SYDNEY EXPRESS – PRIVACY POLICY

Finance Systems Australia Pty Ltd | ABN: 39 654 030 332 | ACN: 654 030 332 | Effective Date: 14/11/2026 | Version 1.0

1. Introduction & Our Identity

Sydney Express Business Directory (“Sydney Express”, “we”, “us”, or “our”) is a digital business directory and online marketplace operated by Finance Systems Australia Pty Ltd (ABN: 39 654 030 332; ACN: 654 030 332), a company incorporated in Sydney, New South Wales, Australia.

Our registered business name “Sydney Express” is registered with the Australian Securities and Investments Commission (ASIC). Our principal place of business is Shops 6 & 7, 89–91 Victoria Road, Drummoyne NSW 2047.

This Privacy Policy explains how we collect, use, disclose, store, and protect personal information in accordance with the Privacy Act 1988 (Cth), the Australian Privacy Principles (APPs) set out in Schedule 1 of that Act, the Spam Act 2003 (Cth), the Do Not Call Register Act 2006 (Cth), and all other applicable Australian laws.

Some small businesses are exempt from the Privacy Act. Whether or not that exemption applies to us, we have chosen to handle all personal information in line with the Australian Privacy Principles and to follow the Notifiable Data Breaches scheme.

By accessing our website at sydneyexpress.com.au (“Website”), submitting or claiming a business listing, buying a plan or advertising, or otherwise interacting with our services (“Services”), you acknowledge that you have read and understood this Privacy Policy.

2. Scope of This Policy

This Privacy Policy applies to:

• All visitors to our Website regardless of whether they create an account;
• All registered users of the Website, including business owners and consumers;
• All businesses and individuals who claim, submit, or pay for a business listing;
• All businesses and individuals who purchase advertising or paid placements;
• All persons who contact us via telephone, email, our contact form, or social media channels;
• All persons who subscribe to our newsletter, email communications, or SMS marketing; and
• All third parties whose personal information we may receive in the course of operating our Services.

This Policy does not apply to third-party websites, apps, or services that may be linked to from our Website. We encourage you to review the privacy policies of any third parties you interact with.

3. What Personal Information We Collect

“Personal information” has the meaning given in the Privacy Act 1988 (Cth): information or an opinion about an identified individual, or an individual who is reasonably identifiable.

3.1 Information You Provide to Us

Account Registration

• Full name and display name;
• Email address;
• Password (stored in hashed form; we do not have access to your plain-text password);
• Phone number (optional at registration, may be required for verification); and
• Profile photo (if uploaded).

Business Listing Submission

• Business name, trading name, and ABN/ACN (where provided);
• Business address, suburb, and postcode;
• Business category and sub-category;
• Business description, opening hours, and services offered;
• Contact phone number, email address, and website URL;
• Business photos, logos, and promotional images;
• Social media handles and external links;
• Any other information you choose to include in your listing; and
• When you claim a listing: your name, your role in the business, your contact details and any documents you give us to show you own or work for the business.

Payment & Billing

• Cardholder name and billing address;
• Credit or debit card details. Card numbers are processed only by our payment processor, Stripe (PCI-DSS Level 1), and are NOT stored on our servers. We never see your full card number;
• Payment amount, transaction date, and invoice reference; and
• ABN for GST invoicing purposes.

Communications

• Content of enquiries, support requests, and complaints submitted via our contact form, email, or telephone;
• Records of correspondence; and
• Details of any disputes or feedback.

User-Generated Content

• Reviews, ratings, and comments posted on the Website;
• Photos or images uploaded in relation to reviews or listings; and
• Responses to surveys or questionnaires.

3.2 Information We Collect Automatically

When you access our Website, our servers and analytics tools automatically collect technical and usage data, including:

• IP address and approximate geographic location derived from your IP address;
• Browser type, version, and operating system;
• Device type and unique device identifiers;
• Referring URL and exit pages;
• Pages viewed, time spent on pages, and clickstream data;
• Search queries entered on the Website;
• Date and time of access; and
• Cookie identifiers and session tokens (see Section 7, Cookies & Tracking Technologies).

3.3 Information From Third Parties

We may receive personal information about you from:

• Public sources, when we create a basic listing for a business (see Section 13.4);
• Business verification data providers (e.g., ABN Lookup via the Australian Business Register);
• Analytics providers (in aggregated or pseudonymous form);
• Other users who mention you in reviews or listings (we will manage such information in accordance with this Policy); and
• Our payment processor, Stripe, confirming successful or failed transactions.

3.4 Sensitive Information

We do not intentionally collect sensitive information (as defined by the Privacy Act 1988 (Cth), which includes health information, racial or ethnic origin, political opinions, religious beliefs, sexual orientation, or criminal records). If you choose to disclose sensitive information as part of a business description or review, you do so voluntarily and consent to us handling that information in accordance with this Policy.

4. How We Use Your Personal Information

We use personal information only for purposes that are reasonably necessary and proportionate to the delivery of our Services.

We will not use your personal information for any purpose that is incompatible with the primary purpose for which it was collected, unless you have separately consented, you would reasonably expect us to use it for that purpose, or we are required or authorised by law to do so.

5. Disclosure of Personal Information

5.1 Our Service Providers

We engage trusted third-party service providers to assist us in operating our Services. These providers receive personal information only to the extent necessary to perform their functions. They include:

• Our web host, Instra Corporation, with servers in Australia;
• Our related businesses that provide Business Growth Services (SynergyOne, Webhost Media and meDigital), only when you choose to use one of those services;
• Stripe, for card payments, subscriptions and invoices (United States);
• HighLevel (GoHighLevel / LeadConnector), the CRM that receives enquiries sent through our Contact Us form (United States);
• Google, for Google Analytics, Google reCAPTCHA spam protection, Google Maps and Google Fonts (United States);
• Ahrefs, for website visit statistics, which does not use cookies (Singapore);
• YouTube, when a video is embedded on a page (United States);
• OpenStreetMap and komoot (Photon), for the address lookup and map pin when you add or edit a listing (Germany / European Union);
• Professional advisors including accountants, lawyers, and auditors; and
• IT support and software development contractors.

5.2 Advertising Partners

We do not use third-party advertising networks (such as Google Ads or Meta) to show ads on our Website or to track you for advertising. If that changes, we will update this Policy and our Cookie Policy before it starts. We do not sell, rent, or trade your personal information to anyone.

5.3 Business Listings – Public Disclosure

Information contained in a business listing (business name, address, phone number, email, hours, description, photos) is, by design, publicly visible on the Website and may be indexed by search engines. If you are a business owner and do not wish certain information to be publicly displayed, do not include it in your listing.

5.4 Reviews & User-Generated Content

Reviews, ratings, and comments you post on the Website are public. Your display name and any information you choose to include in your review will be visible to other users and may be indexed by search engines. Exercise caution about what personal information you include in a public review.

5.5 Legal Disclosures

We may disclose your personal information to law enforcement agencies, regulatory bodies (including ASIC and the OAIC), courts, or other government authorities where we are required or authorised to do so by Australian law, including pursuant to a subpoena or court order, the Privacy Act 1988 (Cth), the Crimes Act 1914 (Cth), or our reporting obligations under anti-money laundering or counter-terrorism financing laws.

5.6 Business Transfers

If Finance Systems Australia Pty Ltd is involved in a merger, acquisition, sale of assets, or restructure, personal information we hold may be transferred to a successor entity. We will notify you via a prominent notice on our Website and/or by email prior to your information being transferred.

5.7 Overseas Disclosure

Some of the providers listed in Section 5.1 store or process personal information outside Australia, so we are likely to disclose personal information to overseas recipients. The main countries are the United States (Stripe, Google, YouTube and HighLevel), Singapore (Ahrefs) and Germany (komoot). These providers may also use data centres and sub-processors in other countries. Before we use a provider, we take reasonable steps, including relying on its contractual privacy and security commitments, to make sure it handles personal information in a way that is consistent with the Australian Privacy Principles.

6. Your Rights & Choices

6.1 Access to Your Personal Information

Under Australian Privacy Principle 12, you have the right to request access to personal information we hold about you. Contact us at support@sydneyexpress.com.au. We will respond within 30 days. We do not charge a fee for making an access request. For large or complex requests, we may recover the reasonable cost of providing access, and will notify you of any such cost before it is incurred.

6.2 Correction of Personal Information

If you believe that personal information we hold about you is inaccurate, out of date, incomplete, irrelevant, or misleading, you may request correction under Australian Privacy Principle 13. Most account information can be corrected directly via your account settings. For other corrections, contact support@sydneyexpress.com.au.

6.3 Deletion of Your Account & Data

You may request deletion of your account and associated personal information at any time. Please note:

• Deletion of your account will remove your personal profile, but public content (such as reviews you have posted) may be retained in a de-identified form;
• Records we must keep by law, such as invoices and payment records, are kept for 7 years; and
• We will delete personal information we are not legally required to retain within 30 days of your request.

Submit deletion requests to support@sydneyexpress.com.au with the subject line “Data Deletion Request”.

6.4 Opt-Out from Marketing

You may opt out of receiving marketing communications from us at any time by:

• Clicking the “Unsubscribe” link in any marketing email;
• Replying “STOP” to any marketing SMS; or
• Contacting us at support@sydneyexpress.com.au.

We will process opt-out requests within 5 business days for email and within 2 business days for SMS, in compliance with the Spam Act 2003 (Cth) and the Do Not Call Register Act 2006 (Cth). Note that transactional communications (receipts, billing notifications, security alerts) are not affected by marketing opt-outs.

6.5 Cookie Controls

When you first visit our Website, our cookie banner lets you accept all cookies, reject non-essential cookies, or choose by category. To change your choice later, clear the cookies for sydneyexpress.com.au in your browser and the banner will appear again on your next visit. You can also set your browser to block or delete cookies, although some parts of the Website (such as signing in) need them to work.

7. Cookies & Tracking Technologies

Our Website uses cookies and similar technologies to keep the Website working and secure and to understand how it is used.

To change your cookie choice, clear the cookies for sydneyexpress.com.au in your browser and choose again when the banner appears. Our Cookie Policy lists the cookies we use in more detail. For more information about cookies generally, visit www.allaboutcookies.org.

8. Data Security

We implement appropriate technical and organisational measures to protect personal information against unauthorised access, disclosure, alteration, loss, or destruction. Our security measures include:

• TLS/SSL encryption for all data sent between your device and our Website (HTTPS);
• Passwords stored only in hashed form. We never see or store your actual password;
• Card payments handled by Stripe. We never see or store full card numbers;
• Administrator access limited to the people who need it;
• Google reCAPTCHA protection against spam and automated abuse on our forms; and
• A data breach response plan (see Section 9).

Notwithstanding these measures, no data transmission over the internet is guaranteed to be 100% secure. You use our Services at your own risk.

9. Notifiable Data Breaches

We follow the Notifiable Data Breaches (NDB) scheme under Part IIIC of the Privacy Act 1988 (Cth). In the event of a data breach likely to result in serious harm to any affected individual, we will:

• Assess the breach within 30 days of becoming aware of it;
• Notify the Office of the Australian Information Commissioner (OAIC) as soon as practicable; and
• Notify affected individuals directly (via email and/or a prominent notice on our Website) as soon as practicable.

Our notification will include a description of the breach, the kinds of information involved, and the steps we recommend affected individuals take to protect themselves.

10. Data Retention

When personal information is no longer needed for these purposes, we securely destroy or de-identify it.

11. Children’s Privacy

Sydney Express is a general business directory for adults. It is not designed for or directed at children.

You must be at least 15 years old to create an account, post a review or send us an enquiry, and anyone under 18 needs a parent or guardian’s permission to do so. You must be 18 or over to buy a plan or advertising, or to submit or claim a listing.

We do not knowingly collect personal information from children under 15, including children under 13 anywhere in the world. We do not build profiles of children, and we do not show behavioural or targeted advertising to anyone.

If we learn that we have collected personal information from a child under 15, we will delete it as soon as practicable, and in any case within 7 days. If you are a parent or guardian and believe your child has given us personal information, email support@sydneyexpress.com.au with the subject line “Child Privacy” and we will act on it promptly.

We will review this section when the Children’s Online Privacy Code made by the Office of the Australian Information Commissioner comes into effect, and update it if the Code applies to our Website.

12. Third-Party Links & Embedded Content

Our Website contains links to third-party websites and may display embedded content from external sources (including YouTube and Google Maps). We are not responsible for the privacy practices of those third parties. We encourage you to read the privacy policies of any third-party services you access via our Website.

When you interact with a listed business (e.g., by clicking their phone number, email address, or website link), you are interacting directly with that business. Sydney Express is not responsible for the data handling practices of listed businesses.

Some links on our Express Experiences, Express Essentials and Express Events pages take you to third-party booking, ticketing or retail websites. Links to Viator and to the retailers on Express Essentials tell that website you came from Sydney Express so we can be credited for the referral. Anything you buy or book there, and the personal information you give them, is handled under that company’s privacy policy, not ours. They may report a sale or booking to us, but we do not receive your name or contact details.

13. Business Owners & Listed Entities

13.1 Verification of Business Information

Business owners who submit or claim a listing on Sydney Express consent to us verifying their business details, including via ABN Lookup (Australian Business Register) and any other publicly available business register. This is done to maintain the accuracy and integrity of our directory.

13.2 Your Responsibilities as a Listing Owner

If you submit personal information about third parties (e.g., your employees’ contact details) as part of a business listing, you represent and warrant that you have obtained all necessary consents from those individuals to share their information with us, and that their information may be publicly displayed on our Website in accordance with this Policy.

13.3 Review & Rating Data

We may use aggregated, de-identified review and rating data for the purpose of generating business insights reports, internal benchmarking, or promotional materials. We will not identify individual reviewers without their express consent.

13.4 Businesses We List from Public Sources

To build the directory, we add basic listings for Sydney businesses using publicly available information. A basic listing shows the business name, category, suburb and business contact details. Where a business is run by an individual, such as a sole trader, some of these details may be personal information.

We only publish details that the business has itself made public for business purposes. For a business run from a home address, we do not publish the street address; the listing shows that the business services Sydney instead. If you would like your listing corrected or removed, email support@sydneyexpress.com.au and we will act within 5 business days. You can also claim the listing free of charge and edit it yourself.

14. Advertising on Sydney Express

Listed businesses can pay for advertising placements on the Website: Spotlight (home page), Top of Search (search and category pages) and Sidebar (listing pages). Paid placements are labelled as ads. They are shown according to the page, category or search you are viewing, not your personal browsing history. Reports we give advertisers (such as views and clicks) are aggregated and do not identify you. All advertising on our Website must comply with Australian law, including the Australian Consumer Law.

15. Automated Decisions

We do not use computer programs to make decisions about you that significantly affect your rights or interests. A person reviews and approves every new listing, claim and paid plan.

Two of our providers use automated tools that can affect what you are able to do on the Website:

• Google reCAPTCHA checks form submissions for spam using technical information about your device and how you interact with the page, and may block a submission it scores as automated; and
• Stripe screens card payments for fraud using your payment and device details, and may decline a payment.

If either tool blocks you, contact us at support@sydneyexpress.com.au and a person will help you complete your request.

16. How to Contact Us & Make a Complaint

16.1 Privacy Enquiries

Post: Privacy Officer, Finance Systems Australia Pty Ltd, Shops 6 & 7, 89–91 Victoria Road, Drummoyne NSW 2047

Email: support@sydneyexpress.com.au

Phone: (02) 8970 9557

16.2 Internal Complaint Resolution

If you believe we have breached the APPs or this Privacy Policy, please lodge a complaint by emailing support@sydneyexpress.com.au with the subject line “Privacy Complaint”. We will acknowledge your complaint within 5 business days and endeavour to resolve it within 30 days.

16.3 External Complaint – OAIC

If you are not satisfied with our response, you have the right to lodge a complaint with the Office of the Australian Information Commissioner (OAIC):

Website: www.oaic.gov.au | Phone: 1300 363 992 | Post: GPO Box 5218, Sydney NSW 2001

17. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, or applicable law. When we make material changes, we will update the Effective Date at the top of this Policy, post a prominent notice on our Website homepage, and where practicable notify registered users by email.

Your continued use of our Services following the posting of a revised Privacy Policy constitutes your acceptance of the changes. Prior versions of this Policy are available upon written request.

18. Governing Law & Jurisdiction

This Privacy Policy is governed by the laws of New South Wales, Australia. Any disputes arising in connection with this Policy or our handling of personal information are subject to the non-exclusive jurisdiction of the courts of New South Wales, except where the APPs or other applicable law provides otherwise.

Finance Systems Australia Pty Ltd | Sydney Express Business Directory | sydneyexpress.com.au