Privacy Notice

This Privacy Notice for Bamtech Lab Pty Ltd (ACN 699 027 668, ABN 50 699 027 668) trading as Captr ID ('we', 'us', or 'our') describes how and why we might access, collect, store, use, and/or share ('process') your personal information when you use our services ('Services'), including when you:

• Visit our website at https://www.captrid.com or any website of ours that links to this Privacy Notice
• Download and use our mobile application (CaptrID), or any other application of ours that links to this Privacy Notice
• Use CaptrID — a cloud-based credential photo capture and management platform designed for organisations such as registered training organisations (RTOs), schools, and government agencies. The platform consists of a web-based Admin Centre for managing organisations, users, and credentials, and companion mobile apps (iOS and Android) that enable distributed photo capture for ID cards and badges. Photos and credential data are captured, stored, and managed on behalf of subscribing organisations.
• Engage with us in other related ways, including any marketing or events

Questions or concerns? Reading this Privacy Notice will help you understand your privacy rights and choices. We are responsible for making decisions about how your personal information is processed. If you do not agree with our policies and practices, please do not use our Services. If you still have any questions or concerns, please contact us at [email protected].

1. What Information Do We Collect?

Personal information you disclose to us

In Short: We collect personal information that you provide to us.

We collect personal information that you voluntarily provide to us when you register on the Services, express an interest in obtaining information about us or our products and Services, when you participate in activities on the Services, or otherwise when you contact us.

Personal Information Provided by You. The personal information that we collect depends on the context of your interactions with us and the Services, the choices you make, and the products and features you use. The personal information we collect may include the following:

• Names
• Email addresses
• Passwords
• Contact or authentication data
• Organisation and company names

Sensitive Information. We do not process sensitive information.

Payment Data. We may collect data necessary to process your payment if you choose to make purchases, such as your payment instrument number and the security code associated with your payment instrument. All payment data is handled and stored by Stripe. You may find their privacy notice here: https://stripe.com/au/privacy.

Application Data. If you use our application(s), we also may collect the following information if you choose to provide us with access or permission:

• Mobile Device Access. We may request access or permission to certain features from your mobile device, including your mobile device's camera and other features. If you wish to change our access or permissions, you may do so in your device's settings.
• Mobile Device Data. We automatically collect device information (such as your mobile device ID, model, and manufacturer), operating system, version information and system configuration information, device and application identification numbers, browser type and version, hardware model, Internet service provider and/or mobile carrier, and Internet Protocol (IP) address (or proxy server). If you are using our application(s), we may also collect information about the phone network associated with your mobile device, your mobile device's operating system or platform, the type of mobile device you use, your mobile device's unique device ID, and information about the features of our application(s) you accessed.
• Push Notifications. We may request to send you push notifications regarding your account or certain features of the application(s). If you wish to opt out from receiving these types of communications, you may turn them off in your device's settings.

This information is primarily needed to maintain the security and operation of our application(s), for troubleshooting, and for our internal analytics and reporting purposes.

All personal information that you provide to us must be true, complete, and accurate, and you must notify us of any changes to such personal information.

Information automatically collected

In Short: Some information — such as your Internet Protocol (IP) address and/or browser and device characteristics — is collected automatically when you visit our Services.

We automatically collect certain information when you visit, use, or navigate the Services. This information does not reveal your specific identity (like your name or contact information) but may include device and usage information, such as your IP address, browser and device characteristics, operating system, language preferences, referring URLs, device name, country, location, information about how and when you use our Services, and other technical information. This information is primarily needed to maintain the security and operation of our Services, and for our internal analytics and reporting purposes.

The information we collect includes:

• Log and Usage Data. Log and usage data is service-related, diagnostic, usage, and performance information our servers automatically collect when you access or use our Services and which we record in log files. Depending on how you interact with us, this log data may include your IP address, device information, browser type, and settings and information about your activity in the Services (such as the date/time stamps associated with your usage, pages and files viewed, searches, and other actions you take such as which features you use), device event information (such as system activity, error reports, and hardware settings).
• Device Data. We collect device data such as information about your computer, phone, tablet, or other device you use to access the Services. Depending on the device used, this device data may include information such as your IP address (or proxy server), device and application identification numbers, location, browser type, hardware model, Internet service provider and/or mobile carrier, operating system, and system configuration information.

Information from external directory and identity services

If your organisation chooses to connect an external directory service (such as Microsoft Entra ID), a data platform (such as Airtable), a student information system or its broker (such as Wonde or aXcelerate), or an automated provisioning provider via the SCIM 2.0 protocol (such as Okta, PingOne, OneLogin, or JumpCloud) to CaptrID, we will process roster and directory data — such as names, email addresses, employee or student IDs, and department information — on behalf of and as directed by the subscribing organisation. With directory sync, CaptrID fetches data from the provider; with SCIM provisioning, the provider pushes data to CaptrID. Where a broker such as Wonde is used, your school authorises CaptrID's access to its own data through that broker. In every case, data is processed at the organisation's instruction and is not collected by us independently. These remain your organisation's systems, not our sub-processors. See Section 10 for more information about data collected on behalf of subscribing organisations.

Photos imported from cloud storage services

If an authorised user chooses to import photos from a cloud storage service (such as Microsoft OneDrive or Google Drive), the user authenticates directly with the cloud provider via an OAuth popup. CaptrID then downloads the selected photo files on behalf of the user. We do not store the user's cloud storage credentials or maintain ongoing access to their cloud account — authentication is limited to the import session. The imported photos are stored within CaptrID and treated identically to photos uploaded from a local device.

Photo quality and face detection

In Short: When you capture a photo in our app, your device performs basic face detection to help you take a good-quality ID photo. This happens on your device, is used only for quality feedback, and is never used to recognise or identify you.

When you take a photo using the CaptrID mobile app, the app uses on-device face detection to give you real-time feedback on photo quality — for example, whether a face is present and roughly centred, whether the eyes appear open, and whether the head is reasonably straight. This helps you produce a usable, consistent ID photo.

This processing:

• runs on your device — it is not sent to us for this purpose;
• is used only to give you quality feedback while you take the photo;
• is temporary — the results are held in memory, used to show on-screen guidance, and then discarded. We do not store, log, or transmit any face-detection data. Only the photo you choose to submit is uploaded.

We do not:

• create or store a face template, 'faceprint', or biometric identifier;
• use your photo or face for facial recognition, matching, verification, identity confirmation, or liveness checks;
• attempt to identify who you are from your face.

Server-side photo processing

In Short: When you submit a photo, it is processed on our Australian servers to check its quality. We keep the photo and a quality score — never a face template. It is never used to recognise or identify you.

The checks described above happen on your device while you are taking the photo. Separately, when a photo is submitted to CaptrID — whether captured in our app, uploaded, or imported — it is processed on our servers in Australia to check its quality (for example sharpness, lighting, resolution and framing) and, where your organisation chooses, to standardise it for printing (such as adjusting the framing or background).

This server-side processing:

• runs in Australia (Google Cloud Run, Sydney) on our own self-hosted engine — no third-party facial-recognition or vision service is used;
• happens in memory to produce a quality result and the finished photo;
• results in us retaining the submitted photo (under your organisation's retention policy) and a quality score — we do not store facial landmarks, measurements, bounding boxes, or any face template;
• includes server-side face detection (whether a face is present, its size, centring and rough pose) only where your organisation has enabled it — this is off by default;
• is for photo quality only, and is never used for facial recognition, matching, verification, or identification.

2. How Do We Process Your Information?

In Short: We process your information to provide, improve, and administer our Services, communicate with you, for security and fraud prevention, and to comply with law. We may also process your information for other purposes with your consent.

We process your personal information for a variety of reasons, depending on how you interact with our Services, including:

• To facilitate account creation and authentication and otherwise manage user accounts. We may process your information so you can create and log in to your account, as well as keep your account in working order.
• To deliver and facilitate delivery of services to the user. We may process your information to provide you with the requested service.
• To respond to user inquiries/offer support to users. We may process your information to respond to your inquiries and solve any potential issues you might have with the requested service.
• To send administrative information to you. We may process your information to send you details about our products and services, changes to our terms and policies, and other similar information.
• To protect our Services. We may process your information as part of our efforts to keep our Services safe and secure, including fraud monitoring and prevention.
• To evaluate and improve our Services, products, marketing, and your experience. We may process your information when we believe it is necessary to identify usage trends, determine the effectiveness of our promotional campaigns, and to evaluate and improve our Services, products, marketing, and your experience.
• To comply with our legal obligations. We may process your information to comply with our legal obligations, respond to legal requests, and exercise, establish, or defend our legal rights.

3. Who We Share Your Information With, and Whose Systems It Moves Between

In Short: We may share information in specific situations described in this section and/or with the following third parties.

Sub-processors we engage

We engage the following third-party providers to operate our Services. These are our sub-processors: we select them, they process your information on our behalf and on our instructions, and they are contractually obligated to protect your data.

Our Security & Sub-Processors page carries the same list with the lawful basis we rely on for each and a direct link to each provider's data processing agreement.

This is distinct from the systems your organisation connects to CaptrID — such as its directory, student information system, or cloud storage. Those remain your organisation's own services under its own agreements, and are described separately below.

Your organisation's own connected systems (organisation-initiated)

Separately from our sub-processors above, a subscribing organisation may connect its own systems to CaptrID. These remain the organisation's services, held under the organisation's own agreements with those vendors. They are not CaptrID sub-processors — we do not select or instruct them, and we hold no contract with them on your behalf. Access is initiated and controlled by the subscribing organisation, not by us.

Systems we receive data from. If an organisation connects a directory service (such as Microsoft Entra ID), a data platform (such as Airtable), a student information system or its broker (such as Wonde or aXcelerate), or an automated provisioning provider via SCIM 2.0 (such as Okta, PingOne, OneLogin, or JumpCloud), personal data from that system is synchronised with CaptrID at the organisation's direction. With directory sync, CaptrID fetches data from the provider; with SCIM, the provider pushes data to a CaptrID endpoint using a bearer token managed by the organisation. Where a broker such as Wonde is used, the school approves CaptrID's access to its own data through that broker. Similarly, if an authorised user imports photos from a cloud storage service (such as Microsoft OneDrive or Google Drive), selected files are downloaded at the user's direction via a session-scoped OAuth authentication. In each case data flows into CaptrID — we do not disclose your information to these systems.

Systems we send data to, at the organisation's instruction. Some organisations ask CaptrID to write data back to their own systems. Where an organisation configures and enables this:

• an approved photograph may be uploaded to the organisation's own student management system (such as aXcelerate) — off by default and triggered by an administrator;
• card numbers and the matching user identifier may be sent to the organisation's own print-management server (such as PaperCut), so that issued ID cards work for secure print release.

In both cases the destination is a system the organisation already operates, and the transfer happens on its documented instruction.

Business transfers

We may share or transfer your information in connection with, or during negotiations of, any merger, sale of company assets, financing, or acquisition of all or a portion of our business to another company.

Data location

All core application data — including user accounts, organisation data, photos, and credential records — is stored in Australia (Sydney, ap-southeast-2 region). Some third-party service providers operate outside Australia as noted in the table above. Where data is transferred outside Australia, it is protected by the provider's data processing agreements and applicable privacy safeguards.

4. How Long Do We Keep Your Information?

In Short: We keep your information for as long as necessary to fulfil the purposes outlined in this Privacy Notice unless otherwise required by law.

We will only keep your personal information for as long as it is necessary for the purposes set out in this Privacy Notice, unless a longer retention period is required or permitted by law (such as tax, accounting, or other legal requirements). No purpose in this notice will require us keeping your personal information for longer than the period of time in which users have an account with us.

When we have no ongoing legitimate business need to process your personal information, we will either delete or anonymise such information, or, if this is not possible (for example, because your personal information has been stored in backup archives), then we will securely store your personal information and isolate it from any further processing until deletion is possible.

Organisation-configured data retention

Subscribing organisations may configure data retention policies for photo sessions and credential data within the platform. These policies determine how long session data (including photos and personal records) is retained before being automatically archived or deleted. The subscribing organisation is responsible for configuring retention settings appropriate to their requirements and obligations.

Organisations and their administrators may also request deletion of specific individual records at any time through the platform's built-in erasure tools.

5. How Do We Keep Your Information Safe?

In Short: We aim to protect your personal information through a system of organisational and technical security measures.

We have implemented appropriate and reasonable technical and organisational security measures designed to protect the security of any personal information we process. These include:

• Encryption of data in transit (TLS/HTTPS) and at rest
• Row-level security policies ensuring organisation-scoped data isolation
• Role-based access controls with configurable permissions
• Immutable audit logging of significant actions
• Secure cloud infrastructure with regional hosting options

However, despite our safeguards and efforts to secure your information, no electronic transmission over the Internet or information storage technology can be guaranteed to be 100% secure, so we cannot promise or guarantee that hackers, cybercriminals, or other unauthorised third parties will not be able to defeat our security and improperly collect, access, steal, or modify your information. Although we will do our best to protect your personal information, transmission of personal information to and from our Services is at your own risk. You should only access the Services within a secure environment.

6. Information About Minors

In Short: We do not knowingly collect data directly from children. Where minors' data is processed, it is collected on behalf of and under the authority of the subscribing organisation.

We do not knowingly collect personal information directly from, solicit data from, or market to children under 18 years of age. Only authorised users (administrators and capturers) who are 18 years or older may create accounts and use the Services.

However, CaptrID is used by organisations such as schools and training providers that may capture photos and personal information of individuals under 18 as part of their credential programmes. In these cases:

• The subscribing organisation acts as the data controller for minors' personal information
• The subscribing organisation is responsible for obtaining appropriate consent or establishing an alternative legal basis for processing minors' data
• CaptrID processes this data solely on behalf of and as directed by the subscribing organisation
• Requests regarding a minor's personal data should be directed to the relevant subscribing organisation in the first instance

If you become aware of any data we may have collected inappropriately from children under age 18, please contact us at [email protected].

7. What Are Your Privacy Rights?

In Short: You may review, change, or terminate your account at any time, depending on your country, province, or state of residence.

Withdrawing your consent: If we are relying on your consent to process your personal information, which may be express and/or implied consent depending on the applicable law, you have the right to withdraw your consent at any time. You can withdraw your consent at any time by contacting us by using the contact details provided in Section 12 below.

However, please note that this will not affect the lawfulness of the processing before its withdrawal nor, when applicable law allows, will it affect the processing of your personal information conducted in reliance on lawful processing grounds other than consent.

Account information

If you would at any time like to review or change the information in your account or terminate your account, you can:

• Log in to your account settings and update your user account
• Contact us using the contact information provided
• Contact your organisation administrator to request account updates or deletion

Upon your request to terminate your account, we will deactivate or delete your account and information from our active databases. However, we may retain some information in our files to prevent fraud, troubleshoot problems, assist with any investigations, enforce our legal terms and/or comply with applicable legal requirements.

If you have questions or comments about your privacy rights, you may email us at [email protected].

8. Cookies, Analytics and Do-Not-Track

In Short: Our marketing website uses privacy-friendly analytics, and a small number of pages set one advertising measurement cookie. The CaptrID application itself uses no tracking cookies.

The CaptrID application

The CaptrID admin portal and mobile app do not use cookies or similar technologies for advertising, profiling, or cross-site tracking. Any storage used is strictly necessary to keep you signed in and to maintain your session. Roster data, photographs, and credential records are never shared with an analytics or advertising provider.

Our marketing website (captrid.com)

We use two measurement tools on our public website:

• Plausible Analytics — privacy-friendly website analytics, used on all pages. Plausible sets no cookies, does not collect personal information, and does not track visitors across websites. It reports only aggregate figures such as page views and referral sources.
• Google Ads conversion measurement — loaded only on our home page, pricing page, contact page, and product landing pages. It sets a first-party cookie (_gcl_au, retained for approximately 90 days) so we can tell whether a visit that began with one of our advertisements led to an enquiry or a trial sign-up.

We use this measurement only to understand which advertising is worth continuing. We do not use it to build profiles of individuals, we do not sell or share the data, and it is never combined with the roster data, photographs, or credential records we process on behalf of subscribing organisations.

How to refuse or remove these cookies

You can block or delete cookies through your browser settings, and our website remains fully functional without them. You can also manage Google's advertising cookies at Google Ads Settings. Because Plausible sets no cookies, there is nothing to refuse.

Do-Not-Track

Most web browsers and some mobile operating systems and mobile applications include a Do-Not-Track ('DNT') feature or setting you can activate to signal your privacy preference not to have data about your online browsing activities monitored and collected. At this stage, no uniform technology standard for recognising and implementing DNT signals has been finalised. As such, we do not currently respond to DNT browser signals or any other mechanism that automatically communicates your choice not to be tracked online. If a standard for online tracking is adopted that we must follow in the future, we will inform you about that practice in a revised version of this Privacy Notice.

9. Do Other Regions Have Specific Privacy Rights?

In Short: You may have additional rights based on the country you reside in.

Australia

We collect and process your personal information under the obligations and conditions set by Australia's Privacy Act 1988 (Privacy Act).

This Privacy Notice satisfies the notice requirements defined in the Privacy Act, in particular: what personal information we collect from you, from which sources, for which purposes, and other recipients of your personal information.

If you do not wish to provide the personal information necessary to fulfil their applicable purpose, it may affect our ability to provide our services, in particular:

• Offer you the products or services that you want
• Respond to or help with your requests
• Manage your account with us
• Confirm your identity and protect your account

At any time, you have the right to request access to or correction of your personal information. You can make such a request by contacting us using the details provided in Section 12.

If you believe we are unlawfully processing your personal information, you have the right to submit a complaint about a breach of the Australian Privacy Principles to the Office of the Australian Information Commissioner.

10. Data Collected About Third-Party Individuals

In the course of using the CaptrID platform, authorised users may capture, upload, and manage photographs and personal information (such as names and identification numbers) of third-party individuals, including students, employees, and other credential subjects.

This data is collected and processed on behalf of the subscribing organisation, which acts as the data controller for such information. CaptrID processes this data solely as directed by the subscribing organisation and does not use it for any independent purpose.

The subscribing organisation is responsible for ensuring that appropriate consents or legal bases are in place for the collection and use of third-party personal information, including where the data subjects are minors.

Requests from third-party individuals regarding their personal data should be directed to the relevant subscribing organisation in the first instance.

11. Do We Make Updates to This Notice?

In Short: Yes, we will update this notice as necessary to stay compliant with relevant laws.

We may update this Privacy Notice from time to time. The updated version will be indicated by an updated 'Last updated' date at the top of this Privacy Notice.

Where a change is material — to this Privacy Notice, to our Terms of Service, or to the sub-processors we engage — we will notify customer account administrators by email at least 30 days before it takes effect, giving a reasonable opportunity to object. We will not rely on you noticing a changed date. The same commitment is set out on our Security & Sub-Processors page.

12. How Can You Contact Us About This Notice?

If you have questions or comments about this notice, you may email us at [email protected] or contact us by post at:

Bamtech Lab Pty Ltd (ACN 699 027 668, ABN 50 699 027 668)
Unit 1, 86 Carselgrove Avenue
Fitzgibbon, Queensland 4018
Australia

13. How Can You Review, Update, or Delete the Data We Collect From You?

You have the right to request access to the personal information we collect from you, details about how we have processed it, correct inaccuracies, or delete your personal information. You may also have the right to withdraw your consent to our processing of your personal information. These rights may be limited in some circumstances by applicable law.

Account deletion

You can delete your account and associated personal data at any time:

• In-app: Use the "Delete Account" option in your profile settings (Admin Portal) or app settings (mobile app)
• By email: Send a request to [email protected] with the email address associated with your account

For full details on what data is deleted and processing timelines, see our Data Deletion page.

To request to review or update your personal information, please contact us at [email protected].