TOUCH.TOWN – PRIVACY POLICY

Aus Deliver which is part of SDM Group Pty Ltd. (ABN: 54 121 107 999) of Sydney, New South Wales, Australia operates the Touch.Town platform (“Touch.Town”, “we”, “us”, “our”).

Touch.Town is a technology marketplace that connects Customers with independent massage Service Providers.

This Privacy Policy explains how Touch.Town collects, holds, uses, discloses and protects personal information when you use:

• the Touch.Town website
• Touch.Town mobile applications
• Customer accounts
• Provider accounts
• booking services
• location and search functions
• messaging
• reviews
• customer support and
• other Touch.Town services.

Touch.Town intends to handle personal information consistently with applicable Australian privacy laws, including the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs) where they apply.

Touch.Town is an 18+ platform.

Customers must be at least 18 years old.

Individual Providers must be at least 18 years old.

Where a Provider operates a business with multiple massage Providers, every person providing services through Touch.Town must also be at least 18 years old.

Touch.Town does not knowingly allow persons under 18 to create Customer or Provider accounts.

If we become aware that an account belongs to a person under 18, we may suspend or delete the account and associated information where appropriate and lawful.

The information Touch.Town collects depends on how you use the Platform.

3.1 Account Information

When you create an account, we may collect:

• name
• email address
• mobile number
• date of birth or confirmation that you are 18+
• profile photograph
• username
• account type
• login information
• authentication information and
• account preferences.

We should generally avoid collecting a full date of birth where confirmation that a person is 18+ is sufficient for the relevant purpose.

For Customers, we may collect information including:

• name
• profile information
• contact details
• approximate or precise location where permission is provided
• search location
• selected search distance
• booking history
• favourite Providers
• appointment details
• Customer-provided service address
• messages sent through Touch.Town
• reviews and ratings
• reports and complaints
• support requests and
• account activity.

For Providers, we may collect:

• name
• business name
• ABN where supplied
• business contact details
• profile photographs
• business photographs
• service descriptions
• qualifications where supplied
• experience
• languages spoken
• service prices
• availability
• Provider premises location
• service area
• travel radius
• insurance information where supplied
• booking history
• ratings and reviews
• communications
• reports and complaints and
• account activity.

Where a business lists multiple massage Providers, Touch.Town may also collect relevant profile information relating to those individual Providers.

Location is an important feature of Touch.Town because Customers use the Platform to find nearby massage Providers.

With appropriate device permission, Touch.Town may collect or process location information from your device.

This may include:

• GPS location
• approximate location
• suburb
• postcode
• manually entered location
• Provider business location
• Customer service address and
• distance between a Customer and Provider.

We may use this information to:

• identify Providers near a Customer
• calculate approximate distance
• apply the Customer’s selected search radius
• display Providers on a map
• determine whether a Customer is within a Provider’s mobile service area
• arrange mobile appointments
• improve location-based search results and
• support safety, fraud prevention and Platform security where appropriate.

You may be able to use Touch.Town without enabling precise GPS location by manually entering a suburb, postcode or other location.

Some location-based functionality may be reduced if location access is disabled.

If you book a mobile massage, Touch.Town may collect the address where the service will take place.

This could include a:

• home address
• hotel
• workplace
• serviced apartment or
• other nominated service location.

The address may be disclosed to the Provider as reasonably necessary to perform the booking.

Providers are required under the Touch.Town Provider Agreement and Safety & Community Standards to use Customer addresses only for legitimate purposes connected with the booking or as otherwise permitted by law.

Customer addresses must not be used for:

• harassment
• stalking
• unauthorised visits
• unrelated marketing
• publication or
• another improper purpose.

Touch.Town should only make the full-service address available to a Provider when reasonably necessary for the booking.

A Provider may operate from:

• commercial premises
• massage premises
• a home business or
• another lawful location.

Touch.Town may display an approximate Provider location before booking rather than the exact street address where appropriate.

The exact Provider address may be provided to a Customer when reasonably necessary for a confirmed appointment.

This approach is intended to help protect Provider privacy and safety.

During the booking or massage process, a Customer may provide information concerning:

• injuries
• allergies
• pregnancy
• medical conditions
• recent surgery
• areas of pain
• skin conditions
• sensitivities
• medications or
• other health-related matters.

Health information may constitute sensitive information under Australian privacy law.

Touch.Town will only collect sensitive information where reasonably necessary for the Platform’s functions and where permitted by law, including obtaining consent where required.

Where possible, health information required solely for the Provider to safely perform the massage should be communicated directly to the Provider rather than unnecessarily retained by Touch.Town.

Touch.Town should minimise the amount of health information stored on the Platform.

Where Touch.Town directly collects sensitive information, including health information, we may request your express consent before collecting it where required.

For example, the Platform may display:

“I consent to Touch.Town collecting and sharing the health information I provide with my selected Provider where necessary to arrange or safely provide my booked service.”

Providing health information should be limited to information reasonably relevant to the service.

Users should not provide unnecessary sensitive information through:

• public profiles
• reviews
• general messaging
• photographs or
• other publicly visible areas.

Do not publish another person’s:

• medical information
• home address
• financial information
• identification documents or
• other sensitive or confidential information

without appropriate authority.

Touch.Town may provide in-app messaging between Customers and Providers.

Messages may be stored to:

• provide the messaging service
• maintain booking records
• investigate complaints
• investigate safety concerns
• prevent fraud
• enforce Touch.Town rules and
• comply with legal obligations.

Users should not send unnecessary sensitive personal information through messages.

Touch.Town personnel should only access messages where reasonably necessary for legitimate Platform, safety, support, compliance or legal purposes.

Touch.Town may collect and retain information relating to bookings, including:

• Customer
• Provider
• service selected
• service location
• date
• time
• duration
• price displayed
• travel fee
• booking status
• cancellation information and
• related communications.

Booking information may be used to operate and improve the Platform and to assist with legitimate complaints, safety issues and disputes.

Unless Touch.Town expressly introduces a payment facility, Touch.Town does not collect or process the Customer’s payment for the massage service itself.

Payment for the massage service is made directly between the Customer and Provider.

Touch.Town therefore generally does not need to collect Customer credit or debit card information for massage service payments.

Touch.Town may separately collect payment information from Providers where necessary to pay:

• subscription fees
• advertising fees
• featured listing fees or
• other Platform charges.

Where payment processing is required, Touch.Town may use a third-party payment processor.

Touch.Town should not store complete credit or debit card details where those details can instead be securely handled by an authorised payment processor.

Touch.Town may collect personal information:

Directly from you

For example when you:

• register
• create a profile
• make a booking
• list a service
• enter an address
• enable location
• send a message
• upload a photograph
• submit a review
• contact support or
• make a report.

Automatically

Certain technical information may be collected when you use Touch.Town, such as:

• IP address
• device type
• browser
• operating system
• app version
• login information
• usage information
• crash information
• cookie identifiers and
• security information.

From other users

For example:

• a Provider may provide information relating to a booking
• a Customer may leave a review
• a user may submit a complaint or safety report.

From service providers

We may receive information from service providers that support authentication, hosting, analytics, maps, communications, security or other Platform functionality.

We may collect, hold, use and disclose personal information where reasonably necessary to:

• create and manage accounts
• verify eligibility to use Touch.Town
• connect Customers and Providers
• provide location-based search
• calculate distance
• facilitate bookings
• provide booking information
• facilitate messaging
• send booking notifications
• manage Provider profiles
• provide reviews and ratings
• provide customer support
• respond to complaints
• investigate safety concerns
• detect fraud
• prevent Platform abuse
• enforce Touch.Town agreements
• improve Platform functionality
• conduct analytics
• maintain security
• comply with legal obligations and
• protect the rights and safety of users and Touch.Town.

Because Touch.Town is a marketplace, some information must be shared between Customers and Providers.

Information a Customer may see about a Provider

This may include:

• Provider name
• profile photo
• business name
• service descriptions
• approximate location
• prices
• availability
• qualifications claimed by the Provider
• experience
• service area
• ratings and
• reviews.

Information a Provider may receive about a Customer

This may include:

• Customer name
• profile information where applicable
• booking information
• appointment location
• relevant contact information
• messages and
• information reasonably necessary to perform the booked service.

Touch.Town should only disclose information reasonably necessary for the relevant purpose.

Some Provider information is intended to be publicly visible because Providers use Touch.Town to advertise their services.

This may include:

• Provider/business name
• profile photo
• business photos
• general location
• service descriptions
• prices
• availability
• ratings and
• reviews.

Providers should not publish information on their public profiles that they do not want prospective Customers to see.

Customer profiles should generally expose substantially less information publicly than Provider profiles.

Customer reviews may be displayed publicly on Provider profiles.

Reviews may show:

• Customer first name or display name
• rating
• review text and
• date.

Customers should not include:

• home addresses
• phone numbers
• medical information
• financial information
• private messages or
• unnecessary personal information

in public reviews.

Touch.Town may use third-party services to operate the Platform.

These may include providers of:

• cloud hosting
• databases
• authentication
• email
• SMS
• push notifications
• maps
• geolocation
• analytics
• cybersecurity
• customer support
• error monitoring and
• payment processing.

These organisations may process personal information where reasonably necessary to provide their services to Touch.Town.

Touch.Town should select reputable service providers and use appropriate contractual and technical safeguards where reasonably available.

Some technology providers used by Touch.Town may store or process information outside Australia.

Where this occurs, information may be disclosed to overseas recipients or processed in countries where Touch.Town’s technology providers operate.

Touch.Town will take reasonable steps required by applicable Australian privacy law in relation to overseas disclosures.

Where practicable, Touch.Town will identify in this Privacy Policy the countries in which overseas recipients are likely to be located once the final hosting, analytics, mapping, messaging and other technology providers have been selected.

Before launch, Touch.Town should update this section with the actual overseas countries applicable to its technology stack.

Touch.Town may use Supabase or another cloud infrastructure provider for services such as:

• database hosting
• authentication
• file storage
• account management and
• Platform security.

The exact production infrastructure and data-hosting region should be confirmed before launch.

Touch.Town should configure its production environment to use an appropriate hosting region and privacy/security settings.

Touch.Town may use third-party mapping and geolocation technology to:

• display maps
• determine approximate location
• calculate distance
• identify nearby Providers
• geocode addresses and
• support mobile bookings.

Depending on the service used, location or address information may be processed by that technology provider.

Touch.Town should disclose the specific mapping provider in its final production Privacy Policy once selected.

The Touch.Town website may use cookies and similar technologies.

These technologies may be used to:

• keep users signed in
• remember preferences
• improve security
• understand Platform usage
• measure performance
• detect fraud and
• improve the user experience.

Where required, users may be provided with options to manage non-essential cookies.

Touch.Town may use analytics tools to understand matters such as:

• number of Platform users
• popular search locations
• commonly viewed services
• booking activity
• application performance
• errors and
• general usage patterns.

Where reasonably possible, Touch.Town should use aggregated or de-identified information for analytics.

Touch.Town may send users information about:

• Platform features
• relevant services
• promotions
• Provider opportunities or
• other Touch.Town updates

where permitted by law.

Users should be able to unsubscribe from direct marketing communications using the unsubscribe option provided.

Important transactional communications, such as booking confirmations, account security notices and changes to important Platform terms, may still be sent where appropriate.

Touch.Town will not use sensitive information for direct marketing except where permitted by law.

Touch.Town does not sell personal information to third parties.

Touch.Town does not permit Providers to sell Customer information obtained through Touch.Town.

Personal information obtained through Touch.Town must not be used to create unrelated marketing databases without appropriate authority.

Touch.Town may disclose personal information where permitted or required by law, including where disclosure is reasonably necessary in circumstances involving:

• a court order
• legal process
• law enforcement
• suspected unlawful activity
• fraud
• serious misconduct
• a serious threat to life, health or safety or
• another situation permitted or required by applicable law.

Touch.Town may cooperate with police, courts, regulators and other lawful authorities.

If you report a safety concern, Touch.Town may collect:

• your account details
• details of the other user
• booking information
• messages
• description of the incident
• supporting photographs or documents and
• other information reasonably necessary to assess the report.

Safety information will be handled carefully and should only be disclosed where reasonably necessary or legally permitted.

Touch.Town will take reasonable steps to protect personal information from:

• misuse
• interference
• loss
• unauthorised access
• unauthorised modification and
• unauthorised disclosure.

Security measures may include:

• encrypted connections
• access controls
• secure authentication
• database security
• Row Level Security
• role-based access
• secure cloud infrastructure
• backups
• monitoring
• logging and
• other appropriate technical and organisational safeguards.

No internet-connected service can guarantee absolute security.

Users are also responsible for protecting their passwords and account credentials.

Touch.Town aims to collect only information reasonably necessary to operate the Platform.

Touch.Town shall minimise the collection and retention of:

• precise location information
• Customer home addresses
• identification documents
• health information and
• other sensitive information.

Where information is no longer reasonably required and Touch.Town is not legally required to retain it, Touch.Town may delete or de-identify it.

Touch.Town may retain personal information for as long as reasonably necessary to:

• provide the Platform
• maintain accounts
• manage bookings
• resolve disputes
• investigate safety matters
• prevent fraud
• comply with legal obligations and
• protect legitimate legal interests.

Different categories of information may have different retention periods.

When information is no longer reasonably required and there is no legal reason to retain it, Touch.Town will take reasonable steps to destroy or de-identify it where required by applicable law.

Users may request deletion of their Touch.Town account.

Account deletion may result in removal or de-identification of information associated with the account where appropriate.

However, Touch.Town may need to retain certain information where reasonably necessary or legally required, including information relating to:

• completed bookings
• financial records
• fraud prevention
• serious safety incidents
• disputes
• legal claims or
• regulatory obligations.

Deleting an account does not necessarily result in immediate deletion of every record where retention is legally required or reasonably necessary.

You may request access to personal information Touch.Town holds about you.

Touch.Town will respond in accordance with applicable privacy law.

We may need to verify your identity before providing access.

In limited circumstances, access may be refused where permitted by law. If so, Touch.Town will provide appropriate reasons where required.

You may update certain information through your Touch.Town account.

You may also ask Touch.Town to correct information that is:

• inaccurate
• out of date
• incomplete
• irrelevant or
• misleading.

Touch.Town will take reasonable steps required by applicable law to correct personal information where appropriate.

You may control Touch.Town’s access to device location through your device settings.

If you disable precise location, you may still be able to search using:

• suburb
• postcode
• manually entered location or
• another approximate location.

Some features may not work as effectively without location access.

Users may manage push notification permissions through their device settings.

Users may also manage certain communication preferences through their Touch.Town account.

Some essential account, booking, security or legal communications may still be sent where appropriate.

Where practicable and lawful, you may interact with Touch.Town without identifying yourself or by using a display name.

However, identification may be reasonably necessary for functions including:

• account creation
• age eligibility
• bookings
• safety
• fraud prevention
• mobile appointments
• Provider business operation and
• compliance with legal requirements.

Accordingly, some Touch.Town functions cannot practically be provided anonymously.

If you believe Touch.Town has mishandled your personal information, please contact us.

Your complaint should include sufficient information for us to understand and investigate the issue.

Touch.Town will:

1. acknowledge the complaint where appropriate
2. investigate the issue
3. seek additional information if reasonably necessary and
4. provide a response within a reasonable period.

If you are not satisfied with the response, you may have the right to contact the Office of the Australian Information Commissioner (OAIC) or another relevant regulator.

Touch.Town will maintain procedures for responding to suspected data breaches.

Where a data breach is likely to result in serious harm and applicable Australian law requires notification, Touch.Town will take steps required under the applicable data breach notification requirements.

This may include notifying affected individuals and the relevant regulator where legally required.

Providers are independent businesses and are responsible for their own handling of personal information they receive.

Providers must protect Customer information received through Touch.Town.

Providers must not misuse:

• Customer addresses
• phone numbers
• email addresses
• booking information
• health information
• messages or
• other Customer personal information.

Providers must comply with applicable privacy and other laws independently of Touch.Town.

Touch.Town is not responsible for a Provider’s independent handling of information outside the Platform to the extent permitted by law.

Touch.Town may contain links to third-party websites or services.

Touch.Town is not responsible for the privacy practices of independent third parties.

Users should review the privacy policies of those organisations before providing personal information.

Touch.Town may update this Privacy Policy when:

• Platform functionality changes
• technology providers change
• privacy practices change
• laws change or
• new features are introduced.

The current version will be published on Touch.Town.

Where changes materially affect how personal information is handled, Touch.Town may provide additional notice through:

• the Platform
• email
• account notification or
• another reasonable method.

The Last updated date at the top of this Policy identifies the latest version.

For privacy questions, access or correction requests, account deletion requests or privacy complaints, contact:

Touch.Town

Operated by: Aus Deliver

SDM Group Pty Ltd

ABN: 54 121 107 999

Sydney, New South Wales, Australia

Email: support@touch.town

Website: touch.town

Touch.Town is a technology marketplace connecting Customers with independent massage Service Providers.

When you make a booking, certain information must be shared with the selected Provider so the Provider can perform the service.

For mobile massage bookings, this may include the Customer’s service address.

Providers are independent businesses and are required to protect information they receive and use it only for legitimate purposes.

Users should only provide personal, health and location information reasonably necessary for their booking.