Privacy Policy

VendorMatch is an Australian online marketplace that connects customers with independent event vendors and service providers. References to VendorMatch, we, us or our mean the operator of vendormatch.com.au.

Privacy enquiries can be sent to support@vendormatch.com.au.

We handle personal information in accordance with applicable Australian privacy laws, including the Privacy Act 1988 (Cth) and the Australian Privacy Principles where they apply to us.

We only seek to collect information reasonably needed to operate, secure and improve VendorMatch, provide marketplace features, manage subscriptions, communicate with users and comply with legal obligations.

Depending on how you use VendorMatch, we may collect:

• Account information, such as your name, email address, account role, authentication identifiers and account status.
• Vendor business information, such as business name, contact details, business description, categories, service areas, website or social links, business identifiers such as an ABN if provided, profile photos, gallery images and availability.
• Customer event information, such as event type, event date, suburb or location, guest count, budget information and the details included in a quote request.
• Marketplace activity, such as saved vendors, enquiries, quote status, booking status, review eligibility, reviews, vendor responses and account preferences.
• Communications, including messages between customers and vendors, support requests and information you send to us.
• Quote information, including quote totals, package names, deposit amounts and due dates, expiry dates, messages and PDF quotes uploaded by vendors.
• Location information, such as a suburb, postcode or service area you enter. If you choose to use device location features, we may process device-provided location information after you grant permission.
• Subscription and billing information, such as subscription status, plan, billing period, Stripe customer or subscription identifiers and payment status. Stripe processes payment-card details. VendorMatch does not need to store your full card number.
• Technical information, such as IP address, browser or device information, timestamps, authentication and security logs, error information and basic usage data generated when you interact with the service.

We do not intend to collect sensitive information unless it is reasonably necessary and permitted by law. Please avoid placing unnecessary sensitive personal information in public profiles, messages or uploaded documents.

We may collect personal information:

• directly from you when you create or update an account;
• when a vendor creates or edits a business listing;
• when a customer sends an enquiry, saves a vendor or leaves a review;
• when customers and vendors message or send quotes through VendorMatch;
• when a vendor uploads images or a PDF quote;
• when you contact support;
• through authentication providers such as Google if you choose social sign-in;
• from payment processors in relation to VendorMatch subscription billing; and
• automatically through our website, hosting, authentication and security systems.

We may use personal information to:

• create and manage customer and vendor accounts;
• publish and maintain vendor profiles;
• match customers with vendors by category and service area;
• process enquiries and make them available to the relevant vendor;
• enable messaging between customers and vendors;
• create, upload, deliver, preview and manage quotes;
• manage quote acceptance, deposit workflow and booking status;
• operate saved vendors, reviews, ratings and vendor responses;
• manage free and paid vendor plans, trials and subscription access;
• send essential transactional and account notifications;
• provide customer and vendor support;
• detect misuse, fraud, security threats and policy violations;
• moderate listings, reviews and accounts;
• maintain, troubleshoot and improve the platform;
• create aggregated or de-identified business and product insights; and
• comply with legal obligations and respond to lawful requests.

VendorMatch is designed to facilitate communication between customers and vendors. This means some personal information is necessarily shared with another marketplace user.

For example, when a customer sends an enquiry, the relevant vendor may receive the customer's name and event details. When a vendor sends a quote, the relevant customer may receive the vendor's business details, quote information, message and any uploaded PDF quote.

Public vendor profiles may be viewed without an account and can include information the vendor chooses to publish, such as business name, description, category, service area, gallery images and public reviews.

Users must only use another person's information for legitimate purposes connected with the enquiry, booking or service relationship and must not misuse, sell or unlawfully disclose that information.

VendorMatch does not collect or hold money paid by customers to vendors for event services. Those payments are arranged directly between the customer and vendor.

VendorMatch may use Stripe to process payments for VendorMatch's own vendor subscriptions or paid platform features. Stripe processes card details under its own privacy and security practices. We may receive limited billing information from Stripe, such as transaction or subscription status and identifiers required to administer the account.

We may disclose or make personal information available to service providers where reasonably necessary to operate VendorMatch. These may include:

• Google / Firebase for authentication, databases, file storage and related cloud infrastructure;
• Stripe for VendorMatch subscription billing and payment processing;
• Resend and email infrastructure providers for transactional emails and account notifications;
• hosting, security, monitoring and technical service providers;
• professional advisers such as lawyers, accountants or insurers where required;
• regulators, courts, law enforcement or government agencies where disclosure is required or authorised by law; and
• a purchaser or successor if the VendorMatch business is legitimately sold, reorganised or transferred, subject to applicable law.

We do not sell personal information to advertisers.

Some technology providers we use operate globally. Although our Firebase database may be configured to use Australian infrastructure for certain data, personal information may also be processed or disclosed outside Australia through authentication, payment, email, support or infrastructure providers.

Overseas recipients or provider infrastructure may be located in the United States, Japan and other countries in which Google, Stripe, Resend or their service providers operate. Provider locations and subprocessors can change over time.

Where Australian Privacy Principle 8 applies, we will take reasonable steps required by law in relation to cross-border disclosure of personal information.

We use administrative, technical and organisational safeguards designed to protect personal information against misuse, interference, loss and unauthorised access, modification or disclosure.

These measures may include authenticated access, role-based access controls, database and storage security rules, restricted server-side operations, encrypted network connections and access controls provided by our cloud service providers.

Uploaded vendor quote PDFs are intended to be private to the relevant vendor and customer rather than publicly accessible marketplace content.

No internet or storage system is completely secure. Users should keep passwords and devices secure and contact us promptly if they suspect unauthorised account access.

We retain personal information only for as long as reasonably necessary for the purposes described in this Policy, including operating accounts, maintaining marketplace and booking records, resolving disputes, preventing fraud, complying with legal obligations and maintaining legitimate business records.

Closing an account does not necessarily require immediate deletion of every record. We may retain information where reasonably necessary for legal, security, fraud-prevention, dispute or record-keeping purposes. Where information is no longer required and we are legally permitted to do so, we may delete or de-identify it.

VendorMatch and our service providers may use cookies, browser storage and similar technologies that are necessary for authentication, security, session management, preferences and operation of the site.

If we introduce additional analytics or advertising technologies that materially change how information is collected or used, we will update this Policy and provide any notices or choices required by law.

We may send essential service communications such as account verification, enquiries, quote notifications, important message notifications, booking or status updates, security notices and support communications.

These operational messages are different from optional marketing communications. If we send marketing communications, we will provide opt-out mechanisms where required by law.

You can update some account and business information directly through VendorMatch. You may also request access to personal information we hold about you or ask us to correct information that is inaccurate, out-of-date, incomplete, irrelevant or misleading.

Contact support@vendormatch.com.au and provide enough information for us to identify the relevant account and request. We may need to verify your identity before giving access or making a correction.

In some circumstances the law permits or requires us to refuse access or correction. If that occurs, we will provide the response required by applicable law.

If you believe VendorMatch has mishandled your personal information, contact support@vendormatch.com.au with details of your concern.

We will review the complaint, may request further information and will aim to respond within a reasonable period. If the Privacy Act applies to the matter and you are not satisfied with our response, you may be entitled to contact the Office of the Australian Information Commissioner.

We maintain processes for responding to suspected data breaches. Where the Notifiable Data Breaches scheme applies and a breach meets the legal threshold for notification, we will take the steps required by applicable law, which may include notifying affected individuals and the Office of the Australian Information Commissioner.

VendorMatch accounts and marketplace transactions are intended for people aged 18 years and over. We do not knowingly invite children to create marketplace accounts or enter vendor service transactions through VendorMatch.

Vendor profiles or messages may contain links to external websites or social media pages. VendorMatch is not responsible for the privacy practices of external sites. You should review their privacy policies before providing information to them.

We may update this Policy as VendorMatch, our service providers or applicable laws change. The current version will be published on this page with the date of the latest update. Where appropriate or required by law, we will provide additional notice of material changes.

For privacy questions, access or correction requests, complaints or account-data enquiries, contact: