Privacy Policy

Your privacy is important to us. This Privacy Policy sets out how we collect, use, disclose, store, secure and dispose of personal information. We comply with the Australian Privacy Principles (APPs) as contained in the Privacy Act 1988 (Cth) (Privacy Act). The APPs detail how personal information may be collected, used, disclosed, stored and destroyed, and how an individual may gain access to or make complaints about the personal information held about them.

In this Privacy Policy, ‘we’, ‘our’ or ‘us’ means ExitSure Pty Ltd (ACN 698 912 195).

Relationship with our Terms of Use

Capitalised terms used but not defined in this Privacy Policy have the meaning given in our Terms of Use.

Our Terms of Use provide that Input is generally submitted to ExitSure on a non-confidential basis and may be used and disclosed as described in those Terms of Use.

However, where Input or Output contains personal information, we will handle that personal information in accordance with this Privacy Policy and applicable privacy laws. The non-confidential status of Input under our Terms of Use does not remove or limit any privacy obligation that applies to personal information.

Anonymity and pseudonymity

Where lawful and practicable, you may interact with us anonymously or by using a pseudonym, including when making a general enquiry about our products or Services.

We may require you to identify yourself where:

• •we are required or authorised by law to deal with an identified individual; or
• •it is impracticable for us to deal with you without confirming your identity.

For example, we may need to verify your identity to provide a paid Service, verify your authority to act for an organisation, process a transaction, respond to an access or correction request, or investigate suspected fraud or misuse.

What personal information do we collect and hold?

The types of personal information that we collect and hold depend on how you interact with us and the products and Services you use.

They may include:

Input and user content

We collect Input submitted by or on behalf of users through the Platform and Services. This may include:

• •prompts, questions and instructions;
• •information entered into questionnaires, forms and assessments;
• •documents, files, images, audio and other uploaded material;
• •messages, enquiries, comments and feedback;
• •information about a business, its operations and financial position;
• •information about owners, directors, shareholders, employees, contractors, customers, suppliers, professional advisers and transaction participants;
• •information concerning business-exit, succession, sale, valuation or transaction plans; and
• •personal information about you or another individual included in the Input.

You must only submit personal information about another individual where you are authorised to do so and have provided any required notices and obtained any required consents.

Output and inferred information

We may collect and hold Output generated through the Platform or scoring system, including:

• •responses, summaries and recommendations;
• •scores, assessments, forecasts and indicative values;
• •business, transaction and exit-readiness insights;
• •classifications, inferences and predictions derived from Input; and
• •records of your interaction with and use of Output.

Transaction and payment information

Where you purchase a product or Service, we may collect:

• •billing and transaction details;
• •payment status;
• •invoices and payment history;
• •limited payment-card information made available by our payment processor, such as the card type and last four digits; and
• •payment tokens or transaction identifiers.

We do not ordinarily collect or retain full payment-card numbers. Payment information may be collected and processed by a Third Party Provider subject to its own privacy policy and security arrangements.

Communications and support information

We may collect personal information when you communicate with us, including through email, telephone, online forms, customer-support channels, surveys or complaints.

Technical and usage information

When you use the Platform or Services, we may automatically collect:

• •IP address;
• •browser type and version;
• •device and operating-system information;
• •approximate location derived from an IP address;
• •login, access and activity records;
• •pages and features accessed;
• •dates and times of access;
• •referring websites;
• •errors, diagnostic information and performance data; and
• •information about how you interact with the Platform and Services.

Sensitive information

We do not ordinarily seek to collect sensitive information.

You must not provide sensitive information about another individual unless:

• •the Platform expressly permits that information to be submitted;
• •the information is reasonably necessary for the relevant function or Service; and
• •the individual has consented to its collection, use and disclosure or the collection is otherwise required or authorised by law.

Where we collect sensitive information, we may collect, use and disclose that information where the use or disclosure is directly related to the purpose for which it was collected, and we will otherwise handle it in accordance with applicable privacy law.

How do we collect personal information?

We generally collect personal information directly from you when you:

• •access or use the Platform or Services;
• •submit Input or receive Output;
• •purchase or enquire about a product or Service;
• •communicate with us;
• •request support;
• •participate in a survey, promotion or event;
• •subscribe to communications;
• •provide feedback or make a complaint; or
• •otherwise deal with us.

We may also collect personal information from:

• •another user who submits Input concerning you;
• •a company, business or organisation for which you work or act;
• •your authorised representative or professional adviser;
• •Third Party Providers;
• •Third Party Customers and commercial partners;
• •payment processors;
• •publicly available sources;
• •social-media and professional-networking platforms;
• •analytics, identity-verification and fraud-prevention providers; and
• •other persons who are authorised to provide the information to us.

Where we collect personal information about you from another person, we will take reasonable steps to notify you of the circumstances of collection where required by law.

If you do not provide personal information that we reasonably require, we may be unable to provide a product or Service, generate relevant Output, respond to an enquiry or otherwise deal with you.

Why do we collect, hold, use and disclose personal information?

We may collect, hold, use and disclose personal information to:

Provide and administer the Services

• •verify identity and authority;
• •provide the Platform, products and Services;
• •process Input and generate Output;
• •respond to enquiries and provide customer support;
• •process payments and maintain transaction records;
• •communicate with users and organisations;
• •personalise and improve the user experience; and
• •administer our relationship with you.

Operate and protect our business

• •operate, maintain and secure the Platform and Services;
• •monitor performance and investigate errors;
• •detect, prevent and investigate fraud, misuse, security incidents and unlawful activity;
• •enforce our Terms of Use;
• •manage disputes and complaints;
• •obtain professional advice;
• •comply with legal, regulatory, insurance and record-keeping obligations; and
• •establish, exercise or defend legal claims.

Develop and improve products and services

• •analyse how the Platform and Services are used;
• •test, validate, evaluate and improve the Platform and Services;
• •combine information with information submitted by other users or obtained from other sources;
• •develop new products, features and services;
• •undertake research and analytics;
• •create reports, insights, forecasts, benchmarking and comparisons; and
• •create aggregated or de-identified datasets and commercial products.

Commercial use and Third Party Customers

Subject to applicable law, our Terms of Use and any consent required from the relevant individual, we may use and disclose Input and information derived from Input to:

• •prepare reports, datasets, benchmarking, analytics and insights;
• •identify business, transaction, market and industry trends;
• •develop, test and improve products, services, technologies and artificial-intelligence systems;
• •assess and develop products and services that may be relevant to businesses and users;
• •provide, supply, license or otherwise make information available to Third Party Customers and commercial partners; and
• •permit Third Party Customers and commercial partners to use information for their own disclosed business and commercial purposes.

ExitSure will only disclose de-identified and aggregated information to Third Party Customers. Identifiable personal information will only be disclosed with consent or where otherwise permitted or required by law.

Who may receive personal information?

We may disclose personal information to:

• •our employees, officers and contractors;
• •Third Party Providers, including providers of cloud hosting, storage, cybersecurity, analytics, communications, payment processing, customer support and artificial-intelligence technology;
• •commercial, research and technology partners;
• •professional advisers, insurers and auditors;
• •a purchaser or prospective purchaser of all or part of our business or assets;
• •regulators, courts, tribunals, government authorities and law-enforcement bodies;
• •persons involved in investigating or preventing fraud, security threats or unlawful activity; and
• •any other person to whom you have consented or where disclosure is required or authorised by law.

We will take reasonable steps to ensure that a disclosure is limited to the information reasonably required for the relevant purpose.

Direct marketing

We may use personal information to communicate with you about products, Services, events, content or offers that we consider may be relevant to you where:

• •you have consented;
• •you would reasonably expect us to use the information for that purpose; or
• •the use is otherwise permitted by law.

You may opt out of receiving direct-marketing communications from us at any time by:

• •using the unsubscribe facility in the relevant communication; or
• •contacting us using the details set out at the end of this Privacy Policy.

We will not charge you for making an opt-out request and will action the request within a reasonable period.

You may also ask us not to use or disclose your personal information for the purpose of facilitating direct marketing by another organisation and may request that we identify the source of personal information used for direct marketing, subject to any applicable exception.

This does not prevent us from sending non-marketing communications concerning your transactions, security or use of the Services.

How do we hold and protect personal information

We may hold personal information electronically or in hard-copy records, including through systems and storage facilities operated by Third Party Providers.

We take reasonable technical and organisational measures to protect personal information from misuse, interference, loss and unauthorised access, modification or disclosure.

Depending on the nature and sensitivity of the information, those measures may include:

• •access controls and authentication measures;
• •encryption in transit and at rest where appropriate;
• •monitoring, logging and security testing;
• •system and software maintenance;
• •staff training and internal privacy and security procedures;
• •contractual requirements applying to relevant service providers and contractors;
• •incident-response and data-breach procedures; and
• •physical security measures.

No method of transmitting or storing information is completely secure. Although we take reasonable steps to protect personal information, we cannot guarantee the absolute security of information transmitted through or stored using the internet.

How long do we retain personal information?

We retain personal information only for as long as reasonably necessary for:

• •the purpose for which it was collected;
• •providing and administering the Services;
• •maintaining business, transaction and security records;
• •complying with legal, taxation, accounting and regulatory obligations;
• •resolving disputes and enforcing agreements; and
• •any other purpose for which the information may lawfully be used or disclosed.

Retention periods may differ depending on the nature of the information and the relevant Service.

When personal information is no longer required for a permitted purpose, we will take reasonable steps to destroy it or de-identify it, unless its retention is required or authorised by law.

We may retain:

• •de-identified or aggregated information that is no longer personal information;
• •information contained in routine system backups until it is overwritten or deleted in the ordinary course; and
• •records that we are required or permitted to retain for legal, security, insurance or dispute-resolution purposes.

Automated decision-making

We do not currently arrange for a computer program to use personal information to make, or substantially assist in making, a decision by ExitSure that could reasonably be expected to significantly affect an individual’s rights or interests.

If we commence using personal information for that kind of automated decision-making, we will update this Privacy Policy to describe:

• •the kinds of decisions made or substantially assisted by automated systems; and
• •the kinds of personal information used in those decisions,

We will also provide any additional notice required by law.

Will personal information leave Australia?

Some Third Party Providers, Third Party Customers and commercial partners may be located outside Australia or may store or process personal information using systems located outside Australia.

The countries in which overseas recipients are likely to be located include the United States.

The countries involved may change where we appoint or replace a Third Party Provider, Third Party Customer or commercial partner.

Before disclosing personal information to an overseas recipient, we will take reasonable steps required by applicable privacy law to ensure that the recipient handles the information consistently with the Australian Privacy Principles, unless an exception applies.

In some circumstances, an overseas recipient may be subject to foreign laws that require it to disclose personal information to an overseas authority.

Further information about the countries and providers involved in a particular Service may be included in a collection notice or made available on request.

Access to and correction of personal information

You may request access to personal information that we hold about you or ask us to correct information that is inaccurate, out of date, incomplete, irrelevant or misleading.

A request may be made using the contact details set out at the end of this Privacy Policy.

We may need to verify your identity before providing access or making a correction.

We will respond to an access or correction request within a reasonable period.

We will not charge you for making a request. We may charge a reasonable fee for providing access where permitted by law, but the fee will not be excessive and will not apply to making a correction request.

There may be circumstances in which we are permitted or required to refuse access or correction. If we refuse a request, we will ordinarily give you written reasons and information about how you may complain, unless it would be unreasonable or unlawful to do so.

If we correct personal information that we previously disclosed to another APP entity, you may ask us to notify that entity of the correction. We will take reasonable steps to do so where required by law.

Maintaining the quality of personal information

It is important to us that personal information is up to date. We will take reasonable steps to make sure that personal information is accurate, complete and up-to-date. If you find that the information we have is not up to date or is inaccurate, please advise us as soon as practicable so we can update our records and ensure we can continue to provide quality services to you.

Data Breaches

We maintain procedures for responding to an actual or suspected data breach.

If we become aware of a suspected data breach, we will take reasonable steps to:

• •contain the incident;
• •assess the nature and potential consequences of the incident;
• •take remedial action where practicable;
• •determine whether the incident is an eligible data breach under the Privacy Act; and
• •review the incident and take steps to reduce the risk of recurrence.

Where we have reasonable grounds to believe that an eligible data breach has occurred, we will notify the OAIC and individuals at risk of serious harm as soon as practicable, unless an exception applies.

Changes to this Privacy Policy

We may update this Privacy Policy from time to time to reflect changes to our products, Services, information-handling practices, technology or legal obligations.

The updated version will be published on our website with a revised version date.

Where a change materially affects how we use or disclose personal information already collected, we will take additional steps to notify affected individuals or obtain consent where required by law.

Privacy complaints and enquiries

If you have an enquiry or wish to complain about how we have handled your personal information, please contact:

Attention: Privacy Officer, ExitSure Pty Ltd

Email: contact@exitsure.com.au

Please provide your name and contact details and sufficient information for us to understand and investigate the matter.

We will:

• •acknowledge your complaint within a reasonable period;
• •investigate it through an appropriate person;
• •give you a reasonable opportunity to provide relevant information; and
• •provide a written response within a reasonable period.

We will not charge you for making a privacy complaint.

If you are not satisfied with our response, you may complain to the Office of the Australian Information Commissioner.

Version 1

Version date: 28/10/2026

Read the Terms of Use