​Introduction to the Consumer Data Right (CDR)

The Consumer Data Right (CDR) is an Australian Government Reform that lets individuals and small businesses share their data with accredited third parties and regulates the collection and handling of CDR data in line with privacy safeguards and rules that:

• Ensure users' data is managed securely.
• Provide users with control over how their data is shared and used.
  

Accredited Data Recipients (ADRs)

Basiq is an Accredited Data Recipient (ADR), which is an organisation approved under the CDR framework to receive and manage consumer data securely. ADRs are required to adhere to strict privacy and security rules, ensuring that the consumer's data is used only with their consent. ADR and ADR rep/ (Partners) are expected to;

• Transparently disclose how data is used.
• Ensure secure storage and transfer of consumer data.
• Implement privacy safeguards to protect user consent.
  

Key Benefits for Users

• Choice and Control: Users decide what data to share, how it’s used, and who it can be disclosed to.
• Manage Consent: Users can view, modify, or revoke consents at any time.
• Data Deletion Requests: Users can request data deletion or de-identification.
  

Data Usage under CDR

We will use the data collected under the CDR framework for:

• Operational Purposes: Preventing fraud and detecting abuse.
• Auto-grow: Powering Blossom’s round up functionality where we round up spare change and automatically transfer it to your Blossom account.
  

Consent Management

When you give consent, you remain in control. You can easily manage your consent at any time – whether that means reviewing, updating, or withdrawing it – using any of the following methods:

• Directly through the app (this is the easiest and preferred method)
• By contacting our support team via email
  

Data Retention and De-identification

You have the right to request data deletion at any time.

Upon withdrawal of consent:

• Your data will be securely deleted or de-identified, depending on your consent
• Redundant data will be destroyed (except for specific use cases when we are required by law to retain it for a longer period)
• We will ensure that any third-party processors will securely erase any shared data.
  

De-identification process

De-identification involves removing identifiable information while retaining anonymised data for operational purposes, such as analytics and fraud prevention.

Steps include:

• Removing your personal information from transactions
• Stripping timestamps and descriptions that reveal specific details
• Aggregating data to ensure anonymity

We may use de-identified data for improving services, creating insights, and operational analysis.

Retention Policy

We will always:

• Ensure your data is deleted or de-identified promptly when it is no longer required, upon data sharing consent expiry or within 24 hours of receiving a consent revocation request.