Privacy Policy

1. About Us

Infomedia Pty Ltd, together with its subsidiaries, IFM Americas Inc., IFM Europe Limited, Nidasu Pty. Ltd, IFM Deutschland GmbH, SimplePart LLC (collectively the “Infomedia Group”) respects your right to privacy and is committed to protecting the privacy and security of information you share with us.  

This Policy applies to all members of the Infomedia Group. In this Policy, references to “Infomedia”, “we”, “us”, “our”  are to the applicable Infomedia Group entity/ies involved in processing the personal data.

2. About this Policy

This Privacy Policy (the “Policy”) describes how we will collect, use, share and otherwise process your personal data (also known as personal information, or personally identifiable information) in connection with your use of our website, services and any other interactions we have with you.

This Policy does not apply to the extent that we process personal data in the role of a processor or service provider on behalf of our customers, as further specified in the data processing agreement entered into with those customers. 

This Policy does not apply to Simplepart LLC’s customer e-commerce parts websites which Simplepart may host or operate on behalf of our customers. Customer websites are governed by the customer’s privacy notice and Simplepart acts in the role of a processor or service provider. If your request relates to a customer parts website, please contact that customer directly. We will support them in responding.

3. Information we may collect about you

When you use any Infomedia website, create an account with us, install, access and/or use any of our services or otherwise interact with us we collect personal data about you.

The personal data we collect will vary depending on the nature of the services or interaction and may include:

We do not typically collect “sensitive information” (also known as special categories of data) about you, such as information about your health, biometrics, racial or ethnic origin, religious beliefs or sexual orientation.  If at any time we were to require sensitive information from you in order to provide our services, we would only collect it with your express consent or as otherwise permitted by applicable laws.

Our websites and services are not directed at children. We do not knowingly collect personal data from children under the age of 13.

It is important that the personal data we hold about you is accurate and current. Please keep us informed if your personal data changes during our relationship with you.

4. How we collect information

Infomedia collects information in the following ways:

• Registration: We collect your Identity Data, Contact Data and Profile Data when you register your account with us. For services which require direct debit, we may collect your Payment Data.
• Communication: When you communicate with us via email, telephone, chat or another method we collect your Contact Data and may collect Audio Data. If the communication relates to an error or problem you are having with the one of our Services, we will also collect Usage Data for diagnosis and improvement.
• Information you generate when using our services: Each time you access and use our services we collect Content, Device, Cookies, Personalisation and Usage Data. We collect Content Data where you upload it to the services. We collect Device, Cookies, Personalisation and Usage Data as detailed in our Cookie Policy.
• Information we collect through monitoring the use of our website and services: Each time you access and use our website and services we collect information about that access and use, being Device, Content, Cookies, and Usage Data.
• Additional information we otherwise collect through our website and services where we have your consent to do so: When you interact with voice feature of our services, such as AI-powered voice agents, we may collect and process Audio Data.  Where you provide your consent, we may collect your Location Data on an ongoing basis while you are using the services.
• Direct Marketing: We collect and record Direct Marketing Data when we add you to our marketing database, you request to change your direct marketing preferences, or you interact with our direct marketing communications, including where we receive these instructions from others.
• Connected Data: We collect Connected Data when you choose to connect your connected device to your account, including where we are provided with the Connected Data by others.
• Information we receive from third parties: We may receive personal data about you from third parties, such as our customers, security partners to protect against fraud, abuse and other threats, marketing vendors who provide us with information relating to potential customers, advertising vendors and event organisers.
• Publicly available information: We may collect publicly available information about our service users, customers and potential customers.
• Unique application numbers: When you want to install or uninstall a service containing a unique application number or when such a service searches for automatic updates, that number and information about your installation, for example, the type of operating system, may be sent to us.

When we collect personal data in Australia, we do so in accordance with the Australian Privacy Principles, including providing notice of collection at or before the time of collection.

5. How your information will be used

We may use your personal data for a range of purposes relating to our business and services, including:

• to provide and maintain our services
• to enhance, develop and improve our services
• to monitor your use of the services
• to personalise your use of the services
• to keep our services secure
• to provide support for your use of the services such as resolving bugs, queries and other issues
• to facilitate our customers’ use of our services, and improvements to their services
• to communicate with you
• to comply with our legal obligations
• to prevent fraud, criminal activity and to protect the security of our services
• where we are a customer, for use relating to our receipt of third party services

Personalisation may involve limited automated processing, but does not involve solely automated decision-making that produces legal or similarly significant effects on you.

We may aggregate or de-identify your personal data (ensuring you can no longer be identified) and use this for a range of purposes including assessing the effectiveness of our services, updating and improving our services, conducting research and other analytics.

Australian personal data

If you are located in Australia, we will only use or disclose your personal data for the primary purpose for which it was collected, or for a directly related secondary purpose that you would reasonably expect.  We will otherwise only use or disclose your personal data with your consent or as required by applicable law.

Non-Australian personal data

We will only use your personal data when we have a lawful basis to do so. Most commonly, we will use your personal data in the following circumstances:

• Legitimate interests. Where it is necessary for our legitimate interests (or those of a third party) and your interests and fundamental rights do not override those interests. We make sure we consider and balance any potential impact on you (both positive and negative) and your rights before we process your personal data for our legitimate interests. You can obtain further information about how we assess our legitimate interests against any potential impact on you in respect of specific activities by contacting us.
• Consent. Where you have freely consented before the processing in a specific, informed and unambiguous indication of what you want. You can withdraw your consent at any time by contacting us.
• Performance of a contract. Where we need to process your personal data to perform a contract with you or where you ask us to take steps before we enter into a contract with you. Where we rely on performance of a contract and you do not provide the necessary information, we will be unable to perform your contract.
• Legal obligation. Where we need to use your personal data to comply with a legal or regulatory obligation. Where we rely on a legal obligation and you do not provide the necessary information, we may be unable to fulfil a right you have or comply with our obligations to you, or we may need to take additional steps, such as informing law enforcement or a public authority or applying for a court order.

The lawful basis for our processing of categories of personal data includes:

Where you provide personal data to us about another person, you warrant that you are authorised to provide that information to us, and that you will inform that person who we are, how we use and disclose their information, and that they can gain access to that information.

For the purposes of the GDPR and UK GDPR, Infomedia Pty Ltd is the controller of your personal data. Infomedia Pty Ltd’s registered address is at 155 Clarence St, Level 5, Sydney, NSW, Australia 2000, and we can be contacted using the details provided in section 15 below.

6. Criminal offence data

We do not intentionally collect criminal offence data about you. However, we may process data relating to criminal offences in monitoring the use of our services for security purposes, where we suspect you may have committed a crime, such as attempting to make a fraudulent purchase or claim or circumvent the security of the services. In such circumstances, we will provide that information to law enforcement and/or use it to establish, exercise or defend a legal claim. In those circumstances, according to the type of activity and purpose, we will rely on legitimate interests (protecting our business, employees and other users) and legal obligation (where required by legal, judicial or law enforcement to disclose or process that information).

7. Who we share your personal data with

Your information will only be disclosed to parties outside of Infomedia as set out in this Policy or as otherwise notified to you at the time of collection of the information.

We may share your personal data:

• Our group companies. Other companies in the Infomedia Group and our part-owned entities, including Intellegam GmbH. This information is shared for the purposes described in this Policy and generally to support the operation of our businesses.
• Trusted third parties and service providers:
  • Specific third parties identified as our list of sub-processors (a list is available by emailing security@infomedia.com.au).
  • Third party providers of linked websites, plug-ins and integrations incorporated into or accessed via our services, such as embedded survey tools.
  • Service providers which provide IT and system administration services, hosting services for our services, delivery and logistics services, payment processing, fraud and identity verification providers, customer service support, email delivery and administration, and data storage and analysis.
  • Our professional advisors including lawyers, auditors, insurers and other consultants.
  • Marketing, promotional and referral partners and co-operatives with whom we share data to enhance our offerings and identify prospective customers.
• Other external third parties.
  • Service providers you have appointed that we need to contact to fulfil your requests, such as your banking or payment card provider to process your transactions.
  • Third party partners where you have subscribed to receive marketing from or with them.
  • Third parties to whom we may choose to sell, transfer or merge parts of our business or our assets. Alternatively, we may seek to acquire other businesses or merge with them. If a change happens to our business, then the new owners may use your personal data in the same way as set out in this privacy notice.
  • Regulators, law enforcement, public authorities or other third parties where necessary to exercise our rights or comply with a legal obligation.

Transfers to third parties which are located in countries outside of your home jurisdiction are covered in section 9 below.

8. Third party links, services and sites

Infomedia’s website and services may from time to time contain links to and from websites and services owned and operated by third parties, who may collect personal data about you. Please note that these websites (and any services accessible through them) are controlled by those third parties and are not covered by this Policy. You should review the third party privacy notices to understand how they use your personal data before you submit any personal data to these websites or use those services.

9. Cross Border Transfers

Sometimes we may transfer your personal data to countries other than where it originates, including to Australia, the United States, the United Kingdom, and Germany (where members of the Infomedia Group are located), and other countries where our service providers operate. Those countries may have data protection laws which are different to the laws in your country.

By accessing an Infomedia website, or by installing, accessing or using Infomedia’s services, except where we have agreed under an agreement to retain such information within a specific country or region, you agree and consent to the cross-border transfer of your personal data in accordance with this clause.

Where we disclose personal data overseas in relation to our Australian operations, we will take reasonable steps to ensure the recipient does not breach the Australian Privacy Principles.

Transfers out of the EEA/UK

All transfers between our group companies are governed by our intra-group data sharing and transfer agreements. Where available, we rely on the UK government’s and European Commission’s adequacy decisions. For all other transfers between our group companies, we have executed the EU Commission’s standard contractual clauses.

Whenever we transfer your personal data out of the UK or EEA other than between our group companies, we ensure a similar degree of protection is afforded to it by ensuring at least one of the following safeguards is implemented:

• Adequacy decisions: Transfer your personal data to countries that have been deemed to provide an adequate level of protection for personal data.
• SCCs: Where we use certain service providers located outside the UK or EEA, we use suitable contracts governing the transfer of personal data outside of the UK and EEA.
• Exceptions: in limited circumstances we may rely on an exemption to transfer personal data. 

Please contact the Privacy Officer using the contact details below if you want further information on the specific mechanism used by us when transferring your personal data out of the UK or EEA.

10. Information Security

Infomedia is committed to ensuring high standards of data security and privacy. We are ISO 27001 certified, demonstrating our adherence to best practices in information security management. This certification reflects our dedication to protecting the privacy of our customers and partners, safeguarding sensitive information, and maintaining robust security controls across all operations.

Once we have received your information, we will use strict procedures and security features to protect your personal data from loss, unauthorised use or access.

Despite our security commitment, data transmission over the Internet may not be secure and you transmit all information at your own risk. If we become aware of a data breach that is likely to result in serious harm to you, we will notify you and the relevant regulator (such as the OAIC, ICO, or applicable EU supervisory authority) in accordance with applicable law. You are solely responsible for keeping your login account details including passwords confidential, your computer systems are up to date and implement antivirus and other protective measures.

11. Data Retention

We retain personal data for as long as is necessary for the purposes described in this Policy. We determine retention periods based on the type of personal data, statutory limitation periods, our legal and regulatory record-keeping obligations, and the need to resolve disputes or enforce our agreements.

Details of retention periods for different aspects of your personal data are available on request. By law we have to keep basic information about our customers (including Contact, Identity, Security and Transaction Data) for a period of two years after they cease being customers.

Once we no longer have a legal right to hold your personal data, we will delete or, in some circumstances, we will anonymise your personal data (so that it can no longer be associated with you) for research or statistical purposes, in which case we may use this information indefinitely without further notice to you.

In some circumstances, you can ask us to delete your data: see Your legal rights below for further information.

12. Your legal rights

You have the following rights under data protection laws in relation to your personal data:

• Access. Request access to and/or a copy of the personal data we process about you (commonly known as a data subject access request). This enables you to check that we are lawfully processing it.
• Correction. Request correction of any incomplete or inaccurate data we hold about you. (We may need to verify the accuracy of the new data you provide to us.)
• Deletion. Request us to delete or remove personal data where there is no good reason for us continuing to process it. You also can ask us to delete or remove your personal data where you have successfully exercised your right to object to processing (see below), where we have processed your information unlawfully or where we need to erase your personal data to comply with law. (In some cases, we may need to continue to retain some of your personal data where required by law. If these apply, we will notify you at the time of our response.)
• Objection. Object to us processing your personal data where (a) we are relying on legitimate interests as the lawful basis and you feel the processing impacts on your fundamental rights and freedoms, or (b) the processing is for direct marketing purposes. In some cases, we may refuse your objection if we can demonstrate that we have compelling legitimate grounds to continue processing your information which override your rights and freedoms.
• Restriction. Request that we restrict or suspend our processing of your personal data:
  • if you want us to establish the data’s accuracy;
  • where our use of the data is unlawful, but you do not want us to erase it;
  • where we no longer require it, but you need us to hold onto it to establish, exercise or defend legal claims; or
  • you have objected to our use of your data, but we need to verify whether we have overriding legitimate grounds to use it.
• Data portability. Request we transfer certain of your personal data to you or your chosen third party in a structured, commonly used, machine-readable format. This right only applies to information processed by automated means that we process on the lawful bases of consent or performance of a contract.
• Withdraw consent. Withdraw your consent at any time where we are relying on consent to process your personal data. Please know that this does not affect the lawfulness of any processing carried out before you withdraw your consent, and after withdrawal, we may not be able to provide certain products or services to you. We will advise you if this is the case at the time you withdraw your consent. 
• Complain to your data protection regulator. If you are unhappy with how we process your personal data, we ask that you contact us first using the details below so that we have the chance to put it right. However, you also have the right to make a complaint to the applicable data protection regulator at any time.

You can exercise any of these rights at any time by contacting us using the details below.

13. Changes and opt-out choices

You can delete or amend personal data that you have entered via our services, such as your account information. You can change your choices about receiving either subscription or general communications at the data collection point, within your account preference settings. You may opt-out at any time using the links at the bottom of any promotional email or by sending an email request to privacy@infomedia.com.au and we will limit and / or delete use and disclosure of your personal data as requested.

Please note, this option does not apply to communications primarily for the purpose of administering business relationships, including contracts, support, or other administrative and transactional notices where the primary purpose of these communications is not promotional in nature.

14. United States Privacy Laws

The disclosures in this section apply only to United States residents and are intended to supplement this Policy with information required by applicable United States privacy laws. We will comply with applicable United States privacy laws in relation to your personal data. In particular, if you are a resident of some States, you may have additional rights under State privacy laws.

In the 12 months preceding the date of this Policy, we have collected, processed and disclosed the Personal Data as described in sections 3-7 above.

We do not “sell” or “share” your personal data as defined under the United States privacy laws, including for cross-context behavioural advertising purposes. We do not have actual knowledge that we sell or share the personal data of consumers under 16 years of age. Because we do not sell or share personal data, the opt-out rights and Global Privacy Control signals described under some United States privacy laws are not applicable to our processing of your personal data.

You may exercise any rights available to you under US privacy law by contacting us at the details listed below. To protect your personal data, we may require you to provide additional information to verify your identity. You may designate an authorized agent to make a request on your behalf by providing us with written authorisation signed by you, or by having the agent verify their identity and authority directly with us. If we decline to act on your request, you have the right to appeal our decision by contacting us at the details listed below.

In addition to your Legal Rights under the rest of this Policy, you also have the right to know which specific pieces of personal data we have collected about you, including the categories of sources and the categories of third parties we disclosed your personal data to under section 7. You have the right to limit the use of sensitive information about you. You have the right not to receive discriminatory treatment for exercising any of your rights under United States privacy laws.

15. Contact information and Access to information

Infomedia is committed to maintaining accurate, relevant and appropriate information about our customers, client and other stakeholders. You may contact us and/or request access to your information through our Privacy Officer as follows:

16. Complaints

If you have a complaint about our Policy or the collection, use or disposal of your personal data, your complaint should be directed to the Privacy Officer (see contact details above). The Privacy Officer will review your complaint and attempt to resolve it.

If you are not satisfied with the outcome of this review, then you may make a complaint to the relevant regulator (such as the OAIC, ICO, or applicable EU supervisory authority) in accordance with applicable law.

17. Language

This Policy is drafted in the English language, which shall be the only authoritative and binding version. Any translation of this Policy is provided for convenience only and shall have no legal effect. In the event of any inconsistency between the English version and any translation, the English version shall prevail.

18. Changes to our Privacy Policy

We keep our Policy under regular review and may need to change it from time to time to reflect regulatory, legal, technical, security or other business requirements.  We will take appropriate steps to inform you about any changes relative to the significance of the changes we make.  Your continued use of the service/s will constitute your agreement to the updated Policy.

You can check when this Policy was last updated by reading the “last modified” notice below.  

Last Modified July 2026