WEBSITE & MOBILE APP | PRIVACY
Privacy Policy
Website, Mobile App, Mobile Service and Connected Investment Features
OUR PRIVACY COMMITMENT
The Supper™ uses personal information to provide everyday-utility services, beginning with mobile, and to support the separate loyalty-reward and optional investment features a customer chooses. We collect and share only what is reasonably necessary for those purposes, protect it with proportionate safeguards and give customers practical access, correction, deletion and complaint pathways.
CONTRACTING ENTITY
The Supper Operations Co Pty Ltd
ABN / ACN
ABN 51 697 464 314 | ACN 697 464 314
APPLIES TO
www.the-supper.com.au, The Supper™ mobile app and customer services
WEBSITE
Privacy at a glance
Topic
Plain-language position
Who is responsible?
The Supper Operations Co Pty Ltd is responsible for personal information it collects or controls. Cache and the relevant Fund parties are separately responsible for official Fund applications, holdings and transaction records within the roles confirmed in the final Fund Documents and executed appointments.
What do we collect?
Identity and contact details; orders, account and service records; mobile usage and provisioning data; billing and payment status; reward and investment-interface data; device, app, website, security and support records.
Why do we collect it?
To provide and secure services, verify identity, bill correctly, calculate and reconcile rewards, support customer-authorised investment interactions, handle complaints and comply with law.
Do we sell personal information?
No. We do not sell personal information. We disclose information only for the purposes described in this Policy or where authorised or required by law.
Can you control marketing?
Yes. Service messages still apply, but marketing consent can be withdrawn through the unsubscribe function or by contacting us.
Can you access or delete data?
Yes, subject to legal and operational retention duties. App users can initiate account deletion in the App or through the Website data-deletion page.
How do you complain?
Email contact@the-supper.com.au, use the privacy option on the Website or write to our registered address. You may then contact the OAIC if the matter remains unresolved.
IMPORTANT PRODUCT BOUNDARY
The Supper™ supplies the utility proposition. Cache and the responsible Fund parties are expected to provide the regulated investment infrastructure, subject to confirmation in the final Fund Documents and executed appointments. Deleting a The Supper™ app account does not itself close a Fund account or withdraw an investment; those actions must be completed under the applicable Fund Documents.
1. About this Policy
Scope. This Policy explains how The Supper Operations Co Pty Ltd handles personal information when you visit www.the-supper.com.au, use The Supper™ mobile app, enquire about or acquire a service, participate in a customer program, contact support or interact with us in another authorised way.
Australian framework. We manage personal information in accordance with the Privacy Act 1988 (Cth), the Australian Privacy Principles and applicable telecommunications, direct-marketing, record-keeping and data-breach requirements.
Collection notices. A shorter privacy collection notice may be displayed when a particular feature collects information. That notice should be read with this Policy and will explain any feature-specific collection, use, disclosure or choice.
Meaning of personal information. Personal information is information or an opinion about an identified individual, or an individual who is reasonably identifiable. Some information may also be sensitive information and receives additional protection.
1.1 Who this Policy applies to
This Policy applies to visitors, prospective customers, customers, authorised representatives, referrers, promotion participants, suppliers and other individuals whose personal information we handle. An account holder must be at least 18 years old. Information about a dependent or authorised user may be handled where the account holder has authority to provide it.
You may browse general Website content or make a general enquiry without identifying yourself where practical. We must verify identity for services involving mobile activation, number porting, billing, account security, regulated investment interactions or another legal requirement.
2. Privacy roles and service boundaries
The Supper™ records. We are responsible for the customer relationship, app and Website account, utility order and service records, subscription billing, reward calculation and funding records, customer support and our own marketing and compliance records.
Mobile-service providers. Telecommunications wholesalers, networks, billing and provisioning providers handle information needed to activate, operate, support and bill the Mobile Service. Some records may be held in their systems as the operational system of record.
Cache and Fund parties. Cache and the responsible Fund parties identified in the final Fund Documents are separately responsible for Fund eligibility, KYC/AML processes, applications, holdings, transactions, withdrawals and official Fund records within their confirmed legal roles. Those roles remain subject to Cache confirmation and executed appointments.
No data merging by default. The utility contract and investment service remain separate. We exchange only the information reasonably necessary to perform a selected feature, reconcile a transaction, provide support, meet an authorisation or comply with law.
3. Personal information we collect
Information category
Examples
Identity and eligibility
Name, date of birth, residential or service address, identity-document details or verification result, customer identifier, eligibility status and records needed for fraud, sanctions, KYC or legal checks.
Contact and preferences
Email address, mobile number, preferred contact channel, accessibility or safe-contact preference, consents and marketing choices.
Account and order
Login and authentication data, selected product, Order, accepted terms, plan, SIM/eSIM details, activation status, authorised users and account changes.
Mobile service
Mobile number, porting information, network and provisioning status, service usage and traffic metadata, device compatibility information, faults, outages and support diagnostics.
Billing and payments
Invoices, payment method token or masked details, transaction status, refunds, chargebacks, arrears, financial-hardship arrangements and related communications. We do not require storage of a full payment-card number where a payment provider can tokenise it.
Reward and subscription
Eligible paid-bill status, 5% Loyalty Reward calculation, funding and reconciliation status, Monthly Boost status, recurring charge status and cancellation record.
Investment interface
Selected Fund option, application or KYC status, customer instructions, payment-authority status and Fund data displayed to you. Official Fund records will remain with the responsible Fund party identified in the final Fund Documents; Cache's role remains subject to confirmation.
Information category
Examples
App, Website and device
IP address, device and browser type, operating system, app version, device identifiers, session and event logs, cookie identifiers, crash reports, security signals and approximate location inferred from IP.
Support and compliance
Enquiries, chats, emails, complaint and incident records, call notes, documents you provide, identity-authentication events and records of regulatory or law-enforcement requests.
Promotions and insights
Referral source, campaign response, survey feedback, competition entry and aggregated or de-identified product and service analytics.
3.1 Sensitive information
We collect sensitive information only with consent or where another lawful basis applies and the information is reasonably necessary for our functions. This may arise if you disclose health information, racial or ethnic origin, disability, domestic, family or sexual violence circumstances, or another sensitive matter while seeking hardship, accessibility, safety or complaint support.
We restrict internal access to sensitive support records, record safe-contact instructions and disclose the information only where necessary to provide the requested assistance, protect safety or comply with law.
3.2 Information we do not seek
We do not ask for the content of your calls or text messages as part of ordinary service delivery. Telecommunications networks may process communications and related metadata as required to provide the service and comply with law.
Please do not send us another person's sensitive or confidential information unless you are authorised and it is necessary for the matter you want us to handle.
4. How we collect information
Directly from you. We collect information through the Website, App, an Order, identity or payment process, customer-support interaction, survey, promotion, complaint, hardship request or account update.
From authorised people. We may receive information from an authorised representative, account user, parent or guardian, referrer, joint applicant or another person acting with authority.
From service providers. We may receive activation, network, billing, payment, identity-verification, security, analytics and support information from the providers involved in delivering the service.
From Cache and Fund parties. Once investment features are authorised and available, and where you choose an investment feature, we may receive limited status, transaction and display information needed to operate the customer experience, reconcile a Reward or Boost and respond to your enquiry.
From public or official sources. Where lawful and reasonably necessary for fraud prevention, identity, compliance or dispute handling, we may verify information against public registers, official records or trusted verification sources.
Unsolicited information. If we receive personal information we did not request, we assess whether we could lawfully have collected it. If not, we will destroy or de-identify it where lawful and reasonable.
5. Why we collect, use and disclose information
Provide and administer services. To assess an Order, create and secure an account, activate and port a mobile number, provision and support a Mobile Service and communicate service information.
Bill and reconcile. To issue invoices, process authorised payments, manage refunds or chargebacks, verify an eligible paid bill, calculate and fund the 5% Loyalty Reward and reconcile status with relevant providers.
Support selected investment features. To facilitate customer-authorised information flows, show a processing status or official Fund data received from the responsible Fund party identified in the final Fund Documents, and coordinate questions without taking over the Fund parties' legal functions.
Protect customers and systems. To authenticate users, detect and investigate fraud or misuse, prevent unauthorised access, monitor reliability, respond to security incidents and protect legal rights and safety.
Provide support and comply with obligations. To resolve enquiries, complaints, accessibility, hardship and safety requests; keep required records; respond to regulators, courts and law-enforcement bodies; and meet telecommunications, privacy, financial-services and consumer-law obligations.
Improve and communicate. To analyse service performance, understand customer journeys, improve products, conduct research using aggregated or de-identified information, and send marketing where permitted.
6. App permissions, cookies and analytics
| Technology | Purpose | Customer control |
|---|---|---|
| Notifications | Account security, billing, service status, Reward or subscription updates and marketing only where permitted. | Manage in device settings and communication preferences. |
| Camera or files | Capture or upload an identity, porting, complaint or support document when you choose that function. | Permission is requested at the point of use. |
| Biometrics | Allow device-level authentication. The Supper™ receives an authentication result, not your biometric template. | Manage through device settings. |
| Essential storage | Maintain login state, security, shopping or Order flow and preferences. | Required for relevant functionality. |
| Analytics and crash data | Measure use, diagnose errors, prevent abuse and improve performance. | Controls are provided where required and available. |
| Marketing technologies | Measure campaigns or personalise advertising where consent or another lawful basis applies. | Use the cookie controls or withdraw marketing consent. |
Optional permissions are requested when needed. Refusing or disabling an optional permission does not prevent unrelated functions, although the feature relying on that permission may not work. Essential cookies and security technologies cannot be disabled without affecting the relevant service.
We do not treat a device permission as consent for an unrelated purpose. Our app-store privacy labels and Google Play Data safety disclosures must match the data practices described in this Policy and the production app.
7. Who we disclose information to
We disclose only the information reasonably necessary for the recipient's role, subject to contractual, technical, professional or legal safeguards appropriate to the circumstances.
| Recipient group | Examples | Purpose |
|---|---|---|
| Telecommunications parties | Wholesalers, networks, number-porting, provisioning, billing and operational-support providers | Activate, operate, bill, support and lawfully administer the Mobile Service. |
| Cache and Fund parties | Cache and/or the responsible Fund parties identified in the final Fund Documents, within their confirmed roles | Subject to final authorisations, process the selected investment feature, KYC/AML, payment authority, official records, transactions, withdrawals and complaints within the roles confirmed in the final Fund Documents. |
| Identity, fraud and payments | Identity-verification, KYC/AML, fraud-prevention, payment-gateway, bank and direct-debit providers | Verify identity, protect accounts and process authorised transactions. |
| Technology and communications | Hosting, cloud, cyber-security, analytics, email, SMS, customer-support and document providers | Operate, secure and improve the Website, App and customer service. |
| Professional and corporate | Lawyers, auditors, accountants, insurers, financiers and advisers; a purchaser or investor subject to confidentiality | Advice, assurance, insurance, funding and a proposed corporate transaction. |
| Authorities and dispute bodies | Regulators, ombudsmen, courts, tribunals, law enforcement and emergency or safety bodies | Meet law, protect safety, investigate wrongdoing and resolve disputes. |
| With your direction | A representative, third-party service or other recipient you nominate | Carry out your authorised request. |
We do not sell personal information. We may use and share aggregated or de-identified information where individuals are not reasonably identifiable, including for service analysis, reporting and planning.
8. Cache, Fund and investment information
Separate privacy responsibilities. Cache and each relevant Fund party handle personal information under their own privacy policy and the final Fund Documents, within their confirmed legal roles. The relevant policies apply to the official Fund application, identity checks, payment authority, holdings, transactions, withdrawals and regulated complaints controlled by those parties.
Information The Supper™ receives. Once investment features are authorised and available, we may receive the minimum status or record needed to display a customer journey, fund and reconcile a valid Reward, coordinate a Monthly Boost and assist with support. We do not create or substitute an official Fund balance.
Requests involving Fund records. If you ask us to access, correct, delete or investigate information controlled by the responsible Fund party identified in the final Fund Documents, we will identify the record owner and assist with a referral. A request made to The Supper™ does not automatically amend or delete an official Fund record.
No marketing assumption. Choosing a utility or investment feature does not by itself authorise unrelated joint marketing by another entity. Each sender must have its own lawful basis and honour applicable communication choices.
9. Direct marketing and service communications
Service communications. We may send bills, payment notices, security alerts, outage and activation information, required disclosures, complaint updates and other communications reasonably necessary to provide or administer a service. These are not optional marketing messages.
Marketing communications. We send promotional email, SMS, push notifications or other direct marketing only where permitted by law. Marketing messages identify the sender and provide a clear, functional and low-cost way to opt out.
Withdrawing consent. Use the unsubscribe function, reply STOP where offered, change App preferences or contact us. We will action an electronic marketing opt-out within the period required by law, generally no more than five business days. Withdrawing marketing consent does not cancel a service or prevent necessary service communications.
No sensitive-information targeting. We do not use sensitive information for direct marketing without valid consent.
10. Overseas access and disclosure
Some technology, communications, analytics, support or professional providers may operate, store data or allow authorised support access outside Australia. Supplier locations can change as systems and sub-processors change.
The Supper™ does not currently disclose personal information to overseas recipients. You may request the current information through contact@the-supper.com.au.
Before disclosing personal information to an overseas recipient, we take reasonable steps required by Australian privacy law to ensure appropriate handling. In some circumstances the Privacy Act may make us accountable for the recipient's conduct. A service provider's remote access is assessed according to the actual arrangement and control, not merely the physical server location.
11. Automated and rules-assisted decisions
We may use automated or rules-assisted systems to support identity verification, fraud and account-security alerts, service eligibility, activation and provisioning, payment processing, Reward eligibility and transaction reconciliation.
The kinds of personal information used may include identity-verification results, account and service status, billing and transaction data, payment-method and debit-failure records, device and security signals, usage or provisioning events and prior fraud or support indicators. The resulting action may approve, refer, pause, reject, restrict access or request additional information for a process.
Where a decision could reasonably be expected to significantly affect your rights or interests, you may ask us to explain the outcome and request human review where available and required. The Supper™ does not use these tools to provide personal financial advice or decide whether a Fund accepts an application; The responsible Fund parties identified in the final Fund Documents would control those decisions; Cache's role remains subject to confirmation.
This disclosure is intended to meet our transparency standard now and the additional Australian privacy-policy transparency requirements applying from 10 December 2026 where they are relevant to our practices.
12. Security and data breaches
Safeguards. We use proportionate technical and organisational safeguards designed to protect personal information from misuse, interference, loss and unauthorised access, modification or disclosure. Measures may include role-based access, authentication controls, encryption in transit, logging, monitoring, supplier due diligence, staff confidentiality, backups and incident procedures.
Shared responsibility. You should use a strong unique password, protect your device and authentication codes, keep contact details current and notify us promptly about suspected unauthorised activity. No online service can guarantee absolute security.
Incident response. We assess suspected privacy incidents, contain harm, preserve evidence, coordinate with relevant providers and notify affected individuals, the OAIC or another regulator where the Notifiable Data Breaches scheme or another law requires it.
13. Retention, account deletion and de-identification
Retention principle. We keep personal information only for as long as reasonably necessary for the purpose for which it may lawfully be used or disclosed, including service delivery, billing, tax and accounting, fraud prevention, telecommunications duties, complaints, disputes, legal claims, safety and regulatory obligations.
Deletion and de-identification. When information is no longer needed and no law or court or tribunal order requires retention, we take reasonable steps to destroy it or permanently de-identify it. Backup copies may remain until securely overwritten through the ordinary backup cycle and will not be restored for routine use.
App account deletion. You can initiate deletion through Settings > Account > Delete account in the App or through www.the-supper.com.au/data-deletion. We may verify identity and explain any active service, unpaid amount or record we must retain before completing the request.
Separate services. Deleting App access does not itself cancel an active Mobile Service, stop a charge that must be cancelled under its billing terms, close a Fund account or withdraw an investment. We will explain the separate steps and route a Fund request to the responsible Fund party identified in the final Fund Documents.
Required records. We may retain a limited record after account deletion where required or reasonably necessary for law, tax, transaction evidence, fraud prevention, safety, dispute resolution or enforcement. Retained information remains protected and is not used for unrelated marketing.
14. Access, correction and privacy choices
Access. You may ask for access to personal information we hold about you. We will verify identity and respond within a reasonable period. Where the law permits us to refuse or limit access, we will generally give written reasons and available complaint options.
Correction. You may ask us to correct information that is inaccurate, out of date, incomplete, irrelevant or misleading. You can update some account and communication details directly in the App. We may retain an audit record of a correction where required.
Consent and permissions. You may withdraw consent for an optional use, disable optional device permissions and change cookie or marketing choices. Withdrawal applies prospectively and may prevent the feature that relies on that information from operating.
Identity and authority. To protect customers, we may require evidence of identity or authority before releasing or changing information. An authorised representative may act for you where their authority is established.
No fee in ordinary cases. We do not charge for making a privacy request. If a lawful charge may apply to providing access, we will explain it before proceeding.
15. Privacy complaints
Contact us using 'Privacy complaint' in the subject line and describe what happened, the information involved and the outcome you seek. We will acknowledge the complaint, investigate fairly, coordinate with the correct record owner and communicate an outcome within a reasonable period.
If another entity controls the relevant record, we will explain that boundary and assist with a referral rather than treating the matter as closed. Telecommunications matters may also be eligible for the Telecommunications Industry Ombudsman, and regulated financial-service matters may follow the dispute pathway in the Fund Documents.
If you are not satisfied with our privacy response, you may complain to the Office of the Australian Information Commissioner at oaic.gov.au. The OAIC may ask whether you first gave us a reasonable opportunity to resolve the matter.
16. Changes to this Policy
We may update this Policy when our services, technology, providers or legal obligations change. The current version will be published on the Website with its effective date. If a change materially affects how existing customer information is handled, we will provide appropriate notice and obtain consent where required.
We do not use a policy update to retrospectively authorise a materially different use of personal information where consent or another legal basis is required.
Schedule 1 - Privacy contact details
Item
Detail
Privacy entity
The Supper Operations Co Pty Ltd (ACN 697 464 314; ABN 51 697 464 314)
Registered address
Level 1, 530 Little Collins Street, Melbourne VIC 3000
Website
Published Privacy Policy
Privacy email
Privacy contact title
Privacy Officer
Telephone
1800 787 737
Online privacy request
Use the privacy contact option on the Website
App account deletion
Settings > Account > Delete account
Web account deletion
www.the-supper.com.au/data-deletion
External privacy regulator
Office of the Australian Information Commissioner - oaic.gov.au
Telecommunications EDR
Telecommunications Industry Ombudsman - tio.com.au
Financial-services EDR
Australian Financial Complaints Authority - afca.org.au, where stated in the Fund Documents
Schedule 2 - Product and data responsibility map
| Function | Primary responsible party | Key records |
|---|---|---|
| Website and App account | The Supper Operations Co Pty Ltd | Account, navigation, communications, security and support records. |
| Mobile Service | The Supper Operations Co Pty Ltd with telecommunications providers | Order, activation, number porting, provisioning, usage, billing and support. |
| 5% Loyalty Reward | The Supper Operations Co Pty Ltd; the relevant authorised Fund party would process accepted funding, subject to the final Fund Documents and Cache confirmation | Eligibility, calculation, funding, processing status and reconciliation. |
| Monthly Boost | Customer-authorised process administered by the relevant authorised Fund party, subject to final approval and the final Fund Documents | Separate payment authority, contribution processing and official Fund record. |
| Fund account and investments | Responsible Fund parties identified in the final Fund Documents; Cache's role remains subject to confirmation | KYC/AML, application, units, valuation, transactions, withdrawals and Fund complaints. |
YOUR PRIVACY CHOICES
You can request access, correction or deletion, withdraw optional consent, change marketing preferences or make a privacy complaint through contact@the-supper.com.au. We will identify the correct record owner and help route any request involving a telecommunications provider, Cache or a responsible Fund party.