Buy Australian First

Legal

Privacy Policy

Last updated: 15 August 2026

Buy Australian First Pty Ltd (BAF, we, us or our) operates the Buy Australian First website, business directory and BAF verification program. This policy explains how we manage personal information.

We aim to handle personal information consistently with the Privacy Act 1988 (Cth) and the Australian Privacy Principles where they apply to us, and to use privacy-by-design practices as the platform grows.

1. Information we collect

Depending on how you use BAF, we may collect:

  • name, email address, phone number and other contact details;
  • business account and authentication information;
  • your role in, or authority to act for, a business;
  • ABN, ACN, business address, website and business profile information;
  • information supplied in a business claim, verification application, correction request, complaint or appeal;
  • ownership and manufacturing evidence, including documents that may contain names, shareholdings, signatures or other personal information;
  • payment and transaction information associated with BAF services. Card payment details are processed by our payment provider rather than being entered into the BAF database as full card numbers;
  • communications you send to us and our responses;
  • browser, device, security and server-log information generated when you use the website; and
  • your device coordinates when you choose to allow browser location access for nearby-business searches.

2. Verification documents and government identifiers

Verification evidence can contain information about directors, shareholders, beneficiaries, partners, employees or suppliers. Please provide only information reasonably necessary for the verification being requested and redact unrelated personal information wherever possible.

Do not provide a tax file number (TFN) or Director ID to BAF. BAF does not require either identifier for ordinary business claims or BAF verification. If a supporting document contains a TFN or Director ID, please redact it before uploading the document. Please also redact bank account details, identity-document numbers and other unrelated sensitive information unless BAF has specifically requested the information and is legally permitted to collect it.

3. How we collect information

We may collect information:

  • directly from you through forms, uploads, accounts and correspondence;
  • from an authorised representative of a business;
  • from publicly available sources such as business websites, public registers, public directories and published business information; and
  • from service providers when necessary to operate accounts, payments, email, security or website infrastructure.

4. Why we use information

We use information where reasonably necessary to:

  • create, secure and administer business accounts;
  • review business listing claims and link authorised users to listings;
  • research, maintain and correct directory and product information;
  • assess Australian ownership and Australian-made verification applications;
  • request further evidence and conduct re-verification or audits;
  • issue, administer, suspend or revoke BAF verification and BAF IDs;
  • process payments and maintain transaction records;
  • send operational emails about accounts, claims and verification;
  • send marketing communications where we have the required consent or other lawful basis, with an unsubscribe facility;
  • respond to enquiries, corrections, complaints and appeals;
  • protect BAF, its users and the public from misuse or fraud; and
  • comply with legal, regulatory, accounting and record-keeping obligations.

5. Public directory information

BAF publishes business information intended to help people find Australian businesses and products. Public listing information may include a business name, trading location, website, contact details supplied for publication, categories, description, claim status and verification status.

Information supplied privately as verification evidence is not made public merely because it was submitted to BAF. We may publish the outcome of an assessment, the applicable verification status, verification scope, BAF ID and validity period.

6. Location information

If you allow browser location access, BAF uses your coordinates to calculate nearby directory results. The current directory sends those coordinates to a BAF server-side action for the search and does not add the coordinates to the public page URL. You can deny or revoke location permission through your browser or device settings and still use the directory without nearby search.

7. Cookies and similar browser storage

BAF uses cookies and related browser mechanisms where they are reasonably necessary to operate secure account and authentication functions. For example, business login sessions use authentication cookies so the website can recognise a signed-in user and maintain a secure session between requests.

BAF does not currently use third-party advertising cookies in the application. If BAF later introduces non-essential analytics, advertising or similar tracking technologies, we will update our disclosures and implement any consent or choice mechanism required by applicable law.

Browser location permission is controlled separately by your browser or device and is not granted merely because an authentication cookie exists.

8. Service providers and overseas processing

BAF uses third-party technology providers to operate the platform. These include Supabase for database, authentication and evidence storage; Vercel for website hosting and server-side application delivery; Stripe for payment processing; and Resend for transactional email.

BAF's current primary Supabase project is configured in Sydney, Australia. Other service providers and subprocessors may operate internationally. Personal information may therefore also be processed or disclosed outside Australia, including in the United States and other countries in which those providers or their subprocessors operate.

The location of a primary database does not mean every supporting network, email, payment, security or hosting operation occurs only in Australia. We take reasonable steps appropriate to the circumstances when selecting and configuring service providers and will update this policy if our material processing arrangements change.

9. Security

We use technical and organisational measures intended to protect personal information from misuse, interference, loss and unauthorised access, modification or disclosure. Access to verification evidence is restricted to authorised users and administrators who need it for BAF functions.

No internet or storage system can be guaranteed to be completely secure. If we become aware of a data breach, we will investigate it and take remedial and notification steps required by applicable law.

10. Retention

We retain personal information only for as long as reasonably necessary for the purpose for which it was collected, for verification history, dispute and audit purposes, or as required by law. When information is no longer required, we take reasonable steps to delete, destroy or de-identify it where appropriate.

Verification evidence may need to be retained for a reasonable period after a decision, expiry, suspension or appeal so that BAF can support the integrity of its verification records. We aim to minimise retention of unnecessary identity information.

11. Marketing communications

Where BAF sends commercial electronic messages, we will identify the sender and provide an unsubscribe method as required by applicable Australian law. You can unsubscribe from marketing without affecting essential account, security, claim or verification communications.

12. Access and correction

You may ask us to provide access to personal information we hold about you or to correct information that is inaccurate, out of date, incomplete, irrelevant or misleading. We may need to confirm your identity and authority before acting on a request.

Businesses may also request correction of public directory information under our Corrections, Complaints & Appeals Policy.

13. Privacy complaints

Please send privacy enquiries or complaints to admin@buyaustralianfirst.com.au. Include enough information for us to understand the issue, but do not email unnecessary identity documents or sensitive information.

We will review the complaint and respond within a reasonable period. Where the Privacy Act applies, you may also have the right to complain to the Office of the Australian Information Commissioner.

14. Changes to this policy

We may update this policy when BAF services, technology or legal obligations change. The current version and update date will be published on this page. If a material change affects information already collected for an account or verification process, we will take reasonable steps to provide additional notice where appropriate.

15. Contact

Buy Australian First Pty Ltd
Email: admin@buyaustralianfirst.com.au

See also our Terms of Use and Legal & Policies page.