CDR Policy — Consumer Data Right Policy

The following sections address each of the 13 CDR Privacy Safeguards as they apply to RealSync and our use of your CDR data.

Safeguard 1 — Open and transparent management of CDR data

We manage CDR data openly and transparently. This CDR Policy is published on our website and is freely accessible to all consumers. We will update this policy when our practices change and will notify you of material changes.

If you have any questions about how we handle your CDR data, you can contact us at any time at privacy@realsync.com.au.

Safeguard 2 — Anonymity and pseudonymity

Where it is lawful and practicable to do so, you may interact with us using a pseudonym or without identifying yourself. However, because the RealSync BankFlow service requires matching your bank transactions to your specific ecommerce account and orders, we need to be able to identify you and your accounts to deliver the service. Anonymous use of RealSync BankFlow is therefore not practicable.

Safeguard 3 — Collection of CDR data that is solicited

We only collect CDR data that you have explicitly consented to share with us through the consent process facilitated by Fiskil Pty Ltd. We collect CDR data only when it is reasonably necessary for the delivery of the RealSync BankFlow service.

We do not collect CDR data that is excessive relative to the purpose for which it is needed, and we do not collect CDR data without your consent.

Safeguard 4 — Dealing with unsolicited CDR data

If we receive CDR data that we did not solicit (for example, if we are accidentally provided data relating to an account or person we did not request), we will assess whether we could have lawfully collected that data under the CDR rules.

If we could not have lawfully collected it, we will destroy or de-identify that data as soon as practicable and will not use or disclose it.

Safeguard 5 — Notification of the collection of CDR data

At the time you provide consent to share your CDR data, we will inform you (through our consent flow, facilitated by Fiskil):

• What CDR data is being collected
• The purpose for which it is being collected
• How long it will be held
• Your rights to access, correct, and withdraw consent
• How to make a complaint

This notification is provided before you give consent, not after.

Safeguard 6 — Use or disclosure of CDR data

We will only use or disclose your CDR data for the purpose for which it was collected — the RealSync BankFlow bank-to-order matching service — unless:

• You have given separate, explicit consent to a different use or disclosure
• The use or disclosure is required or authorised by Australian law
• The use or disclosure is necessary to prevent a serious threat to life, health, or safety

We do not disclose your CDR data to any third party for their independent commercial purposes.

Safeguard 7 — Use or disclosure of CDR data for direct marketing

We will not use your CDR data for direct marketing under any circumstances, unless you have given us explicit, separate consent specifically for that purpose.

You may withdraw consent for direct marketing at any time, and withdrawal of direct marketing consent does not affect your ability to use the RealSync BankFlow service.

Safeguard 8 — Cross-context use of CDR data

We will not use your CDR data in a context other than the one in which you provided consent (the RealSync BankFlow bank-to-order matching service) without obtaining fresh consent from you that is specific to that new context.

Safeguard 9 — Integrity and correction of CDR data

We take reasonable steps to ensure that the CDR data we hold is accurate, up to date, complete, and not misleading.

If you believe that CDR data we hold about you is inaccurate, incomplete, or out of date, you may contact us at privacy@realsync.com.au to request a correction. We will respond within 30 days and will take reasonable steps to correct the data or, if we disagree that a correction is warranted, we will explain our reasons in writing.

Safeguard 10 — Security of CDR data

We take reasonable steps to protect CDR data from misuse, interference, loss, and unauthorised access, modification, or disclosure. Our security measures include:

• Encrypted data transmission (TLS/HTTPS) for all data in transit
• Encryption of sensitive data at rest
• Role-based access controls — CDR data is accessible only to the system processes and staff roles that require it to deliver the service
• Regular security monitoring, logging, and review
• Data hosted in Australian-based cloud infrastructure

In the event of a data breach involving CDR data, we will notify the affected consumer and the relevant regulators (the OAIC and the ACCC) as required by the CDR rules and the Notifiable Data Breaches scheme.

Safeguard 11 — Access to CDR data by the consumer

You have the right to request access to the CDR data we currently hold about you. To make an access request, please contact us at:

Email: privacy@realsync.com.au
Subject line: CDR Data Access Request

We will respond within 30 days. Note that because we operate under a data minimisation model and delete CDR data promptly once it is no longer needed, the data we hold at any given time will reflect your current and recent transactions only.

Safeguard 12 — Correction of CDR data

If you believe that CDR data we hold is inaccurate, incomplete, out of date, or misleading, you may request a correction at any time. Please contact us at privacy@realsync.com.au.

We will acknowledge your correction request within 5 business days and advise whether the correction has been made or, if not, explain why. If we decline to make the correction, you may request that we associate a statement with the data noting that you consider it inaccurate.

Safeguard 13 — Complaints about CDR data

If you have a complaint about how we have handled your CDR data, please follow the complaints process set out in Section 7 of this policy.