Privacy Policy
1. Who this policy applies to
This policy applies to two groups of people:
- Contractors — sole traders, performers, artists, sportspeople, and other individuals whose superannuation contributions are processed through ContriPay.
- Employers — businesses and venues that use ContriPay to meet their superannuation obligations when engaging contractors.
Different information is collected from each group. Where this policy refers to both groups, it says “you.” Where it applies to one group only, it says “contractor” or “employer.”
2. What information we collect
From contractors
| Information | Why we collect it |
|---|---|
| Legal name | Required for SuperStream and for recipient created tax invoices (RCTIs) |
| Email address | To send invites, onboarding links, and RCTIs |
| Gender | Mandatory SuperStream field required by the clearing house |
| Date of birth | Mandatory SuperStream field required by the clearing house |
| Residential address | Mandatory SuperStream field required by the clearing house; also displayed on RCTIs where available |
| ABN | Required for RCTI and to confirm GST registration status |
| Stage name or act name | Optional; displayed on RCTIs where provided |
| Tax file number (TFN) | Required to route contributions to your super fund and, where necessary, to locate your stapled superannuation account |
| Bank account details (BSB and account number) | Required for super fund contribution processing via SuperStream |
| Super fund details (fund name, USI, member number) | Required to direct your super contribution to the correct fund |
From employers
| Information | Why we collect it |
|---|---|
| Business name and ABN | Required for SuperStream employer identification and RCTIs |
| Contact name, email address, and phone number | Account administration and SuperStream employer contact requirements |
| Refund bank account (BSB and account number) | Required by the clearing house to return funds if a super contribution cannot be processed |
| Stripe customer reference | Stored to identify the employer in Stripe's billing system — no payment credentials are stored by ContriPay |
| Subscription and billing records | Fee structure, included job count, and overage rates applied at the time of subscription — retained as an audit record |
| Default super fund details | Used as the fallback fund when a contractor has not nominated a fund and no stapled fund can be confirmed |
| Xero OAuth tokens | To post RCTIs to the employer's Xero account on their behalf |
3. How we collect information
We collect contractor information directly from contractors via the onboarding form linked in the invite email sent by their employer. Contractors provide their own details and submit them through the form.
We collect employer information directly from employers during account registration on contripay.com.au.
We do not collect personal information from third parties, data brokers, or public sources. The ABR JSON API is used to verify an ABN entered by the employer during registration — this is a lookup of publicly available information, not a collection of new information.
4. How we use personal information
We use personal information only for the purpose it was collected:
- To calculate, record, and submit superannuation contributions to the contractor's nominated fund via the SuperChoice clearing house
- To generate and deliver recipient created tax invoices to the contractor and post them to the employer's Xero account
- To communicate with contractors and employers about their account and contribution status
- To meet our obligations under the Superannuation Guarantee (Administration) Act 1992, the Superannuation Industry (Supervision) Act 1993, and related ATO rulings
We do not use personal information for marketing, profiling, or any purpose unrelated to superannuation processing. We do not sell personal information.
5. Cross-employer contractor records
ContriPay maintains a single record per contractor. If you are engaged by more than one employer that uses ContriPay, your existing details will be pre-filled into the onboarding form when a new employer invites you. This means you do not need to re-enter your information for each new engagement.
Employers cannot view your personal information until you have accepted their invite. Your details are never shared between employers or made available to any employer other than in connection with a specific job you have accepted.
6. Who we disclose information to
- SuperChoice Services Pty Limited (ABN 78 109 509 739)
Authorised representative of PayClear Services Pty Limited (ABN 93 124 852 320), AFSL 314357. SuperChoice processes and routes super contributions via SuperStream. PayClear holds contribution funds in transit prior to disbursement to the contractor's nominated fund. Employers should consider the SuperChoice Clearinghouse Combined Financial Services Guide and Product Disclosure Statement before using the service.
- Xero Limited
ContriPay posts RCTIs to the employer's Xero account using the employer's own Xero OAuth connection. Xero receives only the invoice data necessary to create the RCTI — contractor name, ABN, payment amount, and GST status.
- Resend Inc
Our transactional email provider. Resend delivers invite emails and RCTIs to contractors, and magic link authentication emails to employers. Resend processes email addresses and message content for delivery only.
- Stripe Inc
ContriPay's payment processor for platform subscription fees. Employer name, business name, and contact email are sent to Stripe to create a billing customer record. Payment credentials — bank account details for BECS direct debit, and card details for card payments — are submitted directly from your browser to Stripe and never pass through ContriPay's servers. Stripe stores payment credentials, manages invoicing, and handles failed payment retries and refunds. Stripe operates under its own privacy policy at stripe.com/au/privacy. ContriPay retains only a Stripe customer reference identifier against the employer record — no raw payment credentials are stored by ContriPay.
- The engaging employer
Once a contractor has accepted an invite, the employer can see the contractor's name, stage name, ABN, and GST status in connection with a specific job. The employer does not have access to the contractor's TFN, bank details, super fund member number, or other sensitive fields at any time.
We do not disclose personal information to any other third party unless required by law.
7. Tax file numbers
ContriPay collects TFNs under the authority of the Superannuation Industry (Supervision) Act 1993 and the Taxation Administration Act 1953. TFNs are collected solely for the purpose of processing super contributions and, where required, locating a contractor's stapled superannuation account.
Providing your TFN is voluntary. It is not an offence to decline. However, if you do not provide your TFN, your super fund may deduct additional tax from your contributions, and some types of contributions may not be accepted. If you have not nominated a fund and your TFN is needed to locate your stapled account, your contribution may not be able to be processed, or may be directed to an alternative fund.
TFNs are encrypted at rest using AES-256-GCM encryption. TFNs are never included in emails, logs, error messages, or any system output outside the encrypted database field. Your TFN is held for as long as your contractor record is active. This is because SuperStream requires that if a TFN is in our possession it must be included in every super contribution payload submitted on your behalf. Your TFN will be deleted when your contractor record is closed or deleted.
8. How we store and protect your information
All personal information is stored in Australia on Amazon Web Services infrastructure in Sydney (AWS region ap-southeast-2).
Sensitive fields are encrypted at rest using AES-256-GCM encryption before being written to the database. Encrypted fields include: TFN, bank BSB, bank account number, super fund member number, and Xero OAuth tokens.
Access to the database is controlled by row-level security policies. No personal information is accessible from the browser — all reads and writes go through authenticated server-side functions. Contractor data is only accessible using a valid, single-use, time-limited invite token or an authenticated account session.
We take reasonable steps to protect personal information from misuse, interference, loss, and unauthorised access. We will notify affected individuals and the Office of the Australian Information Commissioner in the event of an eligible data breach under the Notifiable Data Breaches scheme.
9. Retention and deletion
We retain contractor records for as long as the contractor has an active relationship with any employer on the ContriPay platform, and for the period required to meet our obligations under the Superannuation Guarantee (Administration) Act 1992 and ATO record-keeping requirements.
TFNs are retained for as long as the contractor record is active, as described in section 7.
If you request deletion of your record and we are not subject to a legal obligation to retain it, we will delete or de-identify your information within 30 days.
10. Your rights
Under the Australian Privacy Principles, you have the right to:
- Access — request a copy of the personal information we hold about you
- Correction — request that inaccurate or outdated information be corrected. Contractors can update their own details at any time via their account at contripay.com.au/account
- Deletion — request that we delete your personal information, subject to our legal retention obligations
- Complaints — make a complaint about how we have handled your personal information
We will respond to access and correction requests within 30 days.
11. Complaints
If you have a concern about how we have handled your personal information, contact us first using the details below. We will acknowledge your complaint within 5 business days and aim to resolve it within 30 days.
If you are not satisfied with our response, you can refer your complaint to the Office of the Australian Information Commissioner (OAIC) at oaic.gov.au or by calling 1300 363 992.
12. Changes to this policy
We may update this policy from time to time. Where a change is material, we will notify employers by email and update the effective date at the top of this page. Continued use of ContriPay after a policy update constitutes acceptance of the revised policy.
Contact
Nebulous Enterprises Pty Ltd
ABN 13 634 749 509 trading as ContriPay
Privacy enquiries: privacy@contripay.com.au
General enquiries: hello@contripay.com.au
Website: contripay.com.au