PRIVACY POLICY

WolfX

Effective: 19 May 2026 | Version 1.0

WolfX App Pty Ltd (ACN 694 194 655 / ABN 23 694 194 655) (trading as WolfX) (we, us or our) is committed to protecting your privacy and handling your Personal Information in accordance with the *Privacy Act 1988 (Cth) (*Privacy Act) and the Australian Privacy Principles (APPs).

This Privacy Policy explains how we collect, hold, use, disclose, and protect your Personal Information when you access or use our website at www.wolfxapp.com, our WolfX mobile application, and any related services (together, the Platform), including when you use the Carpool Feature, the Marketplace Feature, the Podcast Feature, and the broader social and community features of the Platform.

By accessing or using the Platform, you acknowledge that you have read and understood this Privacy Policy. Where we rely on your consent to collect or use your Personal Information, you may withdraw that consent at any time by contacting us using the details in clause 15.

OPERATIVE PROVISIONS

1. About this Privacy Policy

This Privacy Policy applies to all Personal Information we collect about you through the Platform, whether collected directly from you or from third party sources.

This Privacy Policy should be read together with our Website Terms of Use, Mobile App Terms of Use, Acceptable Use Policy, Website Disclaimer, and Cookie Policy. Those related documents govern specific aspects of how the Carpool Feature, the Marketplace Feature, the Podcast Feature, and associated moderation data are handled.

We may update this Privacy Policy from time to time. Any changes will be posted on the Platform with an updated effective date. Where the changes are material, we will use reasonable endeavours to notify you before the changes take effect.

2. Definitions and interpretation

Definitions

In this Privacy Policy, the following definitions apply:

Accountmeans a user account created by a Student User to access and use the Platform.
APPsmeans the Australian Privacy Principles set out in Schedule 1 to the Privacy Act.
Carpool Featuremeans the carpool matching functionality of the Platform that connects Student Users sharing university-related or other journeys, as further described in our Acceptable Use Policy and Mobile App Terms of Use.
Carpool Matchmeans a connection or pairing between Student Users facilitated through the Carpool Feature.
Data Breachmeans any unauthorised access to, or unauthorised disclosure or loss of, Personal Information that we hold.
Marketplace Featuremeans the functionality of the Platform that allows Student Users to list, advertise, sell, buy, hire, or trade goods, services, and side ventures, as further described in our Mobile App Terms of Use and Acceptable Use Policy.
Moderation Recordsmeans the stored records of User Content reviewed by us under our content moderation programme, together with associated metadata (including reviewer decisions, enforcement actions, and timestamps).
Notifiable Data Breachhas the meaning given to "eligible data breach" in Part IIIC of the Privacy Act.
OAICmeans the Office of the Australian Information Commissioner.
Personal Informationhas the meaning given in section 6 of the Privacy Act, being information or an opinion about an identified individual, or an individual who is reasonably identifiable, whether the information or opinion is true or not, and whether the information or opinion is recorded in a material form or not.
Platformmeans the WolfX website at www.wolfxapp.com, the WolfX mobile application, and any related services operated by us.
Podcast Contentmeans audio recordings, audio files, podcast metadata, transcripts, show notes, artwork, and other materials submitted to, or generated through, the Podcast Feature.
Podcast Featuremeans the podcast hosting, recording, and distribution functionality made available through the Platform.
Privacy Actmeans the Privacy Act 1988 (Cth) and any regulations or subordinate instruments made under it, as amended from time to time.
Privacy Policymeans this Privacy Policy, as amended from time to time.
Sensitive Informationhas the meaning given in section 6 of the Privacy Act, and includes (among other things) information about a person's health, racial or ethnic origin, religious beliefs, sexual orientation, and biometric information.
Student Usermeans a person who is at least 18 years of age and a current or recently enrolled student at a Tertiary Institution, who has registered for an Account.
Tertiary Institutionmeans a university, TAFE, or other tertiary education institution recognised by us from time to time.
User Contentmeans any content, data, materials, listings, requests, messages, profile information, photographs, Podcast Content, or other materials that you submit, post, upload, or otherwise make available through the Platform.

Interpretation

In this Privacy Policy, unless the context otherwise requires:

  1. headings are for convenience only and do not affect interpretation;

  2. the singular includes the plural and vice versa;

  3. a reference to a person includes a corporation, partnership, joint venture, association, government body, or other entity;

  4. a reference to a statute, regulation, or other law includes all amendments, consolidations, and replacements;

  5. a reference to writing includes email; and

  6. where a word or expression is given a particular meaning, other parts of speech and grammatical forms of that word or expression have a corresponding meaning.

3. Information we collect

The types of Personal Information we collect about you depend on how you interact with the Platform. We may collect and hold the following categories of Personal Information.

Information you provide to us includes:

  1. account registration information, including your name, email address (which may include your Tertiary Institution email address), mobile telephone number, username, password, and date of birth (for age verification);

  2. student verification information, including your Tertiary Institution, course of study, year of study, student identification number, and the outcome of any verification check we (or a third party student verification provider engaged by us) conduct;

  3. identity verification information, including any government-issued identification you provide and, if you offer Carpool Matches, your driver licence and vehicle registration details;

  4. payment and billing information, processed through our third party payment provider and (where you subscribe or transact through an app store) through the Apple App Store or the Google Play Store;

  5. profile information, including any profile picture, display name, biographical details, course or interest areas, and preferences you choose to provide;

  6. User Content that you create, list, post, upload, or share through the Platform, including Marketplace listings, Podcast Content, messages to other Student Users, and posts within community features;

  7. Carpool data, including your pick-up and drop-off locations, journey times, routes, vehicle details (if you offer Carpool Matches), and any cost-sharing or rating information you submit;

  8. communications you send to us, including support requests, feedback, and correspondence; and

  9. any other information you voluntarily provide to us through the Platform.

Information we collect automatically includes:

  1. device and browser information, including your IP address, device type, operating system, browser type, and unique device or advertising identifiers;

  2. usage data, including pages and features accessed, time spent on the Platform, Carpool Matches submitted or accepted, Marketplace listings viewed or transacted, Podcast Content played, referring URLs, search terms, and clickstream data;

  3. approximate location data derived from your IP address or, where you have provided consent through the in-app permissions, precise location data from your device (for example, to support pick-up and drop-off coordination through the Carpool Feature); and

  4. cookie and tracking technology data, as described in our Cookie Policy.

Information we receive from third parties: we may receive Personal Information about you from third party sources, including identity and student status verification providers, payment processors (including the Apple App Store and the Google Play Store), mapping providers, podcast distribution platforms, analytics providers, advertising networks, and social login providers (where you choose to sign in through a third party account).

Sensitive Information: we do not generally seek to collect Sensitive Information about you. You should not submit Sensitive Information to the Platform other than where reasonably necessary for an arrangement (for example, an allergy or medical condition disclosed for the purpose of a Carpool Match). Where we do collect Sensitive Information, we will only do so with your consent and where the collection is reasonably necessary for, or directly related to, one or more of our functions or activities, unless an exception under APP 3.4 applies.

4. How we collect your information

We collect Personal Information:

  1. directly from you, when you register for an Account, build a profile, submit User Content, offer or accept a Carpool Match, list or transact through the Marketplace Feature, upload Podcast Content, make a payment, contact us, or otherwise provide information to us;

  2. automatically, through cookies, analytics tools, and similar technologies when you access or interact with the Platform; and

  3. from third parties, as described in clause 3 above.

Where it is reasonable and practicable to do so, we will collect Personal Information directly from you. We will not collect Personal Information by unlawful or unfair means.

If we receive Personal Information about you that we did not solicit, we will deal with that information in accordance with APP 4, including by destroying or de-identifying the information where it is lawful and reasonable to do so.

At or before the time we collect Personal Information from you, or as soon as practicable after, we will take reasonable steps to notify you of the matters set out in APP 5 (including the purposes of collection, the consequences of not providing the information, the kinds of recipients to whom we usually disclose information, and how you can access and correct the information).

5. How we use your information

We use your Personal Information for the primary purposes for which it was collected. These include:

  1. providing, operating, maintaining, and improving the Platform and the features made available through it (including the Carpool Feature, the Marketplace Feature, and the Podcast Feature);

  2. creating and managing your Account, facilitating Carpool Matches, processing Marketplace transactions, hosting and distributing Podcast Content, and processing your subscription, orders, or transactions;

  3. verifying your identity, your age (including confirming that you are at least 18 years of age), and your student status, and administering your use of the Platform;

  4. coordinating arrangements between Student Users, including by displaying relevant Personal Information to a counterparty to the extent reasonably necessary to perform the arrangement;

  5. communicating with you, including sending service-related notices, in-app and email notifications about arrangements, responding to your enquiries, and providing customer support;

  6. sending you marketing or promotional communications where you have consented or where we are otherwise permitted to do so by law (subject to clause 6);

  7. conducting analytics, research, and product development to understand and improve user experience and the performance of the Platform;

  8. detecting, preventing, and responding to fraud, security incidents, harmful or unlawful content, breaches of our Acceptable Use Policy, and breaches of our other terms; and

  9. complying with our legal obligations (including notifiable data breach obligations), enforcing our terms, and protecting our rights and the rights of others.

We may also use your Personal Information for secondary purposes that are related to a primary purpose, where you would reasonably expect us to do so, or where we have your consent.

We will not use your Personal Information for a purpose materially different from the purpose for which it was collected, unless we have obtained your consent or are otherwise permitted or required by law.

6. Direct marketing and content moderation

Direct marketing

We may use your Personal Information (including your name and contact details) to send you direct marketing communications about our products, services, promotions, competitions, or events where you have consented or where we are otherwise permitted to do so under the Privacy Act and the Spam Act 2003 (Cth).

You may opt out of receiving direct marketing communications from us at any time by:

  1. using the unsubscribe link included in each marketing email;

  2. updating your communication preferences in your Account settings; or

  3. contacting us using the details in clause 15.

If you opt out of direct marketing communications, we will continue to send you service-related communications that are necessary for us to provide the Platform and the features made available through it (including notifications about Carpool Matches, Marketplace transactions, and account matters).

Content moderation

To protect the safety and integrity of the Platform and our users, we operate a content moderation programme that involves the following processing of User Content and associated metadata:

  1. automated classification and filtering of User Content to detect potential breaches of our Acceptable Use Policy (including harmful, unlawful, or fraudulent content, prohibited Marketplace listings, and Podcast Content that infringes the rights of third parties);

  2. human review of content that has been flagged by our automated systems or reported by another user, for the purpose of confirming the classification and determining the appropriate response;

  3. the recording and retention of Moderation Records, including the content reviewed, the reviewer's decision, and any enforcement action taken; and

  4. the use of Moderation Records to enforce our Acceptable Use Policy, to respond to reports or complaints, and to provide evidence in connection with disputes, investigations, or legal proceedings.

7. Disclosure of your information

We may disclose your Personal Information to the following categories of recipients for the purposes described in clause 5:

  1. Other Student Users: to the extent reasonably necessary to facilitate Carpool Matches, Marketplace transactions, and other arrangements (for example, a Student User offering a Carpool Match may see the first name, profile photo, and pick-up location of a Student User who accepts that match);

  2. Service providers: third party providers who perform services on our behalf, including hosting and cloud infrastructure providers, payment processors (including Apple App Store and Google Play Store billing), identity and student status verification providers, mapping and navigation providers, podcast hosting and distribution providers, customer support tools, email and SMS delivery providers, content moderation services, and analytics providers;

  3. Group entities: other entities within the Purple TIC Enterprises group, where necessary to provide and support the Platform;

  4. Professional advisors: our lawyers, accountants, auditors, and insurers, where necessary for the provision of their services;

  5. Law enforcement and regulators: government authorities, law enforcement agencies, courts, tribunals, the eSafety Commissioner, or other regulators, where required or authorised by law, or to protect our legal rights and the rights of others; and

  6. Business transfers: a potential buyer, transferee, investor, or merger partner in the event of a sale, merger, restructure, or other transfer of all or part of our business or assets.

Before disclosing your Personal Information to a third party, we take reasonable steps to ensure that the third party is contractually obliged to handle your Personal Information in accordance with the APPs and this Privacy Policy, and only uses your Personal Information for the specified purposes.

We do not sell your Personal Information.

8. Overseas disclosure

We are based in Australia. Some of our service providers (including cloud infrastructure, payment processors, and podcast distribution providers) are located outside Australia, including in the United States, the European Union, and other jurisdictions. Where we disclose your Personal Information to an overseas recipient, we will take reasonable steps in the circumstances to ensure that the recipient does not breach the APPs in relation to the information, consistent with our obligations under APP 8.

By using the Platform, you consent to the disclosure of your Personal Information to overseas recipients for the purposes described in this Privacy Policy.

9. Data retention

We retain your Personal Information only for as long as is reasonably necessary to fulfil the purposes for which it was collected, including to satisfy any legal, regulatory, accounting, or reporting requirements, or to resolve disputes and enforce our agreements.

To determine the appropriate retention period, we consider the amount, nature, and sensitivity of the Personal Information, the potential risk of harm from unauthorised use or disclosure, the purposes for which we process the information, whether we can achieve those purposes through other means, and applicable legal requirements.

When your Personal Information is no longer required, we will take reasonable steps to destroy or de-identify it in accordance with our information handling procedures. Where de-identification is used, the de-identified information may be retained for analytical and research purposes (including to improve the Platform).

We may retain your Personal Information (including User Content and Moderation Records) for longer than we would otherwise need to where you have consented to the extended retention, or where we are required or permitted to do so by law, including to respond to disputes, complaints, investigations, or legal proceedings. Where we defer action on a deletion or correction request on this basis, we will notify you of the reason and the expected timeframe for completion.

10. Data security

We take reasonable steps to protect your Personal Information from misuse, interference, loss, and unauthorised access, modification, or disclosure, as required by APP 11.1. These steps include:

  1. encryption of Personal Information in transit and, where appropriate, at rest;

  2. access controls that limit access to Personal Information to authorised personnel on a need-to-know basis;

  3. regular security assessments and testing of our systems and processes;

  4. staff training on privacy and data handling obligations; and

  5. incident response procedures for investigating and responding to actual or suspected Data Breaches.

While we take reasonable steps to protect your Personal Information, no method of transmission over the internet or method of electronic storage is completely secure. We cannot guarantee the absolute security of your Personal Information.

Breach notification. In the event of a Notifiable Data Breach, we will notify the OAIC and affected individuals in accordance with Part IIIC of the Privacy Act (the Notifiable Data Breaches scheme).

11. Your rights

Under the Privacy Act and the APPs, you have the right to:

  1. Access: request access to the Personal Information we hold about you (APP 12);

  2. Correction: request correction of any Personal Information that is inaccurate, out of date, incomplete, irrelevant, or misleading (APP 13); and

  3. Complaint: make a complaint to us or to the OAIC if you believe we have breached the APPs or mishandled your Personal Information.

To make an access or correction request, please contact us using the details in clause 15. We may require you to verify your identity before actioning your request.

We will respond to your request within a reasonable period and, in any event, within 30 days of receiving the request. We will not charge you for making a request, but we may charge a reasonable fee for providing access if the request requires substantial effort. We will explain the basis of any charge before responding.

There are circumstances in which we may decline an access or correction request (for example, where giving access would have an unreasonable impact on the privacy of other individuals, or where we are required or authorised by law to refuse access). If we decline a request, we will explain our reasons in writing and let you know how to complain.

12. Cookies and tracking technologies

We use cookies and similar tracking technologies on the Platform. For detailed information about the cookies we use, the purposes for which we use them, and how you can manage your cookie preferences, please refer to our Cookie Policy, available at www.wolfxapp.com/cookies.

13. Third party links

The Platform may contain links to third party websites, services, or applications that are not operated or controlled by us (including payment processors, mapping providers, podcast distribution platforms, Tertiary Institution single sign-on providers, and identity verification providers). This Privacy Policy does not apply to those third party services, and we are not responsible for their privacy practices.

We encourage you to review the privacy policies of any third party services before providing your Personal Information to them.

14. Children's privacy

The Platform is not directed at, and we do not knowingly collect Personal Information from, children under the age of 18. You must be at least 18 years of age and a Student User to create an Account, transact through the Platform, or use the Carpool Feature, the Marketplace Feature, or the Podcast Feature.

If we become aware that we have collected Personal Information from a person under 18, we will take reasonable steps to delete that information as soon as practicable. If you believe that we may have collected information from a person under 18, please contact us immediately using the details in clause 15.

15. Contact us and complaints

If you have any questions about this Privacy Policy, wish to exercise your rights, or wish to make a complaint about how we handle your Personal Information, please contact our Privacy Officer at support@wolfxapp.com or by writing to WolfX App Pty Ltd, Attn: Privacy Officer, Level 10, 369 Royal Parade, Parkville VIC 3052.

We will aim to resolve your complaint within 30 days of receipt. If we need more time, we will let you know the reason for the delay and the expected timeframe for resolution.

If you are not satisfied with our response, or if you consider that we have not handled your complaint appropriately, you may refer your complaint to the Office of the Australian Information Commissioner:

  1. Website: www.oaic.gov.au;

  2. Phone: 1300 363 992; and

  3. Post: GPO Box 5218, Sydney NSW 2001.

16. Changes to this Privacy Policy

We reserve the right to amend this Privacy Policy at any time. Any changes will be effective when we post the revised Privacy Policy on the Platform with an updated effective date.

Where the changes are material, we will use reasonable endeavours to notify you by email (where we have your email address) or by posting a prominent notice on the Platform before the changes take effect.