Consumer Data Right Policy

1. About this policy

Beemur Pty Ltd (ABN 49 644 811 405), which runs Billbook, is a CDR representative of Fiskil Pty Ltd, an accredited data recipient under the Consumer Data Right (CDR) (ACCC accreditation number ADRBNK000246). Fiskil collects CDR data from your bank with your consent and shares it with us so we can provide bank feeds in Billbook.

This policy explains how we handle that CDR data, as required by the Competition and Consumer Act 2010 (Cth), the CDR Rules and the CDR Privacy Safeguards. Our Privacy Policy covers all other personal information. Fiskil's own CDR Policy, at fiskil.com/legal/cdr-policy, covers how Fiskil handles your data.

2. What CDR data we collect

Only for the bank accounts you choose to share, and only for as long as your consent lasts:

• Account details: account name, type, BSB and a masked account number (the last few digits).
• Balances: current and available balance.
• Posted transactions: date, amount, description, reference, and any payee, merchant or biller details your bank includes.

We don't ask for your name, address, phone or email from your bank, your full account number, your saved payees, direct debits or scheduled payments.

3. Why we use it

We use CDR data for one purpose: bank feeds in your business's Billbook books. Transactions arrive as bank statement lines, you reconcile them against your invoices, bills and payments, and they build your books, GST, BAS and financial reports. Balances are shown next to your ledger so you can check the two agree.

We never sell CDR data, use it for advertising or marketing, use it to assess credit, combine it with other businesses' data, or use it to train AI models.

If you ask for a suggested account and GST code for a transaction, we send that one transaction to Google's Gemini models on Vertex AI in Sydney, with account numbers and other long numbers removed and no identifiers. A person always accepts or changes the suggestion.

4. Who can see it

• You, and the people you give access to your business's books.
• Your accountant or bookkeeper, only if you've connected them to your books in Billbook. You can remove their access at any time.
• Billbook staff, only when you ask us for help, to fix a problem, or to keep the service secure.

We don't disclose CDR data or anything derived from it to anyone else, unless the law requires it.

5. Service providers and where data is kept

We use these outsourced service providers to store and process CDR data for us. They may use it only to provide their service to us:

• Google Cloud (Google Australia Pty Ltd): hosting, background processing, logs, backups and AI suggestions. Sydney, Australia.
• Neon Inc.: our database. Hosted on Amazon Web Services in Sydney, Australia.

All CDR data is stored and processed in Australia. We don't send CDR data overseas.

6. How we protect it

CDR data is encrypted in transit (TLS 1.2 or higher) and at rest (AES-256). Each business's data is separated at the database level. Everyone who signs in must use two-step sign-in. Access by our staff is limited, logged and reviewed.

7. Stopping sharing, and what happens to your data

You can stop sharing at any time: disconnect your bank in Billbook, use Fiskil's consumer dashboard, or contact your bank. Your consent also ends when it expires (up to 12 months).

When your consent ends, we stop collecting straight away. If you don't reconnect within 30 days, or straight away if you disconnect or close your business, we delete the consent record, Fiskil's identifiers for you and your accounts, and the bank balance figures.

Transactions already imported stay in your books, with the reconciliation built on them, because they're your business's accounting records, which the law requires to be kept. They're deleted when your books are deleted. We don't de-identify CDR data; when it's no longer needed, we delete it.

8. Seeing and correcting your data

Everything we collect for your bank feed is in your books in Billbook. If you think any CDR data we hold is wrong, email privacy@billbook.com.au. We'll acknowledge your request straight away and, within 30 days, correct the data or explain why we haven't, and tell you how to complain if you're not happy. There's no charge.

9. Complaints

Email privacy@billbook.com.au with what happened and what you'd like us to do. We'll acknowledge your complaint within 1 business day, keep you updated, and give you a written answer within 30 days. If we need longer, we'll tell you why and when to expect it.

If you're not satisfied, you can:

• complain to Fiskil at complaints@fiskil.com.au;
• take it to the Australian Financial Complaints Authority (AFCA), a free external dispute resolution service: afca.org.au, 1800 931 678, or GPO Box 3, Melbourne VIC 3001. Fiskil's AFCA membership number is 83521;
• complain to the Office of the Australian Information Commissioner at oaic.gov.au or on 1300 363 992.

10. Changes to this policy

We'll update this page before we change how we handle CDR data, and show the date it changed.