QiKIOU Privacy Policy

1. About this Privacy Policy

QiKIOU is operated by Spydore Pty Ltd (Spydore, we, us or our). This Privacy Policy explains how QiKIOU collects, holds, uses and discloses personal information relating to customers, business owners, administrators, staff and other people who interact with QiKIOU.

We aim to manage personal information consistently with applicable Australian privacy law and the Australian Privacy Principles where they apply. We also use those principles as a design standard for QiKIOU where practical.

This policy is intended to be read together with the QiKIOU Terms applicable to the relevant user and any additional notice presented when a business enables a third-party Connection.

2. Information we may collect and hold

Depending on how QiKIOU is used, we may collect and hold personal information such as names, mobile numbers, email addresses, dates of birth where voluntarily provided, business contact details, account identifiers, authentication and security information, loyalty memberships, points, stamps, rewards, vouchers, gifts, redemption activity, marketing preferences and customer service records.

For business users we may also hold business names, locations, administrator and staff details, role and permission information, billing and subscription records, connection status and integration configuration.

Where a business enables a third-party Connection, QiKIOU may receive limited transaction, order, refund, product, location, customer or related metadata made available by that provider and reasonably required for the enabled service.

We may collect technical and security information such as IP-derived or hashed identifiers, browser or device information, timestamps, session information, error records, rate-limit records, audit logs and security events.

3. How we collect information

We may collect personal information directly when a person registers, signs in, joins a loyalty program, updates a profile, redeems or transfers a reward, contacts support or otherwise interacts with QiKIOU.

We may collect information from a participating business where that business uses QiKIOU to administer its loyalty program or customer relationship.

Where authorised, we may collect information from connected third-party services such as POS, payment, ecommerce or commerce platforms through APIs, OAuth authorisations, webhooks or similar technical interfaces.

We may also generate derived information from these activities, such as loyalty balances, duplicate-prevention references, fraud indicators, audit records and service metrics.

4. Why we collect, hold, use and disclose information

We use personal information where reasonably necessary to create and maintain accounts, identify and authenticate users, administer loyalty programs, calculate points or stamps, issue and redeem rewards, process gifts and transfers, operate pay-it-forward features, match eligible transactions, prevent duplicate credits, process refunds or reversals and provide business reporting.

We may also use information for customer support, service communications, security, fraud and abuse prevention, technical troubleshooting, legal compliance, billing, audit, dispute resolution, service improvement and maintaining the integrity of QiKIOU.

We do not sell personal information to third parties for their own marketing purposes.

5. Participating businesses

When a customer joins a participating business loyalty program, information reasonably required to operate that relationship may be made available to that business.

Joining one business does not automatically give every other QiKIOU business access to that customer's personal information.

Participating businesses are responsible for their own use of information they access through QiKIOU and for complying with applicable privacy, marketing, spam and consumer laws.

6. Third-party Connections and transaction data

A business may choose to connect QiKIOU to third-party services such as Square, Stripe, Lightspeed or other commerce providers. QiKIOU will only access provider data within the permissions and purposes authorised for that Connection.

Some provider data may be processed transiently and not permanently stored. Other information may be retained where reasonably necessary for loyalty calculations, customer matching, duplicate prevention, refunds, reversals, security, billing, audit, dispute resolution or service integrity.

Where practical, QiKIOU may retain provider references, status information, derived loyalty records or audit metadata rather than complete copies of third-party financial records.

QiKIOU does not require a business to disclose its POS or payment-provider password to Spydore in order to establish an OAuth or equivalent supported Connection.

7. Service providers and disclosures

We may disclose or make personal information available to trusted service providers where reasonably necessary to operate QiKIOU, including hosting, infrastructure, communications, security, payment, analytics, support and technology providers.

We may disclose information to a connected third-party provider where necessary to operate an authorised integration or comply with the provider's technical requirements.

We may also disclose information where required or authorised by law, to protect legal rights, to investigate suspected fraud or security incidents, or in connection with a corporate restructure or transfer where lawful safeguards apply.

8. Overseas disclosures

Some service providers and connected platforms may process or receive information outside Australia, including in the United States and other countries in which those providers operate.

Where it is practicable to identify likely overseas recipient countries for a particular service or Connection, we may identify them in this policy, a connection-specific notice or an updated provider list.

We take reasonable steps, where required by applicable law, in relation to overseas handling of personal information.

9. Security

We use reasonable technical and organisational safeguards designed to protect personal information from misuse, interference, loss and unauthorised access, modification or disclosure.

Safeguards may include access controls, authentication, encryption in transit, secure credential handling, rate limiting, audit logging, restricted permissions, monitoring, backups and other security controls appropriate to the service.

No internet-based service can guarantee absolute security. Users and businesses must also protect their devices, credentials, PINs and connected-provider accounts.

10. Data access and audit records

QiKIOU may maintain audit records showing when authorised systems or users access connected services or perform security-sensitive actions.

Audit records may identify the business, provider, action category, purpose, result, timestamp and technical context without necessarily retaining the underlying transaction contents.

These records may be used for security, transparency, troubleshooting, legal compliance, dispute resolution and demonstrating the scope of authorised access.

11. Retention and deletion

We retain personal information only for as long as reasonably necessary for the purposes for which it was collected or for related lawful purposes such as security, fraud prevention, billing, audit, dispute resolution, legal obligations and maintaining the integrity of loyalty records.

Disconnecting a provider or closing an account does not necessarily result in immediate deletion of all historical information where continued retention is reasonably required or permitted by law.

Where information is no longer reasonably required, we may delete it, de-identify it or otherwise manage it in accordance with applicable law and our retention practices.

12. Marketing communications

Marketing consent is separate from acceptance of business or customer terms unless a communication is reasonably necessary to provide or administer the service.

Where marketing choices are offered, users may opt in or out as provided by QiKIOU and applicable law.

Participating businesses remain responsible for ensuring that their own marketing communications comply with applicable consent, unsubscribe and identification requirements.

13. Access and correction

A person may request access to personal information about them held by QiKIOU and may request correction if that information is inaccurate, out of date, incomplete, irrelevant or misleading.

Some information can be reviewed or updated directly through QiKIOU. Other requests may be made through the contact channels published on QiKIOU or Spydore websites.

We may need to verify identity before providing access or making a correction, and applicable law may permit or require us to refuse access in limited circumstances.

14. Privacy complaints

A person who believes their personal information has been mishandled may make a privacy complaint to Spydore Pty Ltd using the contact channels published on QiKIOU or Spydore websites.

We will assess the complaint, may request further information, investigate where appropriate and respond within a reasonable period.

Where applicable, a person may also have the right to raise a privacy complaint with the Office of the Australian Information Commissioner.

15. Data breaches

We maintain processes for responding to suspected unauthorised access, disclosure or loss of personal information.

Where the Notifiable Data Breaches scheme or another applicable law requires notification, we will assess the incident and make required notifications to affected individuals and regulators.

16. Changes to this policy

We may update this Privacy Policy to reflect changes to QiKIOU, law, service providers, information handling practices or security requirements.

Each published version will have a version number and effective date. Historical versions used for recorded business acceptance or acknowledgement will be preserved.

Where a change materially alters how information is handled, we may provide additional notice or seek renewed agreement or consent where required or appropriate.

17. Contact

Privacy enquiries, access or correction requests and complaints may be directed to Spydore Pty Ltd through the contact channels published on QiKIOU or Spydore websites.