CartR® Privacy Policy

Effective date: 1 October 2026

Trolley Data Management Network Pty Ltd ABN 22 669 540 238, operating the CartR® brand

Contact: support@cartr.com.au

1. ABOUT THIS PRIVACY POLICY

CartR® is a registered trade mark and brand of Trolley Data Management Network Pty Ltd ABN 22 669 540 238 (“TDMN”, “CartR”, “we”, “us” or “our”).

We respect your privacy and are committed to protecting your personal information.

This Privacy Policy explains how we collect, hold, use, disclose and protect personal information when you:

  • Visit the CartR website;
  • Create or use a CartR Account;
  • Use the CartR mobile application or an authorised branded version of the application;
  • Rent or interact with an app-connected luggage Cart;
  • Contact customer support; or
  • Otherwise interact with the CartR platform and related services.

This Privacy Policy should be read with the CartR Rental Agreement and Terms of Use and any privacy notice displayed when information is collected.

Where consent is required by law, we will request it separately. Using the Services does not replace any consent that applicable law requires us to obtain.

2. WHO IS RESPONSIBLE FOR YOUR INFORMATION

TDMN operates the CartR website, mobile application and supporting technology platform.

TDMN is generally responsible for personal information collected through the CartR platform. The Rental Operator identified before a rental may also be responsible for information collected in connection with that rental.

An airport, railway station, transport hub, shopping centre, venue operator or other Venue Partner may handle limited information for local support, safety, Cart recovery or incident management.

Where another organisation independently determines how it uses your personal information, its own privacy policy may also apply.

3. PERSONAL INFORMATION WE COLLECT

The information we collect depends on how you interact with the Services and may include the following categories.

3.1 Account and identity information

  • Name;
  • Email address;
  • Mobile telephone number;
  • Account username and authentication information;
  • Country, language and communication preferences;
  • Confirmation that you are at least 18 years old;
  • Account status; and
  • Consent and acceptance records.

3.2 Rental and transaction information

  • Rental Location;
  • Cart identifier;
  • Rental start and return times;
  • Lock and unlock events;
  • Rental duration and charges;
  • Deposit or payment-authorisation status;
  • Return confirmation;
  • Rental history;
  • Refund and payment-adjustment information;
  • Abandonment, recovery or non-return records; and
  • Records of faults, damage, cleaning, accidents or safety incidents.

3.3 Payment information

Payments are processed through Stripe and any other authorised payment provider identified in the App.

Depending on the payment method, we may receive or retain:

  • Cardholder name;
  • Billing address;
  • Card type;
  • The last four digits of the card;
  • Payment token;
  • Stripe or other payment-provider transaction identifier;
  • Payment, refund and authorisation status; and
  • Fraud or payment-failure information.

We do not intentionally store complete payment-card numbers or card security codes in the CartR App or our general customer database. Complete card details are ordinarily collected and processed directly by Stripe or another authorised payment provider.

Apple Pay and Google Pay may also be available where supported by the applicable device, bank, country and Rental Location.

3.4 Location and connected-Cart information

We may collect:

  • The location of a rented Cart;
  • The Rental Location and approved service area;
  • Cart movement and stationary status;
  • Return-point and recovery-location information;
  • Mobile-device location where you grant the required permission;
  • Approximate location derived from an IP address;
  • GPS, Bluetooth and connected-device network information;
  • Lock status, battery level, sensor information and diagnostic events; and
  • Location information associated with a lock, unlock, return, fault, abandonment or recovery event.

3.5 Device and technical information

  • Device type and model;
  • Operating system and App version;
  • Mobile network information;
  • IP address;
  • Device, installation and session identifiers;
  • Language and time-zone settings;
  • Bluetooth, location, camera and notification-permission status;
  • App performance, crash and diagnostic information;
  • Login and security events; and
  • Website browser and usage information.

3.6 Communications and support information

When you contact us or a Rental Operator, we may collect:

  • Emails, messages and customer-support requests;
  • Call details or notes;
  • Photographs or documents you submit;
  • Survey responses and feedback;
  • Complaint and dispute information; and
  • Information about an accident, injury, fault, missing Cart, payment issue or other incident.

3.7 Website, cookie and analytics information

We may collect information about:

  • Pages viewed and links selected;
  • The date, time and duration of visits;
  • Referring pages or websites;
  • Browser and device characteristics;
  • General interaction and navigation patterns;
  • Cookie preferences; and
  • Website and campaign performance.

More information is provided in section 10.

3.8 Marketing information

Where permitted by law, we may collect:

  • Marketing preferences;
  • Newsletter subscriptions;
  • Campaign interactions; and
  • Records of consent, withdrawal and unsubscribe requests.

4. REQUIRED AND OPTIONAL INFORMATION

Information marked as required is needed to create an Account, confirm eligibility, process a payment, start or complete a Rental Session, provide support, maintain safety or comply with legal obligations.

If you do not provide required information, we may be unable to create your Account, process your payment, unlock a Cart, complete a rental or respond fully to your request.

Device-location access may be optional in some circumstances. However, disabling location, Bluetooth, camera, mobile data or notification permissions may prevent or limit certain App features.

A Cart may continue to generate location, lock, status and connected-device information during a Rental Session even if location access is disabled on your mobile device.

5. HOW WE COLLECT INFORMATION

We may collect personal information:

  • Directly from you when you create an Account, start a rental, make a payment, submit a form or contact support;
  • Automatically from the website, App, Cart, connected lock and related technology;
  • From a Rental Operator or Venue Partner involved in providing or supporting a rental;
  • From Stripe, card networks, banks and fraud-prevention providers;
  • From ClickSend and other communications providers;
  • From app stores, mobile operating systems and mapping services;
  • From another person acting with your authority;
  • From security, incident or Cart-recovery records where reasonably necessary; and
  • From regulators, law-enforcement bodies or other organisations where authorised or required by law.

We collect personal information by lawful and fair means and seek to collect only information reasonably necessary for our functions and activities.

6. HOW AND WHY WE USE PERSONAL INFORMATION

6.1 Providing the Services

We may use personal information to:

  • Create and manage Accounts;
  • Confirm eligibility;
  • Identify available Carts;
  • Process rental requests;
  • Unlock and secure Carts;
  • Calculate rental duration and charges;
  • Process deposits, payment authorisations, payments and refunds;
  • Confirm returns; and
  • Provide customer support.

6.2 Safety, security and Cart management

We may use personal information to:

  • Monitor Cart status and location;
  • Detect an incomplete return or suspected abandonment;
  • Send return, safety and Account notifications;
  • Locate and recover missing Carts;
  • Investigate faults, damage, accidents, misuse or theft;
  • Protect users, Venue Partners and other people; and
  • Prevent unauthorised access, payment fraud and security threats.

6.3 Service operation and improvement

We may use personal information to:

  • Maintain the App, website, locks and connected Carts;
  • Diagnose technical problems;
  • Measure service availability and performance;
  • Understand how the Services are used;
  • Improve Cart design, safety and functionality;
  • Plan Cart allocation and maintenance; and
  • Develop new or improved services.

Where reasonably possible, we use aggregated or de-identified information for analysis and service improvement.

6.4 Communications

We may use personal information to:

  • Send rental confirmations and receipts;
  • Send one-time passwords and Account-verification messages;
  • Send operational, return and safety notifications;
  • Respond to enquiries and complaints;
  • Advise you about Account or Service changes;
  • Provide required legal or privacy notices; and
  • Communicate about payment failures or amounts properly due.

6.5 Legal and business purposes

We may use personal information to:

  • Comply with tax, accounting, consumer, privacy and other legal obligations;
  • Establish, exercise or defend legal claims;
  • Respond to valid regulatory, court or law-enforcement requests;
  • Enforce the CartR Rental Agreement and Terms of Use;
  • Obtain insurance or professional advice;
  • Manage a genuine business sale, restructure, investment or transfer; and
  • Keep appropriate business, consent and transaction records.

6.6 Marketing

With your consent, or where otherwise permitted by law, we may send information about CartR products, services, promotions and updates.

You may unsubscribe at any time. We do not use safety, payment or operational messages to bypass your marketing preferences.

7. LEGAL BASES FOR PROCESSING

Where the laws of the United Kingdom, European Economic Area or another jurisdiction require us to identify a legal basis, we rely on one or more of the following:

  • Performance of a contract: where information is needed to create an Account, verify your identity, process a rental, accept payment, provide support or otherwise deliver the Services you request;
  • Legitimate interests: where processing is reasonably necessary to operate and improve the Services, maintain safety, protect Carts, prevent fraud, secure our systems and manage our business, provided those interests are not overridden by your rights;
  • Legal obligations: where processing is required for tax, accounting, consumer protection, regulatory, law-enforcement or other legal purposes;
  • Consent: where you consent to optional location access, non-essential cookies, marketing or another activity for which consent is required; and
  • Legal claims or vital interests: where information is reasonably necessary to protect a person in an emergency or to establish, exercise or defend a legal claim.

You may withdraw consent at any time. Withdrawal does not affect processing already carried out lawfully and does not prevent processing based on another lawful basis.

8. LOCATION AND CONNECTED-CART DATA

Location and connected-Cart information are important to the operation and security of CartR.

During or in connection with a Rental Session, we may use this information to:

  • Confirm the Rental Location;
  • Provide location-related App functions;
  • Record where a Cart was unlocked or returned;
  • Confirm that a Cart remains within an Authorised Area;
  • Determine whether a Cart has remained stationary;
  • Identify an incomplete return or possible abandonment;
  • Send return or safety notifications;
  • Locate a lost, stolen or abandoned Cart;
  • Support a customer, Rental Operator or Venue Partner;
  • Investigate a dispute, fault, safety issue or suspected misuse; and
  • Maintain and improve Cart availability and performance.

We do not use Cart-location information to continuously track an individual independently of the rental service. Cart information may nevertheless be associated with the adult Renter’s Account and Rental Session.

Location information is retained only for as long as reasonably necessary for legitimate safety, transaction, dispute, fraud-prevention and Cart-recovery requirements.

9. ACCOUNT VERIFICATION AND ONE-TIME PASSWORDS

CartR may use one-time passwords to verify your mobile number or email address when you create an Account or sign in.

We use ClickSend and may use other authorised communications providers to transmit these messages.

The provider receives the contact information and message information necessary to send the verification code. Verification codes are temporary. Limited delivery and security records may be retained for fraud prevention, technical support, system security and audit purposes.

We do not use one-time password messages for marketing.

10. COOKIES AND SIMILAR TECHNOLOGIES

We may use cookies, software development kits, pixels, local storage and similar technologies for:

  • Essential website and App functions;
  • Security and login management;
  • Remembering privacy, language and display preferences;
  • Analytics and performance measurement;
  • Diagnosing technical issues; and
  • Marketing and campaign measurement where permitted.

Where applicable law requires consent, non-essential cookies and similar technologies will not be used until you make a choice through the available cookie or privacy controls.

You can adjust your choices through our cookie controls or browser settings. Blocking certain technologies may affect website or App functionality.

We do not sell personal information for money. Some jurisdictions may define certain analytics or advertising disclosures as a “sale”, “sharing” or targeted advertising. Where those laws apply, we will provide the required notice and opt-out method.

11. WHEN WE DISCLOSE PERSONAL INFORMATION

We may disclose personal information to:

  • The Rental Operator responsible for a rental;
  • Venue Partners assisting with local support, safety, return or Cart recovery;
  • Stripe, card networks, banks and fraud-prevention providers;
  • ClickSend and other email, SMS and push-notification providers;
  • Cloud-hosting, database and technology providers;
  • Website and App developers and support providers;
  • Mapping and location-service providers;
  • Analytics, diagnostic and cybersecurity providers;
  • Telecommunications and connected-device service providers;
  • Insurers, accountants, auditors, lawyers and professional advisers;
  • Debt-recovery providers where an amount is lawfully due;
  • Regulators, courts, law-enforcement agencies and emergency services where authorised or required;
  • A buyer, investor or successor involved in a genuine business transaction; and
  • Other recipients you authorise or direct us to contact.

We require service providers to handle personal information only for authorised purposes and with appropriate confidentiality and security protections.

12. OVERSEAS PROCESSING AND DISCLOSURE

CartR operates internationally and uses service providers that may process or store information outside your country.

Depending on the Rental Location, service provider and technical configuration, personal information may be processed or stored in:

  • Australia;
  • The United Kingdom;
  • The United States;
  • One or more countries in the European Economic Area; and
  • Other countries in which an identified Rental Operator or essential service provider operates.

Privacy laws in another country may differ from those in your country.

Where required, we take reasonable steps to ensure overseas recipients protect personal information. These steps may include data-processing agreements, contractual privacy and security requirements, approved standard contractual clauses, recognised international-transfer mechanisms and security assessments.

For Australian personal information, we manage overseas disclosures in accordance with applicable Australian privacy requirements. For UK and European information, we use an approved international-transfer mechanism where required.

13. HOW LONG WE RETAIN INFORMATION

We retain personal information only for as long as reasonably necessary to:

  • Provide the Services and maintain an Account;
  • Complete and reconcile rentals and payments;
  • Respond to complaints, disputes, refunds and chargebacks;
  • Investigate safety incidents, fraud, damage, loss or theft;
  • Maintain security, audit and consent records;
  • Meet tax, accounting, insurance and legal obligations; and
  • Establish, exercise or defend legal claims.

The applicable retention period depends on the type and sensitivity of the information, the reason it was collected, legal requirements and relevant limitation periods.

When information is no longer required, we take reasonable steps to delete it, securely destroy it or de-identify it. Some information may remain temporarily in secured backups until those backups are replaced through our normal retention cycle.

14. DATA SECURITY AND BREACH RESPONSE

We use reasonable technical, organisational and physical safeguards designed to protect personal information against loss, interference, misuse, unauthorised access, disclosure, alteration and destruction.

These safeguards may include:

  • Access controls and authentication;
  • Encryption in transit and, where appropriate, at rest;
  • Payment tokenisation;
  • Network and application security measures;
  • Logging and monitoring;
  • Restricted staff and contractor access;
  • Service-provider security requirements;
  • Backup and recovery processes; and
  • Incident-response procedures.

No internet, mobile, wireless or electronic-storage system can be guaranteed to be completely secure.

If a data breach occurs, we will investigate, contain and assess it and notify affected individuals and regulators where required by applicable law.

You should protect your login details, use an appropriate device passcode and notify us promptly if you suspect unauthorised use of your Account.

15. YOUR PRIVACY RIGHTS

Depending on your location and applicable law, you may have the right to:

  • Request access to personal information we hold about you;
  • Request correction of inaccurate or incomplete information;
  • Request deletion of information in certain circumstances;
  • Restrict or object to certain processing;
  • Withdraw consent;
  • Receive certain information in a portable format;
  • Opt out of direct marketing;
  • Object to targeted advertising or certain uses of cookies;
  • Request review of a significant automated decision;
  • Make a privacy complaint; and
  • Lodge a complaint with a relevant privacy or data-protection regulator.

These rights are not absolute. Legal exceptions may permit or require us to retain or continue using certain information.

To make a request, email support@cartr.com.au. Please describe your request and provide sufficient information for us to identify the relevant Account or Rental Session.

We may need to verify your identity before completing a request. We will respond within the period required by applicable law and will not charge a fee unless permitted by law.

16. ACCOUNT AND COMMUNICATION CHOICES

You may:

  • Update certain Account information in the App;
  • Change mobile-device permissions through your device settings;
  • Adjust notification preferences where the App permits;
  • Use available cookie controls;
  • Unsubscribe from marketing using the link in a marketing message; or
  • Contact us to close your Account.

You cannot opt out of essential rental, payment, safety, security or legal communications while the relevant Account, Rental Session or obligation remains active.

Closing an Account does not require us to delete information that must be retained for legal, safety, transaction, dispute or fraud-prevention purposes.

17. CHILDREN’S PRIVACY

The CartR Account, App, payment service and rental contract are intended only for adults aged 18 years or older.

Children and minors must not create an Account, enter payment information, operate the App independently or submit personal information directly to us.

CartR luggage Carts are intended to transport luggage and goods. They must not be used to carry children or other passengers.

If we learn that a child has provided personal information directly without appropriate authorisation, we will take reasonable steps to delete it, subject to any legal or safety requirement to retain it.

18. AUTOMATED SYSTEMS

We may use automated rules and connected-Cart information to:

  • Confirm lock and unlock events;
  • Calculate rental time and charges;
  • Detect payment failures;
  • Identify an incomplete return;
  • Identify that a Cart has remained stationary;
  • Send operational or return notifications;
  • Detect unusual Account or rental activity; and
  • Flag possible fraud, loss or misuse for investigation.

We do not ordinarily use solely automated processing to make a decision that produces a legal or similarly significant effect without human review.

If you believe an automated process produced an incorrect charge, restriction or other significant outcome, contact us and request a review.

19. THIRD-PARTY SERVICES AND LINKS

The website or App may contain links to third-party websites, app stores, mapping services, payment services or other external platforms.

Those third parties may collect information under their own privacy policies. We are not responsible for the independent privacy practices of an external service that we do not control.

Your mobile operating system controls permissions such as location, Bluetooth, camera and notifications. Review your Apple or Android device settings for further information.

20. PRIVACY COMPLAINTS

If you have a privacy question or complaint, contact our Privacy Officer using the details in section 22.

Please include:

  • Your name and contact details;
  • The relevant Account, Cart or Rental Session information;
  • A clear description of the issue; and
  • The outcome you are seeking.

We will acknowledge and investigate the complaint and aim to provide a response within 30 days. If we need more time, we will explain why and provide an updated timeframe.

If you are not satisfied with our response, you may contact the relevant privacy regulator in your jurisdiction, including:

  • In Australia, the Office of the Australian Information Commissioner at oaic.gov.au;
  • In the United Kingdom, the Information Commissioner’s Office at ico.org.uk; or
  • In the European Economic Area, your local data-protection authority.

Contacting us first may allow us to resolve the issue more quickly, but it does not prevent you from approaching a regulator directly where you have that right.

21. CHANGES TO THIS PRIVACY POLICY

We may update this Privacy Policy to reflect changes in law, technology, our Services or our information-handling practices.

The current version will be published on the CartR website and identified by its effective date. Where a change is material, we will provide additional notice through the website, App, email or another appropriate method.

Where consent is legally required for a new use of personal information, we will request that consent before beginning the new use.

22. CONTACT US

Privacy Officer
Trolley Data Management Network Pty Ltd
ABN 22 669 540 238
Suite 19, 103 George Street
Parramatta NSW 2150
Australia

Email: support@cartr.com.au
Website: cartr.com.au

CartR® is a registered trade mark and brand of Trolley Data Management Network Pty Ltd ABN 22 669 540 238.

© 2026 Trolley Data Management Network Pty Ltd. All rights reserved.