SYDNEY EXPRESS – PRIVACY POLICY

Finance Systems Australia Pty Ltd | ABN: 39 654 030 332| ACN: 654 030 332 | Effective Date: 28/05/2026 | Version 1.1

1. Introduction & Our Identity

Sydney Express Business Directory (“Sydney Express”, “we”, “us”, or “our”) is a digital business directory and online marketplace operated by Finance Systems Australia Pty Ltd (ABN: 39 654 030 332; ACN: 654 030 332), a company incorporated in Sydney, New South Wales, Australia.

Our registered business name “Sydney Express” is registered with the Australian Securities and Investments Commission (ASIC). Our principal place of business is Shops 6 & 7, 89–91 Victoria Road, Drummoyne NSW 2047.

This Privacy Policy explains how we collect, use, disclose, store, and protect personal information in accordance with the Privacy Act 1988 (Cth), the Australian Privacy Principles (APPs) set out in Schedule 1 of that Act, the Spam Act 2003 (Cth), the Do Not Call Register Act 2006 (Cth), and all other applicable Australian laws.

By accessing our website at sydneyexpress.com.au (“Website”), using our mobile applications, submitting a business listing, purchasing an advertising plan, or otherwise interacting with our services (“Services”), you acknowledge that you have read and understood this Privacy Policy.

2. Scope of This Policy

This Privacy Policy applies to:

– All visitors to our Website regardless of whether they create an account;

– All registered users of the Website, including business owners and consumers;

– All businesses and individuals who claim, submit, or pay for a business listing;

– All businesses and individuals who purchase advertising, featured placement, or promotional packages;

– All persons who contact us via telephone, email, our contact form, or social media channels;

– All persons who subscribe to our newsletter, email communications, or SMS marketing; and

– All third parties whose personal information we may receive in the course of operating our Services.

This Policy does not apply to third-party websites, apps, or services that may be linked to from our Website. We encourage you to review the privacy policies of any third parties you interact with.

3. What Personal Information We Collect

“Personal information” has the meaning given in the Privacy Act 1988 (Cth): information or an opinion about an identified individual, or an individual who is reasonably identifiable.

3.1 Information You Provide to Us

Account Registration

– Full name and display name;

– Email address;

– Password (stored in encrypted form — we do not have access to your plain-text password);

– Phone number (optional at registration, may be required for verification); and

– Profile photo (if uploaded).

Business Listing Submission

– Business name, trading name, and ABN/ACN (where provided);

– Business address, suburb, and postcode;

– Business category and sub-category;

– Business description, opening hours, and services offered;

– Contact phone number, email address, and website URL;

– Business photos, logos, and promotional images;

– Social media handles and external links; and

– Any other information you choose to include in your listing.

Payment & Billing

– Cardholder name and billing address;

– Credit or debit card details — note that card numbers are processed exclusively by our PCI-DSS compliant payment processor (Stripe, PayPal, or equivalent) and are NOT stored on our servers;

– Payment amount, transaction date, and invoice reference; and

– ABN for GST invoicing purposes.

Communications

– Content of enquiries, support requests, and complaints submitted via our contact form, email, or telephone;

– Records of correspondence; and

– Details of any disputes or feedback.

User-Generated Content

– Reviews, ratings, and comments posted on the Website;

– Photos or images uploaded in relation to reviews or listings; and

– Responses to surveys or questionnaires.

3.2 Information We Collect Automatically

When you access our Website, our servers and analytics tools automatically collect technical and usage data, including:

– IP address and approximate geographic location derived from your IP address;

– Browser type, version, and operating system;

– Device type and unique device identifiers;

– Referring URL and exit pages;

– Pages viewed, time spent on pages, and clickstream data;

– Search queries entered on the Website;

– Date and time of access; and

– Cookie identifiers and session tokens (see Section 7 — Cookies & Tracking Technologies).

3.3 Information From Third Parties

We may receive personal information about you from:

– Google, Facebook, or Apple if you choose to register or log in via a social sign-on option;

– Business verification data providers (e.g., ABN Lookup via the Australian Business Register);

– Advertising networks and analytics partners (in aggregated or pseudonymous form);

– Other users who mention you in reviews or listings (we will manage such information in accordance with this Policy); and

– Payment processors confirming successful or failed transactions.

3.4 Sensitive Information

We do not intentionally collect sensitive information (as defined by the Privacy Act 1988 (Cth), which includes health information, racial or ethnic origin, political opinions, religious beliefs, sexual orientation, or criminal records). If you choose to disclose sensitive information as part of a business description or review, you do so voluntarily and consent to us handling that information in accordance with this Policy.

4. How We Use Your Personal Information

We use personal information only for purposes that are reasonably necessary and proportionate to the delivery of our Services.

We will not use your personal information for any purpose that is incompatible with the primary purpose for which it was collected, unless you have separately consented, you would reasonably expect us to use it for that purpose, or we are required or authorised by law to do so.

5. Disclosure of Personal Information

5.1 Our Service Providers

We engage trusted third-party service providers to assist us in operating our Services. These providers receive personal information only to the extent necessary to perform their functions and are contractually obligated to protect it. They include:

– Web hosting and content delivery providers;

– Payment processing providers (e.g., Stripe);

– Email and SMS marketing platforms;

– Analytics and tracking providers (e.g., Google Analytics);

– Customer relationship management (CRM) software providers;

– Cybersecurity and fraud detection providers;

– Professional advisors including accountants, lawyers, and auditors; and

– IT support and software development contractors.

5.2 Advertising Partners

We work with third-party advertising networks (including Google Ads) to display advertisements on our Website. These networks may use cookies and similar technologies to collect non-personally identifiable data about your browsing behaviour for the purpose of serving targeted ads. We do not sell, rent, or trade your name, email address, or other directly identifying personal information to advertisers.

5.3 Business Listings — Public Disclosure

Information contained in a business listing (business name, address, phone number, email, hours, description, photos) is, by design, publicly visible on the Website and may be indexed by search engines. If you are a business owner and do not wish certain information to be publicly displayed, do not include it in your listing.

5.4 Reviews & User-Generated Content

Reviews, ratings, and comments you post on the Website are public. Your display name and any information you choose to include in your review will be visible to other users and may be indexed by search engines. Exercise caution about what personal information you include in a public review.

5.5 Legal Disclosures

We may disclose your personal information to law enforcement agencies, regulatory bodies (including ASIC and the OAIC), courts, or other government authorities where we are required or authorised to do so by Australian law, including pursuant to a subpoena or court order, the Privacy Act 1988 (Cth), the Crimes Act 1914 (Cth), or our reporting obligations under anti-money laundering or counter-terrorism financing laws.

5.6 Business Transfers

If Finance Systems Australia Pty Ltd is involved in a merger, acquisition, sale of assets, or restructure, personal information we hold may be transferred to a successor entity. We will notify you via a prominent notice on our Website and/or by email prior to your information being transferred.

5.7 Overseas Disclosure

Some of our service providers may store data on servers outside Australia (for example, the United States, European Union, Singapore, or Ireland). By using our Services, you consent to the disclosure of your personal information to overseas recipients where we have taken reasonable steps to ensure those recipients handle your information in accordance with the APPs or equivalent protections. We maintain data processing agreements with all relevant overseas service providers.

6. Your Rights & Choices

6.1 Access to Your Personal Information

Under Australian Privacy Principle 12, you have the right to request access to personal information we hold about you. Contact us at admin@sydneyexpress.com.au. We will respond within 30 days. We do not charge a fee for making an access request. For large or complex requests, we may recover the reasonable cost of providing access, and will notify you of any such cost before it is incurred.

6.2 Correction of Personal Information

If you believe that personal information we hold about you is inaccurate, out of date, incomplete, irrelevant, or misleading, you may request correction under Australian Privacy Principle 13. Most account information can be corrected directly via your account settings. For other corrections, contact admin@sydneyexpress.com.au.

6.3 Deletion of Your Account & Data

You may request deletion of your account and associated personal information at any time. Please note:

– Deletion of your account will remove your personal profile but public content (such as reviews you have posted) may be retained in a de-identified form;

– Business listing data submitted by you may be retained for up to 7 years for legal and financial compliance purposes; and

– We will delete personal information we are not legally required to retain within 30 days of your request.

Submit deletion requests to admin@sydneyexpress.com.au with the subject line “Data Deletion Request”.

6.4 Opt-Out from Marketing

You may opt out of receiving marketing communications from us at any time by:

– Clicking the “Unsubscribe” link in any marketing email;

– Replying “STOP” to any marketing SMS;

– Updating your communication preferences in your account settings; or

– Contacting us at admin@sydneyexpress.com.au

We will process opt-out requests within 5 business days for email and within 2 business days for SMS, in compliance with the Spam Act 2003 (Cth) and the Do Not Call Register Act 2006 (Cth). Note that transactional communications (receipts, billing notifications, security alerts) are not affected by marketing opt-outs.

6.5 Cookie Controls

You can manage your cookie preferences at any time via our Cookie Consent Banner accessible from the footer of our Website. You may also configure your browser settings to block or delete cookies, however disabling certain cookies may impair the functionality of our Website.

7. Cookies & Tracking Technologies

Our Website uses cookies, web beacons, pixel tags, and similar technologies to enhance your experience, analyse usage patterns, and deliver targeted advertising.

You can withdraw or modify your cookie consent at any time by clicking “Cookie Settings” in the footer of our Website. For more information about cookies generally, visit www.allaboutcookies.org

8. Data Security

We implement appropriate technical and organisational measures to protect personal information against unauthorised access, disclosure, alteration, loss, or destruction. Our security measures include:

– TLS/SSL encryption for all data transmitted between your device and our Website (HTTPS);

– Encryption of passwords using industry-standard hashing algorithms;

– PCI-DSS compliant payment processing — we do not store full card details;

– Access controls limiting employee and contractor access to personal information on a need-to-know basis;

– Regular security assessments and vulnerability scanning;

– Audit logs of access to sensitive data systems;

– Two-factor authentication (2FA) available for user accounts; and

– Incident response procedures for managing data breaches.

Notwithstanding these measures, no data transmission over the internet is guaranteed to be 100% secure. You use our Services at your own risk.

9. Notifiable Data Breaches

Finance Systems Australia Pty Ltd is subject to the Notifiable Data Breaches (NDB) scheme under Part IIIC of the Privacy Act 1988 (Cth). In the event of a data breach likely to result in serious harm to any affected individual, we will:

– Assess the breach within 30 days of becoming aware of it;

– Notify the Office of the Australian Information Commissioner (OAIC) as soon as practicable; and

– Notify affected individuals directly (via email and/or a prominent notice on our Website) as soon as practicable.

Our notification will include a description of the breach, the kinds of information involved, and the steps we recommend affected individuals take to protect themselves.

10. Data Retention

When personal information is no longer required, we securely destroy or de-identify it in accordance with our Data Retention and Destruction Policy.

11. Children’s Privacy

Our Website is not directed to children under the age of 15. We do not knowingly collect personal information from anyone under 15. If you are under 15, please do not use our Services or submit any personal information to us. If you are under 18 and at least 15 years of age, you should obtain consent from a parent or legal guardian before using our Services.

If we become aware that we have inadvertently collected personal information from a person under 15, we will take steps to delete that information as soon as practicable. Parents or guardians who believe their child has provided us with personal information may contact us at admin@sydneyexpress.com.au

12. Third-Party Links & Embedded Content

Our Website contains links to third-party websites and may display embedded content from external sources (including YouTube, Google Maps, and social media platforms). We are not responsible for the privacy practices of those third parties. We encourage you to read the privacy policies of any third-party services you access via our Website.

When you interact with a listed business (e.g., by clicking their phone number, email address, or website link), you are interacting directly with that business. Sydney Express is not responsible for the data handling practices of listed businesses.

13. Business Owners & Listed Entities

13.1 Verification of Business Information

Business owners who submit or claim a listing on Sydney Express consent to us verifying their business details, including via ABN Lookup (Australian Business Register) and any other publicly available business register. This is done to maintain the accuracy and integrity of our directory.

13.2 Your Responsibilities as a Listing Owner

If you submit personal information about third parties (e.g., your employees’ contact details) as part of a business listing, you represent and warrant that you have obtained all necessary consents from those individuals to share their information with us, and that their information may be publicly displayed on our Website in accordance with this Policy.

13.3 Review & Rating Data

We may use aggregated, de-identified review and rating data for the purpose of generating business insights reports, internal benchmarking, or promotional materials. We will not identify individual reviewers without their express consent.

14. Advertising Compliance

Sydney Express operates digital advertising services including video digital displays, online directory advertising, and digital SMS campaigns. In connection with these services:

– All advertising on our platform must comply with the Australian Association of National Advertisers (AANA) Code of Ethics and relevant industry standards;

– We do not accept advertising for prohibited products or services under Australian law;

– Behavioural advertising is conducted using de-identified or pseudonymous audience segments — we do not sell named user profiles to advertisers;

– Advertising metrics provided to clients (click rates, impression counts, geographic reach) are aggregated and do not identify individual users; and

We comply with the Interactive Advertising Bureau (IAB) guidelines on ad targeting and transparency.

15. How to Contact Us & Make a Complaint

15.1 Privacy Enquiries

Post: Privacy Officer, Finance Systems Australia Pty Ltd, Shops 6 & 7, 89–91 Victoria Road, Drummoyne NSW 2047

Email: admin@sydneyexpress.com.au

Phone: (02) 8970 9557

15.2 Internal Complaint Resolution

If you believe we have breached the APPs or this Privacy Policy, please lodge a complaint by emailing admin@sydneyexpress.com.au with the subject line “Privacy Complaint”. We will acknowledge your complaint within 5 business days and endeavour to resolve it within 30 days.

15.3 External Complaint — OAIC

If you are not satisfied with our response, you have the right to lodge a complaint with the Office of the Australian Information Commissioner (OAIC):

Website: www.oaic.gov.au Phone: 1300 363 992 Post: GPO Box 5218, Sydney NSW 2001

16. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, or applicable law. When we make material changes, we will update the Effective Date at the top of this Policy, post a prominent notice on our Website homepage, and where practicable notify registered users by email.

Your continued use of our Services following the posting of a revised Privacy Policy constitutes your acceptance of the changes. Prior versions of this Policy are available upon written request.

17. Governing Law & Jurisdiction

This Privacy Policy is governed by the laws of New South Wales, Australia. Any disputes arising in connection with this Policy or our handling of personal information are subject to the exclusive jurisdiction of the courts of New South Wales, except where the APPs or other applicable law provides otherwise.

Finance Systems Australia Pty Ltd | Sydney Express Business Directory | sydneyexpress.com.au