Privacy Policy

Rollout Co Pty Ltd ("Rollout", "we", "us", or "our") operates an online marketplace at rollout.net.au that connects owners of civil construction equipment with businesses and individuals seeking to hire that equipment.

This Privacy Policy explains how we collect, use, disclose, and protect your personal information. It applies to all users of the Rollout platform, including equipment owners, hirers, transport partners, and visitors to our website.

We are bound by the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs) contained in that Act. We take our obligations under that legislation seriously.

By creating a Rollout account or using our platform, you agree to the collection and use of your information as described in this policy. If you do not agree, please do not use our services.

Account information

• Full name and email address
• Password (stored in encrypted, hashed form — we cannot see it)
• Phone number
• Profile photo (optional)
• ABN (for equipment owners and transport partners)
• Business name (where applicable)

Identity verification information

• Government-issued photo ID (driver's licence or passport)
• A selfie or liveness check image where required
• Date of birth, for age verification

Identity verification is required for all equipment owners who list machines on the platform. See Section 6 for more detail.

Listing information

• Machine details (type, weight, condition, photos, location)
• Pricing and availability
• Operating state and region

Booking and transaction information

• Booking dates, machine hired, hire value
• Booking status and history
• Float/transport requests linked to bookings
• Payment method identifiers (tokenised references — we do not store full card numbers)
• Payout account details (for owners receiving payment)

Communications

• Messages sent between users via the Rollout messaging system
• Support enquiries and correspondence with Rollout

Usage and technical information

• IP address and approximate location derived from it
• Browser type and device information
• Pages visited, searches performed, and features used
• Referral source (how you found Rollout)
• Cookies and similar tracking data (see Section 9)

Reviews and ratings

• Reviews you write about other users or machines
• Reviews others write about you
• Star ratings and sub-category scores

Transport partner information

If you apply to join the Rollout Transport Partner network, we also collect:

• Company name, ABN, years in operation
• Fleet details (number of floats, machine classes)
• States of operation and coverage areas
• Goods in Transit insurance status
• Stripe Connect account details for receiving transport payments

We collect information in the following ways:

• Directly from you — when you create an account, list a machine, make or accept a booking, send a message, submit a transport partner application, or contact us
• From your use of the platform — automatically, through cookies, server logs, and analytics tools as you browse and interact with our website
• From third-party identity verification providers — when you complete our verification process
• From Stripe — payment and payout status information related to your transactions on the platform
• From Google Maps — distance and routing data when calculating float transport quotes, based on addresses you provide

We collect only the information that is reasonably necessary for our functions and activities. Where you choose not to provide certain information, we will tell you the consequences — in some cases it may mean you cannot use particular features of the platform.

We will not use your personal information for a purpose other than those listed above without first seeking your consent, unless we are required or permitted to do so by law.

We do not sell your personal information. We share it only in the following circumstances:

Between users on the platform

When a booking is made, certain information is shared between hirer and owner — including first name, profile photo, and contact details necessary to complete the hire. Reviews are published publicly on the platform once the double-blind period has passed.

Service providers

We engage the following third-party providers to operate the platform. Each handles personal information only on our instructions and is bound by data processing obligations:

Where personal information is disclosed to overseas recipients (including those in the USA), we take reasonable steps to ensure those recipients handle your information in a way that is consistent with the Australian Privacy Principles, as required by APP 8.

Legal requirements

We may disclose your information to law enforcement agencies, courts, regulatory bodies, or other parties where required by Australian law, a court order, or to protect the rights, property, or safety of Rollout, our users, or the public.

Business transfers

If Rollout Co Pty Ltd is acquired by or merged with another entity, your personal information may be transferred as part of that transaction. We will notify you via email or a prominent notice on our website if this occurs, and will take steps to ensure your information remains protected.

To protect the integrity of the marketplace and the safety of all users, we require equipment owners to complete identity verification before their listings are published. This involves submitting a government-issued photo ID (driver's licence or passport) and, where required, a liveness check.

Identity verification is conducted with the assistance of a third-party provider. Your ID documents are processed securely and are not stored on Rollout's servers beyond what is necessary to confirm your identity. The verification provider is required to handle this information in accordance with applicable privacy laws.

Verified status is associated with your Rollout profile. If your verification fails or is revoked, your ability to list equipment on the platform may be suspended.

All payment processing on Rollout is handled by Stripe. When you enter payment details on our platform, those details are transmitted directly to Stripe using encrypted connections. Rollout does not store your full card number, CVV, or other raw payment credentials.

Rollout stores only the tokenised payment references provided by Stripe, which allow us to process future charges in connection with your bookings without handling your card details directly.

Equipment owners who receive payouts through the platform are connected to Stripe via Stripe Connect. Information shared with Stripe in this context — including bank account details, business information, and tax details — is governed by Stripe's Privacy Policy in addition to this policy.

With your consent, we may send you marketing emails about Rollout products, new features, promotions, and relevant industry news. You can opt in to marketing communications when creating your account, and you can opt out at any time by:

• Clicking the "Unsubscribe" link in any marketing email we send
• Updating your notification preferences in your account settings
• Contacting us directly at privacy@rollout.net.au

We will process your opt-out request promptly. Opting out of marketing communications will not affect your receipt of transactional emails related to your bookings, account, or payments — these are necessary for the operation of the service.

We comply with the Spam Act 2003 (Cth) in all commercial electronic communications.

We use cookies and similar technologies to operate and improve the Rollout platform. Cookies are small text files stored on your device that help us recognise you between visits and understand how you use our site.

Types of cookies we use

• Essential cookies — required for the platform to function (authentication sessions, security tokens). You cannot opt out of these without stopping use of the service.
• Analytics cookies — help us understand how users navigate the platform so we can improve it. These may be provided by third parties.
• Preference cookies — remember settings you have chosen, such as your preferred view or saved searches.

You can manage or disable non-essential cookies through your browser settings. Note that disabling cookies may affect the functionality of parts of the platform.

We take reasonable steps to protect the personal information we hold from misuse, interference, loss, unauthorised access, modification, and disclosure. Our security measures include:

• Encrypted data transmission (TLS/HTTPS) for all connections
• Passwords stored using one-way cryptographic hashing — they cannot be retrieved
• Payment data handled exclusively by PCI-DSS certified Stripe infrastructure
• Database access controls and row-level security policies limiting data access by role
• Regular review of security practices as the platform evolves

No method of electronic transmission or storage is 100% secure. While we work hard to protect your information, we cannot guarantee absolute security. If you become aware of a security issue affecting your account, please contact us immediately at security@rollout.net.au.

In the event of a data breach that is likely to result in serious harm to affected individuals, we will notify the Office of the Australian Information Commissioner (OAIC) and affected individuals as required under the Notifiable Data Breaches scheme.

We retain personal information for as long as is necessary to provide our services and to meet our legal obligations. In general:

• Active accounts — we retain your information for as long as your account remains active
• Closed accounts — we retain certain records (booking history, payment records, reviews) for up to 7 years after account closure to meet our tax and legal obligations under Australian law
• Identity verification documents — deleted or de-identified within 12 months of verification, or sooner where required by our verification provider's policies
• Messages — retained for the life of the account; may be retained for a period after account closure where there is an unresolved dispute
• Support correspondence — retained for 3 years

When personal information is no longer required, we destroy or de-identify it securely.

Under the Australian Privacy Principles, you have the following rights in relation to your personal information:

Access

You have the right to request access to the personal information we hold about you. We will respond to access requests within 30 days. In most cases, you can access your information directly through your account settings. For information not available through the platform, contact us using the details in Section 15.

Correction

If you believe information we hold about you is inaccurate, out of date, incomplete, or misleading, you can request that we correct it. We will take reasonable steps to correct the information within 30 days of your request.

Deletion

You can request that we delete your personal information. We will comply where we are not required to retain it by law or for legitimate business purposes. Note that some information (such as reviews you have received) may remain on the platform in anonymised or aggregated form.

Opt-out of marketing

You can opt out of receiving marketing communications at any time. See Section 8.

Complaints

If you are dissatisfied with how we handle your personal information, you have the right to make a complaint. See Section 15.

To exercise any of these rights, contact us at privacy@rollout.net.au. We will not charge you for making a request, though we may charge a reasonable fee for providing access in exceptional circumstances.

Rollout is exclusively for users aged 18 years and over. By creating an account, you confirm that you are at least 18 years of age. We do not knowingly collect personal information from anyone under 18. If we become aware that a user is under 18, we will close their account and delete their information promptly.

If you believe a person under 18 has created a Rollout account, please notify us at privacy@rollout.net.au.

We may update this Privacy Policy from time to time to reflect changes in our practices, legal requirements, or the features of our platform. When we make material changes, we will:

• Update the "Effective" date at the top of this policy
• Notify you by email if you have an active account
• Display a notice on the platform where appropriate

Your continued use of Rollout after a policy update constitutes acceptance of the revised policy. If you do not accept the changes, you should close your account and stop using the platform.

Previous versions of this policy are available on request.

If you have questions about this policy, wish to exercise your privacy rights, or have a complaint about how we have handled your personal information, please contact us:

Our complaints process

When you raise a complaint, we will:

• Acknowledge your complaint within 5 business days
• Investigate the matter and respond with our findings within 30 days
• Where we find a breach has occurred, take reasonable steps to remedy it

External complaint — OAIC

If you are not satisfied with our response to a privacy complaint, you may lodge a complaint with the Office of the Australian Information Commissioner (OAIC):

• www.oaic.gov.au
• 1300 363 992
• GPO Box 5218, Sydney NSW 2001

This policy is governed by the laws of Australia. Rollout Co Pty Ltd (ABN registration pending) — rollout.net.au