Australia's First Shop & Win Network

Privacy Policy

Last updated: 21 November 2025

Privacy Notice

We at PrizeCart (ACN 688 017 692) based in Victoria, Australia, respect the privacy and confidentiality of the personal data of our users, customers, merchants, visitors and all others whom we interact with in the course of providing our services. While we are driven by the goal of making shopping more fun by turning everyday purchases into instant-win prize experiences, we also understand that a key concern you may have is the safety of your personal information. We are committed to ensuring that all personal data provided to us remains secure and is only used for purposes that you have been informed of and, where required, have consented to.

To begin with, we only collect such personal information as is reasonably necessary to:

Provide you with access to the PrizeCart platform (including our website, portal, apps and Shopify integration);
Track and validate your eligible purchases with participating merchants for prize allocation and affiliate commission;
Fulfil our legal obligations in order to properly conduct our trade lottery promotions; and
Understand how our services are used so that we can improve them and serve you and our merchants better as a whole.

We collect the least information possible to achieve these purposes. We provide to our merchant and affiliate partners only such information as is necessary to allow us to verify and track attributed orders, calculate commissions, determine prize eligibility and fulfil prizes.

For example, we utilise cookies and tracking technologies to attribute your transactions with our merchant partners to PrizeCart so that we can validate and credit you with prize allocations (such as "1 prize box per $5 spent") and ensure that the relevant commission is tracked correctly.

Otherwise, where possible, we limit data provided to third parties to an aggregate or de-identified level (for example, trends, volumes and performance insights without identifying individual users).

We do not, under any circumstances, sell your personal information.

We are committed to implementing policies, practices and processes to safeguard the collection, use and disclosure of the personal data you provide us, in compliance with the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs).

Set out below is our detailed personal data protection policy. PrizeCart takes privacy and security seriously and is receptive to any feedback on these issues. If you have any queries, comments or concerns, or require any assistance, please contact us at:

Email (general support): support@prizecart.app
Email (privacy matters): privacy@prizecart.app

The PrizeCart Team

Personal Data Protection Policy

The purpose of this document is to inform you as to how PrizeCart manages, collects, uses and discloses Personal Data relating to you and other users of our website, Shopify app, browser widgets, software applications, mobile applications, prize mechanics and other platforms and services (collectively, the "Services"). We conduct our business in compliance with the relevant data protection legislation, and have implemented additional measures to protect your personal information. The continued provision of our Services to you and your continued use of such Services will be deemed to be our mutual agreement to abide by this Personal Data Protection Policy as updated from time to time on our website.

Personal Data

In this Personal Data Protection Policy, "Personal Data" refers to any information or opinion, whether true or not, about an individual who is identified or reasonably identifiable from that information, or from that information and other information to which we have or are likely to have access, including data in our records as may be updated from time to time.

"Sensitive information" has the meaning given in the Privacy Act 1988 (Cth) and includes information such as health information and biometric information. We do not seek to collect sensitive information in the ordinary course of our Services. If we ever require sensitive information (for example, for identity verification in relation to high-value prizes), we will only collect it where lawful and with appropriate safeguards.

"De-identified information" means information that is no longer about an identifiable individual or an individual who is reasonably identifiable. We may de-identify data that we hold and use or share it in aggregated or anonymised form, for example to provide merchants with insights on campaign performance without revealing user identities.

Collection of Personal Data

The Personal Data that PrizeCart may collect from you will depend on the products, Services and promotions that you use or subscribe to. PrizeCart collects this data to enable our Services and our platforms to function properly, to calculate prize eligibility and affiliate commissions, to prevent fraud and misuse, and to help us better understand how the PrizeCart ecosystem works across different devices, browsers and merchant environments.

Typically, PrizeCart will collect Personal Data relating to you when you:

Leave your contact details with us after visiting or using our websites, portals, mobile applications, social media platforms or Shopify app, or when you make enquiries via any contact channel;
Register for a PrizeCart account, subscribe to our Services or onboard as a merchant;
Interact with the PrizeCart experience embedded on a merchant's website, including post-purchase prize notifications and prize reveal flows;
Sign up for alerts, newsletters or promotional communications, or respond to our marketing collateral (e.g. advertisements, landing pages, referral campaigns);
Contact us with enquiries or requests for assistance or interact with us or our employees or agents, for example via our online interface, email, telephone calls, text messages or meetings;
Participate in contests, trade promotions, prize draws, beta tests, feedback programmes or surveys run by or in conjunction with PrizeCart;
Submit a CV or job application to us, or where a recruitment partner or job portal forwards your application to us;
Are referred to us by business partners, merchants, influencers or third parties (for example, when a merchant nominates you as a contact for integration or prize fulfilment).

The Personal Data collected may include information relating to your:

Identity:

Full name, email address, phone number, date of birth (for eligibility checks), and country of residence;
Postal or delivery address where required for prize fulfilment;
PrizeCart account identifiers and login credentials;
Device identifiers, IP address, browser type and other technical identifiers.

Interactions with us:

Records of your communications with us (e.g. emails, messages, support tickets);
Records of your interactions with the PrizeCart portal, Shopify app and widget (e.g. prize reveals, clicks, redemption attempts).

Account:

Details relating to your PrizeCart account, including profile information, prize history, collected items, achievements and account preferences.

Use of our Services and merchant transactions:

Information relating to your interactions with our Services and merchant sites where PrizeCart is active, including pages or sections you view within our portal, the time spent on those pages, items and information searched within the PrizeCart ecosystem, access time and dates, and information relating to clicks and redirects;
Data related to your transactions with our merchants and affiliate partners, including order reference numbers, order value, merchant name, purchase time and, where necessary, basic product line items to validate eligibility and prevent abuse;
Information generated by our systems to evaluate fraud risk, unusual activity and abuse of prize mechanics.

For the avoidance of doubt, PrizeCart's tracking and integration does not collect your general search engine history, email content, or your browsing data on websites that are not PrizeCart merchant sites or otherwise unrelated to PrizeCart's Services. When you are on one of our merchant's sites, PrizeCart only collects information about that site and transaction that lets us calculate and validate the affiliate commission and prize eligibility relating to you and display the relevant prize notifications.

Preferences:

Details that you have shared with us as to how you would like to be contacted, your preferred prize types, your favourite brands or categories, and your notification settings.

Location:

Some of the Services we provide depend on your location (for example, to show you relevant merchants or jurisdiction-specific legal notices). When you use or interact with our platforms (including our portal and app) on your device, we may use location-related information (such as IP-based location or device location where you have enabled this) to tailor our Services to your location. If you have background location turned on in any mobile app we release in future, our platforms may from time to time receive your device's location even if you are not directly interacting with our platforms at that moment.

Children's Data

Our Services are not intended for use by children under 16, and we do not knowingly collect personal information about children. If you believe a child has provided us their information, please contact us so we can delete it.

Anonymity/Pseudonymity:

Where lawful and practicable (for example, general browsing of our consumer-facing marketing site), you may interact with us without identifying yourself or by using a pseudonym. Certain Services (including account registration, prize fulfilment, and merchant or affiliate integrations) require identification to function.

Apart from collecting the above Personal Data directly from you or your authorised representatives, PrizeCart may also collect Personal Data from third parties (such as merchants we work with, affiliate networks, analytics providers, social media platforms or fraud-prevention agencies), or from publicly available sources, to the extent permitted by law.

In addition, PrizeCart uses "cookies" and similar technologies, which are small data files sent to your browser or device to store and track information about you when you enter our website or interact with our Services. Cookies are used, among other things, to:

Track the attribution of transactions to PrizeCart;
Keep you logged in;
Remember your preferences;
Improve our Services and performance.

Most internet browsers provide you the option to turn off or limit the processing of cookies, but this may result in the loss of functionality, restrict your use of our Services and/or delay or affect the way in which they operate. In particular, if you block cookies used for transaction tracking, we may be unable to attribute your purchases to PrizeCart or credit you with prize allocations, and may be unable to provide you with the Services that you have requested.

Use of the PrizeCart Shopify App and Widgets

PrizeCart's Shopify app and associated widgets are used by merchants to integrate PrizeCart's prize experience into their stores. When you shop on a participating merchant's store where the PrizeCart integration is active, the app or widget may collect the following data in order to make the Services work correctly:

Merchant trade name and domain;
Indication that a relevant PrizeCart promotion is active;
The fact that a qualifying order has been placed (order ID, order value, time of purchase and basic non-sensitive order details);
The number of prize allocations or "boxes" associated with your order (e.g. one prize allocation per $5 spent or such other rule as may apply from time to time);
Browser and device information necessary to render the widget and process the post-purchase reveal flow (such as browser type, operating system, error logs, event stamps).

None of the information collected by the Shopify app or widget includes your payment card numbers, bank account details or passwords. Payment processing is handled by the merchant or their payment service provider; PrizeCart does not process or store payment card details.

The Shopify app does not track your usage or browsing on other websites that do not have PrizeCart installed and does not access your email content or unrelated personal information.

Accuracy of Information and Third Party Consent

You should ensure that all Personal Data submitted to us is complete, accurate, true and correct. Failure to do so may result in our inability to provide you with the products and services that you have requested, or may affect your eligibility for prizes.

Where you provide us with any Personal Data relating to a third party (for example, if you nominate someone else to receive a prize delivery), you represent to us that you have obtained the consent of that third party to provide us with their Personal Data for the purposes set out in this policy.

Use of Personal Data

PrizeCart does not sell or trade Personal Data collected online with third parties. We may use Personal Data relating to you for the following purposes:

1. Administering the Services we provide you

Primarily, we use your Personal Data to operate PrizeCart and process your prize experience. This includes:

Tracking your transactions with our merchant partners via affiliate networks or direct integrations;
Calculating and allocating prize eligibility (for example, the number of prize allocations per order);
Running instant win mechanics, prize pools and reward structures;
Fulfilling prizes, including physical deliveries or digital fulfilment (such as gift cards or credits);
Activating or deactivating Services, accounts and features;
Providing merchants with performance reporting and reconciliation of attributed orders and commissions;
Administering (at times in conjunction with our preferred partners or merchants) promotional events, campaigns, trade promotions and prize draws.

2. Direct marketing and online advertising

We may use your Personal Data to provide you with marketing communications and offers relating to PrizeCart, participating merchants, prize campaigns and related services. This may include:

Email, SMS or in-app notifications about new prize seasons, featured merchants or special offers;
Information about changes to odds, prize structures, or upcoming promotions;
Use of hashed identifiers to reach you on third-party platforms under our instructions (for example, to exclude existing users from acquisition campaigns).

You can opt out of marketing at any time (e.g. via in-message unsubscribe links or via account settings where provided). We do not use sensitive information for direct marketing without your consent.

3. Enhancing the Services we provide you

We use your Personal Data to:

Investigate and resolve complaints, claims and disputes;
Improve the performance, stability and usability of our Services;
Understand user preferences and behaviour across merchants and prize flows;
Develop new products, features and experiences;
Deliver more relevant prize offerings and merchant recommendations within the PrizeCart portal.

We may also use aggregated or de-identified information to help merchants and partners understand campaign performance (for example, trends in spend, prize uptake rates, or category interest) without revealing individual identities.

4. Customer service

This includes using Personal Data relating to you to:

Respond to requests and enquiries made by you (or persons authorised by you);
Provide guidance on how to use our Services;
Provide you with updates relating to our products, services or policies;
Manage complaints and feedback.

5. Security and compliance

We may use Personal Data to:

Detect, investigate and prevent fraud, abuse and other unlawful activity (including abuse of prize mechanics, suspicious refund patterns or multiple account abuse);
Conduct internal audits, risk assessments and system testing;
Meet legal, regulatory and compliance requirements (for example, trade promotion regulations, record-keeping obligations and anti-money laundering controls where applicable);
Assist law enforcement, judicial and other government agencies where required by law;
Conduct due diligence and take steps which PrizeCart considers necessary in the event of a lawsuit or potential lawsuit.

6. Job applications

If you apply for a role with PrizeCart, we may use your Personal Data for:

Recruitment and selection;
Reference checks;
Processing and administering employment records if you are successful.

We will not use Personal Data relating to you for purposes other than those we have informed you of, or which are permitted or required under applicable law and regulations. We will retain Personal Data relating to you only for as long as there is a business or legal need to do so. When we no longer need personal information for any permitted purpose, we will take reasonable steps to destroy it or de-identify it, subject to legal and regulatory record-keeping obligations.

Sharing of Personal Data

We may share Personal Data relating to you with:

Companies within the PrizeCart group, if any, for operational and administrative purposes;
PrizeCart's business partners, vendors, agents and service providers who we work with to deliver Services you have subscribed to or engaged with. This includes:
- Merchant partners and brands participating in PrizeCart campaigns;
- Affiliate networks and tracking providers;
- Payment and payout providers (for example, to fulfil cash-equivalent prizes or reimbursements);
- Cloud hosting providers, IT service providers and analytics tools;
- Customer support tools and communication platforms;
- Third-party service providers engaged in connection with marketing promotions and services offered by PrizeCart or its preferred partners;
- Service providers who provide operational services to PrizeCart (such as information technology, fraud detection, processing, technical services or market research);
- Professional advisers such as auditors, lawyers and consultants.
In the event of an actual or prospective business asset transaction (such as any merger, acquisition, investment or asset sale), any business partner, investor, assignee or transferee for the purposes of facilitating that transaction, subject to appropriate confidentiality safeguards;
Relevant regulators, statutory boards or authorities, or law enforcement agencies as required by any laws, rules, guidelines and regulations or schemes.

Personal Data is disclosed to the above only for relevant purposes (please refer to those mentioned in this Policy) or to protect the interests of our users and merchants. In exceptional circumstances, PrizeCart may also be required to disclose Personal Data relating to you where there are grounds to believe that disclosure is necessary to prevent a threat to life or health, or for law enforcement or regulatory purposes.

In some cases, we encrypt, anonymise and aggregate information before sharing it. Anonymising means stripping the information of personally identifiable features. Aggregating means presenting the information in groups or segments (e.g. age groups, spending ranges, category trends).

Overseas disclosures: We may disclose personal information to overseas recipients (for example, cloud providers and affiliate networks based outside Australia). Where we do so, we take reasonable steps to ensure appropriate safeguards over the data transferred and require overseas organisations we work with to observe strict confidentiality and data protection obligations.

We do not sell your personal information.

Security of Personal Data

PrizeCart ensures that all Personal Data collected will be safely and securely stored and has implemented measures to secure and protect your information. These include, where appropriate:

Using secure, encrypted connections (HTTPS/TLS) on our web pages and APIs where you transmit Personal Data;
Ensuring that Personal Data is only stored on servers with reasonable safeguards to prevent security breaches;
Limiting access to information in our systems to authorised personnel on a need-to-know basis;
Implementing verification processes to prevent unauthorised access to accounts;
Monitoring systems for unusual or suspicious activity;
Securely destroying or de-identifying your personal information when it is no longer needed for our business or legal processes.

Data breaches: We maintain a data breach response process. Where an eligible data breach occurs under the Notifiable Data Breaches (NDB) scheme, we will assess the incident promptly and notify the Office of the Australian Information Commissioner (OAIC) and affected individuals, including outlining steps they should take in response.

Updating Personal Data

You can update certain personal information at any time by accessing your account on the PrizeCart website or portal (where functionality is available). If there is any Personal Data relating to you that you are unable to update through your account and which you wish to correct, you may contact us at privacy@prizecart.app and we will assist where reasonably possible.

Respecting Your Consent and Access to Personal Data

If you wish to:

Access the Personal Data that we hold about you;
Enquire about the ways in which Personal Data relating to you has been or may have been used or disclosed by PrizeCart in the past 12 months; or
Withdraw your consent to our collection, use and/or disclosure of your Personal Data;

you may contact us at privacy@prizecart.app. We will seek to attend to your request as best as we reasonably can and within a reasonable period.

We may refuse access in the limited circumstances permitted by law and will provide written reasons if we do so. Kindly note that we may charge you a reasonable administrative fee for providing access (but not for making a request).

Please note that you may withdraw your consent to our collection, use and disclosure of your information at any time. This includes discontinuing use of our Services or, if you are a merchant, uninstalling the PrizeCart Shopify app. However, depending on the nature of your objection, we may not be able to continue providing our Services or fulfil our obligations under any contract we have with you. Our legal rights and remedies are expressly reserved in such an event.

If you have a privacy complaint, please contact us using the details above. We will acknowledge and respond to privacy complaints within a reasonable period. If you are not satisfied with our response, you may contact the Office of the Australian Information Commissioner (OAIC).

Changes to the Personal Data Protection Policy

PrizeCart reserves the right to modify and update this Personal Data Protection Policy at any time to ensure that it remains consistent with our practices, industry trends and any changes in legal or regulatory requirements. Subject to your rights at law, you agree to be bound by the prevailing terms of this Policy as updated from time to time on our website. Any changes to this Policy will be published on our website, and we may also notify you through other means where appropriate.

Governing Law

We manage personal information in accordance with the Privacy Act 1988 (Cth) and the Australian Privacy Principles.

This Personal Data Protection Policy and your use of the PrizeCart Services shall be governed in all respects by the laws of Australia.