About this Privacy Policy
Universal Apps Pty Ltd ACN 622 689 794, trading as menumiz (“menumiz”, “we”, “our” or “us”), respects the privacy of individuals and is committed to handling personal information responsibly, transparently and securely.
This Privacy Policy explains how we collect, hold, use, disclose, secure, retain and provide access to personal information in connection with:
We are subject to the Privacy Act 1988 (Cth) and the Australian Privacy Principles (“APPs”). In relation to the Document Verification Service, we also comply with applicable requirements under the Identity Verification Services Act 2023 (Cth), the Identity Verification Rules, applicable DVS access policies and our DVS participation arrangements.
This Privacy Policy applies to personal information about individuals. Information relating solely to a business may not be personal information unless it identifies, or is reasonably capable of identifying, an individual.
Who this policy applies to
This Privacy Policy applies to personal information about:
menumiz primarily provides business-to-business services. Our business services are not directed to children. We do not knowingly conduct a DVS identity check on a child without appropriate consent and authority.
Our role when processing information for a business
In some circumstances, a business using menumiz determines what customer or employee information is entered into the menumiz platform and how that information is used.
Where we process personal information on behalf of a business customer, that business may have separate privacy obligations and may be responsible for deciding why the information is collected and used.
This Privacy Policy applies to menumiz’s own handling of personal information. It does not replace the privacy policy or privacy obligations of a restaurant, café, merchant, employer, payment provider or other third party.
Types of personal information we collect
Depending on the services used and the person’s relationship with us, we may collect the following categories of information.
Identity and contact information
This may include:
Business information
This may include:
Identity-document and KYC information
Where identity verification is reasonably necessary or required for menumiz Pay, fraud prevention, legal compliance or another approved function, we may collect:
We will only collect government-related identifiers where permitted by law and reasonably necessary for our functions or activities, or where required or authorised by law.
Financial and transaction information
This may include:
Full payment-card information may be processed directly by an authorised payment provider and may not be stored by menumiz.
Technical and usage information
This may include:
Location information
Where a location-enabled service is used, we may collect approximate or precise location information to:
Location permissions can generally be controlled through the device settings. Disabling location services may prevent some features from operating.
Information about customers of menumiz businesses
Where a customer places an order, makes a booking, joins a loyalty program, makes a payment or interacts with a business through menumiz, we may process:
How we collect personal information
We may collect personal information:
Where practical, we collect personal information directly from the relevant individual.
If personal information is provided to us about another person, the person providing it must be authorised to do so and must ensure that the other person has received any required privacy notice and provided any required consent.
Why we collect and use personal information
We may collect, hold, use and disclose personal information to:
We will not use DVS identification information or DVS match information for advertising, direct marketing, behavioural profiling or market research.
menumiz Pay, KYC and identity verification
When a person applies for menumiz Pay or another service requiring identity verification, we may conduct KYC, fraud-prevention, eligibility and identity checks.
The information required may include:
We will only collect information reasonably necessary for the relevant verification, compliance or payment-service purpose.
Providing false, misleading, incomplete or unauthorised identity information may result in an application being delayed, declined, suspended or reported where required by law.
Document Verification Service
What the DVS is
The Document Verification Service (“DVS”) is a secure Australian identity-verification service that checks whether information provided from an identity document matches information held by the relevant government document issuer or official record holder.
A DVS response generally indicates that the submitted information:
The DVS match result does not provide menumiz with a copy of the government agency’s underlying official record.
When we may use the DVS
We may use the DVS only where:
Possible approved uses may include verifying the identity of a person applying for menumiz Pay or confirming the identity of a business owner, director, beneficial owner, authorised representative or other person whose identity must be verified.
We do not use the DVS merely because it is convenient. We assess whether identity verification and use of a government-related identifier are reasonably necessary for the relevant function.
Express consent before a DVS check
We will not initiate a DVS identity check unless the individual, or a person lawfully authorised to act for that individual, has first provided informed and express consent.
DVS consent must be:
Before requesting consent, we will explain:
Consent to a DVS check will be obtained separately from consent to receive marketing communications.
Authority to provide document information
A person submitting identity-document details must confirm that:
We may request evidence of that authority.
Capacity to consent
We take reasonable steps to ensure that the person giving consent has the capacity to understand what is proposed.
Where appropriate, this may involve:
Consequences of declining DVS consent
An individual may decline consent to a DVS check.
Where a DVS check is reasonably necessary or required to provide menumiz Pay or another regulated or identity-dependent service, we may be unable to approve, activate or continue that service without completing an acceptable identity-verification process.
Where reasonably practicable and legally permitted, we may offer an alternative verification process. An alternative method may take longer or require additional documentary evidence.
Declining DVS consent will not, by itself, enrol the individual in marketing or result in the individual’s identity information being used for another unrelated purpose.
Parties involved in a DVS check
Depending on the verification arrangement, identification information and related match data may be handled by categories of entities including:
The particular document issuer involved will depend on the document selected for verification.
Restrictions on DVS information
Identification information obtained for a DVS check and Information Match Data will not be used for:
We will not use a DVS match result as the sole evidence of identity in civil or criminal proceedings to which the individual is a party.
We will not publicly represent that a DVS match guarantees that a person is who they claim to be. A match indicates only that the submitted document information matched the relevant official record.
Government-related identifiers
We do not adopt a government-related identifier as our own customer or account identifier unless permitted by law.
We only use or disclose government-related identifiers where:
Government-related identifiers are not used for general customer matching, advertising or analytics.
Who we may disclose personal information to
We may disclose personal information to the extent reasonably necessary to:
We require service providers handling personal information on our behalf to protect it and use it only for authorised purposes.
We do not sell identity-document details or DVS information.
Information displayed to customers of a menumiz business
To enable a business to advertise, sell and provide its goods or services, information selected by the business may be displayed to its customers, including:
Business users are responsible for ensuring that information they choose to publish is accurate and appropriate for public disclosure.
Information not ordinarily displayed to restaurant customers
Unless the information is intentionally published by the business, authorised by the relevant individual, or disclosure is required or permitted by law, we do not ordinarily display to restaurant customers:
Marketing
We may use business contact information to communicate about menumiz products, services, updates and offers where permitted by law.
An individual may opt out of marketing by:
Opting out of marketing does not prevent us from sending essential service, account, security, payment, legal or compliance communications.
Identity-document information, government-related identifiers, DVS Information Match Data and DVS match results are not used for marketing.
We will not use a business name or logo in a public client list or promotional material without appropriate authority or another lawful basis.
Cookies, analytics and online technologies
Our websites and applications may use cookies, software development kits, pixels and similar technologies to:
Browser or device settings may allow cookies or similar technologies to be restricted. Some features may not operate correctly when these technologies are disabled.
Information collected through analytics or advertising services is not combined with DVS Information Match Data for advertising, profiling or market research.
Overseas disclosure and access
Some general menumiz service providers or related companies may be located outside Australia, including in jurisdictions in which menumiz related entities, cloud providers, support providers or technology providers operate.
Before disclosing personal information overseas, we take reasonable steps required by applicable privacy law to ensure that the recipient handles it appropriately.
DVS access is subject to stricter controls. We will not permit personnel or entities located outside Australia or New Zealand to access or use the DVS or DVS Information Match Data unless:
Security
We take reasonable technical and organisational measures to protect personal information against misuse, interference, loss, unauthorised access, modification and disclosure.
Depending on the information and system involved, controls may include:
Only authorised personnel with a legitimate operational requirement may access identity-document information, DVS data or KYC records.
Users must keep their credentials confidential and notify us immediately of suspected unauthorised access or account compromise.
DVS logging, monitoring and compliance
We maintain records reasonably necessary to demonstrate compliant DVS use, which may include:
We may monitor DVS access and use to detect unauthorised activity and verify compliance.
We cooperate with lawful DVS compliance reviews and audits. Our DVS use may be subject to annual audits, compliance reporting and independent audits requested by the Framework Administrator.
Data retention and destruction
We retain personal information only for as long as reasonably necessary for:
Retention periods vary according to the type of record and applicable legal or contractual requirements.
When personal information is no longer required and we are not legally or contractually required to retain it, we take reasonable steps to securely destroy it or permanently de-identify it.
Where practical, we minimise the amount of identity-document information stored. A DVS verification result may be retained separately from a full copy of the identity document.
Data breaches and security incidents
We maintain procedures for responding to suspected or actual privacy and security incidents.
Where an incident involves DVS access, credentials, Information Match Data, a suspected vulnerability or unauthorised use, we will promptly escalate and notify the relevant Gateway Service Provider, Framework Administrator or other required party in accordance with applicable requirements.
Where the Privacy Act’s Notifiable Data Breaches scheme applies, we will assess the incident and notify the Office of the Australian Information Commissioner and affected individuals where required.
Where we are informed that a DVS-related breach is reasonably likely to result in serious harm, we will take reasonable steps to notify affected individuals as required.
Suspected security incidents may be reported to:
Access and correction
An individual may request:
Requests may be sent to legal@menumiz.com.
We may need to verify the requester’s identity before processing a request. We will respond within a reasonable period and, where required, provide written reasons if access or correction is refused.
A DVS match result may indicate only whether submitted information matched an official record. If the official government record appears inaccurate, the individual may need to contact the relevant document issuer directly to request correction.
Anonymity and pseudonyms
Where lawful and practicable, an individual may interact with us anonymously or using a pseudonym.
This may not be practicable where:
Privacy and DVS complaints
An individual may complain about:
Complaints should include sufficient information for us to investigate and should be sent to:
Privacy Officer
Universal Apps Pty Ltd trading as menumiz
Email: legal@menumiz.com
Postal address: 121 King St Melbourne VIC 3000 Australia
We will:
A person may also contact the Office of the Australian Information Commissioner regarding an Australian privacy complaint.
Complaints relating to the accuracy of an official identity record may need to be directed to the government agency or document issuer responsible for that record.
Third-party websites and services
Our applications and websites may link to third-party websites or services.
Those third parties are responsible for their own privacy practices. We recommend reviewing their privacy policies before providing personal information.
This Privacy Policy does not apply to information independently collected or controlled by a third party, except to the extent menumiz remains legally responsible for that information.
Accuracy of information
We take reasonable steps to ensure that personal information we collect, use and disclose is accurate, up to date, complete and relevant.
Individuals and business users should promptly update information through their account or contact us when details change.
We may suspend or delay a service where information required for identity, payment, security or legal compliance is incomplete, inconsistent or appears inaccurate.
Changes to this Privacy Policy
We may update this Privacy Policy to reflect:
The current version will be published on our website and will state its effective date.
Where a change materially affects how sensitive, identity or DVS information is handled, we will provide additional notice where reasonably practicable or legally required.
Contact us
Questions about this Privacy Policy or our handling of personal information may be directed to:
Privacy Officer
Universal Apps Pty Ltd trading as menumiz
Email: legal@menumiz.com
Support: support@menumiz.com
Postal address: 121 King St Melbourne VIC 3000 Australia
