xTend Privacy Policy

xTend is a rewards, recognition and incentive platform operated by Pending legal review: Fortisphere Pty Ltd / EVT Incentive Marketing Pty Ltd: confirm legal entity (ABN Pending legal review: 00 000 000 000) ("we", "us", "xTend"), Pending legal review: registered address. We provide the platform to organisations ("Program Sponsors") who run rewards programs for their staff, partners, resellers or customers ("Members").

This policy explains how we handle personal information under the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs). Where a Member is located in the European Economic Area or the United Kingdom, section 12 sets out the additional information required by the GDPR / UK GDPR.

Roles. For most program data we act as a processor/service provider on behalf of the Program Sponsor, who decides why and how Member information is used. For platform account security, fraud prevention and our own legal obligations we act as a controller in our own right. Your Program Sponsor may publish its own collection notice for its program; where it does, that notice applies alongside this policy.

Privacy contact: Pending legal review: privacy@fortisphere.com.

We do not collect government identifiers, health information or other sensitive information, and we ask you not to upload it (for example on a receipt image).

• to create and secure your account, including verifying your identity at sign-in and sending security codes;
• to run the program you are a member of: award, track and redeem points, deliver rewards, publish recognition, run quizzes, surveys and promotions, and show you program content;
• to verify sales and claims you submit, including automated extraction of information from receipt images (section 6);
• to fulfil rewards, which requires sharing your name and delivery address with the supplier or courier;
• to communicate with you about the program (invitations, order updates, points statements, recognition, program news). You can control non-essential notifications in your profile;
• to provide reporting to your Program Sponsor about program performance (in aggregate, and at individual level where the Sponsor is your employer or business partner and is entitled to it);
• to detect and prevent fraud, abuse and security incidents;
• to comply with law, including tax-invoice retention where you buy points.

We rely on your consent where the law requires it (for example, the notice you agree to when you upload a receipt); otherwise we rely on the necessity of the processing to run the program you joined and on our legitimate interests in operating a secure platform.

• Your Program Sponsor and the administrators it appoints, who can see your program activity and profile. Where a Program Sponsor is your employer, it may see your performance within the program.
• Reward suppliers and couriers, who receive only what is needed to deliver a reward (name, delivery address, contact number, the item).
• Service providers (sub-processors) who host and support the platform (section 7).
• Payment provider (Westpac Banking Corporation, through its PayWay service) if your program enables buying points.
• Accounting provider (Xero): invoice-level records for supplier bills and program billing; no Member-identifiable data is sent.
• Regulators, courts or law enforcement where required by law.

We do not sell personal information and we do not share it with third parties for their own marketing.

Program communications (invitations, points updates, recognition, promotions run by your Program Sponsor) are sent because you are a member of that program. Each email carries a one-click unsubscribe for non-essential messages, and your profile lets you turn each notification type on or off per channel. Essential service messages (security codes, password resets, order confirmations) cannot be switched off while your account is active. We comply with the Spam Act 2003 (Cth).

If your program enables receipt or invoice upload, the image you upload is sent to an artificial-intelligence service to read the store, date, items and totals. This service is Amazon Web Services (Bedrock), running Claude models in Australia (Sydney and Melbourne). The same service matches the lines on your receipt to products and drafts summary insights for your program's administrators from totals and product names. The AI service does not keep your receipt or use it to train AI. The extracted information is shown to you and to your program's administrators to verify your claim; a human always makes the final decision on whether points are awarded. You will be asked to agree to this processing at the point of upload. We keep the raw image for Pending legal review: 90 days after extraction and then delete it, keeping only the extracted information and the decision record.

Pending legal review: Confirm each provider's DPA is accepted on the account before publication.

Your application data and files are stored in Australia, and receipt images are read by AI in Australia (section 6). Some providers process limited data overseas: email delivery (Resend, US) and application logs and error reports (Vercel, US; these contain technical identifiers, not your profile). Card payments are processed in Australia (Westpac PayWay). We take reasonable steps to ensure these providers protect your information to a standard comparable to the APPs, including contractual data-processing terms.

Access to your information is restricted by role and by program: administrators can only see the programs they are assigned to. All traffic is encrypted in transit; data is encrypted at rest by our hosting providers. Points movements are recorded in an immutable ledger and every administrative action is logged. Sign-in is protected by rate limiting and, for administrators, a second factor. No system is perfectly secure; if we become aware of a data breach likely to result in serious harm we will notify you and the Office of the Australian Information Commissioner as required by the Notifiable Data Breaches scheme.

We keep your information while you are a member of a program and for as long as needed afterwards to resolve disputes, meet legal obligations and maintain the integrity of the points ledger. Typical periods: profile and contact details, until your membership ends plus Pending legal review: 12 months; points ledger, orders and audit records, 7 years (financial and tax obligations); receipt images, Pending legal review: 90 days after extraction; support cases, Pending legal review: 24 months; sign-in attempt records, 30 days. Program Sponsors can request earlier deletion of a member's personal details; the ledger keeps an anonymised record of points movements because it cannot be rewritten.

You can view and update most of your details in your profile. To request access to, correction of, or deletion of your personal information, or to raise a complaint, contact Pending legal review: privacy@fortisphere.com or ask your Program Sponsor's administrator. We will respond within 30 days. If you are not satisfied you may complain to the Office of the Australian Information Commissioner (www.oaic.gov.au).

• Controller/processor: your Program Sponsor is the controller for program data; we are its processor. We are the controller for account-security and fraud-prevention processing.
• Legal bases: performance of the program agreement you joined (Art. 6(1)(b)); our legitimate interests in security and fraud prevention (Art. 6(1)(f)); your consent for AI receipt processing (Art. 6(1)(a)); legal obligation for tax records (Art. 6(1)(c)).
• International transfers: to the providers in section 7, under Standard Contractual Clauses or an adequacy decision as applicable.
• Your rights: access, rectification, erasure, restriction, portability, objection, and the right to withdraw consent, exercisable via Pending legal review: privacy@fortisphere.com; and the right to lodge a complaint with your supervisory authority.
• Automated decision-making: receipt extraction is automated but every points decision is reviewed by a human.
• EU/UK representative: Pending legal review: appoint if required, or state not required.

The platform uses only strictly necessary cookies: your session, an optional "remember this device" cookie for administrators, and a short-lived cookie during single sign-on. We do not use advertising or analytics cookies. Pending legal review: If analytics are ever added this section and the consent approach must change.

We may update this policy. The current version and its effective date are always available at Pending legal review: https://awardbank.fortisphere.com/privacy. Material changes will be announced in the portal.