Privacy Policy

How Buoyly handles Privacy

Buoyly. Privacy Policy Last updated: 29 March 2026 — Version 1.0

We know privacy policies are rarely anyone's favourite read. We've tried to write ours in plain English — no legal mazes, no unnecessary jargon. If something's unclear, just email us at privacy@buoyly.com.au and we'll explain it.

This Privacy Policy explains how Buoyly Pty Ltd (ABN 65678727958) (“Buoyly”, “we”, “us”, “our”) collects, uses, holds, and discloses personal information when you use our website at buoyly.com.au and our peer-to-peer boat marketplace platform (together, the “Platform”). We are bound by the Privacy Act 1988 (Cth) and the 13 Australian Privacy Principles (APPs) contained in that Act. This policy sets out how we comply with those obligations. By using our Platform, you agree to the collection and use of your information in accordance with this policy. If you don't agree, please don't use our Platform.

Who We Are Company Buoyly Pty Ltd ABN 65678727958 Address Gold Coast, QLD, Australia Website buoyly.com.au Privacy enquiries Support@buoyly.com.au

Buoyly operates a peer-to-peer marketplace that connects boat owners ('Owners') with people who want to experience a day on the water ('Adventurers'). Both Owners and Adventurers are users of our Platform, and this policy applies equally to both. 2. What Personal Information We Collect We only collect personal information that is reasonably necessary for our functions and activities. The type of information we collect depends on whether you're an Adventurer, an Owner, or simply browsing. 2.1 Information you give us directly — Account registration: your full name, email address, phone number, and password. — Owner listings: your boat details, photos, description, pricing, availability, and location. — Booking information: dates, group size, activity type, and any special requirements. — Identity verification: for Owners, we may collect copies of identification documents (such as a driver's licence or passport) and boat registration details, to verify your identity and eligibility to list on the Platform. — Payment information: billing address and payment method details. Note: we do not store your full card number — payment processing is handled by our third-party provider, Stripe. See section 6 for more detail. — Communications: messages you send to other users through our Platform, and any correspondence you have with our support team. — Reviews and ratings: feedback you leave about Owners or bookings, which may be publicly visible on the Platform. — Profile information: a profile photo and any optional bio or description you choose to add. 2.2 Information we collect automatically When you use our Platform, we automatically collect certain technical information including: — your IP address and approximate location — browser type and version — device type and operating system — pages visited, time spent, and navigation patterns — referring URLs (how you found us) — crash reports and performance data 2.3 Information from third parties If you choose to register or log in using a third-party service such as Google, Facebook, or Apple, we may receive your name and email address from that service. We only use what we need to create your account. We may also receive information from payment processors and identity verification services where relevant to processing your booking or verifying your identity as an Owner. 2.4 Sensitive information We do not intentionally collect sensitive information (as defined in the Privacy Act) such as health information, racial or ethnic origin, religious beliefs, or criminal records — unless you choose to share something with us directly. If this happens, we will handle it in accordance with our obligations under the Privacy Act. 3. Why We Collect Your Information We collect and use your personal information for the following purposes: — To operate the Platform: creating and managing your account, enabling bookings between Owners and Adventurers, and processing payments. — Identity and safety verification: verifying the identity of Owners and ensuring the safety and integrity of the Platform and its community. — To communicate with you: sending booking confirmations, updates, receipts, and safety notices. We may also send you service-related announcements that are necessary to the operation of your account. — Customer support: responding to your enquiries, resolving disputes between users, and improving our service. — Trust and safety: detecting, investigating, and preventing fraudulent transactions, abuse, and other harmful or illegal activity on the Platform. — Platform improvement: analysing how people use the Platform so we can make it better. We use anonymised or aggregated data wherever possible for this purpose. — Marketing communications: with your consent, sending you news, promotions, and information about new features or boats in your area. You can opt out at any time. — Legal obligations: complying with our obligations under Australian law, including tax reporting, record-keeping, and responding to lawful requests from government bodies. — Business operations: in the event of a merger, acquisition, or sale of assets, your information may be transferred as part of that transaction. We will notify you before this occurs.

We will never sell your personal information to third parties for their own marketing purposes. That's not something we do — and it's not something we'll ever do. 4. How We Share Your Information We only share your personal information in the following circumstances: 4.1 Between Owners and Adventurers When you make or accept a booking, we share limited profile information between the two parties — including your first name, profile photo, and review history. This is necessary to facilitate the transaction and build trust within our community. Your full contact details (phone number, email address) are only shared once a booking is confirmed, and only to the extent necessary to coordinate the booking. 4.2 Service providers We share information with trusted third-party service providers who help us operate the Platform. These providers are only permitted to use your information for the specific purpose for which it was shared, and are required to handle it in accordance with Australian privacy law. Our current service providers include:

Stripe Secure payment processing. See stripe.com/au/privacy Google Analytics Platform analytics and performance monitoring. Data is anonymised where possible. Mailchimp Email communications and marketing. You can unsubscribe at any time. Intercom / Zendesk Customer support and live chat. Identity verification provider Owner identity verification (e.g. Stripe Identity or similar).

We may update this list from time to time. If a new service provider requires access to your personal information, we will update this policy. 4.3 Legal requirements We may disclose your personal information if required to do so by law, or if we believe in good faith that disclosure is necessary to: — comply with a legal obligation, court order, or lawful request from a government authority — protect the rights or property of Buoyly — prevent or investigate suspected fraud, safety risks, or illegal activity — protect the personal safety of users or the public 4.4 Business transfers If Buoyly is involved in a merger, acquisition, or sale of assets, your personal information may be transferred to the new entity. We will provide reasonable advance notice before your information becomes subject to a different privacy policy. 4.5 With your consent We may share your information for other purposes where you have given us your explicit consent to do so. 5. Overseas Disclosure Some of our third-party service providers are located or store data outside of Australia, including in the United States and the European Union. Where we disclose personal information to overseas recipients, we take reasonable steps to ensure those recipients handle your information in a manner consistent with the Australian Privacy Principles. By using our Platform, you consent to the transfer of your personal information to these overseas service providers for the purposes set out in this policy. 6. Payments and Financial Information All payment processing on the Buoyly Platform is handled by Stripe, a PCI-DSS compliant payment processor. Buoyly does not store, process, or have access to your full credit card or bank account details. When you make a payment through our Platform, your financial information is provided directly to Stripe and is governed by Stripe's Privacy Policy (stripe.com/au/privacy). Stripe adheres to the Payment Card Industry Data Security Standard (PCI-DSS). Owners are paid out through Stripe's secure payout system. We collect your bank account details solely for the purpose of facilitating these payouts, and handle this information in accordance with Australian banking privacy obligations. 7. Cookies and Tracking Technologies Our Platform uses cookies and similar tracking technologies to improve your experience, remember your preferences, and understand how the Platform is being used. 7.1 What are cookies? Cookies are small text files stored on your device when you visit a website. They help the site remember information about your visit, which can make it easier to use the site again and make it more useful to you. 7.2 What cookies we use

Essential cookies Required for the Platform to function. These enable you to log in, complete bookings, and use core features. You cannot opt out of these. Preference cookies Remember your settings and preferences, such as your saved location or login details. Analytics cookies Help us understand how users navigate the Platform, which pages are most visited, and where we can improve. We use Google Analytics for this. Marketing cookies Used to show you relevant advertising on other websites after you've visited our Platform. You can opt out of these — see section 7.3.

7.3 How to manage cookies You can control and manage cookies through your browser settings. Most browsers allow you to refuse cookies, delete existing cookies, or be notified when a cookie is set. Note that disabling certain cookies may affect the functionality of our Platform. To opt out of Google Analytics tracking, you can install the Google Analytics Opt-out Browser Add-on at tools.google.com/dlpage/gaoptout. To opt out of interest-based advertising, you can visit the Australian Digital Advertising Alliance opt-out tool at youronlinechoices.com.au. 8. How Long We Keep Your Information We only keep your personal information for as long as it's needed for the purposes set out in this policy, or as required by Australian law. — Active accounts: we retain your personal information for as long as your account is active. — Closed accounts: after you close your account, we retain certain information for up to 7 years to comply with our legal obligations under the Australian Taxation Office requirements and the Anti-Money Laundering and Counter-Terrorism Financing Act 2006 (Cth). — Booking records: records of completed bookings are retained for 7 years for tax and legal purposes. — Usage data: anonymised usage and analytics data may be retained indefinitely for Platform improvement purposes. — Marketing data: if you unsubscribe from marketing, we will remove you from our marketing lists promptly and retain only the minimum information necessary to honour your opt-out preference. When your personal information is no longer required, we will take reasonable steps to destroy or de-identify it securely. 9. Your Rights Under Australian Privacy Law Under the Privacy Act 1988 (Cth) and the Australian Privacy Principles, you have the following rights in relation to your personal information: 9.1 Right to access You have the right to request access to the personal information we hold about you. We will provide this to you within a reasonable time (generally within 30 days), subject to certain exceptions permitted under the Privacy Act. There is no charge for making an access request, though we may charge a reasonable fee to cover the cost of retrieving and providing the information. 9.2 Right to correction If you believe that personal information we hold about you is inaccurate, out of date, incomplete, irrelevant, or misleading, you can ask us to correct it. We will take reasonable steps to correct the information or, if we disagree, to attach a note explaining why we believe the information is accurate. 9.3 Right to anonymity Where lawful and practicable, you have the option to interact with us anonymously or using a pseudonym. However, most of our core Platform functions (such as booking a boat or listing your vessel) require you to identify yourself so that transactions can be completed safely. 9.4 Right to opt out of marketing You can opt out of receiving marketing communications from us at any time by clicking the unsubscribe link in any marketing email, or by contacting us at privacy@buoyly.com.au. We will remove you from our marketing lists promptly. 9.5 Right to make a complaint If you believe we have breached the Australian Privacy Principles or mishandled your personal information, we encourage you to contact us first so we can try to resolve the issue directly. If you're not satisfied with our response, you have the right to make a complaint to the Office of the Australian Information Commissioner (OAIC): — Website: oaic.gov.au — Phone: 1300 363 992 — Post: GPO Box 5288, Sydney NSW 2001

To exercise any of these rights, email us at privacy@buoyly.com.au. We'll respond within 30 days and will ask you to verify your identity before we action your request. 10. How We Protect Your Information We take the security of your personal information seriously. We implement reasonable technical and organisational measures to protect your information from unauthorised access, disclosure, alteration, or destruction. These measures include: — encryption of data in transit using TLS/SSL — encrypted storage of sensitive account information — secure payment processing through PCI-DSS compliant providers — access controls limiting who within Buoyly can access personal information — regular security reviews and updates

No method of transmission over the internet is 100% secure. While we do everything reasonably within our power to protect your data, we cannot guarantee absolute security. If you become aware of any security issues, please contact us immediately at safety@buoyly.com.au. 10.1 Data breach notification If we become aware of a data breach that is likely to result in serious harm to you, we will notify you and the Office of the Australian Information Commissioner (OAIC) as required under the Notifiable Data Breaches scheme under Part IIIC of the Privacy Act 1988 (Cth). 11. Children's Privacy Our Platform is not directed at, and is not intended for use by, anyone under the age of 18. You must be 18 or older to create an account, make a booking, or list a boat on Buoyly. We do not knowingly collect personal information from anyone under the age of 18. If we become aware that we have collected information from a person under 18 without appropriate consent, we will take steps to delete that information promptly. If you believe a person under 18 has provided us with their personal information, please contact us at privacy@buoyly.com.au. 12. Third-Party Links Our Platform may contain links to third-party websites, social media platforms, or services that are not operated by us. If you click on one of these links, you'll be taken to that third party's site. We have no control over the content or privacy practices of third-party sites and accept no responsibility for them. We encourage you to read the privacy policy of every site you visit. 13. Changes to This Policy We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or for other operational reasons. When we make material changes, we'll notify you by email and/or by posting a prominent notice on the Platform before the change takes effect. The 'Last updated' date at the top of this policy will always reflect when it was most recently revised. We encourage you to review this policy periodically. Your continued use of the Platform after any changes have been posted constitutes your acceptance of the updated policy. 14. Contact Us If you have any questions, concerns, or requests relating to this Privacy Policy or how we handle your personal information, please get in touch:

Email Support@buoyly.com.au Website buoyly.com.au/privacy Post Privacy Officer, Buoyly Pty Ltd, Gold Coast, QLD, Australia

We take all privacy enquiries seriously and will respond within 30 days. If your query is urgent, mark your email 'URGENT: Privacy Enquiry' and we'll aim to respond sooner.