Privacy Policy

NANOTAG AUSTRALIA PRIVACY POLICY
DRAFT FOR REVIEW | Prepared 13 October 2026

Replace every item in square brackets and complete the publication checklist at the end before publishing. The checklist and suggested form notices are separate from the public privacy policy.

PUBLIC PRIVACY POLICY BEGINS

Last updated: 13 Oct 2026

  1. Who we are

NanoTag Australia is operated by KYROH Property Pty Ltd, ABN 89 684 986 936, of Building 45, 28 Barcoo St, Roseville NSW 2069, Australia (NanoTag Australia, we, us or our).

This policy explains how we collect, hold, use and disclose personal information through our Australian registration service, customer accounts, subscriptions, customer support and authorised law enforcement and insurance investigator portal. It applies to personal and corporate registrations and to both Free Basic and Premium customers.

It covers register.nanotagaustralia.com.au and lea.nanotagaustralia.com.au. Other websites, agencies and service providers may have their own privacy policies.

We manage personal information in accordance with the Australian privacy laws that apply to us, including the Privacy Act 1988 (Cth) and Australian Privacy Principles where applicable. This policy does not remove your rights under applicable law.

  1. Information we collect

Depending on the services you use, we may collect:

  • Account and contact information: your name, email address, telephone number, postal or street address, account type and account identifiers.
  • Corporate registration information: company name and relevant business contact details, together with information about the person authorised to register or manage the account.
  • Registration information: NanoTag numbers, kit or product type, registration dates, account associations and registration history.
  • Asset information you choose to provide through available inventory features: item descriptions, serial numbers, vehicle identification numbers, purchase details, values, photographs and insurance information.
  • Theft and recovery information: reported status, incident dates and locations, police report references, relevant police station details, descriptions and recovery updates.
  • Subscription information: your selected plan, subscription status, payment-provider references and transaction records.
  • Communications and privacy preferences: support enquiries, complaints, requests, permission choices and records of consent or withdrawal.
  • Security and technical information: IP addresses, browser and device information, session details, login attempts and activity records needed to operate and protect the service.

For applicants and users of the restricted investigator portal, we may also collect names, work contact details, agency or employer details, professional identifiers, verification correspondence, access decisions, authentication records, case references, search purposes and investigation notes entered into the portal.

We do not ask customers to upload identity documents, health information or other sensitive information merely to register a kit. Please avoid including unnecessary personal information about yourself or other people in photographs, descriptions or incident reports. Where sensitive information is reasonably necessary, we will collect it only with consent or another lawful basis. Allegations of criminal conduct and investigation material require particular care.

  1. How we collect information

We usually collect information directly from you when you register, manage your account, add an asset, report a theft or recovery, make a payment, apply for investigator access or contact us.

We may also receive relevant information from an authorised representative, an approved investigator, a payment or technical service provider, or another source where the collection is lawful and reasonably necessary for our services. We take reasonable steps to notify you about indirect collection when required, unless an applicable exception permits otherwise.

You may browse general information and make general enquiries anonymously or using a pseudonym where practicable. We need accurate identifying and contact information to establish a registration account, connect a NanoTag number to its registered contact, administer a subscription or verify restricted investigator access. If you do not provide information required for a particular service, we may be unable to provide that service or contact you about recovered property.

If you provide information about another person, you must have appropriate authority to do so and give them access to this policy. We remain responsible for meeting our own privacy obligations.

  1. Why we use information

We use personal information to:

  • Create and administer accounts and personal or corporate registrations.
  • Associate NanoTag numbers with registered contacts and maintain accurate registration records.
  • Provide inventory, theft-reporting, recovery and subscription features where available under your plan.
  • Assist with property identification, lawful investigations and contacting registered owners about recovered property.
  • Verify, approve and manage restricted investigator accounts and monitor authorised access.
  • Process subscriptions, keep financial records and resolve payment enquiries.
  • Send account, security, registration, payment and recovery communications.
  • Respond to enquiries, privacy requests and complaints.
  • Protect accounts and systems, investigate misuse and maintain service reliability.
  • Meet applicable legal obligations and manage disputes.

A NanoTag registration or database result is a record supplied to assist identification. It is not conclusive proof of legal ownership, theft, criminal conduct or insurance entitlement. Absence of a theft report does not establish that an item has not been stolen.

  1. Free Basic, Premium and corporate accounts

Our privacy protections apply regardless of your membership level. Payment is not required to request access to or correction of your personal information, make a privacy complaint or manage an optional police-recovery permission.

Free Basic accounts provide registration and the identification features described for that plan. They do not provide customer theft-reporting or the Premium private inventory features. Premium accounts may include additional asset, insurance, theft and recovery information because you choose to use those features.

Corporate registrations initially collect company and authorised contact information together with the applicable registration details. Additional corporate inventory features will be explained before they are introduced.

Ending a Premium subscription does not automatically delete registration records, remove an existing theft report or revoke a separate privacy permission. Contact us or use the available account controls to request a correction, report recovery, withdraw permission or request account closure.

  1. Police access and recovery assistance

The restricted portal is intended for independently verified, approved users acting for authorised purposes. It is not a public owner directory.

Approved police users can search using a NanoTag number. Depending on the registration and the search, a result may include registration status, relevant matching item information and a reported theft or recovery status. Access is limited to information relevant to the permitted purpose, and searches and contact disclosures are recorded against the investigator’s account, case reference and purpose.

You may separately choose to permit disclosure of your registered name, telephone number and email address to verified police users for identifying you and contacting you about property identification, investigation or recovery involving your registered NanoTag numbers. This permission is optional, applies to both Free Basic and Premium accounts, and is not a condition of registration. It does not authorise marketing or insurer access to your contact details.

You may withdraw this permission through the available account controls or by contacting us. Withdrawal stops future disclosures relying on that permission once processed. It does not reverse an earlier lawful disclosure or prevent a disclosure independently required or permitted by law.

If you have not given this permission, an officer may ask us to review a request. We assess the circumstances and disclose information only where there is an independent lawful basis. This may include a disclosure required by an Australian law or court order, or a disclosure reasonably necessary for an enforcement-related activity where the applicable legal requirements are met. We limit such disclosures to what is reasonably necessary and keep the required records.

The standard portal does not automatically disclose your address, photographs, asset valuations, insurance policy details, private incident narratives or unrelated inventory to investigators. A separate request for additional information requires its own assessment and lawful basis.

An authorised police user may make a permitted report or retain information under their agency’s procedures. Once information has been lawfully disclosed, the recipient’s handling of its copy is governed by the laws and policies applicable to that recipient.

  1. Insurance investigator access

Approved insurance investigators have restricted access for authorised property-identification or investigation purposes. Their approval does not make them a police officer or give them unrestricted access to customer records.

The standard insurer portal does not disclose owner names, telephone numbers or email addresses. Your optional police-recovery permission does not authorise disclosure to an insurer.

We assess any separate request for owner contact details or other private information and disclose it only with appropriate consent or another lawful basis. An insurer’s request or portal approval alone does not establish that basis.

  1. Other disclosures and service providers

We may disclose the information reasonably necessary to service providers engaged to provide hosting, secure backups, email delivery, payment processing, technical support and professional services. We select providers and manage access with regard to the information involved and our legal obligations.

We may also disclose information to an authorised representative, where you direct us to do so, or where disclosure is required or permitted by applicable law. We do not make registration records publicly searchable or sell them as marketing lists.

Payment card details are handled through [CONFIRMED PAYMENT PROVIDER] when paid subscriptions are enabled. Our registration service receives the transaction and subscription information needed to administer your account, rather than storing full card numbers or card security codes. The payment provider’s own privacy notice is available at [PROVIDER PRIVACY POLICY LINK].

Information is not automatically shared with every business using the NanoTag name. Any integration with a separate registry or new recipient will be assessed, explained and supported by an appropriate lawful basis before it is enabled.

  1. Storage and overseas handling

Our registration and investigator services use Hostmate in Australia. Backups are stored in Australia.

Where we disclose personal information to an overseas recipient, we take the steps required by applicable Australian privacy law. We do not treat your use of the website or acceptance of this policy as a waiver of overseas-disclosure protections.

  1. Cookies and website technologies

Our websites use cookies and similar technologies needed for functions such as signing in, maintaining sessions and protecting accounts. Security logs may record information about visits and attempts to access the service.

You can manage cookies through your browser settings. Disabling necessary cookies may prevent login or other account functions. External websites linked from our services have their own privacy and cookie practices.

  1. Marketing communications

Creating an account or acknowledging this policy does not automatically subscribe you to promotional messages. We will seek separate permission for promotional email or SMS communications where required and comply with applicable privacy and electronic marketing laws.

You can withdraw marketing permission using the unsubscribe option in a promotional message or by contacting us. We will action electronic marketing unsubscribe requests within five working days, without charging a fee or requiring you to log in. Essential service and security communications may continue while relevant to your account; they will not be used to bypass your marketing choice.

  1. Security

We take reasonable technical and organisational steps to protect personal information from misuse, interference, loss and unauthorised access, modification or disclosure. These include controlled staff access, account authentication, secure connections, restricted investigator permissions, access logging and backup management appropriate to the service.

The investigator portal requires additional authenticator verification for approved users. This does not mean that customer registration accounts currently use SMS verification.

No online service can guarantee complete security. Keep your password and authentication codes private, use a unique password and tell us promptly if you believe your account has been accessed without authority.

  1. Retention and account closure

We retain personal information only for as long as reasonably necessary for the purposes described in this policy or to meet applicable legal requirements.

Retention depends on the type of record and its purpose. Active registration records may be needed to identify a registered contact if property is recovered. Unresolved theft reports may remain relevant after a subscription ends. Transaction records may need to be retained to meet financial obligations. Verification, consent, complaint, security and investigation records are retained for their relevant operational and legal purposes.

We review retained information and take reasonable steps to securely destroy or de-identify it when it is no longer needed and no applicable law or court or tribunal order requires retention. This includes managing retained copies and backups appropriately.

If you request account closure or deletion, we will explain what can be removed, what must or may lawfully be retained and the reason. Closing an account is not necessarily the same as immediately deleting every record or backup. We will also explain any effect on recovery contact services.

  1. Access and correction

Contact us to request access to personal information we hold about you or to ask us to correct information that is inaccurate, out of date, incomplete, irrelevant or misleading. You can also update information using available account controls.

We may reasonably verify your identity before providing information or making changes. We will not charge you for making an access request or for correcting your personal information. If a lawful, reasonable charge is proposed for providing access, we will explain it before proceeding.

We aim to respond within 30 calendar days. If more time is reasonably needed, we will explain the delay. Where access or correction cannot be provided, we will explain the reason and available complaint options, except where the law permits us to withhold that explanation. Applicable rights to have a statement associated with disputed information and to request notification of a correction will be respected.

  1. Privacy complaints and data breaches

If you are concerned about our handling of personal information, contact our Privacy Officer using the details below. Please explain your concern and the outcome you seek, without including unnecessary sensitive information.

We will acknowledge your complaint, investigate it and aim to provide a substantive response within 30 calendar days. If the matter takes longer, we will keep you informed.

If our response does not resolve your concern, you may contact the Office of the Australian Information Commissioner at www.oaic.gov.au or on 1300 363 992 where the matter falls within its jurisdiction. Other complaint or legal rights may also apply.

We assess suspected data breaches and take appropriate containment and remedial steps. Where the Notifiable Data Breaches scheme applies and notification is required, we notify affected individuals and the OAIC as required by law and provide relevant protective advice.

  1. Changes and contact details

We review this policy when our services, information handling or applicable requirements change. We publish the current version and its update date on our websites. Where required, we provide additional notice or seek fresh consent before materially changing how information is used or disclosed. Updating this policy does not retrospectively create consent.

Privacy Officer
KYROH Property Pty Ltd trading as NanoTag Australia
Email: info@nanoatagaustralia.com.au
Post: Building 45, 28 Barcoo St
Roseville NSW 2069
Australia

You can request a free copy of this policy in another reasonably available format.

PUBLIC PRIVACY POLICY ENDS

PUBLICATION CHECKLIST — INTERNAL NOTES, DO NOT PUBLISH

This is a tailored draft, not certification that every Australian law is satisfied. Have an Australian privacy lawyer review the final policy, business arrangements and implemented controls before enabling live registration or investigator contact disclosure. Privacy wording does not replace website terms, subscription and cancellation terms, Australian Consumer Law obligations, agency access agreements or applicable state and territory requirements.

  1. Confirm the full legal operator name associated with the supplied ABN 89 684 986 936. Address supplied: Building 45, 28 Barcoo St, Roseville NSW 2069, Australia. Privacy email supplied: info@nanoatagaustralia.com.au. Check this spelling before publication because its domain differs from nanotagaustralia.com.au used by the websites. Confirm the mailbox is monitored for privacy requests.
  2. Confirm Privacy Act coverage, including applicable exceptions and contracts. Do not assume the small-business exemption applies simply because turnover is below $3 million. Corporate or government contracts may add requirements.
  3. Match the implemented features to the policy. Latest LEA package supports optional police contact permission for BOTH Basic and Premium, insurer contact restrictions and separate legal-basis reviews. Verify those controls in the deployed sites before publishing these promises.
  4. Implement separate, unticked police and marketing choices. Keep permission version, date and withdrawal records. Do not make police-recovery permission compulsory for registration.
  5. Establish a privacy request and complaints process, breach response procedure, independently verified investigator approval and access suspension process. Restrict staff access and protect backup keys. Test that private information is excluded from unauthorised results and that permission withdrawal works.
  6. Use a short collection notice at registration and a tailored notice for investigator applications, including required fields, consequences and overseas disclosures. A footer policy link alone does not explain every collection event.
  7. Review disclosures before introducing the separate nanotag.com.au registry integration. Do not promise a successful master-registry connection unless registration write support and data handling are confirmed.
  8. Review automated decision-making transparency requirements taking effect on 10 December 2026 if computer-assisted decisions could significantly affect individuals’ rights or interests. A simple lookup is not automatically such a decision; assess the actual features and decisions.
  9. Decide whether minors may hold accounts or be registered contacts, and establish an appropriate process before accepting their registrations. Do not assume a checkbox establishes a child’s capacity to consent.
  10. Restrict investigator free-text notes to necessary case information. Confirm relevant agency agreements, independent identity checks and any requirements for protected audit records. The plugin’s logs are not immutable against someone with full hosting/database control.

SUGGESTED FORM NOTICES — REVIEW AND CONFIGURE BEFORE USE

A. Short customer registration collection notice

[LEGAL ENTITY NAME], trading as NanoTag Australia, collects your contact and NanoTag registration information to create your account, identify the registered contact and support property identification and recovery. Premium features collect additional information you choose to provide about your assets and reported incidents. Required fields are marked; without them we may be unable to register your kit or contact you about recovered property. Relevant information may be disclosed to approved investigators and service providers as explained in our Privacy Policy. Our Privacy Policy explains investigator access, optional police contact permission, access and correction rights, and how to complain. Privacy enquiries: info@nanoatagaustralia.com.au.

Link the words “Privacy Policy” to the published policy. Place this notice beside the registration form, not only in the footer.

B. Optional police-recovery permission — separate unticked checkbox

I permit NanoTag Australia to disclose my registered name, telephone number and email address to independently verified, approved police users for property identification, investigation and recovery involving my registered NanoTag numbers. This permission is optional for both Free Basic and Premium accounts. I can withdraw it through my account or by contacting NanoTag Australia. Withdrawal does not undo an earlier lawful disclosure or prevent a disclosure independently required or permitted by law. This permission does not include insurer access or marketing.

C. Optional marketing permission — separate unticked checkbox, only if marketing is enabled

I would like to receive NanoTag Australia product news and offers by email. I can unsubscribe at any time.

Use a separate SMS choice if promotional SMS is later introduced. Do not combine these choices with acceptance of subscription terms.

OFFICIAL REFERENCE MATERIAL — FOR REVIEW, NOT PART OF THE PUBLIC POLICY

Australian Privacy Principles, including policy content, collection, use, disclosure, security, access and correction:
https://www.oaic.gov.au/privacy/australian-privacy-principles/read-the-australian-privacy-principles

OAIC APP 1 guidance, including overseas recipient countries:
https://www.oaic.gov.au/privacy/australian-privacy-principles/australian-privacy-principles-guidelines/chapter-1-app-1-open-and-transparent-management-of-personal-information

OAIC APP 6 guidance, including consent and enforcement-related disclosure records:
https://www.oaic.gov.au/privacy/australian-privacy-principles/australian-privacy-principles-guidelines/chapter-6-app-6-use-or-disclosure-of-personal-information

OAIC APP 11 guidance on security and destruction/de-identification:
https://www.oaic.gov.au/privacy/australian-privacy-principles/australian-privacy-principles-guidelines/chapter-11-app-11-security-of-personal-information

ACMA information about electronic marketing and spam:
https://www.acma.gov.au/avoid-sending-spam

OAIC information about Notifiable Data Breaches:
https://www.oaic.gov.au/privacy/notifiable-data-breaches

Check legal requirements again at publication and whenever the service changes.

Scroll to Top