International disclosure

 

We disclose your personal information to organisations located outside Australia.  Generally, when we disclose personal information to overseas recipients those recipients are located in the United Kingdom, the European Economic Area (EEA), Singapore and Malaysia.

 

In relation to a very small number of our suppliers, your personal information may be transferred to, and stored at, a destination outside Australia as well as processed by staff operating outside Australia who work for them. In these instances the countries your personal information may be disclosed to include: United Kingdom, the European Economic Area (EEA), Singapore and Malaysia.

 

Unfortunately, the transmission of your personal information via the Internet can never be 100% secure. Although we will do our best to protect your personal information, we cannot guarantee the security of personal information about you transmitted to us and so any transmission is at your own risk. Once we have received your personal information, we will use strict procedures and security features to try to prevent unauthorised access.

 

Protecting your personal information

 

We process your personal information and store it on servers managed by our hosting providers.

 

Those servers are located across a number of secure data centres in the EEA. Our server environment is highly secure and there is very limited personnel access. Any personal information will be encrypted “at rest” (in other words, on being stored).

 

We have put in place appropriate security measures to prevent your personal information from being accidentally lost, used or accessed in an unauthorised way, altered or disclosed. In addition, we limit access to your personal information to those employees, agents, contractors and other third parties who have a business need to know. They will only process your personal information on our instructions and they are subject to a duty of confidentiality. 

 

We have put in place procedures to deal with any suspected personal information breach and will notify you and any applicable regulator of a breach where we are legally required to do so.

 

Duration for holding your personal information

 

We will only hold your personal information for as long as reasonably necessary to fulfil the purposes we collected it for, including for the purposes of satisfying any legal, regulatory, tax, accounting or reporting requirements.  

 

To determine the appropriate retention period for personal information, we consider the amount, nature and sensitivity of the personal information, the potential risk of harm from unauthorised use or disclosure of your personal information, the purposes for which we process your personal information and whether we can achieve those purposes through other means, and the applicable legal, regulatory, tax, accounting or other requirements.

 

Your legal rights

 

Under certain circumstances, you have rights under the Privacy Act in relation to your personal information. You have the right to:

 

• Request access to the personal information we hold about you;

 

• Request correction of the personal information that we hold about you. This enables you to have any incomplete or inaccurate personal information we hold about you corrected, though we may need to verify the accuracy of the new information you provide to us. If we do not agree that the personal information we have about you is incorrect, we’ll explain why in writing.

 

 If you wish to exercise any of the rights set out above, please contact our Data Protection Officer via the email address stated below. We will give you access to your personal information in the manner requested by you, if it is reasonable and practicable for us to do so. You will not have to pay a fee to request access to your personal information.  However, we may charge a reasonable fee for providing access if your request is clearly unfounded, repetitive, excessive or costly for us to respond to. Alternatively, we could refuse to comply with your request in these circumstances. We may need to request specific personal information from you to help us confirm your identity and ensure your right to access your personal information (or to exercise any of your other rights). This is a security measure to ensure that personal information is not disclosed to any person who has no right to receive it. We may also contact you to ask you for further personal information in relation to your request to speed up our response. We try to respond to all legitimate requests within one month. Occasionally it could take us longer than a month if your request is particularly complex or you have made a number of requests. In this case, we will notify you and keep you updated. 

 

Marketing

 

We strive to provide you with choices regarding certain personal information uses, particularly around marketing and advertising. You have the right at any time to stop us from contacting you for marketing purposes. If you wish to exercise these rights you can do so by selecting your contact preferences at the point where you provide us with your information on our website or by contacting us. You can also unsubscribe from any email marketing using the links provided in the emails we send to you.

 

Cookies

 

You can set your browser to refuse all or some browser cookies, or to alert you when websites set or access cookies. If you disable or refuse cookies, please note that some parts of this website may become inaccessible or not function properly. For more information about the cookies we use, please see www.railsr.com/cookie-policy 
 

Contact details

 

Please see above in the main body of the Privacy Policy.

 

Complaints

 

If you have a complaint about our handling of your personal information or a breach of the Privacy Act you can make a complaint to us at any time. 

 

To make a complaint, please contact us at dpo@railsr.com. We’ll deal with your complaint promptly and fairly and will respond to your complaint within a reasonable time (usually 30 days).

If you are not satisfied with how we have dealt with your complaint, you can raise the complaint with:

 

Australian Financial Complaints Authority (AFCA)

Website: www.afca.org.au

Email: info@afca.org.au

Phone: 1800 931 678

Mail: GPO Box 3, Melbourne VIC 3001

 

If you are not a small business or consumer AFCA may not consider your complaint and you should complain directly to the OAIC

Office of the Australian Information Commissioner (OAIC)

 

Website: www.oaic.gov.au

Phone: 1300 363 992

Mail: GPO Box 5218, Sydney NSW 2001

 

Changes to the privacy policy and your duty to inform us of changes 

It is important that the personal information we hold about you is accurate and current. Please keep us informed if your personal information changes during your relationship with us.

 

We keep our privacy policy under regular review. This version was last updated on 29 October 2021.

​

 

 

Singapore and Malaysia Privacy Notice

​

We take our data privacy and protection obligations under the law very seriously and this privacy notice (“Notice”) is intended to help you understand what to expect when we collect, and how we use or process, personal data about you in the context of your relationship with our Railsr corporate entities based in Singapore and Malaysia. Therefore, please take some time to read this Notice carefully and in conjunction with the parts of Privacy Policy that we have referenced in this Notice..

​

Scope

 

This Notice is important to you only if the following applies to you:

 

(a)  you are someone who (i) has contacted us through any means to find out more about any goods or services we provide, or (ii) may, or has, entered into a contract with us or is already doing business with us. You may be acting individually, or for or on behalf of the entity you represent when dealing with us.

 

(b)  your personal data is in our possession or under our control, or we act as a data user. This includes personal data in the possession of organisations which we have engaged to collect, use, disclose or process personal data for our purposes.

 

This Notice is not intended to cover the following situations:

 

(a)  if you are an employee or a job applicant. (Separate policies and agreements entered into between us both will continue to apply instead.)

(b)  when we are a data intermediary or processor, whereby we act on behalf of other data users or organisations. (Our relationship with these data users and organisations are governed by the data processing contracts we will have signed with them.)

(c)  our contracts with you or any other documents contain specific terms dealing with how we collect, use, disclose or process your personal data, or state that this Notice does not apply to our relationship with you.

(d)  if you are a website visitor, in which case you should refer to the Privacy Policy.

(e)  when data users and organisations that are our customers (such as, for instance, your employer) use or distribute our products and services, even though these are made available to you through them. We are not responsible for their privacy and security practices given that they control or administer the use of our or their own products and services, and you are encouraged to review their privacy policies instead.

 

Definitions

 

This Notice uses these specific references:

 

“Country” means the country or territory where we are located.

 

“data protection laws” refers to (a) the Personal Data Protection Act 2012 (No. 26 of 2012) (if the Country is the Republic of Singapore), or (b) the Personal Data Protection Act 2010 (if the Country is Malaysia), as well as any rules, regulations, codes, guidelines or other subsidiary legislations enacted pursuant to either (a) or (b) from time to time.

 

“personal data” has the same meaning set out in the Country-specific data protection laws.

 

“us” or “we” refers to any one or more of the following:

 

(a)  Railsbank Technologies Pte. Ltd. (UEN: 201910723N)

(b)  PayrNet Pte. Ltd. (UEN: 201913150C)

(c)  Rails Technology Sdn. Bhd. (Company No.: 202001031053)

(d)  RailsPay Sdn. Bhd. (Company No.: 202001031879)

 

​

Collecting, Using, Processing and Disclosing Your Data

 

In general, the types of data that we collect depend on the circumstances of collection, the nature of our interaction with you, or the type of activity or transaction undertaken. Examples of the type of personal data we may collect from you and use or process are provided in the Privacy Policy.

 

We only collect your personal data if:

(a)  you voluntarily provide it to us either directly or through a third party whom you have authorised to disclose your personal data to us, after (i) you (or your authorised representative) have been notified of the purposes for which the data is collected, and (ii) you (or your authorised representative) have provided written consent to the collection and usage of your personal data for those purposes.

(b)  doing so without consent is permitted or required by the data protection laws or other laws.

 

We may also receive your personal data from publicly available, government or other sources (such as credit reference agencies) that we will include as part of the data we hold about you.

 

Unless it is not needed or permitted by law, we will seek your consent before collecting any additional personal data and before using or processing your personal data for a purpose which has not been notified to you.

 

We may disclose your personal data:

 

(a)  where such disclosure is required for performing obligations in the course of or in connection with our provision of the goods and services requested by you.

(b)  to third party service providers, agents and other organisations we have engaged to perform any of the functions with reference to the above mentioned purposes.

(c)  if our business is sold or integrated with another business, to our advisers and any prospective purchasers and their advisers, as well as to the eventual new owners of the business.

 

Purposes

 

We may collect, use or process your personal data for any or all of the following purposes:

 

(a)  performing obligations in the course of or in connection with our provision of the goods and/or services requested by you.

(b)  verifying your identity.

(c)  responding to, handling, and processing queries, requests, applications, complaints, and feedback from you.

(d)  managing your relationship with us.

(e)  processing payment or credit transactions.

(f)    complying with any applicable laws, regulations, codes of practice, guidelines, or rules, or to assist in law enforcement and investigations conducted by any governmental and/or regulatory authority.

(g)  any other purposes for which you have provided the information.

(h)  transmitting to any unaffiliated third parties including our third party service providers and agents, and relevant governmental and/or regulatory authorities, whether in a Country or abroad, for the aforementioned purposes.

(i)    any other incidental business purposes related to or in connection with the above.

 

These purposes may continue to apply even in situations where your relationship with us (for example, pursuant to a contract) has been terminated or altered in any way, for a reasonable period thereafter (including, where applicable, a period to enable us to enforce our rights under a contract with you).

 

Please do not supply any other person's personal data to us, unless we prompt you to do so.

​

Our Legitimate Interests

 

To the extent that the applicable data protection laws allow for us to rely on our or another person’s legitimate interests, we may collect, use, process or disclose your personal data without your consent for such legitimate interests. In relying on such legitimate interests, we will assess the likely adverse effects on the individual and determine that the legitimate interests outweigh any adverse effect.

 

For clarity, it is in our legitimate interests for us to collect, use, process and disclose your personal data for the following purposes:

​

(a)  fraud detection and prevention.

(b)  detection and prevention of misuse of our products and services.

(c)  Network analysis to prevent fraud and financial crime, and perform credit analysis.

(d)  establishment, exercise or defence of legal claims, whether in court proceedings or in an administrative or out-of-court procedure.

 

These purposes may continue to apply even in situations where your relationship with us (for example, pursuant to a contract) has been terminated or altered in any way, for a reasonable period thereafter.

 

Marketing

 

We may wish to provide you with the following types of information:

(a)  special features of our products and services we think may be of interest to you.

(b)  related information from third parties we think may be of interest to you.

 

We may also provide your information to carefully selected third parties whose products or services we believe may be of interest to you.

 

If you would prefer not to receive any of this information, please let us know via the communication methods described in the ‘Marketing’ section of the Privacy Policy. If you agree to us providing you with marketing information, you can always opt out at a later date.

​

Protecting Your Data

 

We use all reasonable efforts to safeguard your personal data from unauthorised access, collection, use, disclosure, copying, modification, disposal or similar risks. This is done by implementing appropriate administrative, physical and technical measures, such as encryption of data (at rest and in transit), authentication and access controls (such as good password practices and disclosures on a need-to-know basis), firewalls, antivirus protection, web security, minimised data collection, multi-factor authentication, and regular security review and testing.

 

You should be aware, however, that Internet transmissions and electronic storage methods are never entirely secure and for this reason, we do not guarantee the security, integrity, availability and confidentiality of any personal data inasmuch as we keep striving to protect your data by reviewing and enhancing our information security measures.

​

Retaining Your Data

 

We will need to retain your personal data for as long as it is necessary to fulfil the purposes for which it was collected, the legal and business purposes of our business, or as required or permitted by applicable laws. We will stop doing so, or remove the means by which the data can be associated with you, as soon as it is reasonable to assume that such retention no longer serves the purposes for which your personal data was collected, and is no longer necessary for legal or business purposes.

 

Transferring Your Data to Other Territories

 

Your personal data may be transferred to territories outside of the Country that do have similar protections in place regarding your data and restrictions on its use and processing as set out in this Notice. These territories include the United Kingdom and the European Union. These are a couple of situations in which we may transfer your data:

(a)   Your data may be transmitted to data storage facilities where we keep our central records.

(b)  To perform our contract with you, your data may also be transferred to our offices or related corporate entities in the Country or other territories.

 

We will take steps to ensure your personal data continues to receive a standard of protection that is at least comparable to that provided under the applicable data protection laws.

 

Your Rights

 

In certain cases, you may have rights under Country-specific data protection laws relevant to you. Two of these rights that you may exercise are:

 

(a)  Access Request: You have the right to request access to a copy of the personal data that we hold about you, and information about the ways in which we use, process or disclose your personal data. Please take note that:

(i)  we will respond to your request as soon as reasonably possible, typically within a month’s time from us receiving your request. If we do not think we can do so within this timeframe, we will inform you in writing of the time by which we will be able to respond to your request.

(ii)      Where permitted by law, we reserve the right to charge a reasonable administrative fee for this service and will inform you of the fee before processing your request.

(iii)     In exceptional circumstances, we reserve the right to deny you access to your information and may provide you with an explanation as to why we are unable to do so (except where we are not obligated to do or prevented from doing so under any law, including the relevant data protection laws).

(b)  Correction Request: We generally rely on you to ensure that the personal data provided by you (or your authorised representative) is current, complete and accurate. As such, we may seek your help to update or correct your personal data. You also have the right to ask that we correct or update your personal data if the details are incorrect or has changed. You may ask us, or we may ask you, to remove any data you or we think is inaccurate too.

 

To exercise either or both rights, please contact our Data Protection Officer via the contact details stated in the Privacy Policy.

 

In addition, you should always read the data protection laws that apply to you for a fuller understanding of these and your other rights.

 

Your Consent

 

By submitting your personal data, you consent to our collection, use, processing and disclosure of your personal data, as well as for any transfer of the same to territories outside of the Country, as described in this Notice.

 

To the extent that the relevant data protection laws gives you the right to do so, you may withdraw your consent at any time. This can be done by submitting a request to us via the contact details already provided to you or as stated in the Privacy Policy. Depending on how complex your request is and its impact on our relationship with you, we may require a reasonable time period to work on your request.

 

There may be consequences of your consent withdrawal, including any legal consequences which may affect your rights and liabilities to us. For example, we may no longer be able to continue doing business with you. If you decide not to proceed with your consent withdrawal, please promptly write to us.

 

Withdrawing your consent does not affect our right to continue to collect, use, process and disclose personal data where doing so without consent is permitted or required under applicable laws.

 

Our Data Protection Officer

 

The details of our data protection officer remain the same as that specified in our Privacy Policy. We encourage you to provide feedback regarding the contents of this Notice.

 

Other Matters to Note

 

This Notice applies in conjunction with any other notices, contractual clauses and consent clauses that apply in relation to the collection, use, processing and disclosure of your personal data by us, unless we specifically tell you otherwise. Where any content in this Notice differs from what is stated in the Privacy Policy, take note that the content in this Notice will apply instead.

 

We may revise this Notice from time to time without any prior notice. Please bookmark this webpage and return periodically to find out the most updated version of this Notice. Your continued use of our products and services constitutes your acknowledgement and acceptance of such changes.

 

If there is any conflict or discrepancy between the English text of this Notice and any translation thereof, the English text prevails and will supersede any other translation or any other version in any other language.