Data Stewardship and Governance Policy

1. Purpose

SISS Data Services is a software company specialising in data feed solutions, enabling businesses to securely transfer bank data into nominated software platforms.

The purpose of this policy is to define the data stewardship and governance principles applied by SISS Data Services to ensure that data is managed responsibly, securely, and in accordance with applicable regulatory obligations and customer expectations.

2. Scope

This policy applies to all data collected, processed, stored, and disclosed by SISS Data Services through its bank feed and related services.

3. Our Approach to Data (Ethical Use and Stewardship)

SISS Data Services acts as a custodian of customer data and is committed to the responsible and ethical use of that data.

Customer data is only collected, used, and disclosed for purposes authorised by the customer through valid consent. SISS does not repurpose, monetise, or use customer data for unrelated analytics, marketing, profiling, or product development activities unless such use has been clearly disclosed and explicitly authorised through the consent process.

SISS applies data minimisation principles and limits the collection, retention, and use of data to what is necessary to deliver its services, consistent with customer expectations and regulatory obligations.

SISS may use data for internal operational purposes such as service delivery, data quality monitoring, and system performance analysis, subject to appropriate access controls.

4. Data Governance Framework

SISS Data Services maintains a data governance framework designed to ensure the confidentiality, integrity, availability, and quality of data.

Key roles include:

• Data Stewards – responsible for ensuring the integrity, availability, confidentiality, and quality of data
• Data Managers – responsible for operational access and management of data
• Custodianship Model – SISS acts as a custodian of data on behalf of customers and authorised parties

Overall accountability for data governance is assigned to designated senior management roles, supported by defined governance processes.

Data is treated as a shared organisational resource and is managed in accordance with defined governance and security controls.

5. Data Lifecycle Management

SISS manages data across its full lifecycle, including:

• collection
• use and disclosure
• storage and protection
• retention
• deletion

Data lifecycle controls are designed to ensure data remains accurate, secure, and appropriately managed at all stages.

6. Consent and Open Banking Alignment

SISS obtains informed and explicit consent from individuals where required, in accordance with applicable privacy laws and open banking frameworks, including the Australian Consumer Data Right (CDR) and the New Zealand Consumer Data Right established under the Customer and Product Data Act 2025.

Customer consent defines the scope, purpose, and duration of data collection, use, and disclosure. Consent is granular, time-bound, and revocable.

SISS only uses and discloses data in accordance with the consent provided.

Due to the technical design of certain open banking frameworks, SISS may receive a broader dataset from data holders than is required. SISS applies data minimisation controls to ensure that only data necessary to fulfil the authorised purpose is retained and used.

SISS does not utilise screen scraping to obtain or collect data.

7. Data Use and Disclosure Principles

• Data is only made available to authorised parties with a valid business purpose
• Access to data is governed by the principles of least privilege and need to know
• SISS is transparent in how data is used and disclosed
• Data provided to customers is verified against source systems where applicable
• Third parties accessing SISS data must agree to contractual obligations and implement appropriate security controls
  
  

8. Data Classification

SISS classifies data as either:

• Public Data – information that is publicly available
• Protected Data – all other data managed by SISS

Protected data is secured and access is restricted based on business need and authorisation.

9. Data Protection and Security

SISS implements controls to protect data against unauthorised access, misuse, or loss, including:

• access controls and authentication mechanisms
• monitoring and audit of system access
• periodic review of access to APIs and systems
• verification processes prior to sharing personal or financial information

All entities accessing SISS systems must maintain appropriate security controls. SISS may require evidence of such controls and may take action where minimum security expectations are not met.

SISS manages data breaches in accordance with applicable regulatory requirements, including the Notifiable Data Breaches Scheme (Australia) and equivalent obligations under the New Zealand Privacy Act 2020.

Where data is transferred across jurisdictions, SISS ensures appropriate safeguards are in place to protect personal information in accordance with applicable privacy laws.

10. Data Retention and Deletion

SISS retains data only for as long as required to fulfil its operational and regulatory obligations.

• Data collected under open banking consents (including CDR) is deleted or rendered inaccessible in accordance with applicable regulatory requirements when consent expires or is withdrawn
• Personal information is destroyed or de-identified when no longer required, in accordance with applicable privacy laws
• Customers may request access, correction, or deletion of their data in accordance with applicable legislation
  
  

11. Regulatory Alignment

SISS Data Services operates in accordance with applicable regulatory frameworks, including:

• Privacy Act 1988 (Australia)
• Privacy Act 2020 (New Zealand)
• Australian Consumer Data Right (CDR)
• Customer and Product Data Act 2025 (New Zealand)

Data managed under the Consumer Data Right is also subject to the SISS CDR Policy: https://acsiss.com.au/cdr-policy/

SISS maintains governance and oversight processes to ensure alignment with applicable regulatory, privacy, and security obligations across all jurisdictions in which it operates.

12. Review

This policy is reviewed annually or more frequently where required.