Last Updated: 18 August, 2023
At Instant, our aim is to deliver products and services that provide the best possible online shopping experience to merchants and shoppers.
To do this we use some personal data to provide personalised products and services.
For instance, Instant collects and uses information about:
- merchants and brands using Instant’s products and services to power their online business;
- customers who shop at an online business which is powered by Instant’s products and services;
- partners and agencies who develop apps for merchants to use, build online stores on behalf of merchants, refer potential entrepreneurs or introductions to Instant, or otherwise help merchants and brands operate or improve their online or Instant-enabled businesses;
- users of Instant products and services like ‘Instant Checkout’, ‘Instant Audiences’ or ‘Instant SMS’;
- visitors to Intant’s websites;
- or anyone contacting Instant Support.
Instant is highly committed to protecting the privacy and security of your data.
Interpreting how this policy applies
Please note the following interpretations for how this policy applies:
- Instant’s merchant clients (which may include online marketplaces), third party suppliers and commercial partners (together, ‘our Partners’) are independent of Instant and may have privacy policies which differ from ours. Our Partners are responsible for their own privacy policies and privacy practices. Please contact our Partners directly for further information on their privacy policies.
Why we process your information
Instant may process your personal information for a number of reasons.
At a high level, our purpose for processing your personal data includes the following justifications and categories of data types:
- Performance of a Contract: When it's necessary for Instant (or a third party) to process your personal data to comply with obligations under a contract with you. This includes Instant's obligations to provide the Instant Service to you, or to verify information before a new contract with you begins.
- Legitimate Interest: When Instant or a third party has an interest in using your personal data in a certain way, which is necessary and justified considering any possible risks to you and other Instant users. For example, using your anonymised usage data to improve the Instant Service for all users.
We only process personal information for these ‘legitimate interests’ after considering the potential risks to your privacy and balancing any risks with certain measures—for example, by providing clear transparency into our privacy practices, offering you control over your personal information where appropriate, limiting the information we keep, limiting what we do with your information, who we send your information to, how long we keep your information, or the technical measures we use to protect your information.
These “legitimate interests” include:
- preventing risk and fraud;
- answering questions or providing other types of support;
- providing and improving our products and services;
- providing reporting and analytics;
- testing out features or additional services;
- assisting with marketing or other communications.
- Compliance with legal obligations: When Instant must process your personal data to comply with a law.
At any time, you have a right to withdraw your consent by changing your communication choices, opting out from our communications or by contacting Instant Support.
How we collect personal information
When you interact with us or Instant’s products and services, we are collecting personal information about you. Sometimes we collect personal information automatically when you interact with our Services and sometimes we collect the personal information directly from you. At times, we may collect personal information about you from third parties. We receive and store certain types of information from you to help improve your overall online shopping experience.
We may also collect and process the following personal information you provide in connection with our Service:
- Merchant, Partner and Supplier Account and Profile Information: This includes relevant personal and contract information that you provide when you register for an account, or access and use Instant Services. This information includes your email and password, company name, company URL, phone number and office address, company registration and company banking details. If you apply to be an Instant partner or request to ‘talk to sales’, we may collect personal information that you provide when you sign up. This information includes your name, email, title, business phone number, company name, and company URL. In the provision of contracted services, we may collect Personal Information about our Partners’ staff directly from those staff or from our Partners. We may also collect the Personal Information of our suppliers and service providers’ staff during the course of our business activities. This information may include your name, contact details and position. We will collect this information directly from you, or from the applicable supplier or service provider.
- Customer, User and Visitor Contact information: Personal information such as your name, address, phone number, email or other identification information or documents to fulfil our product and service delivery obligations. We may also collect and handle sensitive personal information about you to deliver our products or services. We will only collect this information where it is reasonably necessary, or we have your consent, or where it is required by law. In order to help protect you from fraud and misuse of your Personal Information, we may collect information about your use and interaction with our Websites or Instant Services. For example, we may evaluate your computer, mobile phone or other access device to identify any malicious software or activity.
- Financial, Payment and Transaction Information: If you sign up for one of our Services requiring payment facilitation, we process the relevant financial, payment and transaction information provided in connection with such payment.
Please note that we use third party payment processors to process payments made through Instant Services. As such, all such information is provided directly by you to our third-party processor. The payment processor’s use of your personal information is governed by their privacy notice. We will only receive the last 4 digits of the credit card number along with transaction-related information (i.e., payment date, amount, device type, IP address and card type).
Instant also facilitates payment transactions through payment service providers that use payment tokenisation for data security. Payment tokenisation is a security technique that replaces sensitive payment information, such as credit card numbers, with a unique, random set of characters called a "token". This process helps to keep payment data safe during transactions because the actual card information is not being used or stored. If someone were to access the token, they wouldn't be able to use it to make fraudulent purchases as it doesn't contain the real payment details. By using tokens instead of actual card information, businesses can provide a secure and seamless payment experience for their customers, while reducing the risk of data breaches and fraud.
- Service Providers: Our service providers that perform services solely on our behalf, such as payment processing and marketing providers, collect personal information and often share some or all of this information with us.
- Communications Requests and Support: When you contact us through any method of communications, including through one of our website or Instant Support, you request a demo of Instant Services, or you request to ‘talk to sales’; we may collect your name, email address, mailing address, phone number, company/company URL, account ID, type of inquiry, or any other personal information you choose to provide to us, which products interest you, what platform is currently being used, and meeting dates and times.
- Newsletter, Marketing Emails, and Blog: If you sign up to receive news, alerts or subscribe to a blog from Instant or from a client Merchant using Instant’s Services, we may collect your email and applicable interests and communication preferences where relevant.
- Events, Surveys, Feedback and Promotions: If you fill out any forms or otherwise provide your information to us in connection with Instant events, surveys, or other promotional events, as well as when you provide feedback to us, we may collect your contact information and any other information you provide to us.
- Automatic Data Collection: Like most digital platforms and services, Instant may collect certain personal information automatically when you visit, interact with, or use our Service:
- Log Data: Including your internet protocol (IP) address, operating system, browser details such as type, ID, and configuration, unique identifiers, device type and version, the referring URL, date/time of your visit, the time you spent on our services and any errors that may occur during your visit to our Services.
- Analytics Data: Including the electronic path you take to our services, through our services and when exiting our services, UTM source, as well as your usage and activity on our services, such as the time zone, activity information (first and last active date and time), usage history (flows created, campaigns scheduled, emails opened, total log-ins) as well as the pages, links, objects, products and benefits you view, click or otherwise interact with. We may also analyse the interaction between you and your customer using our Services.
- Location Data: Including your general geographic location based on the IP address we collect.
- Cookie data: We and our third-party providers may use (i) cookies or small data files that are stored on an individual’s computer and (ii) other, related technologies, such as web beacons, pixels, embedded scripts, location-identifying technologies and logging technologies (collectively, “cookies”) to automatically collect this personal information.
How we use Personal Information
Instant only collects and processes information about you that is necessary for us to perform the services you request from us, that is otherwise reasonably necessary for our business activities or if required by law, court, or tribunal order.
We may use the personal information we collect for the following purposes:
- Provide (or assess whether to provide) Instant Services;
- Fulfil our contractual obligations, to deliver the Services you have requested, including customer support;
- Communicate with individuals, including via email, text message, social media and/or telephone and video calls;
- Review our business performance;
- Marketing and sales of our Services to individuals, including through email, direct mail, phone, video call, text message, or through other forms of communications platforms (e.g. WhatsApp, Slack);
- Administer, improve and personalise our Services, including by recognising an individual and remembering their information when they return to our Services and analysing our customer-base;
- Facilitate payment transactions and send notices regarding transactions for our Services;
- Conduct market research;
- Opportunity tracking, conversion and lead generation;
- Test, enhance, update and monitor the Services, or diagnose or fix technology problems;
- Help maintain the safety, security and integrity of our property and Services, technology assets and business;
- Enforce our Terms of Service, resolve disputes, carry out our obligations and enforce our rights, and protect our business interests and the interests and rights of third parties;
- Prevent, investigate or provide notice of fraud or unlawful or criminal activity; or
- To consider you for a position at Instant for which you have applied.
You agree that we may use your Personal Information for the purposes for which we collect it and for related purposes which would be reasonably expected by you.
If all or some of your Personal Information is not collected or cannot be verified, we may be unable to provide you with Instant Services or a customised experience, engage with you, or do business with you.
How we share Personal Information
We may also share, transmit, disclose, grant access to, make available, and provide personal information with and to third parties, as described below:
- Our retailers and third party suppliers: So that they can provide goods or services to you (or the recipient of third party goods or services) or respond to a complaint by you, or to help them improve the quality and standard of service they provide to you. If you transact with a retailer in another country (including the United Kingdom, Canada, the USA, New Zealand and more, stated here https://stripe.com/global), we will disclose personal information to such locations. In addition, you should note that retailers and third party suppliers that you buy goods or services from or contract with (even if such goods or services are purchased using Instant Services) have their own privacy policies, and Instant is not responsible for their actions, including their information protection practices.
- Service Providers: We share personal information with third party contractors and service providers, that are subject to reasonable confidentiality terms, and which may include processing payments, providing web hosting and maintenance services, technology support providers, email and messaging communications providers, analytics providers, data storage providers, and web and video hosting providers and developers. Any such service providers will be subject to confidentiality provisions, and be bound to only process the data on our behalf and under our instructions, unless such service providers act as their own controllers (e.g. in the case we seek advice from lawyers and tax consultants).
- Business and Marketing Partners: We may also disclose personal information with other business and marketing partners with whom we jointly offer products or services, co-market or host events, or who are part of our partner ecosystem. We may obtain your consent where required by applicable law. Our business and marketing partners will use your information in accordance with their own privacy policies or notices.
- Advertising Partners: We may share certain personal information (including information collected through cookies) with our advertising service providers and vendors in order to advertise our Services to you.
- Legal Obligations and Rights: We may disclose personal information to third parties, such as legal advisors and law enforcement agencies, regulators, other authorities and other third parties for legal reasons if we reasonably believe that such action is necessary:
- in connection with the establishment, exercise, or defense of legal claims;
- to comply with laws or to respond to lawful requests and legal process;
- to protect our rights and property and the rights, personal safety and property of others, including to enforce our agreements and policies;
- to detect, suppress, or prevent fraud;
- with companies that we plan to merge with or be acquired by or who may invest in us; or
- as otherwise required by applicable law.
- With Your Consent: We may disclose personal information about an individual to certain other third parties or publicly with their consent or direction. For example, with an individual’s consent or direction we may post their testimonial on our website or service-related publications.
Protecting and Storing Personal Information
Protecting Personal Information
Instant will keep your Personal Information secure by taking reasonable steps to protect it from misuse, loss, and unauthorised access, use, modification, and disclosure.
We protect your information using physical, technical, and administrative security measures to reduce the risks of loss, misuse, unauthorised access, disclosure and alteration.
We also review our security procedures frequently and systemically to consider appropriate new technology and updated methods. Only properly authorised people who have a need to access Personal Information to perform their job will be able to see or use that information.
Even so, despite our reasonable efforts, no security measure is ever perfect or impenetrable. This means we cannot guarantee the absolute security of your personal information - but we will work constantly to protect your information, and to ensure the security and integrity of our Service.
Storing Personal Information
We implement appropriate technical and organisational measures to protect your personal information against accidental or unlawful destruction, loss, change or damage. All personal information we collect will be stored by our cloud hosting provider on secure servers.
We will never send you unsolicited emails or contact you by phone requesting credit or debit card information.
Overseas Transfers of your Personal Information
Your personal information may be transferred to and stored in locations outside Australia where we and our third-party service providers have operations, including in the United States and the United Kingdom.
In the event of a transfer by Instant to a location outside Australia, we ensure that: (i) personal information is transferred to countries recognised as having an equivalent level of privacy protection to Australia; or (ii) the transfer is made pursuant to appropriate safeguards, such as contractual obligations.
Your Privacy Rights in Australia
The Australian Privacy Act 1988 (Cth) and the Australian Privacy Principles (“APPs”) found in Schedule 1 of the Privacy Act provides you various rights under the APPs.
- Right to access and request: You have the right to request access to and/or the correction of your personal information held by Instant. If you wish to obtain access to and/or correct your Personal Information held by Instant, please contact us. We will respond to your request within a reasonable time.
- Right to complain: You also have a right to make a privacy complaint to us. We will first consider your complaint to determine whether there are simple or immediate steps which can be taken to resolve the complaint. We will endeavour to complete the investigation into your complaint promptly. You may be asked to provide further information about your complaint and the outcome you are seeking. Instant will then typically gather relevant facts, locate and review relevant documents, and speak with individuals involved. In most cases, Instant will investigate and provide a written response to your complaint within 30 days of receipt of the complaint. If you are not satisfied with Instant’s response to your complaint, a complaint may be made to the Office of the Australian Information Commissioner (“OAIC”). The OAIC can be contacted by telephone on 1300 363 992 or by using the contact details on the website www.oaic.gov.au.
If you have a complaint, concern or question regarding Instant’s management of your Personal Information and Privacy, please prepare your complaint in writing and email it to us at: email@example.com
Marketing and Privacy
We may share (or we may permit these parties to collect) personal information with online advertising networks, social media companies, and other third-party services, including information about your use of our Service over time, so that they may play or display ads that may be relevant to your interests on other websites or apps, or on other devices you may use. Typically, though not always, the information we share is provided through cookies or similar tracking technologies, which recognise the device you are using and collect information, including hashed data, clickstream information, browser type, time and date you visited the website and other information. This information is used to display targeted ads on other websites, apps, or services. We or the online advertising networks use this information to make the advertisements you see online more relevant to your interests. We may also display targeted advertising to you through social media platforms, such as LinkedIn, Facebook, Twitter, Google, and others. These companies have interest-based advertising programs that allow us to direct advertisements to users who have shown interest in our services while those users are on the social media platform, or to groups of other users who share similar traits, such as likely commercial interests and demographics. These advertisements are governed by the privacy policies of those social media companies that provide them.
If you signed up to receive newsletters or other marketing communications from us, you can opt-out any time by clicking the unsubscribe link at the bottom of the message. You can also log-in to your account to opt-out and update your marketing preferences at any time. Even after you opt-out or update your marketing preferences, please allow us sufficient time to process your marketing preferences. Unless otherwise required to process your requests earlier by law, it may take up to 5 days to process your opt out requests in relation to receipt of electronic marketing materials such as emails and SMS, and up to 30 days for all other marketing-related requests. Even after you’ve opt-out of receiving marketing communications from us, we may still contact you for transactional or informational purposes. These include, for example, customer service issues, returns or product-related inquiries, outstanding payment inquiries, surveys or recalls, or any questions regarding a specific order.
You do not need to create an account with us to exercise your right to opt-out. However, we may ask you to provide additional personal information so that we can properly identify you to track compliance with your opt-out request. We will only use personal information provided in an opt-out request to review and comply with the request. If you choose not to provide this information, we may only be able to process your request to the extent we are able to identify you in our data systems. We may not process your request if we, in good faith, believe that the request is fraudulent. In such instances, we will send a notice to the requestor explaining our decision.