Privacy Policy

1. Policy Purpose

Our Privacy Policy sets out how we look after personal information. It explains the kinds of personal information that we collect, and why we collect it. It also describes how we hold, use, and disclose personal information.

This Privacy Policy outlines the commitment of Transmax Pty Ltd to protect personal information.

2. Policy Scope

This Privacy Policy applies to our business, our websites and our software platforms. It applies in all countries in which we do business.

3. Policy Statement

We comply with all relevant privacy laws, including the requirements applicable to us under the Australian Privacy Act 1988 (Privacy Act), relevant State laws and the applicable privacy laws of other locations in which we operate such as the California Consumer Privacy Act (CCPA) as amended by the California Privacy Rights Act (CPRA).

In this Privacy Policy, “we” and “us” refers to Transmax Pty Ltd and “you” refers to any individual about whom we collect personal information.

By using our website (“our website”) or by providing personal information to us including through a registration process for our software platforms (“our platforms”), you agree to the terms of our Privacy Policy. If you do not agree to our Privacy Policy, please do not use our website or our platforms.

When you agree to the terms of our Privacy Policy, you consent to the collection, use, storage and disclosure of your personal information as described in our Privacy Policy.

If you do not wish to provide personal information to us, then you do not have to do so. However, this may affect your use of our website and platforms and our ability to provide services to you.

For many of our customers, including State government departments, councils, and toll roads, we operate our platform as a data processor or service provider. In these arrangements, our customer is the data controller who determines the purposes and means of the data processing.

Your personal information may be collected, processed and stored on our platforms by our customer. In that case our role is strictly to process this information on their behalf and at their direction. Therefore, the collection, use, and disclosure of your personal information are governed by the privacy policies and practices of that specific client. We recommend reviewing their privacy policy to understand how your information is handled.

3.1 The personal information that we collect

We collect personal information in the provision of our products and services, including the marketing of our products and services. We collect personal information so that we can provide products, services and information to our customers and potential customers.

We also collect information where we are required to do so by law.

We do not knowingly collect information from or direct any of our content specifically to children under the age of 18. If you are under 18 years of age, please do not provide your personal information to us.

The types of personal information we collect depends on the circumstances in which the information is collected. The types of personal information we collect may include:

Your name and contact details, including email, address, mailing address and mobile number
Identification details, such as date of birth
Who you work for and your position
Your profession or occupation
Information regarding your use of or interest in our products and services
How you make payments to us in any transaction, such as payment details and bank account details
Your transaction history with us
Records of communications and dealings with you, such as emails, SMS, telephone, and in-person communications
Social media handles and other social media profile information that you make available to us or to the public
Information regarding your use of our website and our platforms
Information we may collect as part of a survey, customer feedback request or a competition
Information that you provide to us for verification purposes or as evidence in respect of a complaint
Recruitment information, such as your qualifications, work history, criminal history or right to work, if you apply for a job with us
Other information that you provide to us during the course of business

Our platforms also have data feeds provided by third parties, such as police, emergency services, first responders, towing companies and event organisers. Generally, these data feeds do not provide personal information but may do so in certain situations. For example, a data feed could provide the name and contact details for a tow truck operator or emergency services supervisor.

If you are a Transmax employee, we will also collect personal information that is necessary for us to manage your employment and meet our obligations in accordance with laws and agreed employment contracts. For our employees, we maintain employee records that may contain personal information including safety information (e.g. location information, emergency contacts) and travel and right to work information (e.g. copies of passports and visas) and information to pay wages.

We collect information about people who are our suppliers and business partners, or who are employed by our suppliers and business partners. The information we collect is that which we need to do business with that party.

When you communicate with us, we may collect additional information including how best to manage communications with you and your preferred language.

3.2 Online Services

When using our online services, such as our platforms and our website, our computer systems may automatically collect information about you and how you use such services.

We may collect information such as:

User names and passwords that you create to access our platforms
Which services you use and how you use them
Which pages you visit on our website
Device information, such as the model and ID of the device you use, operating system, telephone number and mobile phone network
Server log information, such as details of how you used our platforms, IP address, hardware settings, browser type, browser language, the date and time of your use and referral URL
Information that may uniquely identify your browser or your account
Location information.

If you visit our website and our platforms, we may collect information on your use of the website or platform, such as pages visited, links clicked, text entered, and mouse or cursor movements, as well as information more commonly collected such as the referring URL, browser, device, operating system, and Internet Protocol (“IP”) address. We may use publicly available sources to approximate your geographic region and Internet Service Provider based on your IP address.

We may use your IP address or domain name for internal traffic monitoring and capacity management purposes or to otherwise administer our website and our platforms. No personal information is obtained, rather the patterns and usage of our website and our platforms may be tracked for the purposes of providing improved service and content based on aggregate or statistical review of user traffic patterns.

We may use various technologies to collect and store information, including cookies, pixel tags, local storage, such as browser web storage or application data caches, databases, and server logs. These technologies help us track your usage and remember your preferences.

For example, cookies are small files that store information on your computer browser, mobile phone or other device. Cookies enable the entity that placed the cookie to recognise you across different websites, services, devices and browsing sessions. If you choose, you can set your browser to reject cookies or you can manually delete individual cookies or all of the cookies on your computer by following your browser’s help file directions. Turning off cookies may also disable functions of many websites you visit. You can disable cookies but our platforms may not work as intended if you do so.

Analytics cookies and tracking tags may also be used to collect information about your use of our website (visitation data) that allow our third-party website analytics services (e.g. Google Analytics) to help us analyse trends and understand our website users’ behaviour patterns in the aggregate.

We may use tracking software to review and improve your experience of our website and our platforms. In particular, we may use Google Analytics Advertising products: Remarketing with Google Analytics and Google Analytics Demographics and Interest Reporting. Google Analytics collects data about our traffic via Google Advertising cookies and anonymous identifiers.

Information collected by the Google Analytics cookie or tracking tag is transmitted to, and stored by, Google in accordance with its privacy practices. To opt out of Google Analytics, please visit: https://tools.google.com/dlpage/gaoptout.

For further information about Google’s targeted advertising systems, please visit: https://policies.google.com/technologies/partner-sites.

Our website and our platforms may contain links to other websites. We are not responsible for the privacy practices or the content of other websites. The privacy practices applicable to other websites may differ substantially from ours. Please read the privacy policy of any other websites you visit before using them.

We do not accept responsibility for the content or practices of websites operated by third parties that are linked to from or that link to our websites.

We do not alter our website’s data collection and use practices when we see a Do Not Track signal from your browser.

3.3 Single Sign On (SSO)

Our platforms offer a Single Sign-On (SSO) feature which allows you to authenticate your identity using credentials provided by a third-party identity provider (e.g., your employer's or government agency's system).

3.3.1 What is SSO?

SSO is an authentication method that enables you to securely log in to our platform using your existing credentials from your organisation, without the need to create a separate username and password for our platform. This simplifies the login process and enhances security.

3.3.2 How SSO works and what data is shared

When you use SSO to log in, you are authorising our platform to securely communicate with your organisation’s identity provider. This communication is limited to the exchange of essential information necessary to verify your identity and grant you access to the platform. The information we receive may include your name, email address, and employee/user ID. We only collect the minimum amount of personal information required for the purpose of authentication and providing you with access to the platform.

3.3.3 Data Controller vs. Data Processor

When you use SSO, the personal information used to authenticate your identity is controlled by your organisation (our customer). Your organisation, as the data controller, is responsible for the privacy and security of your SSO credentials and the management of your account within their system. We act as a data processor on behalf of your organisation. We do not control the personal information exchanged during the SSO process and do not use it for any purpose other than to authenticate you and provide access to the platform as directed by your organisation.

Your use of the SSO feature is governed by your organisation's own privacy policies and terms of service. We recommend reviewing those policies to understand how your information is handled by your organisation in connection with SSO and our platforms.

3.4 Activity Logs

To ensure the security, integrity, and operational effectiveness of our platforms, we generate and store automated activity logs. These logs record technical and usage information, such as the date and time of your login, the features you accessed, the IP address from which you connected, and other actions you performed within the platform. The purpose of these logs is to facilitate security monitoring, system maintenance, and to provide audit trails as required by our customers for their own compliance obligations. As these logs are created for security and operational purposes, access to them is restricted to authorised personnel.

3.5 Sensitive information

Sensitive information includes information about your health, racial or ethnic origin, political opinions, religious beliefs and criminal record.

Usually, we don’t collect sensitive information. If we need to do so, we will only collect sensitive information about you with your consent and where it is reasonably necessary for us to do so, or if we are otherwise allowed or required by law to collect that information. If you provide us with sensitive information, we will consider that you have consented to us collecting it.

3.6 How we collect personal information

We collect your personal information directly from you unless it is unreasonable or impracticable to do so.

When collecting personal information from you, it is collected in several ways, including:

directly from you, for example, when you voluntarily give it to us, when you enter your personal details on our website or our platforms, when you register to use our platforms, or when you use or enquire about, acquire or order our products or services
when you use our website or our platforms
during conversations you have with our personnel
when you visit our offices or attend one of our events (such as a training event)
when you attend a conference and the conference organisers provide us with a registered attendee list
when you ask to be added to one of our subscription or mailing lists
when you contact our support function or submit a query to us
when you respond to a survey that we run or fill in forms on our website
when you voluntarily provide us with feedback and customer information collected in the process of conducting customer surveys for market research purposes
from third parties who disclose information to us, such as your employer
from online sources, such as LinkedIn
when you apply for a job with us

If you choose not to provide us with information, we may be unable to supply products or services to you, either to the same standard or at all. We may also not be able to provide you with information about our services.

Where we collect personal information from you, we will generally do so directly ourselves. However, in some cases we may collect personal information from a third party, such as through your representatives, your employer, contractors or suppliers who provide services to us, or third parties who refer you to us because they think you may be interested in our products or services. We will take reasonable steps to notify you of any information we collect about you.

If you provide us with personal information about someone else, you must only do so if that person has consented to you doing so and to us collecting, holding, using and disclosing their information in accordance with our Privacy Policy.

3.7 Use of personal information

We may use and disclose your personal information for the following purposes:

to provide our products and services to you
to implement transactions that you participate in via our website and our platforms
to identify you and to assist you to obtain and use our products and services
to recommend or consider your eligibility for our products and services
to administer and manage our products and services including the completion of transactions and delivery of products and services acquired
to monitor use of our platforms, website, products and services
to customise our website according to user interests
to invite you to events and training sessions
to respond to inquiries from you and to answer your queries and requests
to provide you with customer support
to provide you with information about our platforms and how to use our platforms
to monitor and detect possible fraud or breaches of contract
to ensure that our website and our platforms are used in a legal and responsible manner
to ensure that you and your account with us complies with all relevant laws and your contractual obligations to us
to process payments
to improve, maintain and upgrade our products and services
to carry our planning and forecasting activities
to conduct research
to carry out education and training programs for our staff
to report to our shareholder
for security purposes, including to perform functions that we believe are necessary to protect the security and proper functioning of our website and our platforms
to comply with our legal obligations, assist in the enforcement of laws, resolve disputes, and enforce agreements
to manage and resolve any legal or commercial complaints or issues and comply with our legal and regulatory obligations
to investigate or pursue a legal claim
to administer surveys, contests, or other promotional activities or events sponsored or managed by us or our business partners
to make special offers related to our products and services
to gain an understanding of your needs to provide you with better and more personalised products and services tailored to your requirements
to carry out planning and forecasting activities and other internal business processes
to promote and market our products
to consider you for career opportunities with us and inviting you to participate in recruitment activities and events, if you apply for a role with us
to maintain and update our records
as otherwise required or authorised by law
as authorised by you.

We will not sell your personal information to advertisers or other third parties.

We may de-identify information about an individual so that the information can no longer be related to that individual. We may then use and disclose that de-identified information in the course of our business.

We may also aggregate information on the use of our website and platforms in such a way that the information can no longer be related to the specific individuals. We may then use and disclose such aggregated information in the course of our business (including in any promotional or marketing material or for reports that provide insights).

3.8 Direct Marketing and unsubscribe

We may use and disclose your personal information for marketing purposes or to conduct events.

We will only provide you with direct marketing materials where you would reasonably expect us to, or if you consent to receive direct marketing materials. If we have obtained your personal information from a third party, we will seek your consent to provide you with direct marketing materials.

Direct marketing communications may include promotional material about us, our platforms and the services we provide, and topical newsworthy issues. We may also contact you about other services or special offers we think may be of interest to you. This information may be sent to you by email, SMS or by other means.

You can opt-out of receiving marketing communications from us at any time by following the ‘unsubscribe’ link in the communication or contacting us at marketing@transmax.com.au and request to be unsubscribed.

If you unsubscribe from marketing communications, this will not stop you receiving service-related communications from us if we are otherwise legally entitled to send them to you, such as administration alerts about your account.

3.9 Disclosure of personal information

We may disclose your personal information to:

our customers, including State government departments, councils, and toll road operators
your employer if your employer is a customer or supplier
our shareholder
government agencies, regulators and law enforcement bodies
insurance companies
a court or tribunal
anyone who acquires or considers acquiring our assets or business (or part of it)
a person who serves us with a subpoena or other legal document requiring us by law to disclose information or documents about you to them
your representatives, advisors and others you have authorised to interact with us on your behalf (such as recruitment agencies)
our consultants, contractors, subcontractors, suppliers, service providers and professional advisors, who assist us in operating our business, for example to payment service providers, customer analytics providers, mail house operators, banks, investigators, and organisations that we engage to deal with you on our behalf.

You can choose to connect your account on our platforms with third-party services. By doing so, you are enabling us and those third parties to exchange information about you and data in your account. All third parties’ use of your information will be governed by their own privacy policies and terms of service.

If you are a user of our platform, your employer and your account administrator may have the ability to access and control your account. Please refer to your organisation’s internal policies if you have questions about this.

3.10 Location

We currently conduct our business in Australia and the United States.

We may disclose information to recipients that are located outside the country in which you are located. We may disclose personal information to contractors and external service providers in and outside of the country in which you are located.

The service providers we engage may use international data centres and disaster recovery sites.

By using our website and our platforms or providing us with your personal information, unless we otherwise agree, you consent to the storage and use of your personal information in a country other than the country in which you are located and where a different privacy or data protection regime may apply.

If you are in Australia, we will take commercially reasonable steps to ensure that any overseas recipient to whom we choose to disclose personal information does not breach the Australian Privacy Principles (other than Australian Privacy Principle 1) in relation to the personal information.

If you are in Australia, the Australian Privacy Principles require that we take reasonable steps, dependent on the circumstances, to ensure that the overseas service provider to whom personal information is disclosed does not breach Australian privacy laws (the “Requirement”). Where the Australian Privacy Act applies, when you provide us with your personal information you consent to the disclosure of your information to an overseas provider. Your consent to this disclosure means that the Requirement does not apply and we will not be held accountable under the Australian Privacy Act for any breaches of the Australian Privacy Act by the overseas provider.

When accessing our platforms, the computer systems on which your personal information is collected, stored and used are owned by third party vendors but the computer systems located in:

for users of our platforms in respect of Australian roads: your personal information may be transferred to, used, processed or held by us on systems located in Australia. The content that you upload to the platform, when at rest, will remain on servers located in Australia unless you share that content with a person located elsewhere.
for users of our platforms in respect of United States roads: your personal information may be transferred to, used, processed or held by us on systems located in the United States. The content that you upload to the platform, when at rest, will remain on servers located in the United States unless you share that content with a person located elsewhere.
for all users, our technical support, programming and account support teams may access your personal information from Australia.

We use product analytics tools that are provided by companies in Europe, Australia and the United States. We use PostHog Cloud for product analysis and improvement, as well as in-app surveys, and we redact personal information from the information that we provide to the PostHog platform. See https://posthog.com/privacy for further details regarding PostHog Cloud’s privacy practices.

You consent to your personal information being stored in these locations. We may change locations of the servers that we use, and if we do, we will give you reasonable notice.

3.11 Security and storage

We use a range of physical and technical security processes and procedures to protect the confidentiality and security of the information that we hold, and we update these from time to time to address new and emerging security threats.

We may store customer information (including personal information and payment information) in a variety of formats, including electronic or paper formats.

Sometimes we also keep hard copy records of this personal information in physical storage facilities.

We generally store the personal information that we collect in electronic databases, some of which may be held on our behalf by third party data storage providers.

In respect of our platforms, data is encrypted in transit and at rest.

Transmissions sent to or from our website and our platforms are routinely monitored for quality control and systems administration.

We take other reasonable steps to ensure that your personal information is stored securely.

Security is a shared responsibility. If you are a customer or user of our platform, it is important for you to take reasonable steps to enhance security. These include:

Use up-to-date operating system and browser software.
Similar to emails, never execute any binary code on your computer or work with a file format you don’t understand.
Office document macros should be disabled when opening documents from the Internet.
Use app-based 2FA wherever possible, since this is widely considered to be more secure than SMS-based 2FA.
Use a complex, unique password (i.e. one that you don’t use anywhere else).
Never disclose your password to others.
Accounts should not be shared — it’s expected that each user will have their own account.
Contact security@transmax.com.au immediately if you notice any unusual activity related to your account.

Although we take care, we cannot guarantee the security of information provided to us via electronic means or stored electronically. No security measures are perfect, and we cannot promise to be able to withstand security threats in all circumstances. We cannot guarantee the total security of any data transmission over the Internet.

Personal information is only retained for as long as is necessary or as required by law.

3.12 Access to and correction of personal information

You have the right to access, update and correct the personal information that we hold about you.

If you would like to access the personal information that we hold about you, please let us know by sending an email to privacy@transmax.com.au. We will provide you with a copy of your personal information within a reasonable period after the request is made, usually within 30 days. In some cases, we may charge a reasonable fee to provide access to your personal information, but we will never charge you a fee to make a request. If a fee applies, we will advise you before we provide access. Sometimes, we may not be able to provide you with access to all your personal information and, where this is the case, we will tell you why. We may also need to verify your identity when you request your personal information. Where information about you is held in our platform and we are not the data controller, you authorise us to forward your request to the relevant data controller.

We take reasonable steps to ensure the personal information we hold about you is accurate, complete, up-to-date, relevant, and not misleading.

If you would like to make an update or correction to any personal information we hold about you for our business, please let us know by sending an email to our Privacy Officer at privacy@transmax.com.au.

If there is a reason for not granting you access to your information or making a correction to any personal information, we will provide you with a written explanation of the reasons for the refusal (unless unreasonable to do so) and inform you of the mechanisms to complain about the refusal.

3.13 Deletion

In respect of information stored in our platforms, the platform includes working functionality to allow you to download and delete information in your account at no charge.

In respect of information that is held by us but that is not stored in our platforms, if you choose to have your personal information deleted from our records, we will do so within a reasonable time of your request to us. If so, we will take reasonable steps to ensure that your personal information is not used (except as may be required by law) by us after your request.

Your information may still be retained, however, to resolve potential or actual disputes, enforce our legal agreements, or due to technical or legal requirements, and constraints related to the security, integrity and operation of the platform.

3.14 How can you withdraw your consent

You may withdraw your consent in respect of our collection, use, retention or disclosure of your Personal Information at any time. If you wish to withdraw your consent, please contact our Privacy Officer at privacy@transmax.com.au. However, this may affect your use of our website and our platforms, as well as our products and services. Subject to law and our other legal rights, we will endeavour to comply with your request within a reasonable time.

3.15 United States

If you are a resident of California or Utah, the following provisions supplement and supersede the above to the extent of any inconsistency.

3.15.1 Californian residents

This notice to California residents is provided under California law, including the California Consumer Privacy Act (CCPA), Cal. Civ. Code 1798.100, et seq, as amended by the California Privacy Rights Act. This notice supplements and is incorporated into our Privacy Policy by explaining your privacy rights if you are a California resident, providing our “notice at collection,” and providing certain mandated disclosures about our treatment of California residents’ information, both online and offline.

Where we operate as a data processor for our customers, you must direct any requests to exercise your rights to the relevant customer who is the data controller of your information.

3.15.1.1 Right to access

If you are a Californian resident, you have the right to request, up to two times each year, access to categories and specific pieces of personal information about you that we collect, use, disclose, and sell.

3.15.1.2 Right to delete

If you are a Californian resident, you have the right to request that we delete personal information that we collect from you, subject to applicable legal exceptions.

3.15.1.3 Right to opt out of sale of personal information

If you are a California resident, you have the right to “opt out” of the “sale” of your “personal information” to “third parties” (as those terms are defined in the CCPA).

If you wish to make such a request or to opt out, please contact us by email at privacy@transmax.com.au. Before completing your request, we may need to verify your identity.

Our Privacy Policy above sets out any mandatory disclosures required under the CCPA.

To make an access, deletion, or correction request, please contact the road operator that is the data controller of your personal information, or contact us by email at privacy@transmax.com.au in respect of information that we collect and control in respect of our business operations. Before completing your request, we may need to verify your identity.

3.15.2 Utah residents

This section applies to our processing of personal data on behalf of our government customers who are subject to the Utah Consumer Privacy Act (UCPA).

3.15.2.1 Your privacy rights

As a resident of Utah, you have certain rights with respect to your personal data, subject to certain exceptions. Where we operate as a data processor for our customers, you must direct any requests to exercise your rights to the relevant customer who is the data controller of your information.

These rights, as applicable to you, may include:

The Right to Know: The right to confirm whether a data controller is processing your personal data and to access that data.
The Right to Deletion: The right to request the deletion of personal data you have provided to a data controller.
The Right to Data Portability: The right to obtain a copy of your personal data that you have provided to the data controller in a portable and, to the extent technically feasible, readily usable format.
The Right to Opt Out: The right to opt out of the processing of your personal data for the purposes of targeted advertising or the sale of your personal data.

3.15.2.2 Our role

Where we are a data processor, we process the personal data on behalf of our customers. This means we act on their instructions regarding the collection, processing, and storage of your personal data. We are required to assist our customers in fulfilling your privacy rights requests.

To exercise any of these rights, please contact the road operator that is the data controller of your personal information, or contact us at privacy@transmax.com.au in respect of information that we collect and control in respect of our business operations. Before completing your request, we may need to verify your identity.

3.16 General

3.16.1 Other important agreements that govern your use of our websites and platforms

In addition to our Privacy Policy, your rights and obligations concerning our platforms are governed by customer contracts and user agreements. Please review the relevant agreement carefully as you must agree to comply before you use our platforms.

3.16.2 Business transfers

We reserve the right to transfer information (including personal information) that you provide or that we otherwise collect in connection with a sale or transfer of assets or of any portion of our business.

3.16.3 Links to other sites

Our website and our platforms may contain links to other websites. We are not responsible for the privacy practices or the content of those other websites. The privacy practices applicable to those other websites may differ substantially from ours, so we advise you to read the privacy policy of those other websites before using them.

3.16.4 Links from other sites

Additionally, there may be third party websites that may be providing links to our website without our knowledge or control. We are not responsible for the content of any third-party websites, expressly disclaim any statements or assertions made on such websites, and deny all liability associated with your use of, and the content on, such other websites or advertisements contained therein.

3.17 Further information and complaints

For further information, or if you would like to make a complaint about our use, handling or disclosure of your personal information, please contact us via email at privacy@transmax.com.au. Following receipt of your complaint, we will investigate and respond to you within a reasonable period of time.

If you are not satisfied with our response, you may also contact the relevant regulator such as the Australian Information Commissioner. As at the date of this Privacy Policy, the contact details are as follows:

Office of the Australian Information Commissioner

GPO Box 5218

Sydney NSW 2001

Phone: 1300 363 992

Email: enquiries@oaic.gov.au

Online: https://www.oaic.gov.au/individuals/how-do-i-make-a-privacy-complaint

If you would like more information about the Privacy Act or Australian privacy requirements in general, please visit the Office of the Information Commissioner’s website at www.oaic.gov.au.

3.18 Changes to this policy

We regularly review this Privacy Policy and our privacy practices.

From time to time, we will change this Privacy Policy. If we do, we will update the Privacy Policy on our website. The changes will come into effect immediately upon notification on our website.

If the changes are significant, we will aim to provide customers and users with an email notification of the changes.

Please check our website from time to time to understand how the current version of our Privacy Policy applies to you.

3.19 Questions?

If you have any questions about this Privacy Policy, please email them to privacy@transmax.com.au and be sure to indicate the nature of your question.

Approval

Approved by the Transmax Board of Directors on 27 November 2025.