Privacy Policy

Last Updated: 16 March 2026
Effective Date: 16 March 2026

ZooYak Pty Ltd, a company registered in Australia ("ZooYak", "we", "us", "our"), operates the ZooYak security guard workforce management platform. We are committed to protecting the privacy and security of all personal information we collect and process.

This Privacy Policy explains how we collect, use, disclose, store, and protect personal information in connection with our platform, including the manager portal, client portal, mobile application, website, and APIs (collectively, the "Service"). It applies to all individuals whose personal information we process, including customers, authorised users, guards, website visitors, and client portal users.

This Privacy Policy is designed to comply with the Privacy Act 1988 (Cth), the Australian Privacy Principles ("APPs"), and applicable Australian state and territory workplace surveillance legislation.

By accessing or using the Service, you acknowledge that you have read and understood this Privacy Policy. If you do not agree with our privacy practices, you should not use the Service.

1. At a Glance

2. Scope and Application

2.1 What This Policy Covers

This Privacy Policy applies to personal information collected through:

• the ZooYak website (zooyak.com);
• the manager portal (app.zooyak.com);
• the client portal;
• the ZooYak mobile application for iOS and Android;
• our APIs and integrations; and
• any other interaction with ZooYak, including support enquiries, sales communications, and events.

2.2 Who This Policy Applies To

This Privacy Policy applies to all individuals whose personal information we process, including:

• Customers: security companies and organisations that subscribe to the Service;
• Authorised Users: managers, administrators, and other personnel authorised by a Customer to use the Service;
• Guards: security officers, patrol officers, and other field personnel whose work is managed through the Service;
• Client portal users: representatives of the Customer's clients who access the client portal;
• Website visitors: individuals who visit zooyak.com or related websites.

2.3 Relationship to Terms of Service

This Privacy Policy forms part of, and should be read together with, our Terms of Service. Definitions used in the Terms of Service have the same meaning in this Privacy Policy unless otherwise defined.

2.4 Controller vs Processor Relationship

The distinction between when ZooYak acts as a data controller and when it acts as a data processor is fundamental to understanding your rights. See Section 4 for full details. In summary:

• ZooYak is the controller for account registration data, billing data, website analytics, and direct marketing.
• ZooYak is the processor for all Customer Data, including guard records, shift data, incident reports, GPS location data, documents, and communications processed on behalf of the Customer.
• The Customer is the controller for their workforce data. Employees and guards seeking to exercise their privacy rights over workforce data should contact their employer in the first instance.

3. Definitions

In this Privacy Policy, the following terms have the meanings set out below:

• "Personal Information" has the meaning given in section 6 of the Privacy Act 1988 (Cth): information or an opinion about an identified individual, or an individual who is reasonably identifiable, whether the information or opinion is true or not, and whether the information or opinion is recorded in a material form or not.
• "Sensitive Information" has the meaning given in section 6 of the Privacy Act 1988 (Cth), and includes information about an individual's racial or ethnic origin, political opinions, membership of a political association or trade union, religious beliefs, philosophical beliefs, sexual orientation, criminal record, health information, genetic information, biometric information, and biometric templates.
• "Customer" means a security company or organisation that has entered into a subscription agreement with ZooYak for use of the Service.
• "Authorised User" means any individual authorised by a Customer to access and use the Service, including managers, administrators, guards, and client portal users.
• "Guard" means a security officer, patrol officer, or other field personnel whose work is managed through the Service.
• "Organisation" means the Customer's account tenant within the Service, representing their security company or business entity.
• "Service" means the ZooYak cloud-based security guard workforce management platform, including the manager portal, client portal, mobile application, APIs, and all related features and functionality.
• "Customer Data" means all data, content, information, and materials that a Customer or its Authorised Users upload, submit, store, transmit, or otherwise make available through the Service, including personal information of guards, employees, contractors, and clients.
• "Aggregated Data" means data that has been de-identified and aggregated such that it does not identify, and cannot reasonably be used to identify, any individual or Customer.
• "Data Processing Agreement" or "DPA" means the agreement between ZooYak and a Customer that governs the processing of personal data on behalf of the Customer, as required under applicable data protection laws.

4. Our Role: Controller vs Processor

4.1 When ZooYak Is the Data Controller

ZooYak determines the purposes and means of processing, and is therefore the data controller, for the following categories of personal information:

• Account registration data: information collected when Customers or Authorised Users create accounts (name, email, phone number, company details);
• Billing and payment data: payment card details (via Stripe), billing addresses, invoice records, and subscription information;
• Website analytics: information about how visitors interact with our website, collected via cookies and similar technologies;
• Direct marketing: contact information used to send promotional communications (with consent or where permitted by law);
• Support interactions: information provided when contacting our support team.

4.2 When ZooYak Is the Data Processor

ZooYak processes the following categories of personal information on behalf of and under the instructions of the Customer (who is the data controller):

• guard profiles, employment details, and qualifications;
• shift records, timesheets, and pay information;
• GPS location data, checkpoint scans, and patrol routes;
• incident reports, photos, evidence, and witness statements;
• documents, signatures, and uploaded files;
• in-platform communications and notification logs;
• leave requests, performance records, and disciplinary records;
• vehicle assignments and fleet management data;
• custom form submissions and responses.

4.3 What This Means for Your Rights

4.4 Data Processing Agreement

Where applicable data protection legislation requires it, the parties shall enter into a Data Processing Agreement ("DPA") governing ZooYak's processing of personal data on behalf of the Customer. The DPA is available at zooyak.com/legal/dpa and is incorporated by reference into the Terms of Service.

5. Information We Collect

We collect and process different categories of personal information depending on how you interact with the Service. The categories below describe the types of information we may collect.

5.1 Account and Identity Data

When you create an account or are added as an Authorised User, we collect:

• full name;
• email address;
• phone number;
• company name;
• role and permissions within the Organisation;
• profile photo (optional);
• authentication credentials (passwords are hashed; we do not store plaintext passwords).

5.2 Workforce Management Data

Processed on behalf of the Customer as data processor.

When Customers manage their workforce through the Service, we process:

• guard profiles and employment details;
• qualifications, certifications, and training records;
• security licence numbers and expiry dates;
• shift records, schedules, and rosters;
• timesheets, clock-in/clock-out records, and hours worked;
• pay rates and payroll-related information;
• leave requests and leave balances;
• performance records and notes;
• disciplinary records;
• emergency contacts and next-of-kin details;
• health information (e.g., fitness-for-duty declarations, where provided by the Customer).

5.3 Location and Surveillance Data

Processed on behalf of the Customer as data processor.

When enabled by the Customer, the Service may collect the following location and surveillance data:

• real-time GPS coordinates (latitude and longitude);
• checkpoint scan records (NFC, QR code, or Bluetooth scans);
• patrol route data and route completion status;
• geofence entry and exit logs;
• clock-in and clock-out locations (GPS coordinates at the time of time recording).

Indoor positioning via Bluetooth Low Energy (BLE) beacon infrastructure may be used to track guard movements within buildings. This includes trilateration-based X/Y coordinate estimation, floor level identification, and positioning accuracy metrics derived from beacon signal strength readings.

5.4 Incident and Safety Data

Processed on behalf of the Customer as data processor.

When incidents are reported through the Service, we process:

• incident reports and descriptions;
• photographs, video, and other evidence;
• injury details and medical information (where provided);
• witness statements and contact details;
• chain-of-custody records for evidence;
• SOS alerts and emergency notifications;
• incident status, resolution notes, and follow-up actions.

5.5 Financial and Billing Data

When Customers subscribe to the Service or make payments, we collect:

• payment card details — processed and stored by our payment processor, Stripe. ZooYak does not store full card numbers, CVVs, or complete card details on our systems;
• billing name and address;
• invoice records and payment history;
• subscription tier and plan details;
• onboarding credit and account credit history;
• tax-related information as required for billing.

5.6 Technical and Usage Data

When you access and use the Service, we automatically collect:

• IP addresses;
• browser type, version, and language preferences;
• device type, operating system, and screen resolution;
• access logs (timestamps, pages visited, actions performed);
• feature usage analytics (which features are used and how);
• error logs and crash reports;
• API call logs (endpoints accessed, response codes);
• referral URLs and search terms used to find our website.

5.7 Communications Data

Processed on behalf of the Customer as data processor.

When communications are sent through the Service, we process:

• in-platform messages and announcements;
• notification logs (push, email, SMS);
• email delivery records and status;
• SMS delivery records and status.

5.8 Document and Media Data

Processed on behalf of the Customer as data processor.

When documents and media are uploaded to the Service, we process:

• uploaded documents (PDFs, Word files, spreadsheets);
• photographs and images;
• electronic signatures;
• floor plans and site diagrams;
• branding assets (logos, colour schemes);
• document metadata (file name, size, upload date, uploader).

5.9 Sensitive Information and Biometric Data

When guards enrol biometric authentication, a cryptographic hash of the biometric template is stored on our servers. Raw biometric data is never stored — only a one-way cryptographic hash that cannot be reversed to recreate the original biometric data. Device-level biometric verification (Face ID, fingerprint) is processed entirely on the guard's device and is not transmitted to our servers.

6. How We Collect Information

We collect personal information through the following means:

6.1 Directly From You

• when you register an account or complete your user profile;
• when you fill in forms within the Service;
• when you contact our support team;
• when you participate in surveys or provide feedback;
• when you subscribe to our marketing communications.

6.2 From Your Employer or the Customer

• when a Customer adds you as a guard, user, or authorised person;
• when a Customer uploads workforce data including your employment details, qualifications, and emergency contacts;
• when a Customer configures tracking or monitoring features that collect your location data.

6.3 Automatically

• through cookies and similar technologies when you visit our website or use the Service (see Section 15);
• through server access logs and application logs;
• through the mobile application (GPS data, device information) when location services are enabled.

6.4 From Third-Party Integrations

• from accounting and payroll integrations (e.g., Xero, MYOB, KeyPay) when authorised by the Customer;
• from single sign-on (SSO) providers when configured by the Customer.

6.5 From Payment Processors

• limited transaction data from Stripe (payment confirmation, last four digits of card, card type, billing postcode) necessary to maintain billing records.

7. How We Use Information

We use personal information for the following purposes:

7.1 Providing the Service

• operating, maintaining, and delivering the features and functionality of the Service;
• processing Customer Data in accordance with the Customer's instructions;
• enabling workforce management features including scheduling, time tracking, patrol management, and incident reporting;
• facilitating communications between Customers, guards, and clients through the platform.

7.2 Account Management

• creating and managing user accounts;
• authenticating users and maintaining session security;
• managing roles, permissions, and access controls;
• providing customer support and responding to enquiries.

7.3 Billing and Payments

• processing subscription payments and issuing invoices;
• managing billing cycles, credits, and refunds;
• complying with tax obligations (including GST and ATO reporting);
• detecting and preventing fraudulent transactions.

7.4 Security and Fraud Prevention

• protecting the Service against unauthorised access, cyberattacks, and other security threats;
• detecting, investigating, and preventing fraudulent or illegal activity;
• monitoring for abuse of the Service or violations of the Terms of Service;
• maintaining audit logs for security and compliance purposes.

7.5 Service Improvement and Analytics

• analysing usage patterns to improve the Service's features, performance, and reliability;
• conducting internal research and development;
• generating Aggregated Data for benchmarking and industry insights (de-identified only, never identifying individual guards or Customers).

7.6 Legal Compliance

• complying with applicable laws, regulations, and legal processes;
• responding to lawful requests from law enforcement or regulatory authorities;
• establishing, exercising, or defending legal claims;
• fulfilling our obligations under the Privacy Act 1988 (Cth), including the Notifiable Data Breaches scheme.

7.7 Communications

• sending service-related notifications (e.g., shift reminders, system maintenance notices, security alerts);
• sending account-related communications (e.g., billing confirmations, policy updates);
• sending marketing communications to Customers and account holders only (with consent or where permitted by law).

Note: We do not send direct marketing communications to guards or employees whose data is processed on behalf of a Customer. Service-related notifications to guards (e.g., shift assignments, schedule changes) are sent on behalf of the Customer.

7.8 Aggregated Data

• generating de-identified, aggregated insights for industry benchmarking, such as average shift durations, incident rates, and compliance trends;
• producing anonymised reports to help Customers understand their operational performance relative to industry norms.

Aggregated Data cannot be used to identify any individual or Customer and is not considered Personal Information under this Privacy Policy.

8. Disclosure and Sharing

We may disclose personal information to the following categories of recipients:

8.1 Sub-Processors and Service Providers

We use third-party sub-processors and service providers to help operate the Service. These providers process personal information only on our instructions and are bound by appropriate data processing agreements. See Section 16 for a full list of sub-processors.

8.2 Payment Processors

Payment card data is processed by Stripe, Inc. in accordance with Stripe's privacy policy and PCI DSS compliance standards. ZooYak does not have access to full payment card numbers.

8.3 Cloud Infrastructure

All Customer Data is hosted on Amazon Web Services (AWS) infrastructure located in Sydney, Australia. AWS processes data in accordance with the AWS Data Processing Addendum and maintains SOC 2, ISO 27001, and other certifications.

8.4 Professional Advisors

We may disclose personal information to our legal, accounting, and other professional advisors where necessary for us to obtain their advice or assistance.

8.5 Law Enforcement and Regulators

We may disclose personal information where we are required or authorised to do so by applicable law, regulation, court order, or governmental request. We will endeavour to notify the affected Customer before making such disclosure, unless prohibited by law.

8.6 Business Transfers

In the event of a merger, acquisition, corporate reorganisation, or sale of all or substantially all of ZooYak's assets, personal information may be transferred to the acquiring entity. We will provide at least 30 days' notice of any such transfer and ensure that the acquiring entity is bound by privacy obligations at least as protective as those in this Privacy Policy.

8.7 The Customer (Data Controller)

Where ZooYak processes personal information on behalf of a Customer, that Customer has access to the data as the data controller. Customers may access, export, and manage all Customer Data through the Service.

8.8 No Sale of Personal Information

9. GPS Location Tracking and Workplace Surveillance

9.1 Tracking Features

The Service includes the following location tracking and monitoring features that may be enabled by the Customer:

• Real-time GPS tracking: continuous or periodic recording of a guard's GPS coordinates during an active shift;
• Checkpoint scanning: recording the time and location when a guard scans an NFC tag, QR code, or Bluetooth beacon at a designated checkpoint;
• Geofencing: recording entry to and exit from predefined geographic boundaries;
• Route tracking: recording the path taken during a patrol and comparing it against the designated route;
• Clock-in/clock-out location: recording the GPS coordinates at the time a guard records starting or ending work.

9.2 When Tracking Is Active

Location tracking features are only active when all of the following conditions are met:

• the Customer has enabled the tracking feature;
• the guard has an active shift or is performing an authorised activity;
• the mobile application is running and location permissions have been granted on the device.

Location data is not collected when a guard is not on shift, unless the Customer has specifically configured the Service to do so (in which case the Customer bears all legal responsibility for such collection).

9.3 Customer's Obligations

9.4 Guard Rights Regarding Location Data

If you are a guard whose location data is collected through the Service:

• you may request access to your location data by contacting your employer (the Customer), who is the data controller;
• your employer is required to respond to your access request in accordance with applicable privacy and surveillance laws;
• you may also have rights under applicable workplace surveillance legislation to receive notice before surveillance commences.

9.5 Retention of Location Data

Location data is retained for 12 months from the date of collection, after which it is securely deleted. Customers may request earlier deletion of location data by contacting ZooYak. See Section 12 for full retention details.

10. International Data Transfers

10.1 Primary Storage Location

All Customer Data is primarily stored and processed on Amazon Web Services (AWS) infrastructure located in Sydney, Australia (ap-southeast-2 region).

10.2 Transfers Outside Australia

In limited circumstances, personal information may be transferred outside Australia where necessary for the provision of the Service. This may occur through:

• sub-processors with operations outside Australia (see Section 16 for locations);
• payment processing via Stripe (which may process data in the United States);
• support and maintenance activities.

10.3 Safeguards for International Transfers

Where personal information is transferred outside Australia, we ensure that:

• APP 8 compliance: in accordance with Australian Privacy Principle 8, we take reasonable steps to ensure that the overseas recipient does not breach the APPs in relation to the information;
• all overseas recipients are bound by contractual obligations regarding data protection at least as protective as those in this Privacy Policy.

10.4 Sub-Processor Locations

The locations of our sub-processors are listed in Section 16. The majority of our sub-processors operate from Australian data centres. Stripe, our payment processor, operates from the United States with appropriate data protection safeguards including SCCs.

11. Data Security

We implement comprehensive technical and organisational measures to protect personal information against unauthorised access, alteration, disclosure, or destruction.

11.1 Encryption

• In transit: all data transmitted between your device and our servers is encrypted using TLS 1.2 or higher;
• At rest: all data stored on our systems is encrypted using AES-256 encryption, with encryption keys managed through a dedicated key management service.

11.2 Access Controls

• role-based access control (RBAC) with least-privilege principles;
• multi-factor authentication (MFA) required for administrative access;
• unique user accounts for all personnel with access to production systems;
• regular access reviews and prompt revocation upon role change.

11.3 Infrastructure Security

• virtual private cloud with network segmentation;
• security groups and network access control lists;
• web application firewall (WAF) for protection against common web-based attacks;
• distributed denial-of-service (DDoS) mitigation.

11.4 Monitoring and Testing

• real-time alerting for suspicious activity;
• comprehensive access logging and audit trails;
• regular penetration testing by qualified third parties;
• automated vulnerability scanning of infrastructure and code;
• security incident event management (SIEM).

11.5 Personnel Security

• background checks for all personnel with data access;
• binding confidentiality agreements;
• mandatory security awareness training;
• clean desk and clear screen policies.

11.6 Multi-Tenant Data Isolation

The Service operates a multi-tenant architecture with strict logical data isolation. Each Organisation's data is separated using organisation-scoped database queries that are enforced at the application layer. No Customer can access another Customer's data.

11.7 Compliance Targets

ZooYak is committed to achieving and maintaining SOC 2 Type II compliance. Information about our current security posture and compliance certifications is available upon request, subject to appropriate confidentiality obligations.

11.8 Incident Response

We maintain a documented incident response plan that includes procedures for identification, containment, eradication, recovery, and post-incident review. See Section 14 for our Notifiable Data Breaches obligations.

12. Data Retention

We retain personal information only for as long as necessary to fulfil the purposes for which it was collected, or as required by applicable law. The following table sets out our standard retention periods:

12.1 Deletion Methods

When the retention period for personal information expires, we securely delete or de-identify the data using one or more of the following methods:

• Crypto-shredding: destruction of encryption keys, rendering encrypted data permanently unreadable (where applicable);
• Secure deletion: overwriting data in accordance with industry-standard secure deletion procedures;
• De-identification: irreversibly removing all identifying attributes, converting data to Aggregated Data.

12.2 Customer-Initiated Deletion

Customers may request deletion of specific Customer Data at any time by contacting ZooYak. We will process deletion requests within 30 days, subject to any legal obligations that require us to retain the data.

13. Your Rights Under the Australian Privacy Act

Under the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs), you have the following rights:

13.1 Right of Access (APP 12)

You have the right to request access to the personal information we hold about you. We will provide access within 30 days of receiving your request, subject to any exceptions permitted under the Privacy Act 1988.

13.2 Right of Correction (APP 13)

You have the right to request correction of personal information that is inaccurate, out of date, incomplete, irrelevant, or misleading. We will respond to correction requests within 30 days. If we refuse to correct information, we will provide a written notice explaining our reasons and how you may complain.

13.3 How to Exercise Your Rights

• For account and billing data (where ZooYak is the controller): contact us directly at privacy@zooyak.com;
• For workforce data (where the Customer is the controller): contact your employer (the Customer) in the first instance. Your employer may then instruct ZooYak to action your request.

13.4 Response Timeframe

We will respond to access and correction requests within 30 days of receiving the request. If we need additional time, we will notify you and provide a revised timeframe.

13.5 No Fee

We do not charge a fee for making an access or correction request, or for providing access to your personal information. However, we may charge a reasonable fee for providing access in a non-standard format (e.g., certified copies) if requested.

13.6 Right to Complain

If you are not satisfied with our response to your request or our handling of your personal information, you have the right to complain to the Office of the Australian Information Commissioner (OAIC). See Section 21 for complaint details.

14. Notifiable Data Breaches

14.1 Australian NDB Scheme

ZooYak complies with the Notifiable Data Breaches (NDB) scheme under Part IIIC of the Privacy Act 1988 (Cth), introduced by the Privacy Amendment (Notifiable Data Breaches) Act 2017 (Cth). Under this scheme:

• we are required to assess whether an eligible data breach has occurred or is suspected to have occurred;
• an eligible data breach occurs when there is unauthorised access to, or unauthorised disclosure of, personal information, or loss of personal information, that is likely to result in serious harm to any of the individuals to whom the information relates;
• upon confirming an eligible data breach, we will notify the Office of the Australian Information Commissioner (OAIC) as soon as practicable (and in any event within 30 days of becoming aware of the breach);
• we will also notify the affected individuals as soon as practicable, providing details of the breach, the types of information involved, and recommended steps to take.

14.2 Customer Notification

Where a data breach involves Customer Data, ZooYak will notify the affected Customer within 48 hours of confirming the breach. The notification will include:

• the nature and scope of the breach;
• the categories and approximate number of records affected (where known);
• the likely consequences of the breach;
• the measures taken or proposed to address the breach and mitigate its effects.

15. Cookies and Tracking Technologies

15.1 What Are Cookies

Cookies are small text files placed on your device when you visit a website. We use cookies and similar technologies to provide, protect, and improve our Service.

15.2 Types of Cookies We Use

15.3 No Analytics, Advertising, or Third-Party Tracking Cookies

We do not use analytics cookies, advertising cookies, retargeting cookies, or third-party tracking cookies. We do not share cookie data with advertising networks or data brokers.

15.4 Managing Cookies

You can manage cookies through your browser settings. Most browsers allow you to refuse cookies or delete existing cookies. Please note that disabling essential cookies (session, authentication, CSRF) will prevent you from using the Service.

15.5 Do Not Track

We honour Do Not Track (DNT) signals sent by your browser. Since we do not use analytics or tracking cookies, no additional action is required when a DNT signal is detected.

15.6 Further Information

For more detailed information about our use of cookies, please see our Cookie Policy.

16. Sub-Processors

We use the following third-party sub-processors to assist in providing the Service. All sub-processors are bound by data processing agreements and are required to implement appropriate technical and organisational security measures.

16.1 Changes to Sub-Processors

We will provide at least 30 days' prior written notice before engaging a new sub-processor or materially changing the scope of an existing sub-processor's engagement. If a Customer has a reasonable objection to a new sub-processor on data protection grounds, the parties will discuss the objection in good faith in accordance with the Terms of Service.

17. Automated Decision-Making

17.1 No Solely Automated Decisions

ZooYak does not make any decisions based solely on automated processing, including profiling, that produce legal effects concerning any individual or that similarly significantly affect any individual.

17.2 Advisory Algorithmic Features

The Service includes certain algorithmic and analytics features that are advisory only, including:

• scheduling optimisation suggestions (suggesting optimal shift assignments);
• compliance alerts (flagging expiring licences or overdue training);
• performance analytics (aggregated metrics and trend analysis);
• billing calculations (automated calculation of fees based on usage and tier).

These features provide recommendations and alerts to assist the Customer in making decisions. The Customer retains all decision-making authority over their workforce. No employment, disciplinary, performance, or scheduling decision is made by ZooYak or the Service without human review and authorisation by the Customer.

18. Children's Privacy

The Service is designed for use by businesses and their employees in the security industry and is not directed at individuals under the age of 18. We do not knowingly collect personal information from children under 18.

If we become aware that we have collected personal information from a child under 18, we will take steps to promptly delete that information. If you believe we may have collected information from a child under 18, please contact us at privacy@zooyak.com.

19. Third-Party Links and Integrations

19.1 Third-Party Websites

The Service and our website may contain links to third-party websites or services. These third-party websites have their own privacy policies, and we are not responsible for their content or privacy practices. We encourage you to read the privacy policy of any third-party website you visit.

19.2 Third-Party Integrations

The Service offers integrations with third-party applications, including accounting software (Xero, MYOB), payroll systems (KeyPay), and other business tools. When you enable a third-party integration:

• data may be shared between ZooYak and the third-party application as necessary for the integration to function;
• the third party's own terms of service and privacy policy govern their processing of your data;
• you can disconnect integrations at any time through the Service settings.

ZooYak is not responsible for the privacy practices of third-party integration providers.

20. Changes to This Privacy Policy

20.1 Material Changes

If we make material changes to this Privacy Policy (including changes to the categories of data collected, the purposes of processing, or the recipients of data), we will provide at least 30 days' prior notice via email to the address associated with your account and/or via an in-app notification. For existing users, material changes require affirmative consent and will not take effect until accepted.

20.2 Non-Material Changes

Non-material changes (such as clarifications, formatting updates, or corrections) may take effect upon posting to this page. We will update the "Last Updated" date at the top of this Privacy Policy whenever any change is made.

20.3 Previous Versions

Previous versions of this Privacy Policy are available upon request by contacting privacy@zooyak.com.

21. How to Make a Complaint

21.1 Australian Residents

If you believe we have breached the Australian Privacy Principles or mishandled your personal information:

1. Contact us first: email privacy@zooyak.com with details of your complaint. We will acknowledge your complaint within 5 business days and aim to resolve it within 30 days.
2. If unsatisfied: you may lodge a complaint with the Office of the Australian Information Commissioner (OAIC):
   • Website: www.oaic.gov.au
   • Phone: 1300 363 992
   • Post: GPO Box 5218, Sydney NSW 2001

22. Contact Information

If you have any questions, concerns, or requests regarding this Privacy Policy or our privacy practices, please contact us:

• Email: privacy@zooyak.com

22.1 Data Protection Enquiries

For matters relating to data protection, please contact us at privacy@zooyak.com. We are responsible for overseeing our compliance with applicable data protection laws and for handling all privacy-related enquiries and complaints.

This Privacy Policy was last updated on 16 March 2026 and is effective as of 1 March 2026. Previous versions of this Privacy Policy are available upon request by contacting privacy@zooyak.com.