SCRAN PRIVACY POLICY

Effective date: 23 July 2026

1. Introduction

Scran Pty Ltd respects the privacy of the individuals and businesses that interact with us.

This Privacy Policy explains how we collect, hold, use, disclose and protect personal information in connection with:

the Scran website;

business enquiries and subscriptions;

Stripe payments and billing;

NFC cards, plaques and QR codes;

Scran-hosted pages and managed links;

private customer feedback;

review analytics and reports;

sales, marketing and customer support; and

our general business operations.

In this Privacy Policy, “Scran”, “we”, “us” and “our” mean:

Scran Pty Ltd

ACN 687 087 903

ABN 66 687 087 903

Apartment 3305, 88 The Esplanade

Surfers Paradise QLD 4217

Australia

Email: team@scran.com.au

Website: www.scran.com.au

“Personal information” means information or an opinion about an identified individual, or an individual who is reasonably identifiable, whether or not the information is true or recorded in a material form.

2. Application of Australian privacy law

Scran will comply with privacy laws that apply to its activities.

Where Scran is an organisation covered by the Privacy Act 1988 (Cth), we will handle personal information in accordance with the Australian Privacy Principles.

Where the Privacy Act does not legally apply to a particular activity, Scran will nevertheless seek to follow the privacy standards set out in this Policy as a matter of good business practice.

Nothing in this Policy limits any rights that an individual may have under applicable privacy, consumer or other laws.

3. Information we may collect

The information we collect depends on how a person interacts with Scran.

3.1 Business and account information

We may collect:

individual names;

business and venue names;

job titles and roles;

email addresses;

telephone numbers;

business, billing and service addresses;

Australian Business Numbers and tax information;

account and subscription details;

nominated report recipients;

Google Business Profile details;

public review-page links;

business categories;

competitor names supplied by a customer;

customer-service requests;

complaints;

refund and cancellation details; and

records of communications with Scran.

3.2 Payment and transaction information

We may receive or hold:

Stripe customer identifiers;

transaction identifiers;

subscription status;

payment and invoice status;

billing address;

payment dates;

payment amounts;

refund and dispute information; and

limited information about the payment method, such as card brand and expiry date.

Scran does not ordinarily receive or store complete payment-card numbers or security codes.

3.3 NFC, QR-code and digital interaction information

When a person taps an NFC card, scans a QR code or interacts with a Scran-hosted page, we may collect:

the date and time of the interaction;

the Scran card, plaque, link or venue involved;

the page visited;

referral information;

approximate location derived from an internet connection;

IP address;

browser type;

device type;

operating system;

interaction and diagnostic data;

cookie or similar identifiers; and

information needed to prevent fraud, abuse or technical misuse.

We do not use NFC cards to secretly read information stored on a person’s telephone. The NFC product generally directs the device to a webpage or review destination when the user chooses to interact with it.

3.4 Feedback information

Where Scran provides a private-feedback function, we may collect:

feedback text;

ratings and selected responses;

the venue associated with the feedback;

date and time of submission;

information voluntarily entered by the person;

contact details where the person chooses to provide them;

whether the person requests a response; and

technical and security information associated with the submission.

People should avoid including unnecessary sensitive or highly confidential information in feedback.

3.5 Public review information

Scran may collect or analyse information that is publicly accessible through Google Business Profiles and other online review or business-listing services, including:

public reviewer names or profile names;

public review text;

public ratings;

review dates;

business responses;

aggregate rating information;

public business information; and

trends visible from public review activity.

Scran does not claim ownership of third-party reviews.

3.6 Branding and product information

We may collect:

business logos;

brand colours;

business names;

artwork;

photographs;

website links;

social-media links;

customer instructions;

product-design approvals; and

details needed to create or configure NFC products.

3.7 Website and analytics information

When a person uses www.scran.com.au, we may collect:

IP address;

browser and device information;

pages visited;

time spent on pages;

buttons or links selected;

referring website;

broad geographic location;

website errors;

session information;

cookie identifiers; and

marketing-attribution information.

3.8 Marketing information

We may collect:

communication preferences;

records of marketing consent;

unsubscribe requests;

email engagement;

campaign interactions;

business interests;

enquiry history; and

information supplied during sales discussions.

3.9 Sensitive information

Scran does not ordinarily seek sensitive information such as health information, racial or ethnic origin, political opinions, religious beliefs, sexual orientation, biometric information or criminal records.

A person may voluntarily include sensitive information in feedback or correspondence. Where this occurs, Scran will only collect, use or disclose that information where reasonably necessary and permitted by law.

4. How we collect information

Scran may collect personal information:

directly from an individual;

through the Scran website;

through Stripe checkout;

through onboarding forms;

through email or telephone communication;

during face-to-face sales or support discussions;

through NFC taps and QR-code scans;

through Scran-hosted feedback pages;

from the business employing or represented by an individual;

from an authorised business representative;

from public review platforms and public business listings;

from analytics, hosting and security providers;

from contractors or service providers; and

from publicly available sources.

Where practicable, Scran will collect personal information directly from the individual concerned.

5. Collection notices

A Privacy Policy describes Scran’s overall information-handling practices. Scran may also provide a shorter collection notice when information is collected.

For example, an onboarding form or feedback page may explain:

who is collecting the information;

why it is being collected;

whether it will be provided to a participating venue;

what may happen if the requested information is not provided;

relevant overseas disclosures; and

where this Privacy Policy can be found.

6. Why we collect, use and disclose information

Scran may collect, hold, use and disclose personal information to:

respond to enquiries;

verify business and venue details;

establish and manage subscriptions;

process and reconcile payments;

issue invoices and refunds;

manage payment failures and disputes;

communicate with subscribers;

create, program and deliver NFC products;

configure QR codes and digital destinations;

manage Scran-controlled links and redirects;

deliver review-intelligence services;

prepare weekly or periodic reports;

identify themes in reviews and feedback;

provide practical business observations;

deliver customer support;

diagnose technical problems;

improve Scran’s products and services;

measure website and campaign performance;

prevent fraud, abuse and security incidents;

maintain accounting, tax and business records;

manage cancellations and NFC-product collection;

comply with legal and regulatory obligations;

enforce Scran’s contractual rights;

establish, exercise or defend legal claims;

conduct internal administration and business planning;

send service messages;

send marketing communications where permitted; and

facilitate a genuine business restructure, investment, sale or acquisition.

7. Consequences of not providing information

A person is generally not required to provide personal information to Scran.

However, if required information is not provided, Scran may be unable to:

respond to an enquiry;

identify the relevant business;

process a subscription;

verify or process a payment;

configure an NFC product;

deliver reports;

respond to feedback;

investigate a complaint;

process a cancellation or refund; or

provide another requested service.

Feedback providers may be able to submit feedback without providing their name or contact details where the applicable form permits anonymous submission.

8. Anonymous and pseudonymous interactions

Where lawful and practicable, individuals may interact with Scran anonymously or using a pseudonym.

This may not be practical where Scran needs to:

verify a business subscriber;

process a payment;

issue an invoice;

deliver a product;

arrange NFC collection;

respond personally to a complaint;

prevent fraud; or

comply with a legal obligation.

Private-feedback forms may allow anonymous feedback where the participating venue and form configuration permit it.

9. How private feedback is handled

Where a person submits private feedback through a Scran page:

Scran may receive and store the feedback;

the feedback may be provided to the business venue concerned;

Scran may include the feedback in reports or trend analysis;

the venue may independently decide how to respond;

Scran may use automated or AI-assisted tools to classify themes or sentiment;

Scran may remove or restrict unlawful or abusive content; and

Scran may retain technical information for security and service integrity.

The participating venue may have its own privacy policy and may independently use information received through the feedback process.

Individuals should review the venue’s privacy practices where relevant.

Scran is not responsible for a venue’s independent use of personal information after it has been lawfully disclosed to that venue, although Scran may suspend a venue’s use of the Scran service if we reasonably believe it is being seriously misused.

10. Public reviews and reporting

Scran may analyse publicly available reviews to identify matters such as:

recurring compliments;

recurring complaints;

service trends;

operational themes;

rating movement;

review volume;

business-response activity; and

potential improvement opportunities.

Reports may contain summaries, paraphrased themes, aggregated data and limited review excerpts where reasonably appropriate.

Scran will seek to avoid unnecessarily reproducing personal information about individual reviewers.

Public review information may remain subject to the applicable third-party platform’s terms.

11. Automated and AI-assisted processing

Scran may use software and artificial-intelligence-assisted tools to help:

organise reviews;

identify common themes;

classify sentiment;

summarise feedback;

identify trends;

prepare draft observations;

detect spam or abuse; and

improve report production.

Human review may be used where appropriate, but not every automated classification will be manually checked.

Automated analysis may produce errors or fail to understand context, sarcasm or ambiguity.

Scran does not currently intend to use automated processing to make decisions that produce legal effects or similarly significant effects concerning individual feedback providers.

Scran’s business reports are advisory and do not automatically impose employment, financial, legal or other decisions on individuals.

12. Payment processing through Stripe

Scran uses Stripe to process subscriptions and payments.

Stripe may independently collect:

names;

contact details;

billing details;

card or bank information;

device and transaction information;

identity-verification information; and

fraud-prevention information.

Stripe handles that information under its own privacy policy and legal obligations.

Scran may receive Stripe-generated customer, payment, invoice, subscription and refund information.

13. Who we may disclose information to

Scran may disclose personal information to:

the business venue associated with submitted feedback;

Stripe and other payment providers;

website-hosting providers;

cloud-storage providers;

email and communications providers;

analytics providers;

cybersecurity and fraud-prevention providers;

customer-relationship management systems;

form and survey providers;

printing, engraving and NFC-product manufacturers;

contractors helping prepare reports;

delivery or collection providers;

professional advisers, including lawyers and accountants;

insurers;

regulators;

courts;

law-enforcement bodies;

government agencies where required or authorised by law; and

potential buyers, investors or advisers involved in a genuine business transaction.

Scran does not sell lists of personal information to third-party advertisers.

14. Contractors and service providers

Scran may engage contractors to assist with:

website operation;

software development;

report preparation;

design;

printing;

NFC configuration;

customer support;

bookkeeping;

communications; and

other business functions.

Contractors may only receive the information reasonably required for their work.

Scran will take reasonable steps to require contractors to keep personal information confidential and use it only for authorised purposes.

15. Overseas disclosures and storage

Some Scran service providers operate or store data outside Australia.

Personal information may therefore be disclosed to, accessed by or stored with recipients located in countries including:

the United States;

the United Kingdom;

New Zealand;

Singapore;

Ireland;

other European Union countries; and

other countries in which Scran’s technology providers or their subprocessors operate.

The specific countries may change as providers alter their infrastructure.

Where required by law, Scran will take reasonable steps to ensure that overseas recipients handle personal information consistently with applicable Australian privacy requirements.

Individuals may contact team@scran.com.au for further information about overseas processing relevant to their information.

16. Direct marketing

Scran may send marketing emails, messages or other communications where:

the recipient has expressly consented;

consent may lawfully be inferred from an existing business relationship or the circumstances; or

the communication is otherwise permitted by law.

Marketing communications will identify Scran and provide contact details and a functional unsubscribe method.

Scran will keep reasonable records of marketing consent where appropriate.

A person may unsubscribe by:

selecting the unsubscribe link in the message;

replying with “unsubscribe”; or

emailing team@scran.com.au.

Scran will action valid marketing unsubscribe requests within five working days.

Unsubscribing from marketing does not prevent Scran from sending essential communications relating to:

an active subscription;

payment or billing;

service delivery;

reports;

security;

cancellations;

refunds;

legal notices; or

customer support.

17. Cookies and similar technologies

Scran’s website and hosted pages may use cookies, pixels, local storage and similar technologies.

These may be used to:

operate website features;

maintain sessions;

remember preferences;

understand website usage;

measure advertising and campaign performance;

identify technical errors;

improve page performance;

prevent fraud and abuse; and

protect Scran’s systems.

Users may control cookies through browser settings.

Disabling cookies may affect the operation of some website features.

Where legally required, Scran will seek consent before placing non-essential cookies.

18. Third-party analytics and advertising

Scran may use analytics or advertising tools supplied by third parties.

These providers may process device, browser, website interaction and marketing-attribution information.

Scran will configure these tools reasonably and will not intentionally provide sensitive information for advertising purposes.

Where required, information about particular tools may be provided through a cookie notice or consent-management system.

19. How we hold information

Scran may hold personal information:

in cloud-based business systems;

in Stripe;

in email systems;

in report-generation tools;

in customer and subscription records;

in secure electronic files;

in website and hosting systems;

in backups; and

occasionally in physical records.

Information from different interactions may be linked where reasonably necessary to manage a customer relationship or provide the service.

20. Information security

Scran takes reasonable steps to protect personal information from:

misuse;

interference;

loss;

unauthorised access;

unauthorised modification; and

unauthorised disclosure.

Security measures may include:

access controls;

passwords;

multi-factor authentication where available;

reputable cloud providers;

encryption in transit;

restricted administrator access;

software updates;

backups;

confidentiality requirements;

device security;

account monitoring; and

procedures for responding to incidents.

No internet transmission or storage system can be guaranteed to be completely secure.

Individuals should avoid sending sensitive information through ordinary email unless necessary.

21. Data breaches

Scran will assess suspected data breaches and take reasonable steps to contain and remediate them.

Where the Notifiable Data Breaches scheme or another law applies, Scran will notify affected individuals and the Office of the Australian Information Commissioner where required.

A person who believes their information or Scran account has been compromised should contact team@scran.com.au promptly.

22. Data quality

Scran takes reasonable steps to ensure that personal information used or disclosed is accurate, current, complete and relevant for its intended purpose.

Subscribers should notify Scran if their:

business name;

venue address;

email address;

telephone number;

billing information;

review link; or

nominated report recipient

changes or is incorrect.

23. Retention and deletion

Scran retains personal information only for as long as reasonably required for:

service delivery;

customer support;

subscription management;

legal and contractual obligations;

accounting and tax records;

dispute resolution;

fraud prevention;

insurance;

security; and

legitimate business recordkeeping.

Retention periods will vary according to the information and legal requirements.

When personal information is no longer reasonably required, Scran will take reasonable steps to destroy it or permanently de-identify it, unless retention is required or authorised by law.

Backups may retain information for a limited period before being overwritten.

24. Access to personal information

An individual may request access to personal information that Scran holds about them by contacting:

Privacy Officer

Scran Pty Ltd

Email: team@scran.com.au

Address: Apartment 3305, 88 The Esplanade, Surfers Paradise QLD 4217, Australia

The request should provide enough information to identify the individual and the information requested.

Scran may require reasonable proof of identity before providing access.

Scran will respond within a reasonable period.

Scran does not ordinarily charge for making an access request. A reasonable administrative charge may apply to the provision of extensive records where permitted by law, but the individual will be notified before any charge is incurred.

There may be circumstances where Scran is permitted or required to refuse access. Where lawful and appropriate, Scran will explain the reason for refusal and available complaint options.

25. Correction of personal information

An individual may ask Scran to correct information that is:

inaccurate;

out of date;

incomplete;

irrelevant; or

misleading.

Correction requests may be sent to team@scran.com.au.

Scran may ask for supporting information where reasonably required.

Where Scran refuses a correction request, Scran will, where required and lawful, explain the reason and inform the individual of relevant complaint options.

26. Privacy complaints

A person who believes Scran has mishandled their personal information may submit a written complaint to:

Privacy Officer

Scran Pty Ltd

Email: team@scran.com.au

Address: Apartment 3305, 88 The Esplanade, Surfers Paradise QLD 4217, Australia

The complaint should include:

the complainant’s name and contact details;

a description of the concern;

relevant dates;

supporting information; and

the outcome sought.

Scran will:

acknowledge the complaint within a reasonable period;

investigate the issue;

request further information where necessary;

seek to resolve the concern fairly; and

aim to provide a substantive response within 30 days.

If the complainant is not satisfied and the Privacy Act applies, they may be able to complain to the Office of the Australian Information Commissioner.

27. External privacy complaints

The Office of the Australian Information Commissioner can be contacted through the complaint options made available on its official website.

Individuals are generally encouraged to complain to Scran first and allow a reasonable opportunity for Scran to respond.

28. Children

Scran’s subscriptions are intended for businesses and adults.

Scran does not knowingly seek to enter subscription contracts with children under 18.

Customers of participating venues may include children. Scran encourages venues to consider whether their feedback collection is appropriate for their customer base.

Scran does not intentionally seek sensitive information from children through its standard feedback services.

A parent or guardian who believes a child has provided personal information inappropriately may contact team@scran.com.au.

29. Employment information

Scran reports may refer to service or operational themes that relate generally to a participating business’s staff.

Businesses must not treat a Scran report as the sole basis for disciplinary, termination or other significant employment decisions.

Scran does not ordinarily require venue customers to identify individual staff members in feedback.

Where a report includes information about an identifiable employee, the subscribing business is responsible for handling that information in accordance with applicable employment, workplace and privacy laws.

30. Links to third-party sites

Scran’s website, NFC products and hosted pages may link to:

Google;

Stripe;

participating business websites;

social-media platforms; and

other third-party services.

Those services have their own privacy policies and information-handling practices.

Scran is not responsible for the independent privacy practices of a third-party service.

31. Business transfers

If Scran is involved in a genuine merger, acquisition, restructure, financing or sale of all or part of its business, personal information may be disclosed to professional advisers, potential purchasers or a successor entity.

Scran will take reasonable steps to protect confidentiality during the transaction and ensure that transferred personal information continues to be handled lawfully.

32. Changes to this Privacy Policy

Scran may update this Privacy Policy to reflect:

changes in law;

changes to our services;

new technology;

new providers;

changes in data-handling practices; or

operational improvements.

The current version will be published at:

www.scran.com.au/privacy

The effective date at the top of the Policy will be updated when changes are made.

Where a change is material and affects active subscribers, Scran may also provide notice by email or through the service.

33. Contact details

Questions, access requests, correction requests, privacy complaints and marketing-unsubscribe requests may be directed to:

Privacy Officer

Scran Pty Ltd

ACN 687 087 903

ABN 66 687 087 903

Apartment 3305, 88 The Esplanade

Surfers Paradise QLD 4217

Australia

Email: team@scran.com.au

Website: www.scran.com.au