BydfareBYDFARE PTY LTD
Privacy Policy
Version 1.0 | 2026 | Australia
Bydfare Pty Ltd is committed to protecting your privacy and handling your personal information in accordance with the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs). This Privacy Policy explains what information we collect, why we collect it, how we use and disclose it, and your rights in relation to it.
Part A — About This Policy
1. Who We Are
Bydfare Pty Ltd (ACN to be registered) ('Bydfare', 'we', 'us', 'our') operates the Bydfare ride-hailing platform, including the Bydfare iOS and Android applications and associated websites and services (collectively, the 'Platform').
Bydfare is the entity responsible for the collection, use, disclosure and storage of personal information in connection with the Platform.
2. Scope of This Policy
This Privacy Policy applies to all personal information collected by Bydfare in connection with the Platform, including information collected from:
- Passengers using the Bydfare App to book rides.
- Drivers registering to offer rideshare services through the Platform.
- Visitors to the Bydfare website.
- Any person who contacts Bydfare by email, phone or through the App.
This Policy does not apply to third-party websites, applications or services that may be linked from the Platform. We encourage you to review the privacy policies of any third-party services you use.
3. Changes to This Policy
We may update this Privacy Policy from time to time. Where we make a material change, we will notify users via the App and by email at least 30 days before the change takes effect. The current version of this Policy is always available in the App under Settings > Legal > Privacy Policy and on our website at www.bydfare.com/privacy.
Continued use of the Platform after the effective date of an updated Policy constitutes acceptance of the updated terms.
Part B — What Personal Information We Collect
4. Information Collected from Passengers
When you register and use the Platform as a Passenger, we collect:
| Category | Information Collected |
|---|---|
| Identity | Full name, date of birth (for age verification), profile photograph (optional) |
| Contact | Email address, mobile phone number |
| Account | Account credentials (password stored as encrypted hash — never in plain text), account creation date, device identifiers |
| Payment | Credit/debit card details (tokenised and held by Stripe — Bydfare does not store raw card numbers), billing address, payment history |
| Location | GPS coordinates at time of ride request (pickup location), destination address, route data during active rides |
| Usage | App usage logs, ride history, search history, in-app chat logs (retained 90 days), device type and operating system, IP address |
| Ratings | Ratings given to Drivers, written reviews, ratings received from Drivers |
| Communications | Support enquiries, complaint records, appeals correspondence |
5. Information Collected from Drivers
When you register and use the Platform as a Driver, we collect all information listed in Clause 4 above, plus:
| Category | Information Collected |
|---|---|
| Identity Documents | Government-issued photo ID (passport or driver's licence), biometric face-match data (for identity verification — processed by third-party KYC provider) |
| Licence & Accreditation | Rideshare accreditation number and issuing authority (NSW/VIC/QLD), accreditation expiry date, accreditation documents |
| Vehicle | Vehicle registration number, make, model, year, colour, vehicle photos (front, rear, interior), rideshare vehicle authorisation documents |
| Insurance | Rideshare insurance certificate of currency, policy number, insurer name, expiry date |
| Financial | Bank account details (BSB and account number — held by Stripe Connect for AUD payout purposes), ABN (if applicable), total earnings data |
| Background Check | Criminal history check results (pass/fail only — full records held by background check provider, not Bydfare), driving record check results |
| Location | Continuous GPS location data while Driver is active on the Platform (online status enabled) |
| Performance | Trip completion rate, cancellation rate, Driver rating, response time to ride requests |
6. Sensitive Information
Certain information we collect is classified as 'sensitive information' under the Privacy Act, which attracts higher protection. Sensitive information we may collect includes:
- Biometric data: facial recognition/face-match data collected during Driver identity verification. This data is processed by our third-party KYC provider (Onfido or Veriff) and is not stored by Bydfare beyond what is required for verification.
- Criminal history: background check results (pass/fail only) collected from Drivers. Full criminal records are held by our background check provider and are not retained by Bydfare.
We only collect sensitive information where it is reasonably necessary for our functions, with your consent, or where required or authorised by law. We do not collect sensitive information about race, religion, health, sexual orientation or political opinions unless directly relevant to a specific function and with explicit consent.
7. Information We Do Not Collect
Bydfare does not collect or store:
- Raw credit or debit card numbers (all card data is tokenised by Stripe).
- Full criminal history records (pass/fail background check result only).
- Audio recordings of trips or calls (in-app chat is text only).
- Health information (except where voluntarily disclosed in a support enquiry).
Part C — How We Collect Personal Information
8. Collection Methods
We collect personal information through the following methods:
| Method | Examples |
|---|---|
| Directly from you | Registration forms, profile and document uploads, in-app chat, support enquiries, ratings and reviews |
| Automatically from your device | GPS location data, device identifiers, IP address, app usage logs, crash reports, session data |
| From third parties | Identity verification results (Onfido/Veriff), background check results (background check provider), payment verification (Stripe), map and routing data (Google Maps Platform) |
| From other users | Driver ratings of Passengers, Passenger ratings of Drivers, incident reports |
| From public sources | ABN lookup (ATO), rideshare accreditation verification (state transport authorities) |
9. Location Data
Location data is central to the Platform's operation. We collect location data as follows:
- Passengers: GPS location is collected when a Ride Request is submitted (pickup location) and throughout the active ride for route tracking purposes. Location access is requested at app launch and can be managed in device settings.
- Drivers: Continuous GPS location is collected while the Driver has online status enabled in the Driver App. This data is used to match Drivers with nearby Passenger ride requests and to display Driver location to matched Passengers.
- Location data is not collected when the App is closed or when the Driver has offline status.
Note: You may disable location permissions for the App in your device settings, but doing so will prevent the core functions of the Platform from operating (Passengers cannot submit ride requests without location access; Drivers cannot receive ride requests without location enabled).
10. Cookies and Tracking
The Bydfare website uses cookies and similar tracking technologies to:
- Remember your preferences and login status.
- Analyse website traffic and usage patterns (via analytics tools).
- Detect and prevent fraud and abuse.
You may manage cookie preferences through your browser settings. Disabling all cookies may affect website functionality. The Bydfare App does not use browser cookies but does use device identifiers and analytics SDKs (such as Firebase Analytics) for app performance monitoring.
Part D — Why We Collect and Use Personal Information
11. Primary Purposes
We collect and use personal information for the following primary purposes:
| Purpose | Information Used | Legal Basis |
|---|---|---|
| Providing the Platform — matching Drivers and Passengers, processing rides and payments | Identity, contact, location, payment, vehicle, accreditation | Contract performance; legal obligation (rideshare regulation) |
| Driver onboarding and verification — licence, vehicle, insurance and background checks | Identity documents, accreditation, vehicle, insurance, background check results | Legal obligation (state rideshare law); legitimate interest (safety) |
| Payment processing — charging Passengers and paying Drivers | Identity, contact, payment and bank account details (Drivers), transaction records | Contract performance |
| Safety and security — SOS monitoring, incident response, fraud prevention | Location, identity, usage logs, chat logs, ratings | Legitimate interest; legal obligation |
| Platform improvement — app performance, bug fixes, feature development | Usage logs, device data, crash reports | Legitimate interest |
| Regulatory compliance — state rideshare authority obligations, tax reporting | Identity, financial records, transaction data | Legal obligation |
| Customer support — responding to enquiries and complaints | Identity, contact, account data, trip history | Contract performance; legitimate interest |
| Ratings and reviews — Driver and Passenger quality management | Ratings, reviews, performance data | Legitimate interest |
12. Marketing Communications
With your consent (which we collect at registration or via the App preferences), we may send you:
- Platform updates and new feature announcements.
- Promotional offers and discounts on rides.
- Driver incentive campaigns and earning opportunity alerts.
You may opt out of marketing communications at any time by:
- Tapping 'Unsubscribe' in any marketing email.
- Updating your notification preferences in the App under Settings > Notifications.
- Emailing privacy@bydfare.com with 'Unsubscribe' in the subject line.
Opting out of marketing will not affect transactional communications (e.g. ride receipts, payment confirmations, account security alerts, legal notices). These are sent regardless of marketing preferences as they are necessary for the operation of the Platform and your account.
Spam Act: All marketing communications sent by Bydfare comply with the Spam Act 2003 (Cth). We will not send unsolicited commercial electronic messages and will always provide a functional unsubscribe mechanism.
Part E — Disclosure of Personal Information
13. Third-Party Service Providers
We disclose personal information to the following categories of third-party service providers who assist us in operating the Platform. All service providers are bound by data processing agreements that require them to protect personal information and use it only for the purposes for which it was disclosed:
| Service Provider | Purpose | Data Disclosed |
|---|---|---|
| Stripe (USA) | Payment processing (Passenger charges and Driver payouts via Stripe Connect) | Payment card details (tokenised), bank account details, identity (for Stripe KYC), transaction records |
| Onfido or Veriff (UK/USA) | KYC identity verification — document check and biometric face-match | Government ID documents, selfie/biometric data, verification result |
| Background check provider (Australia) | Driver criminal history and driving record verification | Full name, date of birth, licence number, consent form |
| Google Maps Platform (USA) | Mapping, routing, location search and ETA calculation | Anonymised location queries, route data |
| Amazon Web Services — AWS (USA and Australia) | Cloud infrastructure — app backend, database, file storage | All platform data stored on AWS servers in Australia (ap-southeast-2) and potentially US regions for redundancy |
| Firebase / Google Cloud (USA) | Push notifications, app analytics, crash reporting | Device identifiers, usage data, crash logs |
| Email service provider | Transactional and marketing emails | Email address, name, communication preferences |
International transfers: Several of our service providers are located in the United States and the United Kingdom. By using the Platform, you consent to your personal information being transferred to, stored in and processed in these countries. We take reasonable steps to ensure overseas recipients handle your information in a manner consistent with the APPs.
14. Disclosure to Regulatory Authorities
We may disclose personal information to government or regulatory authorities without your consent where required or authorised by law, including:
- State transport authorities (Transport for NSW, CPVV, QLD Department of Transport): Driver accreditation verification and compliance reporting.
- Australian Taxation Office (ATO): Income and transaction reporting where required by tax law.
- Australian Securities and Investments Commission (ASIC): Where required in connection with regulation or Platform compliance.
- Law enforcement agencies: In response to a valid court order, subpoena, search warrant or other lawful process.
- Office of the Australian Information Commissioner (OAIC): In the event of an eligible data breach or privacy complaint investigation.
Note: Where legally permitted, we will attempt to notify you before disclosing your information to law enforcement.
15. Disclosure to Other Users
To facilitate the Platform's core functions, certain information is visible to other users:
| Information | Visible To |
|---|---|
| Driver's first name, profile photo, vehicle make/model/colour, licence plate, star rating | Passenger who has accepted the Driver's bid |
| Driver's 'Founding Driver' badge | All Passengers during the bidding process |
| Passenger's first name and star rating | Drivers viewing a ride request bid |
| Live GPS location during active ride | Matched Passenger (Driver location); emergency contact via Share My Ride link |
| Written reviews | Publicly visible on Driver/Passenger profiles within the App |
We do not disclose Driver or Passenger phone numbers, email addresses, home addresses, full names, payment details or financial information to other users.
16. Business Transfers
If Bydfare is involved in a merger, acquisition, asset sale or corporate restructure, personal information held by Bydfare may be transferred to the acquiring entity. We will notify affected users via the App and email before any such transfer occurs and will ensure the acquiring entity is bound by obligations consistent with this Privacy Policy.
Part F — Data Retention
17. Retention Periods
We retain personal information for as long as necessary to fulfil the purposes for which it was collected and to comply with our legal obligations. The following retention periods apply:
| Data Category | Retention Period | Legal Basis for Retention |
|---|---|---|
| KYC identity documents and verification records | 7 years from end of customer relationship | Rideshare regulatory compliance; fraud prevention |
| Driver accreditation and vehicle records | Duration of Driver account + 5 years | State rideshare regulations |
| Trip and ride history | 7 years from trip date | ATO record-keeping; rideshare regulatory compliance |
| Financial records (payments, earnings, invoices) | 7 years from financial year end | Corporations Act 2001; ATO |
| Background check results (pass/fail) | Duration of Driver account + 2 years | Legitimate interest (safety) |
| In-app chat logs | 90 days from chat date | Safety and dispute resolution |
| Marketing preferences | Until account closure or opt-out | Spam Act compliance |
| Account profile data (name, photo, contact) | Account closure + 30 days (then deleted on request) | Contract performance |
| Usage and analytics data (anonymised) | Up to 3 years (anonymised — cannot identify individuals) | Legitimate interest |
| Security and fraud logs | 2 years from log date | Legitimate interest (security) |
Note: Certain retention periods are mandatory under Australian law and cannot be shortened regardless of a deletion request. See Clause 22 for your deletion rights.
Part G — Security of Personal Information
18. Security Measures
We take reasonable steps to protect personal information from misuse, interference, loss, and unauthorised access, modification or disclosure. Our security measures include:
| Measure | Description |
|---|---|
| Encryption in transit | All data transmitted between the App and our servers is encrypted using TLS 1.2 or higher |
| Encryption at rest | All personal data stored on AWS servers is encrypted at rest using AES-256 |
| Access controls | Role-based access controls — only staff with a legitimate business need can access personal data |
| Password security | Passwords stored as salted cryptographic hashes — never in plain text |
| Penetration testing | Platform undergoes independent security penetration testing prior to launch and annually thereafter |
| Staff training | All staff with access to personal data receive annual privacy and security training |
| Incident response | We maintain a documented data breach response plan and will notify affected users and the OAIC as required by the Notifiable Data Breaches (NDB) scheme |
No security system is impenetrable. While we implement industry-standard security measures, we cannot guarantee the absolute security of personal information transmitted via the internet or stored on our systems.
19. Notifiable Data Breaches
Bydfare is subject to the Notifiable Data Breaches (NDB) scheme under Part IIIC of the Privacy Act 1988 (Cth). If we reasonably believe that an eligible data breach has occurred — being an unauthorised access to or disclosure of personal information that is likely to result in serious harm to any of the affected individuals — we will:
- Notify the Office of the Australian Information Commissioner (OAIC) as soon as practicable.
- Notify all affected individuals directly (via email and in-app notification) as soon as practicable.
- Provide details of the breach, the information involved, and the steps individuals should take to protect themselves.
- Take immediate steps to contain the breach and prevent further unauthorised access.
Part H — Your Privacy Rights
20. APP 12 — Right of Access
You have the right to request access to the personal information Bydfare holds about you. To make an access request:
- Email privacy@bydfare.com with the subject 'Privacy Access Request'.
- Include your full name, registered email address and a description of the information you are seeking.
- We will respond within 30 days of receipt of your request.
- We may ask you to verify your identity before providing access.
We will provide access to your personal information free of charge in most cases. We may charge a reasonable fee for requests that are complex or require significant processing time — we will advise you of any fee before proceeding.
We may decline to provide access where required or permitted by law (e.g. where disclosure would reveal information about another individual, or where access would compromise an regulatory compliance investigation). We will give you written reasons for any refusal.
21. APP 13 — Right of Correction
If you believe that personal information Bydfare holds about you is inaccurate, out-of-date, incomplete, irrelevant or misleading, you have the right to request correction. You may:
- Update your profile information directly in the App under Settings > Profile.
- Email privacy@bydfare.com with the subject 'Privacy Correction Request' for information you cannot update directly.
We will correct inaccurate information within 30 days of receiving a correction request. If we disagree that the information is inaccurate, we will notify you in writing and you may request that a statement of your claim be associated with the relevant record.
22. Right to Request Deletion
You may request deletion of certain personal information Bydfare holds about you. We will process deletion requests as follows:
| Data Category | Deletion Outcome | Reason if Not Deleted |
|---|---|---|
| Profile data (name, photo, contact details) | Deleted within 30 days of request | N/A — deletion granted |
| Payment method (card tokens) | Deleted / removed from Stripe within 30 days | N/A — deletion granted |
| Marketing preferences | Deleted (you are unsubscribed immediately) | N/A — deletion granted |
| Trip and ride history | Retained — cannot be deleted | Legal obligation: ATO and rideshare regulatory retention requirements |
| KYC identity documents | Retained — cannot be deleted | Legal obligation: rideshare regulatory and record-keeping requirements |
| Driver accreditation records | Retained — cannot be deleted | Legal obligation: state rideshare regulations |
| Background check results | Retained — cannot be deleted | Legitimate interest: safety records |
To request deletion, email privacy@bydfare.com with the subject 'Privacy Deletion Request'. We will respond within 30 days confirming what has been deleted and what has been retained (and why).
Note: Closing your Bydfare account does not automatically delete your personal information. You must submit a separate deletion request if you wish to have deletable data removed. Account closure and data deletion are processed separately.
23. Right to Opt Out of Marketing
You may opt out of receiving marketing communications from Bydfare at any time using any of the following methods:
- Click 'Unsubscribe' in any marketing email.
- Update your preferences in the App under Settings > Notifications > Marketing.
- Email privacy@bydfare.com with 'Unsubscribe' in the subject line.
Opt-out requests are processed within 5 business days. After opting out, you will continue to receive transactional communications necessary for the operation of your account.
24. Right to Lodge a Complaint
If you believe Bydfare has handled your personal information in a way that breaches the Privacy Act or the APPs, you have the right to lodge a complaint. We ask that you first raise your concern with us directly:
- Email privacy@bydfare.com with the subject 'Privacy Complaint'.
- Describe the nature of your complaint and the outcome you are seeking.
- We will acknowledge your complaint within 5 business days and provide a substantive response within 30 days.
- If you are not satisfied with our response, you may escalate your complaint to the Office of the Australian Information Commissioner (OAIC) at www.oaic.gov.au or by calling 1300 363 992.
OAIC: The OAIC can investigate privacy complaints and make determinations, including ordering Bydfare to take corrective action or pay compensation in certain circumstances.
Part I — Children's Privacy
25. Minimum Age
The Platform is not directed at children under the age of 13. We do not knowingly collect personal information from children under 13. Users between 13 and 18 years of age may only use the Platform as Passengers when accompanied by an adult, and are subject to the same privacy protections as adult users.
If we become aware that we have inadvertently collected personal information from a child under 13 without parental consent, we will take prompt steps to delete that information. If you believe we have collected information from a child under 13, please contact us at privacy@bydfare.com.
Part J — Cross-Border Disclosure
26. International Data Transfers
As described in Clause 13, some of our service providers are located outside Australia — principally in the United States and the United Kingdom. By using the Platform, you consent to the transfer of your personal information to these countries.
We take the following steps to ensure overseas recipients handle personal information in a manner consistent with the APPs:
- We enter into data processing agreements with all overseas service providers that impose privacy obligations equivalent to the APPs.
- We select service providers that operate under recognised privacy frameworks (e.g. US providers subject to SOC 2 Type II certification; UK providers subject to UK GDPR).
- We conduct due diligence on overseas providers' privacy and security practices before engagement.
APP 8: Under APP 8, before disclosing personal information to an overseas recipient, Bydfare must take reasonable steps to ensure the recipient does not breach the APPs in relation to that information. Our data processing agreements and provider selection process are designed to satisfy this obligation.
Part K — Contact Us
27. Privacy Officer
Bydfare has appointed a Privacy Officer responsible for ensuring compliance with the Privacy Act and overseeing privacy practices across the Platform. If you have any questions, concerns or requests relating to this Privacy Policy or the handling of your personal information, please contact our Privacy Officer:
Appendix — Australian Privacy Principles Compliance Summary
The following table summarises how this Privacy Policy addresses each of the 13 Australian Privacy Principles:
| APP | How Bydfare Complies |
|---|---|
| APP 1 — Open and transparent management | This Privacy Policy is publicly available on the Bydfare website and in the App. It clearly describes our information handling practices. |
| APP 2 — Anonymity and pseudonymity | Anonymity is not practicable for Platform users due to safety, payment and regulatory requirements. We use anonymised/aggregated data for analytics where possible. |
| APP 3 — Collection of solicited personal information | We collect only information reasonably necessary for Platform functions (Clauses 4–5). Collection methods are described in Clause 8. |
| APP 4 — Dealing with unsolicited personal information | Unsolicited personal information that we do not need is destroyed or de-identified as soon as practicable. |
| APP 5 — Notification of collection | Users are notified of the collection of personal information via this Policy at registration. In-context notifications are provided where significant new collection occurs. |
| APP 6 — Use or disclosure for primary purpose | We use and disclose information only for the purposes described in this Policy (Clauses 11–13) or with consent. |
| APP 7 — Direct marketing | Marketing is opt-in at registration and users may opt out at any time (Clause 12 and Clause 23). |
| APP 8 — Cross-border disclosure | Overseas recipients are bound by data processing agreements. Users consent to cross-border transfers at registration (Clause 26). |
| APP 9 — Adoption of government identifiers | We do not adopt or use government identifiers (e.g. TFN, Medicare number) as our own identifiers. |
| APP 10 — Quality of personal information | We take reasonable steps to ensure information is accurate, up-to-date and complete. Users can correct their information (Clause 21). |
| APP 11 — Security of personal information | Security measures are described in Clause 18. NDB scheme compliance is described in Clause 19. |
| APP 12 — Access to personal information | Access request process described in Clause 20. |
| APP 13 — Correction of personal information | Correction request process described in Clause 21. |
© 2026 Bydfare Pty Ltd. All rights reserved. This Privacy Policy was prepared to comply with the Privacy Act 1988 (Cth) and Australian Privacy Principles.