1. About this policy
This policy explains how Sloop IT Pty Ltd ACN 677 536 739 (Sloop, we, us) collects, uses, shares and protects personal information. We handle personal information in line with the Privacy Act 1988 (Cth) and the Australian Privacy Principles.
It applies to everyone who uses Sloop’s websites, the Sloop App, the merchant portal, customer accounts and the “Rent Now, powered by Sloop” checkout (together, the Platform). That includes:
- Customers: people who apply to rent, or rent, goods from a store that uses Sloop;
- Merchants: businesses that use Sloop to offer rentals, and their owners and staff;
- Visitors: anyone who visits our websites or contacts us.
When you rent through Sloop, the store you rent from (the Merchant) owns the goods and is your lessor. Sloop acts as the Merchant’s agent. The Merchant also handles some of your information and may have its own privacy policy.
2. What we collect
| Who | Information | When |
|---|---|---|
| Customers | Name, date of birth, residential and delivery addresses, email, mobile | When you create an account or apply |
| Customers | Identity document details and images, and a selfie or short video used to match your face to your document | Identity check, with your consent |
| Customers | Bank account information you choose to share: income, expenses, balances and transactions | Affordability check for rentals of 22 days or more, with your consent |
| Customers | Card brand, last four digits and expiry, and a payment token. Full card numbers are held by our payment providers, not by Sloop | Checkout |
| Customers | Rentals, payments, deposit holds, returns, damage reports, hardship requests and messages | During your rental |
| Merchants | Business name, ABN, addresses, store details, products and prices, bank details for payouts | Onboarding and use of the Sloop App |
| Merchants | Names, emails, phone numbers and roles of owners and staff, and identity details of the person who signs the Merchant Agreement | Onboarding |
| Everyone | Device, browser, IP address, approximate location, pages viewed and actions taken on the Platform | When you use the Platform |
| Everyone | Emails, chat messages, call recordings and complaints | When you contact us |
Sensitive information
The face-match information used in the identity check is biometric information, which the law treats as sensitive. We collect it only with your consent and use it only to verify your identity and prevent fraud. Our identity verification provider, Didit, does the match. [We do not keep the biometric template after the check is complete.]
We do not ask for other sensitive information, such as health, religion or ethnicity. If you tell us about your circumstances, for example in a hardship request, we use that only to respond to you.
How we collect it
Mostly from you. We also collect it from:
- the Merchant’s store, for example your order and delivery details from Shopify;
- our identity verification provider, Didit, and our fraud-check provider, IPQS, which checks your email address and mobile number;
- our bank-data provider, Fiskil, through Australia’s Consumer Data Right (open banking), from the bank accounts you choose to share;
- our payment providers;
- carriers, about delivery and return of the goods;
- the Merchant, for example when it confirms a return or reports damage;
- public registers, such as the ABN Lookup, for Merchants.
If you don’t give us your information
You can browse our websites and ask general questions without telling us who you are. To rent through Sloop, though, we need your identity and, for longer rentals, your bank account information. Without them we cannot assess your application.
3. How we use it
We use personal information to:
- verify identity and prevent fraud;
- decide whether to approve a rental application, including checking affordability for rentals of 22 days or more;
- prepare and sign Rental Agreements for Merchants, and keep a record of what was signed;
- take payments, place and release deposit holds and make refunds, as the Merchant’s agent;
- send messages about applications, rentals, payments, returns and overdue amounts;
- handle hardship requests, disputes and complaints;
- recover overdue amounts or unreturned goods for the Merchant;
- onboard and support Merchants, pay them out and bill our fees;
- keep the Platform secure, fix problems and improve our services;
- meet our legal obligations and respond to lawful requests.
We use information that has been de-identified, so that it no longer identifies anyone, to analyse how the Platform is used and to develop and train our decision engine and other models.
We send marketing only if you have agreed to receive it, and you can unsubscribe at any time.
4. Automated decisions
Sloop uses computer programs, including machine-learning models, to make or help make decisions that affect you. This section explains which ones and what information they use.
Decisions made by a computer program alone
| Decision | Personal information used |
|---|---|
| Whether your identity is verified | Name, date of birth, address, identity document details and images, face-match result, device and IP information |
| Whether to approve or decline your rental application | Identity check result, fraud check results, your rental and payment history with Sloop, and, for rentals of 22 days or more, income, expenses and transactions from the bank accounts you share |
| Whether a payment, account or rental is flagged as possible fraud | Email and mobile check results, account, device, IP, payment and rental activity |
| When a failed payment is retried and when reminders are sent | Payment history and messages you have sent us |
Approvals and declines happen in real time, with no person reviewing them first. To approve a rental of 22 days or more, the system checks that your total rental payments, across Sloop and other providers, are no more than 10% of your net position, worked out from your bank information.
Decisions a computer program helps with
| Decision | Who decides | Personal information used |
|---|---|---|
| Hardship options offered to you | The Merchant | Your request, rental and payment history |
| Issuing a default notice, or referring an overdue amount to a debt collector | The Merchant | Rental, payment and contact history |
| Fees for damage or loss | The Merchant | Return inspection results, rental and payment history |
What we never use
Rental prices are set by Merchants and are the same for every Customer renting the same goods for the same term at the same time. None of your personal information is used to set your price.
Asking about a decision
If you would like to know more about a decision, or think it was wrong, contact us using the details in section 10. A person will look at your request. If something in your information was wrong, you can ask us to correct it and to assess your application again.
6. Keeping it secure
We protect personal information with encryption in transit and at rest, access limited to staff and contractors who need it, multi-factor authentication, logging, and regular security testing. Our core decision engine and customer data are not accessible to external engineers without specific approval and confidentiality obligations.
No system is completely secure. If a data breach is likely to cause you serious harm, we will tell you and the Office of the Australian Information Commissioner (OAIC) as the Notifiable Data Breaches scheme requires.
7. How long we keep it
We keep personal information only as long as we need it for the purposes in section 3 or the law requires. Generally:
| Information | Kept for |
|---|---|
| Rental Agreements, payment records and price records | [7] years after the rental ends |
| Identity check results (not the biometric template) | [7] years after your last rental |
| Bank account information used for an affordability check | [2] years after the check |
| Declined applications | [2] years after the decision |
| Merchant records | [7] years after the Merchant Agreement ends |
| Messages and call recordings | [2] years |
After that we delete or de-identify it.
9. Your rights
You can ask to see the personal information we hold about you, or ask us to correct it if it is wrong, out of date or incomplete. We will respond within 30 days. We don’t charge for this. If we refuse, we will tell you why and how to complain.
You can withdraw a consent, such as to marketing or to bank data access, at any time. Withdrawing a consent you gave for an application already decided does not change that decision.
Sloop’s services are not intended for anyone under 18.
10. Contact us and complaints
To ask a question, make a request or complain about how we have handled your personal information, contact our Privacy Officer:
- Email: [privacy@sloop-it.com]
- Post: Privacy Officer, Sloop IT Pty Ltd, PO Box 3026, Allambie Heights NSW 2100
We will acknowledge your complaint within 2 business days and aim to resolve it within 30 days.
If you are not satisfied with our response, you can complain to the OAIC at oaic.gov.au or on 1300 363 992.
11. Changes to this policy
We may update this policy. The current version is always at [sloop-it.com/privacy], with the date it was last updated. If we make a significant change, we will tell Customers and Merchants with an account by email.