Contact us

Privacy Policy

We may change this policy from time to time. Any updated versions of this policy will be posted to our website. Please review it regularly.
This privacy policy was last updated on 12 May 2026.

Purpose of this Policy

SISS Data Services Pty Limited (ACN 151 858 203) and its related bodies corporate (SISS, we, us, our) recognise the importance of protecting the privacy and the rights of individuals in relation to their personal information.  This Privacy Policy sets out how we collect, use, store and disclose your personal information, including personal information collected via our websites and through any of SISS’s products or services, which at the time of writing include ACSISS Connect, ACSISS Adviser, ACSISS My Data, ACSISS Platform and CDR Ready.  

SISS Data Services Pty Limited (ACN 151 858 203) and its related bodies corporate (SISS, we, us, our) recognise the importance of protecting the privacy and the rights of individuals in relation to their personal information. This Privacy Policy sets out how we collect, use, store and disclose your personal information, including personal information collected via our websites and through any of SISS’s products or services, which at the time of writing include ACSISS Connect, ACSISS Adviser, ACSISS My Data, ACSISS Platform and CDR Ready.

This Privacy Policy is governed by the Australian Privacy Principles set out in the Privacy Act 1988 (Cth) (the Act) and is designed to tell you what will happen to the information you provide to us. Please be sure to read this entire Privacy Policy before submitting personal information to us, our agents or contractors, or otherwise using our websites.  

We will only collect, use or disclose personal information in accordance with the Act and this Privacy Policy.  


What is your personal information?

This Privacy Policy concerns any personal information or sensitive information of yours which is provided to us.  

Personal information is any information about an identified individual or an individual who is reasonably identifiable, whether the information is true or not and whether the information is recorded in a material form or not.  

Sensitive information is any personal information about your racial or ethnic origin, political opinions, membership of a political association, religious beliefs or affiliations, philosophical beliefs, membership of a professional or trade association, membership of a trade union, sexual orientation or practices, criminal record, health, genetics, biometrics or biometrics templates. We generally do not wish to be informed of a person’s sensitive information.  

We, in any event, will collect, use or disclose sensitive information about you only as allowed by law, for example where we have received your consent to do so or the collection is required by law.  


Consent

By using our websites or otherwise providing us directly, or through others, with your personal information, you agree with the terms of this Privacy Policy and consent to the collection, use, and disclosure of that information in accordance with this Privacy Policy, the Australian Privacy Principles set out in the Act and other applicable privacy laws.  


What personal information do we collect and hold? 

The type of personal information we collect may include (but is not limited to) the following types of personal information: 

  • name;
  • mailing or street address;
  • email address;
  • telephone number;
  • age or birth date;
  • your employment-related information if you apply for a position with us;
  • profession, occupation or job title;
  • details of the products or services you have purchased from us, together with additional information necessary to deliver those products and services;
  • details about you or your business which you may give us as a result of any of our compliance or due diligence procedures;
  • any additional information relating to you that you provide to us directly through our websites, products or platforms, or indirectly through the use of our websites or online presence, through our representatives or otherwise; and/or
  • information you provide to us through questionnaires, surveys or discussions with our personnel from time to time. 

We may also collect some information that is not personally identifiable information because it does not identify you or anyone else. 


How do we collect your personal information? 

We collect personal information that is necessary for our business activities and in order to provide and develop our services. We may do this in a number of ways, including but not limited to:  

Personal information collected directly from you when it is provided voluntarily by you;  

  • Personal Information provided to us from your financial institution where consent has been provided by you;  
  • From publicly available resources;  
  • By analysing records of your use of our services and websites; and  
  • Through other methods for collecting information.  

When you visit our websites, platforms and download information from them, our Internet Service Provider (ISP) makes a record of your visit and records the following information: 

  • your internet address; 
  • your domain name, if applicable; and 
  • the date and time of your visit to the website. 

Our ISP also collects information such as the pages our users’ access, the documents they download, links from other sites they follow to reach our websites, and the type of browser they use. However, this information is anonymous and is only used for statistical and website development purposes. Our web servers may also gather your IP address to assist with the diagnosis of problems or support issues with our services.  

 Any information gathered in this way is for aggregate purposes only and cannot be traced to an individual user. 

 

Overseas Storage and Transmission

SISS hosts its services and infrastructure in Australia. We are committed to keeping your data within Australia wherever this is within our control. 

 Where you have nominated an accounting, ERP or financial management platform to receive your data, that platform may be hosted outside Australia. The hosting location of your nominated platform is outside SISS’s control and will depend on the platform provider and your organisation’s configuration. In those circumstances, your data will be transmitted to and stored in the country or region in which your nominated platform operates. 

 We take reasonable steps to ensure that any overseas recipients of your personal information handle it consistently with the Australian Privacy Principles. 


Other purposes of collection 

We may also use your personal information for purposes related to those described above which would reasonably be expected by you. We will not use your information for purposes other than those described above unless we have your consent or as permitted by law (including for legal and regulatory reasons).  


Credit Card Details 

 SISS does not directly collect or store credit card details. All payments for our products and services are processed by our third-party payment provider, Stripe, which handles card data in accordance with its own privacy and security standards (including PCI DSS compliance). We do not receive, store or transmit credit card numbers (PANs), expiry dates, security codes (CVV/CVC) or cardholder names. 

 

In relation to Consumer Data Right (CDR) and bank data services, we are not provided with credit card details (including PANs, expiry dates, security codes or cardholder names) by financial institutions, and we do not collect or store such details through those channels. 

 

Passive information collection  

 As described above, when you visit our websites and web servers record certain information automatically. In addition, as you navigate through our websites, further information can be passively collected (that is, gathered without you actively providing the information) through various technologies, including but not limited to cookies, internet tags, web beacons and navigational data collection.  

 

Our websites may use and combine such passively collected anonymous information to provide better services to website visitors, customisation, compile and analyse statistics and trends and otherwise administer and enhance the website experience for you. Such information is not combined with personally identifiable information collected elsewhere on our websites, unless you have consented.  

 

We will handle any personal information collected by cookies in the same way that we handle all other personal information as described in this Privacy Policy.  

 

What happens if we can’t collect your personal information? 

 If you do not provide us with the personal information we request, we may not be able to provide our products or services to you or fulfil our legal and regulatory obligations. 

 

For what purposes do we collect, hold, use and share your personal information? 

 We collect personal information about you so that we can perform our business activities and functions, comply with our legal, regulatory and contractual obligations, and to provide our products and services to you. 

We collect, hold, use and share your information for the following purposes: 

  1. to provide products and services to you and to send communications requested by you; 
  2. to answer enquiries and provide information or advice about existing or new products and services; 
  3. to assess the performance of our website and services and to improve the operation of our website and provision of services; 
  4. to conduct business processing functions including providing personal information to our related bodies corporate, contractors, service providers or other third parties; 
  5. for our administrative, marketing and business development purpose;  
  6. to update our records and keep your contact details up to date; 
  7. if you have applied for a position with us, to evaluate your application; 
  8. to comply with our contractual obligations; and/or 
  9. to comply with any law, rule, regulation, lawful and binding determination, decision or direction of a regulator, or in cooperation with any governmental authority of any country. 

 

Your personal information will not be shared, sold, or disclosed other than as described in this Privacy Policy (unless otherwise agreed in a separate agreement with you). 

 

To whom may we disclose your information? 

 We may only disclose your personal information in certain circumstances, such as where we are required by law or where you have consented to us doing so.  

 We may disclose your personal information to: 

  1. our employees, related bodies corporate, contractors or service providers for the purposes of operation of our websites or business, fulfilling requests by you, and to otherwise provide services and products to you including, without limitation, web hosting providers, IT systems administrators, couriers, payment processors, data entry service providers, and professional advisers such as accountants, solicitors, business advisers and consultants; 
  2. suppliers, service providers and other third parties with whom we have commercial relationships, for business, marketing and related purposes; 
  3. any organisation for any authorised purpose with your express consent; and/or 
  4. any government authority or regulator as required to comply with any law or regulation. 

 

When making such a disclosure we will take reasonable steps to ensure that the recipient is bound by privacy obligations. Unless you consent, we otherwise will not disclose your personal information to third parties.  

 Where we disclose your personal information to professional service providers such as accountants, financial advisers, lenders or other regulated entities, those recipients may have independent legal obligations governing how they handle your information that operate independently of the purposes for which SISS collected or disclosed it. SISS is not responsible for how those recipients handle your personal information once it has been disclosed to them in accordance with your consent or our legal obligations. 

 

Direct Marketing 

 We may send you direct marketing communications and information about our services, events or business updates to which we consider may be of interest to you if you have requested or consented to receive such communications.  

 These communications may be sent in various forms, including but not limited to email, SMS or MMS, in accordance with applicable marketing laws, such as the Spam Act 2003 (Cth). You always have the right to opt-out of receiving such information or communications. You may exercise that right by contacting us as set out below.  

 

Storage and Security of Information  

 We take all reasonable steps to protect the personal information we hold from misuse, interference, loss, unauthorised access, modification, or disclosure. This includes implementing a variety of safeguards consistent with the Act, the Consumer Data Right Rules, and ISO/IEC 27001:2022. 

 Personal information may be stored electronically in secure environments. Access to this information is limited to authorised personnel and contractors, who are bound by confidentiality obligations and subject to appropriate access controls. 

 We regularly review and update our security measures to reflect evolving threats, emerging technologies, and our regulatory obligations. While we take these precautions seriously, no method of online data transmission or storage can be guaranteed to be completely secure. Please be aware that emails and other communications sent to or from our websites may not be entirely secure. 

  

Notifiable Data Breaches 

 In the event of any unauthorised access to, loss, or disclosure of your personal information that is likely to result in serious harm to you, we will: 

  1. Promptly investigate the incident;  
  2. Assess whether it constitutes an eligible data breach under the Act; and 
  3. Notify you and the Office of the Australian Information Commissioner (OAIC) as soon as practicable, in accordance with our obligations under the Notifiable Data Breaches (NDB) scheme. 

 We will also implement appropriate mitigation and containment measures and conduct a post-incident review to prevent recurrence. 

 

Withdrawal of Consent 

 You may withdraw your consent to the collection, use or disclosure of your personal information at any time. To do so you should notify: 

  • SISS:  by contacting our Privacy & Security Officer using the details at the end of this policy; and 
  • Your financial institution: to withdraw any consent provided directly to them; and/or 
  • Your nominated platform or third party: to withdraw any authorisation provided to them directly. 

Please note that withdrawing consent may affect our ability to provide some or all of our services to you. Withdrawal of consent does not affect the lawfulness of any collection, use or disclosure that occurred prior to the withdrawal. 

 

Access and Correction of Information 

 You may request access to any of the personal information we hold about you by contacting us as specified below.  

 We will endeavour to take all reasonable steps to keep secure any information which we hold about you, and to keep this information accurate and up to date. If, at any time, you discover that information held about you is incorrect, you may contact us to have the information corrected. 

 In addition, our employees and the contractors who provide services related to our information systems are obliged to respect the confidentiality of any personal information held by us. 

 

Links to other sites 

 We may provide links to websites outside of our websites, as well as to third party Web sites. These linked sites are not under our control, and we cannot accept responsibility for the conduct of companies linked to our website.  

 Before disclosing your personal information on any other website, we encourage you to examine the terms and conditions of using that website and its privacy statement. 

 

Complaints  

 If you have any questions or concerns about our collection, use or disclosure of personal information, or if you believe we have not complied with this Privacy Policy or the Act, please contact us as set out below. Our Privacy & Security Officer will investigate the complaint and determine whether a breach has occurred and what action, if any, to take.  

 SISS takes all privacy complaints seriously and aims to resolve any such complaint in a timely and efficient manner (SISS has a target response time of 30 days).  

 We expect our procedures will deal fairly and promptly with any complaints. However, if any person remains dissatisfied, they can also make a formal complaint with the Officer of the Australian Information Commissioner (which is the regulator responsible for privacy in Australia).  

 

Office of the Australian Information Commissioner (OAIC).  

 Direct complaints to the following contact points and please note they can be submitted via their website. 

Office of the Australian Information Commissioner  

GPO Box 5218  

Sydney NSW 2001 

1300 363 992  

www.oaic.gov.au  

 

Changes to this policy  

 We reserve the right to change this Privacy Policy from time to time by publishing changes to it on our website. We encourage you to check our website periodically to ensure that you are aware of our current Privacy Policy.  

 

Further information regarding privacy 

 If you wish to discuss aspects of this Privacy Policy with us please don’t hesitate to contact our Privacy & Security Officer: 

 Email: privacy@siss.com.au 
Phone: (02) 9299 4547 
Post: Compliance Officer, PO Box 98, Crows Nest, Sydney NSW 2065 

 Effective: 12 May 2026