Savvy Investments Co Pty Ltd (ABN 50 698 325 334) · surprisebonus.com · NSW governing law
Last updated: 7 June 2026
Privacy enquiries: privacy@surprisebonus.com · General enquiries: hello@surprisebonus.com
1.1 Savvy Investments Co Pty Ltd ABN 50 698 325 334 ("we", "us", "our") operates SurpriseBonus at surprisebonus.com. We are committed to protecting your privacy and handling your personal information in accordance with the Privacy Act 1988 (Cth) ("Privacy Act") and the Australian Privacy Principles ("APPs").
1.2 This Privacy Policy explains what personal information we collect, why we collect it, how we use and store it, who we share it with, and your rights in relation to it.
1.3 By using SurpriseBonus, you consent to the collection, use, and disclosure of your personal information as described in this Policy. If you do not agree, please do not use the Service.
1.4 References to "the Service" have the same meaning as in our Terms of Service.
2.1 We collect the following categories of personal information to operate the Service:
| Category | Examples |
|---|---|
| Identity | Name, date of birth, age |
| Contact | Email address, phone number |
| Financial / income | Employment status, income range, household income, Centrelink or government payment status |
| Family and household | Family composition, relationship status, number and ages of dependants |
| Employment | Employment type, employer type, industry, work hours |
| Health and disability | Disability status, chronic health conditions, carer status (where you voluntarily provide this to improve eligibility matching) |
| Location | State or territory of residence, postcode |
| Technical | IP address, browser type, device identifiers, usage data, cookies |
| Account | Username, password (hashed), account activity |
| Competition submissions | Taglines or other content you submit in competitions |
2.2 Sensitive information. Some of the information listed above — specifically health, disability, and carer status — is "sensitive information" under the Privacy Act. We only collect sensitive information where you voluntarily provide it for the purpose of improving the accuracy of your eligibility match Results. You may choose not to provide sensitive information; this may affect the completeness of your Results but will not prevent you from using the Service.
2.3 We collect personal information directly from you when you register, use the interview or intake process, purchase access to Results, or participate in competitions or surveys.
3.1 We collect and use your personal information for the following purposes:
3.2 We do not use your personal information to send you third-party marketing. We do not sell your personal information to third parties. We do not share your personal information with third parties for their marketing purposes.
4.1 The Service uses artificial intelligence and fully automated processing to generate eligibility match Results. When you provide your information through the intake process, it is processed by our AI model without individual human review. No person at SurpriseBonus reviews your specific information to generate your individual Results.
4.2 This automated processing constitutes automated decision-making for the purposes of the Privacy Act and, from 10 December 2026, the Privacy Act as amended by the Privacy and Other Legislation Amendment Act 2024 (Cth) ("Tranche 2 Amendments"). See clause 11 for our Tranche 2 automated decision-making transparency obligations.
4.3 Results produced by automated processing may be inaccurate, incomplete, or based on outdated information. Automated processing cannot account for all individual circumstances. Results are information only and are not a formal eligibility determination.
4.4 You have the right to request human review of automated processing that significantly affects you. To make such a request, contact us at hello@surprisebonus.com. We will acknowledge your request within 5 business days and advise you of the review process and timeframe.
5.1 Storage location. Your personal information is stored using Supabase, a cloud database provider. Supabase infrastructure used by SurpriseBonus is hosted in Singapore. By using the Service, you consent to your personal information being stored and processed in Singapore.
5.2 Cross-border disclosure. In addition to Supabase (Singapore), your personal information may be processed by the following categories of overseas recipients for the purpose of AI model operation and service delivery:
Before disclosing your personal information to overseas recipients, we take reasonable steps, as required by APP 8, to ensure those recipients handle your information in accordance with the APPs or in a manner that provides comparable protections. By using the Service, you acknowledge and consent to these cross-border disclosures.
5.3 Security measures. We implement reasonable technical and organisational security measures to protect your personal information from unauthorised access, disclosure, alteration, or destruction. These measures include encryption in transit and at rest, access controls, and regular security reviews.
5.4 Data retention. We retain your personal information for as long as necessary to provide the Service and meet our legal obligations. We apply the following retention periods:
At the end of the applicable retention period, we will take reasonable steps to destroy or de-identify personal information in accordance with APP 11.2.
6.1 The Service uses cookies and similar tracking technologies to operate the platform, maintain your session, and analyse aggregate usage.
6.2 We use the following categories of cookies:
6.3 We do not use cookies to track you across third-party websites for advertising purposes. We do not share cookie data with third-party advertisers.
6.4 You can manage cookie preferences through your browser settings. Disabling cookies may affect your ability to use certain features of the Service.
7.1 We do not sell your personal information.
7.2 We do not share your personal information with third parties for their marketing purposes.
7.3 We share your personal information only with:
8.1 You have the following rights in relation to your personal information:
8.2 To exercise your rights, contact us at privacy@surprisebonus.com. We will acknowledge your request within 5 business days and respond within 30 days. We will not charge you for making an access or correction request.
9.1 We are bound by the Notifiable Data Breaches ("NDB") scheme under Part IIIC of the Privacy Act. If we have reasonable grounds to believe an eligible data breach has occurred — that is, a breach involving your personal information that is likely to result in serious harm to you — we will:
9.2 We will notify you as soon as practicable after we become aware of an eligible data breach, providing a description of the breach, the types of information involved, and the steps we recommend you take to protect yourself.
10.1 If you have a concern about our handling of your personal information, please contact us first at privacy@surprisebonus.com. We will acknowledge your complaint within 5 business days and respond within 30 days.
10.2 If you are not satisfied with our response, you may lodge a complaint with the OAIC at www.oaic.gov.au or by calling 1300 363 992.
11.1 From 10 December 2026, the Privacy Act as amended by the Privacy and Other Legislation Amendment Act 2024 (Cth) introduces new transparency requirements for automated decision-making that significantly affects individuals.
11.2 SurpriseBonus uses automated processes — specifically AI-driven eligibility matching — to generate Results that identify programs you may potentially be eligible for. This constitutes automated decision-making. We are transparent about this use throughout our Terms of Service, at the point of Result delivery, and in this Policy.
11.3 From 10 December 2026, this Privacy Policy will include and we will maintain a current disclosure of:
11.4 Right to request human review. If you believe an automated Result has significantly affected you and you wish to request human review, contact us at hello@surprisebonus.com. We will acknowledge within 5 business days and respond within 30 days. We note that because Results are information only and are not binding determinations, the scope of human review is limited to confirming whether the automated process was applied correctly.
12.1 We may update this Policy from time to time. We will notify you of material changes by email or prominent notice on the platform. Continued use of the Service after changes take effect constitutes acceptance of the updated Policy.
Savvy Investments Co Pty Ltd
ABN 50 698 325 334
Australia
Privacy enquiries: privacy@surprisebonus.com
General enquiries: hello@surprisebonus.com
Website: surprisebonus.com