Privacy Policy

This policy explains how Flixlink Broadband Pty Ltd (ABN 44 669 575 679), trading as FlixLink Telecommunications ('FlixLink', 'we', 'us', 'our'), handles your personal information. It covers what we collect and why, how we keep it safe, who we share it with (including anyone overseas), how long we keep it, and how you can see it, correct it or make a complaint. It also explains the extra privacy rules that apply to phone and internet providers, the decisions our computer systems make, and how we handle credit information.

1. About this policy

This is our privacy policy under the Privacy Act 1988 and the Australian Privacy Principles. It also contains our credit information policy (section 12), which the credit reporting rules in Part IIIA of the Privacy Act require.

It applies to:

• our customers and people who apply for a service;
• authorised representatives, and people who use a service on someone else's account;
• people who contact us, check an address or use our website;
• the people we deal with at our business customers.

This policy is free. If you'd like a copy in another form, such as a printed copy, ask us and we'll do our best to provide it.

Other FlixLink documents also explain how we look after you: our Customer Terms, Account Security and Scam Protection Policy, Domestic, Family and Sexual Violence Support Policy and Financial Hardship Policy.

2. The personal information we collect

Personal information is information or an opinion that identifies you, or could reasonably identify you. What we collect depends on the services you have and how you deal with us.

Sensitive information

Some information, such as health information (for example, a medical need that affects your service), is sensitive information under privacy law. We only collect it with your consent, or where the law allows. You don't have to give it to us.

Information about other people

If you give us information about someone else, such as an authorised representative, a family member who uses a mobile on your account, or staff at your business, please let them know and point them to this policy.

3. How we collect it

From you

• When you check an address, place an order or send a message on our website.
• When you fill in an application or order form, such as our mobile application form.
• When you call or email us, including when we check your identity on a call.
• When you apply for financial hardship help or make a complaint.

When you use our services

Our systems, and our wholesale suppliers' networks, create records when you use your services, such as call records and internet session records.

From other organisations

• Our wholesale suppliers and NBN Co: information about your address and the services available there, the progress of your connection, faults and technician appointments.
• Vocus: if you're transferring an nbn service, we may ask Vocus to confirm that your AVC ID matches your address. Vocus also tells us which provider currently supplies that service.
• Stripe: whether your payments have gone through.
• Other phone and internet providers: when you move a service or number to or from us.
• People acting for you: such as your authorised representative, a financial counsellor or a lawyer.
• Credit reporting bodies: only if we do an external credit check, with your consent (section 12).
• The TIO and regulators: when they refer a complaint to us or ask about your service.

If you don't want to give us information

You can browse our website, check an address or ask a general question without telling us who you are. To supply a service, though, we need your name, contact details and service address, and for some services we must check your identity. If you don't give us the information we need, we may not be able to supply the service or help with your request.

Information we didn't ask for

If we receive personal information we didn't ask for and don't need, we destroy it or remove anything that identifies you, as long as the law allows.

4. Why we use your information

We collect, use and share personal information to:

• check which services are available at your address, and give you quotes;
• check your identity and protect your account from fraud, including SIM-swap and number-transfer fraud;
• connect, transfer, supply, maintain and repair your services, including booking nbn technicians;
• check that a new mobile phone can call Triple Zero (000), as the law requires;
• bill you, take payments, manage modem repayments and deal with failed payments;
• send you service messages, such as order updates, outage notices, usage and roaming alerts, and notices about changes. These aren't marketing, so opting out of marketing doesn't stop them, and you can't opt out of the ones the law requires;
• follow up an online order you started but didn't finish paying for;
• give you support, and deal with faults and complaints;
• assess and give financial hardship help, and support you if you're affected by family violence;
• assess credit where we need to (section 12);
• detect, prevent and report scams, fraud and misuse of our services and network;
• meet our legal obligations, such as the phone number database (section 7), keeping metadata (section 8), helping emergency services and law enforcement (section 6), and keeping tax and business records;
• improve our services and train our staff;
• tell you about our products and offers, if you agree (section 14).

We only use or share your information for these purposes, for related purposes you would reasonably expect, with your consent, or where the law requires or allows it. We don't sell your personal information.

5. Who we share it with

We only give these organisations the information they need. Our service providers must keep it secure and use it only to provide their services to us.

Debt collectors: we don't currently use debt collection agencies, and we never sell debts. If we ever use a collection agency, we'll only do so after following our Financial Hardship Policy policy and our process for overdue bills, and we'll give it only the information it needs.

6. Telecommunications information, emergencies and law enforcement

As a phone and internet provider, we must follow Part 13 of the Telecommunications Act 1997 as well as the Privacy Act. Part 13 makes it an offence for us, our staff and our contractors to use or disclose information about the content of your communications, the services we supply to you, or your affairs or personal details, unless the Act allows it.

The Act allows this only in limited cases, including:

• to supply your services and run our business, including sharing with other carriers and providers where needed;
• with your consent, or where you would reasonably expect it;
• when someone calls 000, 112 or 106, so emergency services get the caller's details;
• to prevent or lessen a serious threat to someone's life or health;
• when the law requires or allows it, for example under a warrant, a court order or an authorised request from a law enforcement agency;
• to give information to the ACMA, ACCC, TIO or eSafety Commissioner to help them do their work;
• to give details to the phone number database (section 7).

Law enforcement and national security. Under the Telecommunications (Interception and Access) Act 1979, authorised agencies can ask for some information, such as subscriber details and metadata, without a warrant. They need a warrant to get the content of communications. We must also give police and other authorities reasonable help to enforce the criminal law, protect public revenue and safeguard national security. The law may stop us telling you about a request.

We record the disclosures the law requires us to record, and keep those records for 3 years. The Australian Information Commissioner monitors them.

7. Phone directories and the Integrated Public Number Database (IPND)

If we supply you with a phone number, including a mobile number, the law requires us to give details to the Integrated Public Number Database (IPND). Telstra runs the IPND as a condition of its carrier licence. We, or our wholesale supplier on our behalf, give the IPND:

• your phone number and name;
• the service address;
• whether the number is listed or unlisted, and for a listed number, the name and address to publish;
• whether the service is residential, business, government or charity, and the type of service (such as fixed, mobile or data-only).

The IPND is used by:

• emergency services, for example to help find you when you call 000;
• law enforcement and national security agencies;
• publishers of public phone directories, for listed numbers only;
• approved researchers doing non-commercial research on public health, electoral matters or Australian Government policy. In limited cases they can get unlisted mobile numbers and postcodes.

Listed or unlisted. You choose whether your number is listed in public phone directories, or unlisted (sometimes called a silent number). Unlisted numbers aren't given to directory publishers, but they're still in the IPND for emergency services and law enforcement. To check or change your choice, contact us.

You can ask us for a copy of your IPND record. We'll give it to you within 20 business days, and fix any mistakes for free.

8. Metadata we must keep (data retention)

The Telecommunications (Interception and Access) Act 1979 requires us to keep, or make sure someone keeps for us, certain information about your services and communications. This includes:

• your name, address and account details, and the services you have;
• who a communication was from and to (for example, the phone numbers involved, or the IP address your internet service was given);
• the date, time and length of a communication or internet session;
• the type of communication and service;
• the location of the equipment used (for example, which mobile tower a phone used).

It doesn't include the content of your communications or your web browsing history.

We must keep this information for at least 2 years after it's created. Account details are kept while your account is open and for at least 2 years after it closes. Some of this information may be kept for us by our wholesale suppliers. It must be encrypted and protected. The Privacy Act applies to it, so you can ask to see the metadata kept about you (section 18). Agencies can request it, as explained in section 6.

9. Transfers and keeping your number

Moving an nbn service to us. We use your AVC ID and your address's nbn location ID to transfer your existing nbn service. We may check with Vocus that the AVC ID matches your address. Your old provider's service ends when the transfer is complete.

Moving a phone number to us. We, through our wholesale supplier, give your current provider the details it needs to find your account and approve the transfer, such as the number, your name, and your account number or date of birth. Before a mobile number moves, we send a one-time code by SMS to that number. Only share that code with us, and only for that transfer.

Moving a number away from us. If you move a number to another provider, that provider sends us a request, and we share the details needed to complete it.

Moving a number is a high-risk transaction, so we check it's really you first (section 15).

10. Information that goes overseas

Our own team works in Australia, and the information you enter on our website is sent to our systems in Microsoft's Australia East region. But some companies we use handle information overseas.

Our wholesale suppliers, such as Vonex, Vocus and NBN Co, are Australian businesses. Their own privacy policies explain whether they send information overseas.

Before we use a service provider that handles personal information overseas, we take reasonable steps to make sure it protects that information in line with Australian privacy law. You can read Stripe's privacy policy.

11. Decisions made by computer programs

Our systems make some decisions automatically, or do things that are closely connected to a decision. These are the decisions that use personal information and could affect you.

A person, not a computer program alone, decides:

• whether to restrict, suspend or disconnect your service, including for unpaid bills or a breach of our Acceptable Use and Fair Use Policy;
• the result of a credit assessment;
• financial hardship applications;
• complaints.

If you think an automated decision is wrong, contact us and a person will review it.

12. Credit information

This section is our policy for managing credit information under Part IIIA of the Privacy Act.

When we do a credit assessment

We don't do routine credit checks. We only assess credit:

• before we supply a post-paid service with a minimum term longer than one month, such as a 24-month Home Wireless Broadband or 5G Home Broadband plan, as the telco consumer protection rules require; or
• for large business orders.

We ask for your consent first. A credit assessment may include getting a credit report from a credit reporting body. If we do, the credit reporting body records our request on your credit file.

We also give you credit when you pay off a modem in interest-free monthly repayments. We keep records of the repayment plan and your payments.

Apart from the details needed to ask for a credit report, we don't give information about you to credit reporting bodies. This means we don't report defaults or your repayment history to them.

The credit information we collect and hold

• Identification details, such as your name, date of birth, and current and previous addresses.
• That you've applied for credit with us, and its type and amount.
• Details of credit we give you, such as a modem repayment plan, and your repayments.
• Overdue payments and payment arrangements, in our own records.
• If we get a credit report: the information in it (such as past credit applications, defaults, court judgments and personal insolvency information), and what we work out from it, which is usually an assessment of whether you're likely to be able to pay.

How we collect and hold it

We collect credit information from you, from our own records, and from a credit reporting body if we get a credit report. We hold it with our other records, protected as described in section 15.

Why we use it

To assess your application, to manage credit we give you (such as modem repayments), to deal with overdue amounts in line with our Financial Hardship Policy policy, to handle complaints and correction requests, and to meet our legal obligations. We don't use credit reports for marketing.

Who we share it with

Only with you, people you authorise, service providers who store it for us (such as Microsoft), our professional advisers, the TIO and regulators, or where the law requires or allows it. Apart from asking for a credit report, we don't disclose credit information or credit reports to credit reporting bodies or other credit providers. We don't expect to disclose credit information or credit reports to anyone outside Australia, although Microsoft may access data from overseas, as explained in section 10.

Before and after a credit check

Before we get a credit report, we'll tell you the name and contact details of the credit reporting body we'll use. If we refuse your application wholly or partly because of a credit report, we'll tell you in writing, name the credit reporting body that gave us the report, and explain that you can get a free copy of your credit report from it.

You can ask a credit reporting body not to use your information for direct marketing pre-screening. You can also ask it to put a ban on your credit file if you think you've been, or are likely to be, a victim of fraud, including identity fraud.

Seeing and correcting your credit information

You can ask to see the credit information we hold about you, including any credit report. We'll respond within 30 days.

You can ask us to correct your credit information at any time, for free. We'll deal with your request within 30 days, or longer if you agree in writing. If we need to, we'll consult the credit reporting body or credit provider involved. We'll tell you the outcome in writing.

Credit complaints

If you complain about how we've handled your credit information, we'll acknowledge your complaint within 7 days and give you our decision within 30 days, or longer if you agree in writing. If you're not happy with the outcome, you can go to the TIO or the OAIC (section 19).

13. Our website: cookies, fonts and payment pages

Our website doesn't set cookies, and it doesn't use analytics or advertising trackers.

• Session storage. So you don't have to start again, our website keeps your address check and an unfinished order (your name, email, mobile, address, plan and connection details) in your browser's session storage. It stays on your device. Your browser deletes it when you close the tab, and our website stops using it after a set time (3 hours for an unfinished order, 20 hours for an address check). The unfinished order is cleared when you complete your order.
• Address checks. When you type an address, we send it to our wholesale supplier Vonex to find the address and check which nbn services are available there. We don't need your name for this.
• Fonts. Our pages use fonts from Google Fonts (fonts.googleapis.com and fonts.gstatic.com). To show them, your browser connects to Google, which receives your IP address and standard browser details. Google says no cookies are sent to the Google Fonts service.
• Payment pages. Online payments are made on Stripe's checkout page on stripe.com, not on our website. Stripe uses its own cookies and collects device details to prevent fraud. Stripe's privacy policy applies to what it collects.
• Our servers. Our website's servers use your IP address to stop misuse, for example by limiting how many orders or checks can be made in a short time. They may also keep technical logs so we can fix problems.
• Links. Our website links to other websites, such as government sites and speedtest.net. Their own privacy policies apply.

14. Marketing and how to opt out

We may tell you about our products, plans and offers.

• We only send marketing emails or texts with your consent, as the Spam Act 2003 requires.
• Every marketing email or text identifies us and has a free, easy way to unsubscribe. We act on unsubscribe requests within 5 working days.
• We don't make telemarketing calls to numbers on the Do Not Call Register unless you've agreed to them.
• You can stop marketing at any time: use the unsubscribe option in the message, or contact us.
• Opting out of marketing doesn't stop service messages, such as bills, order updates, outage notices, and usage and roaming alerts.
• We don't give or sell your details to other businesses for their marketing.

15. How we store and protect your information

We store personal information:

• in our systems on Microsoft Azure (Australia East region) and in Microsoft 365, including forms you email to us;
• with Stripe, for payments and billing;
• in our wholesale suppliers' systems, for your services.

We protect it in these ways:

• Multi-factor authentication. Before a high-risk change to your account, such as a SIM swap, a new eSIM, moving a number, changing your contact details or password, or adding an authorised representative, we check it's really you, usually with a one-time code sent to your phone or email. We don't charge for this.
• Change alerts. After a high-risk change, we let you know, unless that could put someone affected by family violence at risk.
• Email authentication. We only email from addresses ending in @flixlink.com.au (payment receipts may come from Stripe). Our email domain uses SPF, DKIM and DMARC, which helps stop scammers sending emails that pretend to be from us.
• Secure payments. Card payments are made on Stripe's secure, PCI DSS-certified payment pages, so your full card number never reaches us.
• Secure systems. Our website uses encrypted connections (HTTPS). The keys to our supplier and payment systems stay on our servers and are never sent to your browser.
• Limited access. Only people who need your information to do their job can access it.
• Protected metadata. The metadata we must keep (section 8) is encrypted and protected, as the law requires.

We'll never ask for your full card number, passwords or banking logins, or ask you to pay with gift cards or crypto. See Account Security and Scam Protection Policy for how to tell it's really us.

No system is completely secure. If you think your account or information has been misused, contact us straight away.

16. Data breaches

If we suspect a data breach, such as personal information being lost or accessed without permission, we act quickly to contain it and assess whether it's likely to cause serious harm. We complete that assessment within 30 days. If it's an eligible data breach under the Notifiable Data Breaches scheme in the Privacy Act, we'll tell you and the OAIC as soon as practicable, and explain what happened and what you can do to protect yourself.

If you're worried your identity information has been misused, IDCARE gives free support: call 1800 595 160 or visit idcare.org.

17. How long we keep information

We keep personal information only for as long as we need it for the purposes in this policy, or as long as the law requires. Some minimum periods are:

When we no longer need information and the law doesn't require us to keep it, we securely delete or destroy it, or remove anything that identifies you.

18. Seeing and correcting your information

You can ask to see the personal information we hold about you, including the metadata kept under the data retention law and your IPND record. Contact us (section 23).

• We'll check your identity first, to protect your information.
• We'll respond within 30 days.
• We don't charge you for asking. If giving you access takes significant work, such as finding a large amount of old records, we may charge a reasonable fee. We'll tell you the amount first.
• In some cases the law lets us refuse access, for example if it would unreasonably affect someone else's privacy or harm a law enforcement investigation. If we refuse, we'll tell you why in writing and how to complain.

If information we hold about you is wrong, out of date, incomplete or misleading, ask us to correct it. It's free, and we'll respond within 30 days. If you ask, we'll also tell organisations we shared it with. If we don't agree to correct it, we'll tell you why in writing, and you can ask us to attach a note to the information saying you think it's wrong.

For credit information, see section 12.

19. Making a privacy complaint

If you think we've mishandled your personal information or breached the Australian Privacy Principles, please tell us.

1. Contact us first. Email info@flixlink.com.au with 'Privacy complaint' in the subject, or call (02) 9071 2900. We handle privacy complaints under our complaints process. We'll acknowledge your complaint straight away if you make it by phone, or otherwise within 2 working days, and propose a resolution within 10 working days.
2. The TIO. If you are not satisfied with how we have handled your complaint, you have a right to take it to the Telecommunications Industry Ombudsman, which is a free and independent service. The TIO handles privacy complaints about phone and internet providers. Call 1800 062 058 or visit tio.com.au.
3. The OAIC. You can also complain to the Office of the Australian Information Commissioner (OAIC) if you're not satisfied with our response, or we haven't responded within 30 days. OAIC complaints must be in writing, and the OAIC may ask you to go to the TIO first. Lodge a complaint with the OAIC or call its enquiries line on 1300 363 992.

For complaints about credit information, the timeframes in section 12 apply.

20. Children

Some customers get a service, such as a mobile, for a child to use. The account holder is our customer and is responsible for the account. We take extra care with information about children and use it only to provide the service.

21. Extra care if you're affected by family violence

If you're affected by domestic, family or sexual violence, we can help keep your information safe. For example, we can agree on a safe way to contact you, and take extra care that your details aren't shared with someone who may harm you. You don't need to give us evidence. Our Domestic, Family and Sexual Violence Support Policy policy explains more privacy options, such as silent numbers.

22. Changes to this policy

We may update this policy, for example when the law or our services change. We'll publish the new version on our website with its effective date. If a change significantly affects how we handle your personal information, we'll also tell you by email or SMS before it takes effect.

23. Contact us

For privacy questions, requests or complaints, contact us. Our support hours are 9am to 6pm, Monday to Friday (Sydney time).

• Phone: (02) 9071 2900
• Email: info@flixlink.com.au (put 'Privacy' in the subject)
• Website: flixlink.com.au
• Flixlink Broadband Pty Ltd, ABN 44 669 575 679, trading as FlixLink Telecommunications

nbn® is a trade mark of NBN Co Limited.