Coast To Coast Converters Australia Pty Ltd (C2C, we, us or our) is an organisation covered by the Privacy Act 1988 (Cth) and the Australian Privacy Principles where they apply. This policy explains how Personal Information is handled through the C2C App and related administration, support and business systems.
It applies to staff, approved users, customers, suppliers, contractors, authorised representatives and other individuals whose Personal Information is handled through the App.
The private-sector employee-records exemption may apply to an act or practice directly related to a current or former employment relationship and an employee record. Where that exemption applies, some Privacy Act rights may not apply in the same way; C2C nevertheless uses this policy as a practical privacy standard where reasonably practicable.
Depending on the user, feature and transaction, C2C may collect or generate: name, contact details, account identifier, role, employer or business; business name, ABN, GST status and authority information; addresses and map-validated address details; bank account name, BSB and account number; customer and supplier notes and interaction history; bookings and calendar records; employee role, targets, goals, KPIs and performance information; converter photographs, serial numbers, categories, grades, weights, assays, prices and transaction history; purchase, payment, RCTI, invoice and receipt information when those features are enabled; device identifiers, IP address, operating system, login history, authentication and audit records; support communications, diagnostics and security records; and identity or authority verification information where reasonably required.
C2C aims to collect only information reasonably necessary for its functions or activities. It will provide a further notice if it begins collecting a materially new category of information, sensitive information, or a copy of an identity document not reasonably apparent from this policy.
Information may be collected directly from an individual through the App, forms, email, telephone or in-person dealings; from an employer, customer, supplier or authorised representative; from C2C staff who create operational records; automatically from a device, login or system interaction; and from approved service providers or public/business sources where lawful and relevant.
Collection notices may be shown at or before a particular collection, including camera/photo, address/maps, notifications, bank details, identity or authority verification and employee-performance information.
Because the App is an authenticated workplace and transaction system, anonymous or pseudonymous use is generally not practicable. If required information is not provided, C2C may be unable to create an account, assign work, verify a transaction, make a payment or provide the relevant feature.
C2C may use or disclose Personal Information to create and manage accounts and roles; schedule work and manage customer relationships; identify, grade, price, purchase and record catalytic converters; administer payments and accounting when enabled; verify identity, authority, lawful source, ABN, GST and bank details; operate, secure, maintain and improve the App; investigate misuse, fraud, stolen material, errors or security incidents; communicate operational and legal information; manage staff performance and authorised work; comply with law, regulators, court orders and recordkeeping obligations; obtain legal, accounting, insurance, technical or security services; resolve complaints and disputes; and manage business continuity, corporate transactions and the defence or exercise of legal rights.
C2C will not use Personal Information for an unrelated purpose unless authorised by law or with consent where required.
C2C takes reasonable steps to keep Personal Information accurate, up to date, complete and relevant for the purpose for which it is used or disclosed. Users should promptly report errors and changes.
Converter photographs, serial-number records, grades, assays and transaction information may relate to a person or business. C2C may retain and analyse those records to operate and improve its converter database, prevent fraud, support grading consistency and maintain transaction history.
C2C does not use GPS/EXIF metadata from converter photographs to track employees. The production App is required to remove location metadata during upload unless C2C separately approves a lawful documented use.
The current release uses Google Maps to capture or validate an address. The validated address may be stored in the App database and associated with a customer, supplier, booking or user record.
The current release is not configured to maintain continuous or background employee location tracking or a separate history of precise GPS coordinates.
If C2C later introduces employee location tracking while the App is open or in the background, C2C will update this policy, complete a jurisdiction-specific workplace-surveillance review and provide any required consultation and notice before activation.
Depending on the function and App version, the App may store or cache authentication tokens, login state, customer details, bank details, converter records and photographs, address or location information, notifications and temporary files on an approved device. The production configuration is required to minimise local storage, protect unavoidable cached information and avoid storing full bank details locally unless strictly necessary and specifically protected.
Depending on the device, operating system and configuration, locally stored information may enter iCloud, Google or other device backups unless technically excluded. C2C requires sensitive App data to be excluded where technically available, cleared on logout or disablement where appropriate, and accessed only on approved devices.
Push notifications may be delivered through Firebase, Apple or Google platform services. Production notification and email payloads must not contain full bank details, authentication secrets or unnecessary confidential information. Users should use device lock-screen privacy settings.
Optional device permissions can be denied or withdrawn through device settings. Withdrawing a permission may stop the related feature from working but does not affect prior lawful handling.
C2C may disclose or make information available to authorised staff and approved service providers who need the minimum information reasonably required for a legitimate purpose. Current or intended providers include AWS for hosting and database infrastructure; Firebase for notifications or app services; Google Maps for address services; Google Workspace and SMTP services for email; Apple and Google Play for app distribution; Supportsoft and replacement developers for authorised development, maintenance and support; and accountants, lawyers, insurers, auditors and security specialists.
Xero or another accounting provider may be added only when the relevant function is enabled and this policy and store disclosures are updated as required.
C2C may also disclose information to police, regulators, courts, government authorities, payment providers or other persons where required or permitted by law, to investigate suspected stolen material or fraud, or to protect rights and safety.
C2C does not sell or rent Personal Information.
Primary production application and database infrastructure is hosted through AWS in the Asia Pacific (Sydney) region. Some global providers may process or support information in other countries under their service arrangements.
Authorised Supportsoft personnel in India may access application files and associated data when required for approved development, maintenance or support and while C2C permits that access.
India is the specifically confirmed overseas developer-access country at the date of this policy. C2C takes reasonable steps appropriate to the arrangement to limit overseas access to authorised purposes, named accounts and minimum necessary information, and to require confidentiality, security, incident notification and prompt revocation. Foreign law may apply to information handled overseas.
The current release does not use an additional external AI or image-recognition service beyond the providers identified in this policy.
C2C does not currently arrange for a computer program to use Personal Information to make, or do a thing substantially and directly related to making, a decision that could reasonably be expected to significantly affect an individual's rights or interests.
Before introducing an external AI, image-recognition service or significant automated decision, C2C will assess necessity, data use, access countries, retention and model-training settings and update notices, this policy and store disclosures where required. From 10 December 2026, this policy will include the additional automated-decision information required by the Privacy Act if the obligation applies.
C2C uses and requires appropriate technical and organisational measures, having regard to the nature of the information and risks, to protect Personal Information from misuse, interference, loss and unauthorised access, modification or disclosure.
C2C applies security measures appropriate to the information, system and risk. These measures include, or for production use are required to include, individual accounts, least-privilege role restrictions, secure password hashing and reset controls, multifactor authentication for privileged access, encryption in transit and at rest, protected backups and restoration testing, audit records, session revocation, device controls, staff training, provider confidentiality and security controls, and incident-response procedures. Controls are reviewed and updated as the App and risks change.
No internet or storage system is completely secure. Individuals should promptly report suspected compromise and protect their own credentials and devices.
Approved providers must notify C2C promptly of an actual or suspected security incident affecting C2C information and cooperate with containment, investigation, remediation and any required notification.
C2C retains Personal Information only for as long as reasonably required for the purpose collected, business operations, employment, transactions, accounting, tax, legal compliance, security, fraud prevention, disputes or the exercise or defence of legal rights. C2C maintains or will maintain an internal retention schedule for major record categories.
Disabling or deleting an account may initially soft-delete the user so the record remains marked as deleted and cannot be used to access the App. Some linked records may need to remain for lawful or operational reasons.
When no longer required and no law or documented legitimate reason requires retention, C2C will take reasonable steps to delete or de-identify Personal Information. Backup copies may remain until the relevant rolling backup expires or is securely overwritten.
Retention periods may differ for employment records, tax/accounting and transaction records, security and audit logs, converter records, legal claims and backups. A longer period is used only where law or a documented legitimate need requires it.
To request access to or correction of Personal Information, email shannon@coast2coastconverters.com. C2C may verify identity.
If C2C lawfully refuses or limits a request, it will give written reasons and available complaint options where required. No fee applies to make a request; any permitted access charge will be reasonable and notified first.
Users should keep account, authority, ABN, GST and bank information accurate and notify C2C promptly of changes.
Request account deletion in the App where available or by emailing shannon@coast2coastconverters.com. C2C may disable access immediately and will distinguish account deactivation, soft deletion and permanent deletion or de-identification of associated data.
C2C may retain records lawfully or reasonably needed for employment, tax, accounting, transactions, fraud prevention, claims, security or compliance.
Where information has been provided to an approved service provider, C2C will take reasonable steps to request corresponding deletion or restriction where required and practicable, subject to lawful retention.
C2C may send operational, security, booking, account and legal messages required for App use.
Direct marketing is sent only where permitted, with consent where required and a functional unsubscribe method. Unsubscribing does not stop essential service, security or legal messages.
C2C will promptly assess suspected loss, unauthorised access or disclosure, take reasonable containment and remediation steps, preserve relevant evidence and notify affected individuals and the Office of the Australian Information Commissioner where an eligible data breach requires notification.
Send privacy questions or complaints to shannon@coast2coastconverters.com and include enough detail for investigation.
C2C will acknowledge the complaint and aims to provide a substantive response within 30 days, or explain any delay. A dissatisfied person may complain to the Office of the Australian Information Commissioner or another regulator.
C2C may update this policy when the App, law, providers or information practices change. Material changes will be notified as appropriate and may require renewed acknowledgement.
The current version and last updated date will be displayed in the App and website.
Contact: shannon@coast2coastconverters.com | 21-23 Phillip Street, Kingswood NSW 2747, Australia | https://c2cconverters.com.au/.
