Privacy Policy and Disclaimer

Privacy Policy

RegWrangler Pty Ltd (ACN 691 900 615) (“RegWrangler”, “we”, “us”, or “our”) is committed to protecting the privacy of all users (“you” or “your”) engaging with our regulatory intelligence and oversight platform (“Platform”).

This Privacy Policy outlines how we collect, hold, use and disclose your personal information and how you may access or correct that information or make a privacy complaint, in accordance with the Privacy Act 1988 (Cth) and the Australian Privacy Principles (“APPs”).

This Privacy Policy applies to personal information collected through the Platform, our website, and any related services or communications with you.

1. Information We Collect

We may collect and process the following types of personal information:

Contact Information: Name, email address, phone number, and company details.
Account Information: Usernames, passwords, and preferences.
Usage Data: Details of your use of the Platform, including log-in times, interactions, features used, and any requests or feedback.
Technical Data: IP addresses, device information, browser type, operating system, device identifiers, and similar technical information generated through your use of the Platform.

We only collect personal information that is reasonably necessary for one or more of our functions or activities. We may also collect and generate system logs, audit records and monitoring data relating to use of the Platform for security, operational, troubleshooting and compliance purposes.

We may collect personal information directly from you, from your organisation where it subscribes to the Platform, from publicly available sources, or automatically when you interact with the Platform or our website.

Where you upload or input content that contains personal information relating to third parties, you warrant that you have authority to do so and that such collection and disclosure complies with applicable privacy laws. We process such information solely for the purpose of providing the Platform.

We do not intentionally collect sensitive information (as defined in the Privacy Act 1988 (Cth), including health information, racial or ethnic origin, political opinions, religious beliefs, sexual orientation or criminal records) unless required to do so or where you have consented. Where sensitive information is incidentally contained in content you upload or input to the Platform, we will handle it in accordance with the APPs and use it only for the purpose of providing the Platform.

Where RegWrangler provides the Platform to a customer organisation, that organisation generally determines the personal information made available through the Platform and the purposes for which it is used. In those circumstances, RegWrangler generally handles personal information on behalf of, and under the instructions of, the relevant customer organisation in connection with providing the Platform and related services.

Customer organisations are responsible for ensuring they have appropriate rights, consents and legal authority to disclose personal information to RegWrangler for processing through the Platform.

If you do not provide certain personal information, we may be unable to create or administer your account, provide access to the Platform, or deliver support and related services.

At or around the time we collect personal information from you, we will take reasonable steps to notify you of the matters required under APP 5, including the purposes of collection and our usual disclosures. Such notification may be provided through this Privacy Policy, through collection notices presented at the point of collection, or through our Platform interface, as appropriate to the circumstances.

2. How We Use Your Information

We use the personal information we collect to:

Provide, operate, and improve the Platform.
Communicate with you, including responding to inquiries and providing updates.
Facilitate transactions and billing.
Ensure compliance with our terms and policies.
Conduct analytics and research to enhance user experience.

We may also use personal information for limited administrative or service communications, such as service notices, security alerts, and operational messages relating to the Platform.

Certain features of the Platform utilise automation and artificial intelligence to analyse usage patterns, generate insights, or support regulatory intelligence functionality. Where we use commercially available AI products or services in delivering the Platform, we take reasonable steps to ensure those tools are used in a manner consistent with the APPs, including by conducting due diligence on AI providers, implementing appropriate contractual protections, and limiting the personal information submitted for AI processing to what is reasonably necessary. We do not use personal information or customer-uploaded data to train general-purpose AI models unless expressly agreed or required by law.

We do not use personal information for direct marketing purposes unless permitted under applicable law and you have been given the opportunity to opt out of such communications. Any electronic direct marketing communications will also comply with the requirements of the Spam Act 2003 (Cth) and the Do Not Call Register Act 2006 (Cth), which impose additional obligations in relation to commercial electronic messages and telemarketing calls.

3. Disclosure of Personal Information

We may share your personal information with:

Third-party service providers who assist us in delivering the Platform.
Legal and regulatory authorities as required by law or to protect our rights, and to affiliates and subsidiaries where reasonably necessary to operate, administer and support the Platform.

Service providers engaged by us may include cloud hosting providers, data storage providers, analytics providers, payment processors, customer support providers, and information technology service providers.

RegWrangler primarily stores customer data using infrastructure hosted in Australia. However, certain third-party service providers engaged by us, including analytics, email delivery and AI processing providers, may process limited personal information outside Australia in connection with providing the Platform and related services.

For example, where AI-enabled summarisation features are used, limited content (which does not contain client-specific or personal information) may be transmitted to AI service providers operating in jurisdictions including the United States.

We take reasonable steps to ensure that overseas recipients handle personal information in a manner consistent with the Australian Privacy Principles, including through contractual protections, vendor due diligence processes, and assessment of provider security practices. Where required by APP 8, we will take reasonable steps to ensure overseas recipients do not breach the APPs in relation to that information. We will monitor and have regard to any approved country whitelist established under the Privacy Act 1988 (Cth) when assessing cross-border disclosure arrangements.

4. Data Security

We implement reasonable technical and organisational measures to protect your personal information against unauthorised access, alteration, disclosure, or destruction.

These measures include technical and organisational safeguards designed to protect personal information and customer data, including encryption in transit, encrypted data storage, access controls, authentication protections, role-based permissions, logging and monitoring processes, network security measures, and internal governance procedures.

RegWrangler also applies multi-tenant data segregation controls designed to restrict organisations from accessing data belonging to other customers.

While no method of electronic storage or transmission is completely secure, RegWrangler maintains security measures designed to protect personal information against unauthorised access, misuse, interference, loss, alteration or disclosure. In the event of a data breach involving personal information, we will comply with our obligations under the Notifiable Data Breaches scheme in Part IIIC of the Privacy Act 1988 (Cth).

5. Retention of Personal Information

RegWrangler retains personal information for as long as reasonably necessary to:

provide the Platform and related services;
comply with legal, accounting and regulatory obligations;
resolve disputes; and
enforce contractual rights and obligations.

Personal information may also remain within backup systems and security archives for a limited period in accordance with backup, recovery and security processes.

Where personal information is no longer reasonably required, RegWrangler will take reasonable steps to destroy or de-identify the information in accordance with applicable law.

6. Your Rights

Subject to applicable law, you may have the following rights regarding your personal information:

Access and obtain a copy of your data.
Request correction of your data, or request deletion where the information is no longer needed for the purpose for which it was collected and we are not required by law to retain it.
Where required by applicable law, object to or request restriction of processing.
Withdraw consent where we rely on your consent to process personal information, noting that this may not apply where processing is required by law or necessary to provide the Platform.

You may request access to, or correction of, personal information we hold about you by contacting us using the details set out below. We will respond within a reasonable period and may require verification of your identity before processing your request. In some circumstances, we may be permitted or required by law to refuse an access or correction request, including where providing access would pose a serious threat to the life, health or safety of any individual, would have an unreasonable impact on the privacy of others, or where the information relates to existing or anticipated legal proceedings. Where we refuse a request, we will provide written reasons and information about how you may complain about the refusal.

Certain features of the Platform may involve the use of computer programs that use personal information to make, or substantially assist in making, decisions that could reasonably be expected to significantly affect the rights or interests of individuals. In accordance with the Privacy and Other Legislation Amendment Act 2024 (Cth), and the new APP 1.7–1.9 obligations taking effect on 10 December 2026, we will update this Privacy Policy prior to that date to include specific information about: (a) the kinds of personal information used in such automated decision-making; (b) the kinds of decisions made or substantially assisted by computer programs; and (c) the circumstances in which such decisions may significantly affect individuals’ rights or interests. If you have questions about how automated processes may affect you in the interim, please contact us using the details below.

7. Cookies and Tracking Technologies

Our Platform may use cookies and similar technologies to enhance user experience and analyse usage patterns.

You can manage cookies through your browser settings; however, disabling cookies may affect functionality.

We may use analytics and performance monitoring tools to collect aggregated or de-identified usage and performance information to improve the reliability, functionality and performance of the Platform.

8. Privacy Complaints

If you believe that we have breached the Australian Privacy Principles or mishandled your personal information, you may lodge a complaint by contacting us using the details below.

Please provide sufficient details about the alleged breach so that we can investigate the matter. We will acknowledge receipt of your complaint and seek to resolve it within a reasonable period.

If you are not satisfied with our response, you may lodge a complaint with the Office of the Australian Information Commissioner (OAIC).

9. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. Any changes will be posted on our website with an updated effective date.

We will take reasonable steps to notify users of material changes to this Privacy Policy. Continued use of the Platform after such notification constitutes acceptance of the revised Privacy Policy.

10. Contact Us

If you have any questions or concerns about this Privacy Policy or our privacy practices, please contact our Privacy Officer at [email protected] or by writing to RegWrangler Pty Ltd at PO Box 9520 Deakin ACT 2600.

Effective Date: 11 May 2026