with us.
  
  
• Communications Requests and Support: When you contact us through any method of communications, including through one of our website or Instant Support, you request a demo of Instant Services, or you request to ‘talk to sales’; we may collect your name, email address, mailing address, phone number, company/company URL, account ID, type of inquiry, or any other personal information you choose to provide to us, which products interest you, what platform is currently being used, and meeting dates and times.
  
  
• Newsletter, Marketing Emails, and Blog: If you sign up to receive news, alerts or subscribe to a blog from Instant or from a client Merchant using Instant’s Services, we may collect your email and applicable interests and communication preferences where relevant.
  
  
• Events, Surveys, Feedback and Promotions: If you fill out any forms or otherwise provide your information to us in connection with Instant events, surveys, or other promotional events, as well as when you provide feedback to us, we may collect your contact information and any other information you provide to us.
  
  
• Automatic Data Collection: Like most digital platforms and services, Instant may collect certain personal information automatically when you visit, interact with, or use our Service:
  
  

• Log Data:  Including your internet protocol (IP) address, operating system, browser details such as type, ID, and configuration, unique identifiers, device type and version, the referring URL, date/time of your visit, the time you spent on our services and any errors that may occur during your visit to our Services.
  
  
• Analytics Data:  Including the electronic path you take to our services, through our services and when exiting our services, UTM source, as well as your usage and activity on our services, such as the time zone, activity information (first and last active date and time), usage history (flows created, campaigns scheduled, emails opened, total log-ins) as well as the pages, links, objects, products and benefits you view, click or otherwise interact with. We may also analyse the interaction between you and your customer using our Services.
  
  
• Location Data: Including your general geographic location based on the IP address we collect.
  
  
• Cookie data: We and our third-party providers may use (i) cookies or small data files that are stored on an individual’s computer and (ii) other, related technologies, such as web beacons, pixels, embedded scripts, location-identifying technologies and logging technologies (collectively, “cookies”) to automatically collect this personal information. 

‍

How we use Personal Information

‍

Instant only collects and processes information about you that is necessary for us to perform the services you request from us, that is otherwise reasonably necessary for our business activities or if required by law, court, or tribunal order.

‍

We may use the personal information we collect for the following purposes: 

‍

• Provide (or assess whether to provide) Instant Services;
  
  
• Fulfil our contractual obligations, to deliver the Services you have requested, including customer support;
  
  
• Communicate with individuals, including via email, text message, social media and/or telephone and video calls;
  
  
• Review our business performance;
  
  
• Marketing and sales of our Services to individuals, including through email, direct mail, phone, video call, text message, or through other forms of communications platforms (e.g. WhatsApp, Slack);
  
  
• Administer, improve and personalise our Services, including by recognising an individual and remembering their information when they return to our Services and analysing our customer-base;
  
  
• Facilitate payment transactions and send notices regarding transactions for our Services;
  
  
• Conduct market research;
  
  
• Opportunity tracking, conversion and lead generation;
  
  
• Test, enhance, update and monitor the Services, or diagnose or fix technology problems;
  
  
• Help maintain the safety, security and integrity of our property and Services, technology assets and business;
  
  
• Enforce our Terms of Service, resolve disputes, carry out our obligations and enforce our rights, and protect our business interests and the interests and rights of third parties;
  
  
• Prevent, investigate or provide notice of fraud or unlawful or criminal activity; or
  
  
• To consider you for a position at Instant for which you have applied.
  
  

You agree that we may use your Personal Information for the purposes for which we collect it and for related purposes which would be reasonably expected by you.

‍

If all or some of your Personal Information is not collected or cannot be verified, we may be unable to provide you with Instant Services or a customised experience, engage with you, or do business with you.

‍

How we share Personal Information

‍

We may also share, transmit, disclose, grant access to, make available, and provide personal information with and to third parties, as described below:

‍

• Our retailers and third party suppliers: So that they can provide goods or services to you (or the recipient of third party goods or services) or respond to a complaint by you, or to help them improve the quality and standard of service they provide to you. If you transact with a retailer in another country (including the United Kingdom, Canada, the USA, New Zealand and more, stated here https://stripe.com/global), we will disclose personal information to such locations. In addition, you should note that retailers and third party suppliers that you buy goods or services from or contract with (even if such goods or services are purchased using Instant Services) have their own privacy policies, and Instant is not responsible for their actions, including their information protection practices.
  
  
• Service Providers: We share personal information with third party contractors and service providers, that are subject to reasonable confidentiality terms, and which may include processing payments, providing web hosting and maintenance services, technology support providers, email and messaging communications providers, analytics providers, data storage providers, and web and video hosting providers and developers. Any such service providers will be subject to confidentiality provisions, and be bound to only process the data on our behalf and under our instructions, unless such service providers act as their own controllers (e.g. in the case we seek advice from lawyers and tax consultants).
  
  
• Business and Marketing Partners: We may also disclose personal information with other business and marketing partners with whom we jointly offer products or services, co-market or host events, or who are part of our partner ecosystem. We may obtain your consent where required by applicable law. Our business and marketing partners will use your information in accordance with their own privacy policies or notices.
  
  
• Advertising Partners: We may share certain personal information (including information collected through cookies) with our advertising service providers and vendors in order to advertise our Services to you.
  
  
• Legal Obligations and Rights: We may disclose personal information to third parties, such as legal advisors and law enforcement agencies, regulators, other authorities and other third parties for legal reasons if we reasonably believe that such action is necessary:

• in connection with the establishment, exercise, or defense of legal claims; 
• to comply with laws or to respond to lawful requests and legal process; 
• to protect our rights and property and the rights, personal safety and property of others, including to enforce our agreements and policies;
• to detect, suppress, or prevent fraud;
• with companies that we plan to merge with or be acquired by or who may invest in us; or
• as otherwise required by applicable law.
  
  
  

• With Your Consent: We may disclose personal information about an individual to certain other third parties or publicly with their consent or direction. For example, with an individual’s consent or direction we may post their testimonial on our website or service-related publications. 

‍

Protecting and Storing Personal Information

‍

Protecting Personal Information

Instant will keep your Personal Information secure by taking reasonable steps to protect it from misuse, loss, and unauthorised access, use, modification, and disclosure.

‍

We protect your information using physical, technical, and administrative security measures to reduce the risks of loss, misuse, unauthorised access, disclosure and alteration.

‍

We also review our security procedures frequently and systemically to consider appropriate new technology and updated methods. Only properly authorised people who have a need to access Personal Information to perform their job will be able to see or use that information. 

‍

Even so, despite our reasonable efforts, no security measure is ever perfect or impenetrable. This means we cannot guarantee the absolute security of your personal information - but we will work constantly to protect your information, and to ensure the security and integrity of our Service.

‍

Storing Personal Information

We implement appropriate technical and organisational measures to protect your personal information against accidental or unlawful destruction, loss, change or damage. All personal information we collect will be stored by our cloud hosting provider on secure servers. 

‍

We will never send you unsolicited emails or contact you by phone requesting credit or debit card information.

‍

Overseas Transfers of your Personal Information

Your personal information may be transferred to and stored in locations outside Australia where we and our third-party service providers have operations, including in the United States and the United Kingdom.

‍

In the event of a transfer by Instant to a location outside Australia, we ensure that: (i) personal information is transferred to countries recognised as having an equivalent level of privacy protection to Australia; or (ii) the transfer is made pursuant to appropriate safeguards, such as contractual obligations. 

‍

Your Privacy Rights in Australia

The Australian Privacy Act 1988 (Cth) and the Australian Privacy Principles (“APPs”) found in Schedule 1 of the Privacy Act provides you various rights under the APPs.

‍

• Right to access and request: You have the right to request access to and/or the correction of your personal information held by Instant. If you wish to obtain access to and/or correct your Personal Information held by Instant, please contact us. We will respond to your request within a reasonable time.
  
  
• Right to complain: You also have a right to make a privacy complaint to us. We will first consider your complaint to determine whether there are simple or immediate steps which can be taken to resolve the complaint. We will endeavour to complete the investigation into your complaint promptly. You may be asked to provide further information about your complaint and the outcome you are seeking. Instant will then typically gather relevant facts, locate and review relevant documents, and speak with individuals involved. In most cases, Instant will investigate and provide a written response to your complaint within 30 days of receipt of the complaint. If you are not satisfied with Instant’s response to your complaint, a complaint may be made to the Office of the Australian Information Commissioner (“OAIC”). The OAIC can be contacted by telephone on 1300 363 992 or by using the contact details on the website www.oaic.gov.au.

‍

If you have a complaint, concern or question regarding Instant’s management of your Personal Information and Privacy, please prepare your complaint in writing and email it to us at: privacy@instant.one

‍

Marketing and Privacy

‍

We may share (or we may permit these parties to collect) personal information with online advertising networks, social media companies, and other third-party services, including information about your use of our Service over time, so that they may play or display ads that may be relevant to your interests on other websites or apps, or on other devices you may use. Typically, though not always, the information we share is provided through cookies or similar tracking technologies, which recognise the device you are using and collect information, including hashed data, clickstream information, browser type, time and date you visited the website and other information. This information is used to display targeted ads on other websites, apps, or services. We or the online advertising networks use this information to make the advertisements you see online more relevant to your interests. We may also display targeted advertising to you through social media platforms, such as LinkedIn, Facebook, Twitter, Google, and others. These companies have interest-based advertising programs that allow us to direct advertisements to users who have shown interest in our services while those users are on the social media platform, or to groups of other users who share similar traits, such as likely commercial interests and demographics. These advertisements are governed by the privacy policies of those social media companies that provide them. 

‍

If you signed up to receive newsletters or other marketing communications from us, you can opt-out any time by clicking the unsubscribe link at the bottom of the message. You can also log-in to your account to opt-out and update your marketing preferences at any time. Even after you opt-out or update your marketing preferences, please allow us sufficient time to process your marketing preferences. Unless otherwise required to process your requests earlier by law, it may take up to 5 days to process your opt out requests in relation to receipt of electronic marketing materials such as emails and SMS, and up to 30 days for all other marketing-related requests. Even after you’ve opt-out of receiving marketing communications from us, we may still contact you for transactional or informational purposes. These include, for example, customer service issues, returns or product-related inquiries, outstanding payment inquiries, surveys or recalls, or any questions regarding a specific order.

‍

Unless you have exercised your right to opt-out, we may disclose your personal information to third parties for monetary or other valuable consideration, or use your information for all the purposes described in this Privacy Policy, including for targeted advertising. The third parties to whom we disclose personal information may use such information for their own purposes in accordance with their own privacy statements. 

‍

You do not need to create an account with us to exercise your right to opt-out. However, we may ask you to provide additional personal information so that we can properly identify you to track compliance with your opt-out request. We will only use personal information provided in an opt-out request to review and comply with the request. If you choose not to provide this information, we may only be able to process your request to the extent we are able to identify you in our data systems. We may not process your request if we, in good faith, believe that the request is fraudulent. In such instances, we will send a notice to the requestor explaining our decision.

‍