Privacy Policy

This Privacy Policy explains how Granite Griffin Pty Ltd (ABN 52 694 080 932), trading as Wheels Mate ("Wheels Mate", "we", "us" or "our"), collects, uses, discloses and protects personal information.

It applies to our website at wheelsmate.com.au and the services we provide through it (together, the "Platform"), and to your other dealings with us, such as when you email us. It applies to everyone who uses the Platform, including visitors, buyers, private sellers, motor dealers and their staff, and people who contact us.

We handle personal information in accordance with the Privacy Act 1988 (Cth) and the Australian Privacy Principles.

"Personal information" means information or an opinion about an identified individual, or an individual who is reasonably identifiable.

What we collect depends on how you use the Platform.

When you visit the Platform:

• technical information, such as your IP address, browser and device type, the pages you view, the links you click and the website you came from; and
• information collected through cookies and similar technologies (see section 10).

When you create an account:

• your name, email address and mobile number;
• your login details;
• the one-time codes we send to verify your email address and mobile number; and
• your account settings, including your marketing choices.

When you list a vehicle as a private seller:

• details about the vehicle, such as its make, model, variant, year, odometer reading, registration number, registration expiry, VIN, written-off status, roadworthy certificate, number of previous owners, description and photos;
• your suburb or the vehicle's location;
• whether you are the vehicle's legal owner and, if you are not, a signed authority letter from the owner (which includes the owner's details);
• identity verification information (see section 5); and
• listing status and performance information, such as views and enquiries.

When you buy a report or use our tools:

• the registration number or VIN you search, and other details you enter for valuations, reports and comparisons; and
• a record of the reports you buy.

When you open a dealer account:

• the name, role, email address and mobile number of the person who opens and manages the account;
• your business details, such as your ABN, legal and trading names, addresses, phone number, website and billing email;
• your business locations and motor dealer licence details;
• records of your subscription, listings, and credit purchases and use; and
• if you use a stock feed or bulk upload, the listing information you or your feed provider send us.

When you pay us:

• payment and billing records, such as the amount, date, items bought and transaction references. Our payment processor, Stripe, handles your card details. We do not store full card numbers.

When you use messaging:

• the messages you send and receive on the Platform, and any information you choose to include in them, such as names, phone numbers, email addresses or addresses.

When you use WheelTalk, our AI chat assistant:

• the questions you type and the answers you receive; and
• if you are not logged in and ask to talk to our team, the email address you give us so we can reply.

When you contact us:

• your enquiries, complaints, scam reports and support requests, and our responses.

To keep the Platform secure:

• records of logins and access to accounts and our systems.

We do not ask for sensitive information, such as health information or information about your racial or ethnic origin or religious beliefs. Please do not include it in listings or messages.

We collect personal information:

• From you, when you create an account, list a vehicle, buy something, send a message or contact us.
• Automatically, through cookies and similar technologies when you use the Platform.
• From other users, for example when someone messages you, reports a listing or a scam, or when a private seller gives us an authority letter from a vehicle's owner.
• From our service providers, for example the result of an identity check from our identity verification service, vehicle information from our licensed vehicle-data providers and the Personal Property Securities Register (PPSR), payment confirmations from Stripe, and listing information from a dealer's stock feed provider.
• From public sources, such as business and motor dealer licence registers, which we may check when verifying dealers.

If you give us personal information about someone else (for example, the owner's details in an authority letter), please make sure they know you are doing so and refer them to this policy.

We collect, use and disclose personal information to:

• provide and operate the Platform and its features, including listings, featured upgrades, reports, valuations, comparisons, dealer tools and messaging;
• create and manage accounts, and verify email addresses and mobile numbers;
• verify the identity of private sellers before they list a vehicle (see section 5);
• verify dealers and their licences before their listings go live;
• review private listings before they are published, and check listings for accuracy and compliance with our Terms and Conditions;
• process payments, subscriptions, credits and refunds;
• send service messages, such as receipts, listing updates, billing notices and security alerts;
• detect, prevent and investigate fraud, scams, misuse of the Platform and breaches of our Terms and Conditions;
• respond to enquiries, complaints and support requests;
• understand how the Platform is used and improve it;
• advertise the Platform on other websites and apps, and measure how well our advertising works (see section 10);
• send marketing messages, but only if you have opted in (see section 11); and
• comply with our legal obligations and our obligations to our data and verification providers and regulators.

We only use or disclose personal information for another purpose if you consent, or if the law allows it (for example, where the purpose is related to the reason we collected it and you would reasonably expect it, or where it is needed to lessen a serious threat to someone's life, health or safety).

Private sellers must verify their identity before listing a vehicle for sale. Buyers, report purchasers and dealers do not complete this check. You can choose either of the following.

Automated check. You enter your driver licence details, and we use an authorised third-party identity verification service to check whether they match the records held by the document issuer or official record holder. Before any check is made, you must give your express consent by ticking a box that is not pre-ticked. We record the consent wording you agreed to, its version, and the date and time you agreed.

Manual check. Instead of the automated check, you can upload an image of your current driver licence in the listing process for review by our Director or Privacy Officer. A manual check does not involve the automated service unless you separately consent to one.

If the automated check cannot verify you, you can choose the manual check.

What we keep, and for how long:

• Licence and card numbers entered for an automated check are used only for that check and are not kept once the result is returned.
• Other identity details captured for a check, such as your name, date of birth, address, state and licence expiry date, are deleted within 90 days.
• Licence images, and the details taken from them for a manual check, are deleted within 90 days of your most recent upload.
• We keep a limited audit record of each check for 2 years (or longer only if we need it for an audit, investigation or legal claim). It records things like the date and time, who started the check, your consent, the document type, the result, a reference number, error codes and any manual review steps. It does not include your licence image or full licence or card numbers.

Only our Director and Privacy Officer are authorised to access licence images and the identity details linked to them.

We use identity verification information only to verify your identity as a seller and to keep the records described above. We do not use it for marketing, advertising, analytics, profiling or market research, and we keep it separate from our marketing and analytics activities.

If you choose not to verify your identity, you can still use the rest of the Platform, but you will not be able to list a vehicle for sale as a private seller.

The automated identity check in section 5 is carried out by a computer program. Its result (verified or not verified) decides whether you can list a vehicle using the automated route. It uses your name, date of birth and driver licence details (such as your licence number, card number and state of issue).

If the automated check does not verify you, you can have a person review your identity instead by choosing the manual check, or you can contact us (see section 19).

We also use automated tools to help detect and block spam, scams and other messages that breach our Terms and Conditions (see section 8). If you think a message was blocked by mistake, please contact us.

Listings are public. A private seller's listing shows the seller's initials, or their first name or last name only; their suburb; and their phone number only if they choose to display it. A dealer's listing shows the dealer's business details.

When you send a message, the person you message can see it.

Please do not include personal information in listing descriptions or photos that you do not want to be public. Photos can also contain hidden information, such as the location where they were taken, so check your photo settings before uploading.

Messages are stored on the Platform. We use automated tools to scan messages to help detect and block spam, scams and other content that breaches our Terms and Conditions. Our staff read messages only when needed to investigate a complaint, scam report, safety concern, dispute or possible breach of our Terms and Conditions, or where the law requires it.

Please be careful about sharing personal or financial information in messages. We cannot control what another user does with information you share with them, or what happens once a conversation moves off the Platform.

We share personal information only as described in this policy:

• Other users. Listing details are public as described in section 7, and messages are shared with the people you message. If you message a dealer, the dealer receives what you send. Our Terms and Conditions require dealers to use it only to respond to you and deal with you about the vehicle. We do not give your name or contact details to dealers or other businesses for their own marketing.
• Service providers who help us run the Platform, including Amazon Web Services (hosting), Cloudflare (website security and performance), Stripe (payments), Postmark (email), DataFlows (SMS), Google Firebase (storage of WheelTalk chats), and Google, Meta and TikTok (analytics and advertising, see section 10).
• OpenAI, which processes the text of the questions you type into WheelTalk so they can be matched to the answers in our help articles. We send OpenAI only the text you type, not your name, email address or account details, so please do not include personal information in your questions.
• Our identity verification service, if you choose the automated identity check.
• Our licensed vehicle-data providers and the PPSR, which receive the details needed for a search (such as a registration number or VIN) when you search a vehicle or buy a report.
• Our data and verification providers and their auditors, where needed to show that we comply with our agreements with them.
• Professional advisers, such as our lawyers, accountants, auditors and insurers.
• Regulators, law enforcement agencies and courts, where the law requires or authorises it, for example to respond to a lawful request or to report suspected fraud.
• A buyer of our business, if we sell or restructure our business. The buyer would have to handle your personal information in line with this policy.

We use cookies and similar technologies (such as pixels and tags) to:

• keep you logged in and keep the Platform secure (these are essential for the Platform to work);
• understand how people use the Platform (analytics); and
• show Wheels Mate advertising on other websites and apps, and measure how well it works (advertising).

We use Google Analytics, the Google Ads tag, the Meta Pixel and the TikTok Pixel. Through these tools, Google, Meta and TikTok collect information about your visit, such as the pages you view and actions you take on the Platform, your IP address, device and browser information, and cookie identifiers. They use this information to provide measurement services to us and to show you ads, and may also use it for their own purposes in line with their own privacy policies, including linking it to any account you have with them.

We do not use identity verification information for analytics or advertising.

You can control cookies and ads by:

• blocking or deleting cookies in your browser settings (if you block essential cookies, parts of the Platform may not work);
• installing Google's opt-out tool for Google Analytics: tools.google.com/dlpage/gaoptout; and
• changing the ad settings in your Google, Meta (Facebook and Instagram) and TikTok accounts.

We only send marketing emails and SMS if you have opted in. You can unsubscribe at any time by using the unsubscribe link in our emails, following the opt-out instructions in our SMS, or contacting us. Even if you opt out of marketing, we will still send service messages, such as receipts, billing notices and listing updates, while you have an account.

We host the Platform and store personal information in Australia, in Amazon Web Services data centres in Sydney. WheelTalk chats are also stored in Australia, in Google Firebase's Sydney region.

Some of our service providers store or process personal information outside Australia:

• Cloudflare (website security and performance) operates data centres around the world, so information you send to or receive from the Platform may pass through Cloudflare data centres outside Australia;
• Postmark (email delivery) stores data in the United States;
• Stripe (payments) may transfer data to other countries, including the United States and India;
• OpenAI (WheelTalk, our AI chat assistant) processes the text of your WheelTalk questions in the United States;
• Google and Meta (analytics and advertising) process data in the United States and other countries; and
• TikTok (advertising) states that it stores data in the United States, Singapore and Malaysia.

Before we disclose personal information to an overseas recipient, we take reasonable steps to make sure it is handled in a way that is consistent with the Australian Privacy Principles, unless an exception under the Privacy Act applies.

Some members of our software development team are based outside Australia. They work with test data and do not have access to the personal information we hold.

We take reasonable steps to protect personal information from misuse, interference and loss, and from unauthorised access, modification or disclosure. These steps include:

• encrypting data when it is sent to and from the Platform and when it is stored;
• role-based access controls, a unique login for each staff member, and multi-factor authentication for administrator accounts;
• logging access to identity verification information and manual identity reviews; and
• limiting access to licence images to our Director and Privacy Officer.

No method of sending or storing information is completely secure, so we cannot guarantee absolute security. Please keep your login details safe and tell us straight away if you think your account has been misused.

If a data breach is likely to result in serious harm to you, we will notify you and the Office of the Australian Information Commissioner as the law requires.

We keep personal information only for as long as we need it for the purposes in this policy or as the law requires. The main periods are:

If you delete your account, section 15 applies. When we no longer need personal information, we delete it or de-identify it. Deleted information may remain in our secure backups for a limited time until it is overwritten.

You can delete your account at any time using the delete option in your account settings. When you do:

• your account is closed and any live listings are removed;
• we delete or de-identify your personal information within 30 days, including your messages, which are also removed from the conversation history of the people you messaged; and
• we keep only information we must keep by law (such as payment and tax records), records our data-licence and identity verification agreements require us to keep (see section 14), and information connected to an unresolved complaint, dispute, scam report or investigation, which we keep until it is resolved.

You can ask for access to the personal information we hold about you, or ask us to correct it, by contacting us (see section 19). You may also be able to update some information yourself in your account settings.

We will need to confirm your identity before we act on a request. We will respond within a reasonable time, usually within 30 days. We do not charge you for making a request. If we refuse a request, we will tell you why and how you can complain.

• You can browse the Platform without creating an account. Where it is practical, you can also make general enquiries without identifying yourself or by using a pseudonym. You will need to identify yourself to create an account, list a vehicle, buy a report or send messages.
• You can opt in to or out of marketing at any time (see section 11).
• You can control cookies and ads (see section 10).

You must be 18 or older to create an account. We do not knowingly collect personal information from children through accounts. If we learn that someone under 18 has created an account, we will close it and delete their personal information, except for any information we must keep by law.

If you have a question, want to access or correct your information, or want to make a complaint about how we handle personal information, please contact our Privacy Officer:

Privacy Officer, Wheels Mate

Granite Griffin Pty Ltd (ABN 52 694 080 932)

Email: support@wheelsmate.com.au

Please give us enough details to look into your complaint. We will acknowledge it within 1 business day and aim to respond within 30 days.

If you are not satisfied with our response, you can complain to the Office of the Australian Information Commissioner (OAIC) at www.oaic.gov.au or on 1300 363 992.

We may update this policy, for example when we add new features or change how we handle personal information. We will publish the updated policy on the Platform with a new "last updated" date. If we make a significant change, we will also tell account holders by email.