Privacy policy

RizeC is operated by Zheng Zhang, ABN 37 692 390 837.

This Privacy Policy explains how we collect, use, disclose, store and delete personal information when you:

• Visit our website.
• Purchase a RizeC Identity NFC card.
• Submit information for a RZProfile.
• Choose an External Link destination.
• Use the Customer Portal.
• Visit a hosted profile or follow a card link.
• Contact us or receive communications from us.

We handle personal information in accordance with applicable Australian privacy requirements.

For privacy enquiries, contact:

Privacy contact: RizeC Privacy Officer

Email: contact@rizec.com.au

Postal address: 883 Collins Street, Docklands VIC 3008

Depending on your interaction with us, we collect the following categories of information.

Contact and Account Information

This includes your name, email address, telephone number, business name and information needed to verify access to your Customer Portal.

Order and Delivery Information

This includes your selected card, quantity, order number, billing and shipping details, payment status, delivery tracking, subscription status and warranty correspondence.

Profile Information

If you choose RZProfile, this includes information and materials you submit for publication, such as:

• Your name or business name.
• Job title, business category or professional details.
• Profile photograph, business logo and other supplied images.
• Headline, biography or business description.
• Telephone numbers and email addresses.
• Business address and opening hours.
• Website, social media, booking and other links.
• Other fields relevant to your selected template.

External Link Information

If you choose External Link, we collect the destination URL you submit and the information needed to associate it with your card and order.

Support and Communication Records

This includes enquiries, requested changes, complaints, troubleshooting information and our correspondence with you.

Technical and Service Information

Our website and service infrastructure may process technical information such as IP addresses, browser and device information, access times, requested pages, error information and security logs.

We also process card identifiers and first-use information needed to connect a card to its destination and determine the start of an included RZProfile subscription.

Additional analytics or tracking information: We record when each card or profile link is opened (tap counts and tap times) so the card owner can see tap statistics in the Customer Portal. We do not use third-party analytics, advertising or cross-site tracking tools.

Please do not submit passwords, identity documents, payment card details or other confidential information as public profile content.

We collect information:

• Directly from forms you complete before payment.
• When you place an order or access the Customer Portal.
• When you submit profile materials or an external URL.
• When you contact us or request changes.
• Through website and service infrastructure when pages are accessed.
• From payment and delivery providers in connection with your order.

If someone provides information on your behalf, they must have appropriate authority to do so.

You can browse general website information without creating an account. We need certain contact, payment and delivery information to fulfil purchases. If required information is not provided, we may be unable to complete the relevant order or service.

We use personal information to:

• Process and fulfil orders.
• Verify account access.
• Create, configure and publish the profile you request.
• Connect your card to its selected destination.
• Establish subscription activation and expiry dates.
• Arrange delivery and provide tracking information.
• Process manual renewals.
• Send order, shipping, renewal and necessary service notices.
• Complete requested information and template changes.
• Provide support and assess warranty claims.
• Maintain, troubleshoot and protect the service.
• Address misuse, complaints and disputes.
• Meet applicable legal and record-keeping obligations.

If we propose a materially different use requiring your consent, we will explain it and seek that consent separately.

A RZProfile is intended to be publicly accessible.

Information you submit for display may be viewed by anyone who opens your profile URL, scans its QR code or taps your card. The link may be forwarded, and public content may be copied or indexed by search engines.

Only submit information you intend to make public. If you submit another person’s information or photograph, you must have the necessary permission.

Order, shipping, billing and account information is not automatically published on your profile. It becomes public only if you separately submit it as display content.

Deleting your profile from our service does not necessarily remove copies held by visitors, search engines or external platforms.

Payments are processed through Stripe. Your full card number, expiry date and card verification code (CVC) are submitted directly to Stripe and do not pass through RizeC’s servers. We do not receive or store these card details in our databases or logs.

Our systems retain the following payment and order information:

• Stripe transaction and customer identifiers.
• Payment amounts and payment status.
• Billing information.
• Product names, quantities and unit prices.
• Order dates and times.
• Payment dates and times.

We use these records to fulfil orders, confirm payments, manage subscriptions and renewals, provide support, process refunds and meet applicable record-keeping obligations.

Stripe handles payment information under its own privacy policy, available at:

https://stripe.com/privacy

Please do not submit card numbers, expiry dates or CVCs through profile forms, email or support messages.

Cookies and similar technologies may be used to support account access, maintain sessions, operate checkout and protect the service.

The technologies actually used on our website are:

Essential cookies and storage

• rz_token (RizeC, first-party cookie) — keeps you signed in to the Customer Portal and checkout. It cannot be read by page scripts and expires after 30 days or when you sign out.
• Shopping cart (RizeC, browser local storage) — remembers the cards in your cart on this device until you check out or clear it.
• Profile setup drafts (RizeC, browser local storage) — saves unpublished changes while you set up a card in the Customer Portal, until you publish or discard them.
• Checkout progress (RizeC, browser session storage) — keeps your checkout details and order number while you sign in and pay through Stripe. It is cleared when you close the browser tab.
• Stripe — when you continue to Stripe’s secure checkout page, Stripe uses its own cookies on its own domain to process the payment and prevent fraud, under its privacy policy.

Analytics technologies: None.

Advertising or tracking technologies: None.

Available preference controls: Because we use only the essential technologies listed above, our website does not display a cookie preference banner. You can view and delete cookies and site data through your browser settings.

You can also manage cookies through your browser. Blocking essential technologies may affect sign-in, checkout or other functionality.

Where consent is required for a particular technology, we will obtain it before using that technology.

We disclose information where necessary for the purposes described in this Policy, including to:

• Personnel and authorised contractors carrying out profile creation, support or administration.
• Payment processors.
• Hosting, database, authentication, storage and email service providers.
• Delivery providers.
• Professional advisers where needed for our business or legal obligations.
• Authorities or other recipients where disclosure is required or permitted by applicable law.
• A recipient you have specifically authorised.

Service providers should receive only the information reasonably needed for their role.

Public profile content is also disclosed to people who access the profile, as explained in Section 5.

Our principal service providers are:

We do not obtain permission to share information for unrelated third-party marketing merely because you accept our purchase terms or acknowledge this Policy.

Some providers may store or process information outside Australia.

Our current arrangements are:

Primary storage locations: 883 Collins Street, Docklands VIC3008

Countries where overseas recipients are likely to handle information: Australia

We will take the steps required by applicable law when arranging overseas handling of personal information.

Publishing a public profile also makes its content accessible to visitors internationally. This is separate from the locations where our providers store or process information.

Acknowledging this Policy does not waive any protections you have under applicable privacy law.

We take reasonable technical and organisational steps to protect personal information against loss, misuse and unauthorised access, alteration or disclosure.

Access to information should be limited to people and providers who need it to perform their role.

No online service can guarantee absolute security. Contact us promptly if you believe your account or information has been accessed without authority.

If a data incident occurs, we will assess and respond to it, including notifying affected people and authorities where required by law.

We keep information while needed to provide the requested services and satisfy applicable legal obligations.

RZProfile Expiry

The first year of RZProfile is included in the AU$79 card price and begins on your first successful tap.

If you cancel or do not renew, when the subscription expires we will stop public access to your profile and delete its content and associated personal information.

Other customer information that is no longer needed and is not legally required to be retained will also be deleted.

Once deletion is complete, the previous profile content cannot be restored. Save anything you want to keep before expiry.

Legally Required Records

We may retain transaction, tax or other records where retention is required by law. Such records are retained only for the applicable period, with their use restricted accordingly.

Backups and Provider Copies

Deletion arrangements must account for backups and copies held by service providers.

Active-system deletion timeframe: 14 Days

Maximum retention of deleted information in backups: 14 Days

Treatment of backup copies pending deletion: Backup copies awaiting deletion are kept under restricted access and are accessible only to authorised personnel who need them for disaster recovery, security or system restoration. They are not used for marketing, analytics or routine customer service. If a backup is restored, we will reapply previously recorded deletion requests and subscription-expiry deletions before returning the restored data to normal operational use. Restoring a backup will not reactivate an expired profile or make previously deleted content publicly accessible again.

External Link Customers

Choosing External Link does not create a RZProfile subscription. We retain the information needed to fulfil your order and provide any agreed services, and delete information when it is no longer needed unless legal retention is required.

We cannot delete information held independently by the external website you select.

Contact our Privacy Officer if you want to:

• Request access to personal information we hold about you.
• Correct inaccurate or outdated information.
• Request removal of publicly displayed information.
• Request deletion of information.
• Ask about our handling of your information.

We may reasonably verify your identity before acting, using no more information than needed for that purpose.

We will respond within a reasonable period and meet any applicable statutory requirements.

If we cannot grant a request in full, we will explain the reason where legally permitted and explain how you can raise a complaint.

Requesting deletion of information needed to operate your profile or account may prevent the relevant service from continuing. We will explain the effect before acting where reasonably practicable.

A privacy correction request does not require you to purchase a new subscription.

Marketing subscriptions are separate from purchasing a card or accepting our Terms.

We will send marketing messages only with the consent required by law. Such messages will identify us and provide a way to unsubscribe.

You may unsubscribe using the message’s unsubscribe facility or by contacting us. We will action marketing opt-outs within the legally required timeframe.

Order confirmations, delivery updates, account verification codes, renewal reminders and necessary service notices are sent for the relevant operational purpose. A marketing opt-out does not itself cancel your order or subscription.

Profiles and cards may link to third-party websites, social platforms, booking systems or payment services.

Those services have their own privacy practices. Review their policies before providing information to them.

This Policy covers RizeC’s handling of information. It does not govern information another business collects directly through its own website or service.

If you submit another person’s information, you must have authority to provide it and, where relevant, permission for public display.

Do not submit sensitive personal information or information about children for publication unless necessary, appropriate and supported by the permissions required by law.

If you believe someone has published your information through RizeC without authority, contact us with the relevant profile link and details so we can investigate.

To make a complaint, contact our Privacy Officer using the details in Section 1. Describe what happened and the outcome you are seeking.

We will acknowledge the complaint, investigate and respond within a reasonable period. If more time is needed, we will explain the progress and next steps.

If you are dissatisfied with our response, you may contact the Office of the Australian Information Commissioner, where the matter falls within its jurisdiction, or another relevant authority.

OAIC information is available at:

https://www.oaic.gov.au/privacy/privacy-complaints

We may update this Policy to reflect changes to our services, information handling or legal requirements.

The updated version and its effective date will be published on our website. We will provide additional notice or obtain fresh consent where required.

A Policy update does not retrospectively authorise a use or disclosure that requires separate consent.

You may request a copy of this Policy by contacting us.