Consumer Data Right (CDR) Policy

Scope

The Better Rewards Company Pty Ltd (trading as and referred to herein as ‘DeepChange’) operates a mobile application that enables users to accumulate loyalty rewards by linking their bank accounts to the application and making purchases at participating partner retailers. These rewards contribute to funding environmental initiatives, such as reducing ocean plastic, by supporting partner organisations working globally to remove plastic from the environment.

DeepChange accesses personal banking data via open banking services provided by Wych Australia Pty Ltd, ensuring compliance with the Consumer Data Right (CDR) framework. This policy outlines how DeepChange collects, uses, and manages CDR data in accordance with Australian regulatory requirements.

Collection of Your Personal Banking Data

DeepChange adopts a data minimisation approach, collecting only the information necessary to track and register eligible transactions at participating partner retailers. With your consent, we access the following data:

• Customer and account information

• Transaction details, including:

  • Incoming and outgoing transactions

  • Amounts

  • Dates

  • Descriptions of transactions

  • Details of the parties involved (e.g., name, BSB, account number)

Data collection occurs multiple times daily to ensure the information is up-to-date and relevant for processing rewards.

Consent receipts are provided at the time of granting consent, detailing the scope and duration of the consent.

Classes of CDR Data

DeepChange collects and holds the following classes of CDR data:

1. Account Information

2. Transaction Details, including:

   • Amounts

   • Dates

   • Descriptions of transactions

   • Parties involved

Purposes of CDR Data

The primary purpose of collecting CDR data is to enable DeepChange to:

• Register and process rewards accumulated by users when shopping with participating partner retailers.

• Ensure accurate tracking and invoicing for partner retailers.

• Provide transparency and updates through the user’s dashboard.

CDR data will not be used for purposes other than those outlined in this policy.

Disclosure

DeepChange does not disclose or use personal banking data for direct marketing or commercial purposes. Personal banking data is not shared with non-accredited or accredited third parties, whether in Australia or overseas.

Outsourced Service Providers

DeepChange develops and maintains its software and does not share CDR data with outsourced providers. Open banking services are facilitated by Wych Australia Pty Ltd, an accredited provider under the CDR framework.

How to Contact Us

For inquiries regarding this policy or your CDR data, please contact us at:

• Email: support@DeepChange.co

• Address: 2/13 Wood Street, Manly, NSW 2095

How to Make a Complaint or Request Redress

If you believe DeepChange has breached the CDR rules or wish to request a correction, deletion, or apology, you may submit a complaint via email to support@DeepChange.co. Include the following information:

• Your name

• Your contact details

• Your preferred contact method (phone/email/letter)

• Details of your complaint

DeepChange will acknowledge receipt within one (1) business day and aim to resolve the issue within thirty (30) calendar days. If unresolved, you will receive a written explanation and information on pursuing external dispute resolution through the Australian Financial Complaints Authority (AFCA) or the Office of the Australian Information Commissioner (OAIC).

Events for Notifying CDR Consumers

DeepChange ensures that you are informed in the following situations:

• When you consent to the collection, use, or disclosure of your CDR data

• When your consent expires

• When you amend or withdraw consent

• When DeepChange accesses your data

• When you request a correction of your data

• In the event of a data breach involving your CDR data

Notifications will be provided via email, in-app notifications, or updates to the user dashboard.

Consequence of Withdrawing Consent

If you withdraw consent or stop sharing data, DeepChange will cease collecting transactions from your account. As a result:

• Loyalty rewards will no longer be tracked or accumulated.

• Contributions to environmental initiatives will be paused.

Deleting CDR Data

DeepChange will delete all banking data collected under a user’s consent, along with any derived data, within 24 hours of:

• Consent expiration

• Withdrawal of consent

• Account deletion

• Notification from your bank that you are no longer eligible

Data deletion is performed via a secure and scheduled process. Exceptions may apply if data retention is required by Australian law.

Security of CDR Data

DeepChange employs stringent security measures, including encryption and secure servers, to protect your CDR data. Access is restricted to authorised personnel, and data is processed in compliance with Australian privacy laws.

For more information, please contact us at support@DeepChange.co.