Privacy Policy

Who we are and what this Policy covers

TRAN Systems (ABN 99 773 857 017), the operator of Yumme (“Yumme”, “we”, “us” or “our”), is responsible for the personal information described in this Policy when we decide how and why it is handled.

This Policy applies to the Yumme mobile application, yumme.network, tran.systems, merchant and business tools, customer ordering experiences, support channels, events, promotions, and any other product or service that links to this Policy (together, the “Services”).

It applies to customers and order recipients; merchants, home cooks and their personnel; delivery or fulfilment participants if those features are offered; business customers; website visitors; applicants; and people who contact us. A feature-specific notice shown when information is collected forms part of this Policy. If a feature-specific notice conflicts with this Policy, the more specific notice applies to that feature.

Our privacy roles

When Yumme decides the purpose

Yumme acts as the privacy “controller” or responsible organisation when we determine the purposes and means of handling information—for example, operating Yumme accounts, securing the platform, processing Yumme support requests, conducting analytics, and administering marketing preferences.

Merchants and business customers

Merchants and business customers may separately decide how they handle customer, employee or other information. In those circumstances, they are independently responsible for their practices. A merchant may receive the information needed to accept, prepare, fulfil, refund and support an order. Contact that merchant directly about its independent use of the information.

Where Yumme handles personal information solely on documented instructions from a business customer, Yumme acts as that customer’s processor or service provider. We use such information only to provide the contracted service, maintain security, meet legal duties and as otherwise permitted by the agreement and applicable law. A rights request concerning that information may need to be referred to the relevant business customer.

Information about other people

If you provide information about an order recipient, employee, guest, emergency contact or another person, you must be authorised to do so and should make this Policy available to them. Do not provide more information than the feature requires.

Personal information we collect

The information collected depends on your role, location, settings and the features you use. “Personal information” includes information or an opinion about an identified or reasonably identifiable person, and equivalent concepts under other applicable laws.

Sensitive information

We do not ask for sensitive information merely because it may be useful. We collect it only where reasonably necessary for our functions and with consent, or where another legal permission applies. Depending on the feature, this may include precise geolocation; identity document data; biometric information used for identity verification; accessibility information; allergy or dietary information included in an order; health or safety information in an incident report; or government identifiers.

We do not intentionally collect genetic information, racial or ethnic origin, political opinions, religious beliefs, trade-union membership, sex-life or sexual-orientation information unless you voluntarily include it in a communication or content, or a clearly explained feature lawfully requires it. Please avoid including sensitive information in free-text fields unless necessary.

If information is required

Some information is optional. If required information is not provided, we may be unable to create or secure an account, process an order or payment, provide a requested feature, verify eligibility, fulfil a legal duty or investigate an incident. We will indicate required fields where practical.

How we collect information

We collect personal information:

• from you, including through accounts, forms, orders, uploads, device permissions, support, promotions and communications;
• through your use of the Services, including device, usage, cookie, location, order and transaction events;
• from other users, such as an order purchaser, recipient, referring user, merchant, delivery participant, account administrator or person reporting an incident;
• from service providers and partners, including payment processors, identity-verification services, fraud-prevention providers, analytics services, maps, communications providers, app stores, delivery or fulfilment providers and social-login providers;
• from business customers, where an employer or other organisation authorises your access to a Yumme business account;
• from public and official sources, such as business registers, sanctions lists, public websites and regulators where verification or compliance requires it; and
• through integrations you authorise, subject to the permissions shown by that provider.

If we receive unsolicited personal information, we assess whether we could lawfully have collected it. If not, we will destroy or de-identify it where lawful and reasonable.

How and why we use personal information

Under Australian law, we generally use or disclose personal information for the primary purpose for which it was collected, a related purpose you would reasonably expect, with consent, or as otherwise authorised or required by law. Where consent is the basis, you may withdraw it prospectively, but this does not affect earlier lawful handling or handling supported by another legal basis.

We may aggregate or de-identify information so it no longer identifies or is reasonably likely to identify you. We may use and disclose that information for analytics, research, reporting and service improvement. We do not attempt to re-identify protected de-identified data except to test privacy safeguards or where permitted by law.

Automated processing, recommendations and fraud controls

Yumme may use rules, algorithms and machine-learning tools to operate and protect the Services. These tools may:

• rank search results or recommend merchants, products, content and promotions based on location, availability, prior activity and stated preferences;
• estimate fulfilment times, service areas, inventory relevance, fees or other service information;
• detect unusual logins, payment risk, duplicate accounts, abuse, prohibited transactions or other patterns associated with fraud and platform harm; and
• moderate or prioritise support, content and incident reports.

Automated signals may lead us to request verification, delay or decline a transaction, restrict a feature, withhold a payout where contractually and legally permitted, or refer a matter for review. We design these systems to use data relevant to the stated purpose and monitor them proportionately for accuracy, security and unfair outcomes.

When we share or disclose information

We disclose only information reasonably relevant to the recipient’s role and require service providers to protect it through contractual or equivalent controls where appropriate.

We may challenge requests that are unlawful, overbroad or inconsistent with human rights, and we notify affected users before disclosure where lawful and appropriate. In an emergency involving a serious threat to life, health or safety, we may disclose relevant information to emergency services or other appropriate recipients as permitted by law.

Sale of information: Yumme does not sell personal information in exchange for money. Certain privacy laws define “sale” or “sharing” broadly to include disclosures for cross-context behavioural advertising. Where those laws apply, you may opt out as described in sections 9, 10, 16 and 18.

Payments, financial data and blockchain features

Card and conventional payments

Payment providers may collect card, bank-account or wallet information directly under their own privacy notices. Yumme generally receives a payment token, limited card descriptors, transaction status and fraud signals rather than the complete card number or security code. We use payment data to process charges and payouts, issue refunds, reconcile accounts, prevent fraud, address disputes and meet legal obligations.

Digital assets and public blockchains

If Yumme enables a digital-asset or blockchain feature, we may handle public wallet addresses, transaction identifiers, token type and amount, network, smart-contract events and related compliance information. Blockchain transactions may be public, permanent, replicated globally and outside Yumme’s control. They may not be erasable or reversible. Do not place names, contact details, order notes, health information or other unnecessary personal information into a public blockchain transaction.

Where possible, Yumme keeps directly identifying account data off-chain and links it to on-chain activity only as needed for the feature, security, accounting, fraud prevention or compliance. A request to delete a Yumme account cannot remove information already recorded on a public blockchain, but we will delete or de-link off-chain information where required and technically feasible.

Cookies, SDKs and similar technologies

Yumme and authorised partners may use cookies, pixels, local storage, software development kits (“SDKs”) and similar technologies in our websites, apps, emails and advertisements.

• Strictly necessary: sign-in, security, fraud prevention, load balancing, shopping-cart and core service functions.
• Preference: language, region, accessibility and other remembered settings.
• Analytics: performance, errors, feature use and audience measurement.
• Advertising: campaign measurement, frequency control, attribution and personalisation where permitted.

Where required, non-essential technologies are not activated until you make a choice. You can use Yumme’s cookie controls, device privacy settings or browser tools to withdraw or change consent. Blocking necessary technology may prevent parts of the Services from working. Browser “Do Not Track” signals are not governed by one universal standard; where applicable law requires recognition of a valid opt-out preference signal, including Global Privacy Control, Yumme treats that signal as an opt-out for the browser or device that sends it.

More details—including current providers, purposes, cookie duration and controls—should be read in Yumme’s Cookie Notice and consent interface. If those sources conflict, the setting that gives you the more specific current choice controls.

Marketing, notifications and your choices

We may send service messages needed to administer your account or transactions, including receipts, security alerts, policy notices, order updates and support responses. These are not marketing and may continue while you use the relevant Service.

We send direct marketing only where permitted. You can:

• use the unsubscribe link in a marketing email;
• reply STOP where an SMS program supports it;
• turn promotional push notifications off in the app or device settings;
• adjust cookie or advertising preferences; or
• contact us to opt out or withdraw consent.

We action opt-outs within the period required by law and may keep a minimal suppression record so we do not add you back to the same marketing list. Withdrawing marketing consent does not prevent service or safety communications. We do not disclose mobile-originator opt-in data or consent to third parties for their independent marketing.

Public profiles, reviews and user content

Content you choose to publish—such as a merchant profile, menu, image, review, rating, comment or public list—may be visible to other users, search engines and the public. It may be copied or reshared outside Yumme. Check the audience and avoid publishing personal or sensitive information you do not want others to see.

We may use content and related identifiers to display it, attribute it as the feature explains, moderate it, investigate authenticity or abuse, enforce policies and improve the Services. You may request removal through the available feature or by contacting us. Removal from Yumme does not ensure deletion of copies made by others, search-engine caches, legal records or data we must retain for safety, disputes or compliance.

Overseas storage, access and transfers

Yumme is operated from Australia and may use personnel and providers in other countries. Based on the current operating model, information may be stored in or accessed from Australia, Vietnam, Singapore, the Philippines, Thailand, India, the United States and other countries where our cloud, communications, security, analytics, payment or support providers operate.

Privacy laws and government-access rules may differ from those in your location. Before disclosing personal information to an overseas recipient, we take reasonable steps required by Australian Privacy Principle 8 and other applicable laws. Depending on the transfer, safeguards may include vendor due diligence, data-processing terms, confidentiality and security obligations, access restrictions, encryption, data minimisation, transfer-risk assessments, approved contractual clauses, and monitoring or audit rights.

Australian law may make us accountable for certain acts or practices of an overseas recipient. Exceptions can apply—for example, where informed consent validly applies or another legal exception permits the disclosure. For transfers governed by the EEA or UK rules, we use an adequacy decision, approved contractual safeguards or another lawful transfer mechanism as required.

Retention, account closure and deletion

We keep personal information only as long as reasonably needed for the purpose collected, a compatible lawful purpose, or a legal requirement. We consider the information’s sensitivity, volume and context; risks of harm; the life of the account or transaction; limitation periods; tax, corporate, consumer and financial-record duties; safety and fraud needs; dispute or enforcement holds; and whether the purpose can be met with de-identified data.

You may request account deletion through an available account setting or by contacting us. We first deactivate the account, verify the request where necessary, and delete or de-identify information unless retention is permitted or required. We may retain limited information to prevent a person restricted for serious fraud or safety reasons from immediately recreating an account, to maintain transaction records, or to establish, exercise or defend legal claims.

When information is no longer needed and no exception applies, we take reasonable steps to destroy it securely or ensure it is de-identified. Deletion from live systems may not be immediate where data remains in protected backups, public blockchains, another controller’s systems or records subject to a legal hold.

How we protect information

We maintain a risk-based privacy and security program designed to protect personal information against misuse, interference, loss, and unauthorised access, modification or disclosure. Depending on risk and system capability, measures may include:

• encryption in transit and appropriate encryption or equivalent protection at rest;
• role-based access, least-privilege controls, strong authentication and additional controls for privileged access;
• logging, monitoring, rate limiting, fraud controls, backups and resilience measures;
• secure development, code review, vulnerability management, testing and patching;
• staff confidentiality obligations, privacy and security training, and access removal when roles change;
• vendor risk assessment, contractual security requirements and incident-notification duties;
• data minimisation, retention schedules, secure disposal and de-identification; and
• incident-response, business-continuity and disaster-recovery processes.

No internet, mobile, storage or authentication system is completely secure. You can help by using a unique password, enabling available multi-factor authentication, protecting one-time passcodes, keeping devices and apps updated, checking links and messages, and contacting us promptly about suspected account compromise. We will never ask you to disclose a password or one-time code through an unsolicited message.

Data breach and incident response

We maintain procedures to identify, contain, investigate, document and remediate suspected privacy or security incidents. We assess what happened, the information and people affected, likely harm, available remedial action, legal notification duties, and measures to reduce recurrence.

Where the Australian Notifiable Data Breaches scheme applies and an eligible data breach is likely to result in serious harm, we notify the Office of the Australian Information Commissioner (“OAIC”) and affected individuals as soon as practicable, unless an exception applies. We also comply with applicable notification laws in other locations. A notice may describe the incident, information concerned, recommended protective steps and how to contact us.

If you believe your Yumme account or information has been compromised, change affected credentials, contact your payment provider if relevant, and report the matter promptly to [email protected] or +61 466 324 030.

Your rights, choices and account controls

Subject to your location, Yumme’s role, identity verification and lawful exceptions, you may have rights to:

• know whether we handle your information and obtain access or a copy;
• correct inaccurate, out-of-date, incomplete, irrelevant or misleading information;
• request deletion or de-identification;
• object to or restrict certain handling;
• withdraw consent prospectively;
• receive portable data in a commonly used machine-readable format;
• opt out of direct marketing, targeted advertising, sale or sharing as legally defined, and certain profiling;
• request information about or human review of certain automated decisions;
• authorise an agent to act for you where law permits; and
• complain to us and an applicable privacy regulator without retaliation.

Self-service controls

Where available, use account settings to edit profile details, close an account, manage linked services and set notification preferences. Use device settings to control precise location, camera, microphone, photos, contacts and push notifications. A permission change does not delete information already collected; use a deletion request for that.

Submitting a request

Email [email protected] with the subject “Privacy Request” or write to the address in section 22. Describe the right you wish to exercise, the Yumme service involved, your account contact details and the country or state in which you live. Do not email identity documents unless we specifically request them through an appropriate channel.

Verification, authorised agents and responses

We verify requests proportionately to the sensitivity and risk. We may ask you to confirm control of an account, answer account-specific questions or provide limited evidence of identity or authority. An authorised agent may need to provide written permission, and we may confirm the request directly with you. Information collected for verification is used for that purpose and related security or legal compliance.

We respond within the period required by applicable law. For Australian access or correction requests, we aim to respond within 30 days. We may extend a period where law allows and will explain the reason. We do not ordinarily charge a fee, but may charge a reasonable cost or refuse a request where legally permitted—for example, if it is manifestly unfounded, excessive or would unreasonably affect another person’s privacy. If we refuse, we explain the grounds and available complaint steps unless prohibited.

Australia-specific protections

Yumme handles personal information in accordance with the Privacy Act 1988 (Cth) and the Australian Privacy Principles (“APPs”) where they apply, as well as other applicable laws including direct-marketing, telecommunications, consumer, financial-record and state or territory requirements.

Anonymity and pseudonymity

You may interact anonymously or under a pseudonym where lawful and practicable—for example, when making a general enquiry. Identification may be necessary for accounts, payments, orders, safety, rights requests, fraud prevention, merchant verification or legal compliance.

Access and correction

You may request access to personal information we hold and correction of information that is inaccurate, out-of-date, incomplete, irrelevant or misleading. If we correct information previously disclosed to another organisation, you may ask us to notify that organisation where required and reasonable. If we decline to correct a record, you may ask us to associate a statement with it.

Government-related identifiers and sensitive information

We do not adopt a government-related identifier as our own account identifier, and use or disclose such identifiers only where permitted. We collect sensitive information with consent where required or under a lawful exception, apply additional access and purpose limits, and do not use it for unrelated advertising.

Direct marketing

You may ask us at any time not to use or disclose personal information for direct marketing and to identify the source of that information where the APPs give you that right. We will not charge for the request.

Privacy complaints

First contact our Privacy Officer using section 22. Include enough detail for us to investigate, but do not send unnecessary sensitive information. We will acknowledge the complaint, investigate it fairly, keep you informed where appropriate, and provide an outcome within a reasonable period—generally within 30 days for a standard complaint.

If you are not satisfied, you may complain to the Office of the Australian Information Commissioner. The OAIC generally expects you to complain to the organisation first and allow a reasonable response time.

Additional rights in other regions

This section supplements the rest of the Policy. It applies only where the relevant law covers Yumme’s handling and does not limit more favourable rights.

New Zealand

Where the Privacy Act 2020 applies, you may request access and correction and complain to the Office of the Privacy Commissioner. We assess notifiable privacy breaches and overseas disclosures under applicable New Zealand requirements.

EEA, United Kingdom and Switzerland

Where applicable, our legal bases include performance of a contract, compliance with legal obligations, protection of vital interests, your consent and our or another party’s legitimate interests. Legitimate interests include providing and improving the Services, platform security, fraud prevention, support, business administration and proportionate marketing. We balance those interests against your rights and expectations.

You may have rights of access, rectification, erasure, restriction, objection, portability and consent withdrawal, and rights relating to solely automated decisions. You may object at any time to direct marketing. You may complain to your local supervisory authority. For cross-border transfers, see section 12. Contact the Privacy Officer for details of the relevant controller or transfer safeguard for your service.

United States state privacy laws

Residents of California and other states with applicable comprehensive privacy laws may have rights to know, access, correct, delete, obtain a portable copy, opt out of sale, sharing, targeted advertising or certain profiling, limit certain uses of sensitive information, appeal a refusal, and receive equal service for exercising a right.

We disclose these categories to the recipient groups in section 7 for the listed business and commercial purposes. We do not sell personal information for money. If advertising disclosures are legally considered sale or sharing, you may opt out through Yumme’s cookie/privacy controls, a recognised opt-out preference signal where required, or a request to the Privacy Officer. We do not knowingly sell or share for cross-context behavioural advertising the personal information of users we know are under 16.

If we deny an appealable US request, respond to our decision with “Appeal” and the reason you disagree. We will review it and provide any regulator contact required by law. California residents may also request information permitted by the “Shine the Light” law about disclosures for third parties’ direct marketing.

Canada, South Africa and other locations

Where applicable law provides access, correction, deletion, objection, consent withdrawal, portability, complaint or other rights, we honour them subject to lawful limits. Canadian users may complain to the Office of the Privacy Commissioner of Canada or an applicable provincial authority. South African users may complain to the Information Regulator. Contact us for the relevant regulator or local route.

Children and younger users

Yumme’s registered Services are intended for people aged 18 or older unless a clearly identified feature lawfully supports a younger user with appropriate safeguards. We do not knowingly permit a child to create a standard account or knowingly collect a child’s personal information for targeted advertising.

An adult may provide limited information about a child as an order recipient only where authorised and necessary. Do not place sensitive information about a child in order notes unless essential for safe fulfilment. If you believe a child has provided personal information contrary to this section, contact us. We will investigate and delete or restrict it as required, while preserving information needed for safety or law.

Third-party services and integrations

The Services may link to or integrate with app stores, payment providers, maps, social platforms, identity providers, wallets, merchant sites or other third parties. A link does not mean Yumme controls that organisation. When you leave Yumme or authorise an integration, the third party’s terms and privacy notice apply to its independent collection and use.

Review permissions before connecting an account. Where available, you can remove an integration through your Yumme or third-party settings. Removing access stops future collection through the connection but may not delete information already received by either party. Contact the relevant organisation about its records.

Changes to this Policy

We review this Policy as our Services, technology and legal obligations change. The effective date and version at the top identify the current Policy. Updated wording applies prospectively from the stated effective date unless law requires otherwise.

For material changes, we provide notice appropriate to the impact—for example, through the Services, by email, or with a prominent website notice. Where a new use requires consent, we request it rather than relying only on continued use. We encourage you to review notices when new features are introduced.

Contact, rights requests and complaints

Contact Yumme’s Privacy Officer for questions, rights requests, consent withdrawal, account deletion, direct-marketing objections, security reports or complaints.

For privacy complaints, state “Privacy Complaint” in the subject line and describe what happened, the outcome you seek, relevant dates and the Service involved. We will handle complaints without retaliation. You may also contact the regulator identified in section 17 or 18.