Privacy policy

Effective 12 January 2026. Last updated 27 July 2026. This policy explains how BW Staff Rewards Pty Ltd (ABN 00 000 000 000) handles personal information. We are bound by the Privacy Act 1988 (Cth) and the Australian Privacy Principles.

1. The Short Version

We hold the minimum needed to run a rewards program: who you are, how to reach you, and what happened in your account. Your employer sees what it paid for — points issued and recognition — and not what you chose to spend them on. Nothing is sold, and nothing leaves Australia.

2. What We Collect

We do not collect your date of birth, home address, salary, bank details, government identifiers, or biometric information. If an employer's onboarding file contains those fields, they are discarded rather than imported.

3. What Your Employer Can See

This is the clause most people are actually looking for, so it is stated as a table rather than a paragraph.

Points issued is your employer's business, because your employer paid for them. What you spent them on is not.

4. Recognition Is Visible To Your Team

Recognition messages, including the reason attached, are visible to colleagues in your team. That is how the feature works rather than an oversight, and it is worth knowing before you send one.

An administrator can remove a recognition, and you can ask us or your administrator to remove one written about you.

5. How We Use It

• To run your account, issue points and fulfil redemptions.
• To provide your employer with aggregate reporting, within the limits in clause 3.
• To answer your support requests.
• To meet financial, tax and record-keeping obligations.

We do not use personal information for advertising, we do not build profiles for resale, and we do not use your data to train models.

6. Who We Share It With

Three categories, and no others.

1. Your employer, limited to what is set out in clause 3.
2. The supplier fulfilling a reward, limited to what that specific order requires. A digital gift card needs nothing but the order; a physical item needs the delivery address you entered.
3. Our infrastructure providers, who host the platform in Australia under contract and cannot use the data for their own purposes.

We will also disclose information where we are required to by law. If that happens and we are permitted to tell you, we will.

7. Where It Is Stored

In Australian data centre regions. Personal information is not transferred or stored overseas, and support is staffed from Australia, so no offshore team holds administrative access.

8. Security

Access is restricted to staff who need it for their role and is logged. Data is encrypted in transit and at rest. Administrative access requires multi-factor authentication.

No system is perfectly secure. If a data breach occurs that is likely to result in serious harm, we will notify affected individuals and the Office of the Australian Information Commissioner as required under the Notifiable Data Breaches scheme.

9. How Long We Keep It

The seven-year figure on transactions exists because a redeemed reward is a financial record. It is the shortest period we can responsibly hold it for, not a default.

10. Your Rights

You can ask us to give you a copy of the information we hold about you, correct anything that is wrong, or delete what we are not required to keep. There is no fee.

Email [email protected] from the address on your account, or write to us at the address in clause 12. We respond within 30 days and usually much sooner.

11. Complaints

Tell us first — email the privacy address above and we will investigate and respond in writing within 30 days.

If you are not satisfied with our response, you can complain to the Office of the Australian Information Commissioner. Contacting us first is not a precondition, but it is usually faster.

12. Contact And Changes

Privacy enquiries: [email protected]
BW Staff Rewards Pty Ltd, Level 5, 120 Spencer Street, Melbourne VIC 3000
(03) 5550 0199

If we change this policy we update the date at the top of the page. Where a change reduces your privacy protections, we give 30 days notice before it takes effect.

Frequently Asked