Privacy Policy

This policy explains how [Registered company name] Pty Ltd (ABN [ABN]), trading as Portfoli.au (we, us, our), handles personal information. It applies to our website, our applications and every other service we provide.

We handle personal information in accordance with the Privacy Act 1988 (Cth) (Privacy Act) and the thirteen Australian Privacy Principles (APPs) in Schedule 1 of that Act.

Personal information means information or an opinion about an identified individual, or an individual who is reasonably identifiable, whether or not it is true and whether or not it is recorded in a material form.

We collect only what we need to provide the service. We collect and hold the following kinds of personal information.

Identity and contact information

Your first name, your last name if you give one, and your email address. We do not ask for your postal address, telephone number, date of birth or identity documents. If a feature you choose to use ever needs more, we will ask at that point and say why.

Your agreements with us

That you confirmed you are 18 or older, that you accepted our Terms of Service and this policy (with the version and the date and time you did), whether and when you agreed to receive product news, and whether you have confirmed your email address.

Account information

Your login credentials (passwords are stored only as a salted hash, never in a form we can read), your account settings, and a record of your communications with us. When we send you a code to confirm your email address, we keep only a one-way hash of it, which stops working after ten minutes or once used.

Financial and investment information

The holdings, transactions, brokerage and fees you record or upload, the exchange rates applied to them, the names you give your portfolios, and the summaries, reports and calculations we generate from that information.

Information about other people

If you keep a portfolio for a family member, you may give it their name. We use that name only to label the portfolio for you, and we never contact that person. Please make sure they are happy for you to record it, and tell them about this policy.

Payment information

If you subscribe to a paid plan, our payment processor collects and processes your card or bank details. We do not store full card numbers on our systems; we hold only a token, the last four digits, the card type and expiry, and a record of the transaction.

Technical information

Your IP address and browser identifier, which we keep only as a one-way hash in our security log and in the counters that stop repeated sign-in attempts, together with the dates and times of security events such as signing in. Our hosting provider processes your IP address to deliver the service. We do not use analytics or advertising trackers.

Tax file numbers

We do not require your tax file number to use Portfoli.au, and we ask that you do not provide one. See section 6.

Sensitive information

We do not seek sensitive information as defined in section 6 of the Privacy Act (which includes health information, and information about racial or ethnic origin, political opinions, religious beliefs, sexual orientation and criminal record). If you provide it to us unsolicited, we will deal with it under APP 4, which generally means destroying or de-identifying it if it would have been unlawful for us to collect it.

Wherever it is reasonable and practicable, we collect personal information directly from you: when you create an account, enter or upload records, subscribe to a plan, or contact our support team.

We also collect information:

• from our payment processor, in the form of the transaction records and tokens described above;
• automatically, through cookies and similar technologies, as described in section 9; and
• from publicly available sources, such as market data and corporate action announcements, which are generally not personal information.

If we collect personal information about you from someone else, we will take reasonable steps to notify you of the matters in APP 5, unless an exception applies.

We handle personal information for these purposes:

• to create, authenticate and administer your account;
• to provide the service: recording your holdings and transactions, valuing them, and producing the summaries, reports and downloads you ask for;
• to process payments and manage subscriptions;
• to provide customer support and respond to your questions and complaints;
• to maintain, secure, test and improve the service, including diagnosing faults and preventing fraud and misuse;
• to send you service messages, such as billing notices, security alerts and changes to our terms. These are not marketing, and you cannot opt out of them while you have an account;
• to send you product news, but only if you have agreed to receive it (see section 8); and
• to comply with our legal obligations and to establish, exercise or defend legal claims.

Under APP 6 we will only use or disclose your personal information for the purpose we collected it for (the primary purpose), for a related secondary purpose you would reasonably expect, where you have consented, or where the Privacy Act otherwise permits or requires it.

We may disclose personal information to:

• Service providers who perform functions on our behalf: cloud hosting and storage, payment processing and email delivery. They may use the information only to perform those functions for us.
• People you authorise, for example an accountant, registered tax agent or financial adviser you send a download or a tax-time pack to.
• Our professional advisers, including lawyers, auditors and insurers.
• Law enforcement, courts and government agencies, where we are required or authorised by law to do so.
• A purchaser, if we sell or transfer all or part of our business, subject to that purchaser agreeing to handle the information consistently with this policy.

Tax file numbers receive specific protection under the Privacy Act and the Privacy (Tax File Number) Rule 2015, which is legally binding. We do not require your tax file number in order to provide the service, and we ask that you do not enter one into any free-text field.

If you do provide a tax file number, we will not use or disclose it except as permitted by taxation, personal assistance or superannuation law, and we will take reasonable steps to delete it once it is no longer required.

Under APP 9 we will not use a government related identifier (such as a tax file number, Medicare number, driver licence number or Centrelink reference number) as our own identifier for you.

Under APP 2 you have the option of dealing with us anonymously or by pseudonym where that is lawful and practicable. You may browse our public website and make general enquiries without identifying yourself.

It is not practicable for us to provide an account, hold your records or process a payment anonymously, because we could not secure your data to you, restore your access, or meet our obligations to you if we did not know who you were.

We send product news only if you have agreed to receive it. The box is unticked when you sign up, and you can change your choice at any time in Settings. Every marketing message we send contains a functional unsubscribe facility, as required by the Spam Act 2003 (Cth), and we will action an unsubscribe request within five business days.

You may opt out at any time by using the unsubscribe link, changing your notification settings, or writing to us at support@portfoli.au. Opting out of marketing does not stop service messages about your account, billing or security.

Under APP 7.6 you may also ask us to tell you where we obtained your information, and we will respond within a reasonable period and at no charge.

We use cookies and similar technologies. A cookie is a small file stored on your device. Where a cookie can be linked to you, we treat it as personal information.

Strictly necessary

One cookie keeps you signed in and protects your session. The service does not work without it.

Stored in your browser

Display choices, such as which portfolio you last viewed or how a table is sorted, and a short-lived copy of figures you have just loaded, so pages appear quickly. These stay on your device.

We do not use analytics, advertising or tracking cookies.

You can block or delete cookies through your browser settings. If you block strictly necessary cookies, you will not be able to sign in.

APP 11 requires us to take reasonable steps to protect personal information from misuse, interference and loss, and from unauthorised access, modification or disclosure. The steps we take include encryption of data in transit and at rest, hashed password storage, access controls that limit staff access to what their role requires, logging and monitoring, and periodic review of our security practices and our service providers.

We hold personal information in electronic form on servers operated by our cloud hosting providers, and occasionally in hard copy, which we store securely.

We maintain a data breach response plan. If we have reasonable grounds to believe an eligible data breach has occurred, we will comply with the Notifiable Data Breaches scheme in Part IIIC of the Privacy Act. An eligible data breach is unauthorised access to, unauthorised disclosure of, or loss of personal information that is likely to result in serious harm to any affected individual.

That means we will contain and assess the breach, and where it is an eligible data breach, notify the Office of the Australian Information Commissioner (OAIC) and the individuals at risk of serious harm as soon as practicable, setting out what happened, what information was involved and what those individuals should do in response. Where we suspect a breach may be eligible, we will complete an assessment within 30 days.

Your records are stored in a database in Sydney, Australia. Some of our service providers are based outside Australia, so personal information is likely to be disclosed to recipients in the United States of America and Japan. These are our hosting and network provider (United States), which may also handle a request in the country you are in when you use the service, and our email delivery provider (United States), which receives your email address and sends your account emails from its servers in Japan.

Before disclosing personal information overseas, APP 8.1 requires us to take reasonable steps to ensure the recipient does not breach the APPs. We do this through contractual commitments with our providers and by assessing their security practices before we engage them.

The list above reflects our current providers. If it changes we will update this policy.

We keep personal information only for as long as we need it for the purposes set out in this policy, or for as long as the law requires us to.

Some records must be kept for minimum periods. For example, records relevant to a tax return generally need to be kept for five years under Australian taxation law, and capital gains tax records may need to be kept for longer. Because you may need your records for that purpose, we retain your transaction history while your account is open.

When you close your account we will delete or de-identify your personal information within a reasonable period, except where we are required to retain it by law, or where we need it to establish, exercise or defend a legal claim. Backups are overwritten on a rolling cycle.

Under APP 12 you may request access to the personal information we hold about you. Under APP 13 you may ask us to correct it if it is inaccurate, out of date, incomplete, irrelevant or misleading. Much of it you can view and change yourself at any time in your account settings.

For anything else, write to support@portfoli.au. We will need to verify your identity. We will respond within 30 days. We do not charge for making a request; if giving access involves substantial work we may charge a reasonable fee for our costs, and we will tell you what it is before we incur it.

We may refuse access or correction in the limited circumstances the Privacy Act allows. If we do, we will tell you in writing why, and how you can complain. If we refuse to correct information, you may ask us to attach a statement noting that you consider it inaccurate, and we will take reasonable steps to do so.

If you think we have breached the Privacy Act, the APPs or this policy, please tell us first so we have the chance to put it right.

Step 1: complain to us

Write to The Privacy Officer at support@portfoli.au, or by post to [Registered street address, State, Postcode, Australia]. Set out what happened and what you would like us to do. We will acknowledge your complaint within 5 business days, investigate it, and give you a written response within 30 days. If we need longer we will tell you why and when to expect an answer.

Step 2: take it to the OAIC

If you are not satisfied with our response, or we do not respond in time, you may complain to the Office of the Australian Information Commissioner (OAIC). The OAIC generally requires you to raise the matter with us first and allow us 30 days to respond.

https://www.oaic.gov.au · 1300 363 992

Portfoli.au is designed for Australian investors and Australian tax record-keeping, and our services are directed to Australia.

If you are in the European Economic Area or the United Kingdom, data protection law there may give you additional rights, including rights of access, rectification, erasure, restriction, portability and objection, and the right to complain to your local supervisory authority. Where that law applies to us, we will honour those rights. Write to support@portfoli.au to exercise them.

We may update this policy from time to time. The version number and the date at the top of this page tell you which version is current.

If we make a change that materially affects how we handle your personal information, we will give you advance notice by email or through the service before the change takes effect.

Privacy enquiries and complaints

The Privacy Officer · support@portfoli.au

General support

support@portfoli.au

Post

[Registered company name] Pty Ltd, [Registered street address, State, Postcode, Australia]