Privacy Policy

Last updated: March 2025

1.1 Purpose and scope

This Privacy Policy describes how Tucked collects, uses, stores and discloses personal information when you visit our website, contact us, sign up for our services or otherwise interact with us. It applies to all personal information we handle, whether collected online or offline. Under the updated Australian privacy laws that came into force on 10 June 2025, businesses must be transparent about how they handle personal information and are subject to stricter consent requirements and new consumer rights such as data erasure and data portability.

1.2 What information we collect

We may collect the following types of personal information:

• Contact and identification details: your name, email address, telephone number, postal address and other contact information you provide when you fill out our online forms, call us or send us an email.
• Property and energy information: details about your household, property or business premises (e.g. location, roof type, energy usage) that help us determine whether you are eligible for energy incentives or suitable energy products.
• Interactions with our services: information you provide when you request quotes from energy partners or respond to our questionnaires, any communications between you and Tucked or between you and our partners, and any feedback you give us.
• Technical information: device identifiers, IP addresses, browser type, geolocation (to the extent permitted), session duration and browsing behaviour (e.g. cookies and similar technologies). We use cookies and tracking tools to remember your preferences and measure the effectiveness of our marketing. You may disable cookies in your browser, but this might limit the functionality of our website.

We do not knowingly collect sensitive personal information (such as health information, biometric data or information about race or sexuality) unless you voluntarily provide it and we have a valid legal basis to collect it.

1.3 How we collect information

We collect personal information:

• Directly from you: when you submit a request for an energy comparison, sign up for newsletters, participate in surveys, contact us by phone or email or otherwise interact with our services.
• From third parties: where you have authorised us to obtain information from energy retailers, solar installers or government programmes in order to assess your eligibility or provide tailored quotes. In certain cases we may also collect marketing lists from reputable providers, but we remain responsible for ensuring consent was obtained and that the data is used compliantly.
• Automatically: through the use of cookies and other tracking technologies that collect information about your interactions with our website. We do not use tracking pixels to profile users unless we have obtained your consent and provided clear disclosures about how tracking works and how you can opt out.

1.4 Why we collect your information and how we use it

We collect and use personal information for the following purposes:

• Providing and improving our services: to match you with suitable energy providers, to facilitate quotes or applications and to respond to your enquiries.
• Marketing and communications: to send you updates about rebates, energy offers or other products and services we think may interest you. Under Australian spam laws, we must obtain consent before sending marketing messages. Every marketing message will clearly identify us as the sender and provide an easy way to unsubscribe.
• Legal compliance: to comply with laws, including the Privacy Act, the Spam Act and any orders of courts or regulatory authorities.
• Analytics and improvement: to analyse website traffic, understand how users interact with our website and improve our content and services. Data used for analytics will be aggregated or de-identified wherever possible.
• Business operations: to manage our internal operations, including record-keeping, risk management, audit and training.

1.5 Lawful bases for processing and consent

Under the Privacy Act and the 2024-2025 reforms, we must have a lawful basis to collect and use personal information. Our lawful bases include:

• Consent: We will ask for your consent for marketing communications or when collecting sensitive information. Consent must be freely given, specific, informed and unambiguous. We do not use pre-ticked boxes or bundled consent.
• Contract: Where we need your information to provide our services, such as connecting you with energy providers.
• Legal obligations: To comply with our obligations under Australian law, including the Spam Act and data breach notification requirements.
• Legitimate interests: To operate and improve our business while balancing your privacy rights.

You have the right to withdraw your consent at any time by contacting us or using the unsubscribe facility in our communications.

1.6 How we disclose your information

We may disclose your personal information to:

• Energy comparison providers and partners: to enable them to provide you with quotes and services. We only share information necessary for them to contact you and provide an accurate quote.
• Service providers: such as web-hosting companies, IT support, marketing agencies and data-analytics providers who perform services on our behalf.
• Regulators and law enforcement: where required by law, court order or to comply with lawful requests from government agencies.
• Potential buyers or investors: in the context of a sale, merger or reorganisation of our business.

We do not sell or rent your personal information to third parties for their own marketing.

1.7 International data transfers

Our websites and services may be hosted on servers outside Australia or involve partners located overseas. Before we disclose your personal information to an overseas recipient, we will take reasonable steps to ensure that the recipient does not breach the Australian Privacy Principles (APPs).

1.8 Security of your information

We implement technical and organisational measures to protect personal information from misuse, loss and unauthorised access, modification or disclosure. This includes secure servers, encryption, access controls and staff training. Despite these measures, no method of transmission or storage is completely secure. We will destroy or permanently de-identify your personal information when we no longer need it.

1.9 Data retention

We keep personal information only as long as reasonably necessary to fulfil the purposes described above, comply with legal requirements, resolve disputes and enforce our agreements. When your information is no longer needed, we will delete or de-identify it in accordance with our retention schedule and the Privacy Act.

1.10 Your rights and choices

Australian privacy law gives you certain rights with respect to your personal information. Under the 2025 reforms, individuals may:

• Access: request a copy of the personal information we hold about you.
• Correction: ask us to correct any inaccurate, outdated or incomplete information.
• Erasure: request that we delete your personal information when it is no longer necessary or when consent has been withdrawn.
• Data portability: request that we provide your personal information in a structured, commonly used and machine-readable format.
• Withdraw consent: opt out of receiving marketing communications. All marketing emails include an unsubscribe link and we will honour opt-out requests within 5 business days.
• Opt out of profiling: you can request not to be subject to significant decisions based solely on automated processing.
• Complain: if you believe we have breached your privacy rights, you may lodge a complaint with us or with the OAIC.

1.11 Complaints handling

If you have a complaint about how we have handled your personal information, please contact us and provide as much detail as possible. We will acknowledge your complaint within 2 business days and aim to resolve it within 10 business days. If you are not satisfied with our response, you may lodge a complaint with the OAIC or an approved external dispute resolution scheme.

1.12 Contact us

If you have any questions, requests or complaints about this Privacy Policy, please reach out.

1.13 Changes to this Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in laws, regulations or our practices. The most recent version will always be available on our website, and updates will take effect immediately upon posting. By continuing to use our services after any changes, you agree to the revised policy.