LEGAL & PRIVACY

SHIFFTO PRIVACY POLICY

Last Updated: 29 September 2026

Effective Date: 29 September 2026

Table of Contents (40)

Have a privacy question?

Contact our Privacy Team for questions, requests or concerns regarding this Privacy Policy.

privacy@shiffto.com

SHIFFTO PRIVACY POLICY

SHIFFTO (“SHIFFTO”, “we”, “us” or “our”) is operated by Shiffto Pty Ltd (“SHIFFTO”).

This Privacy Policy explains how SHIFFTO collects, uses, stores, protects, discloses and otherwise handles personal information when you use our website, mobile applications, platform, marketplace, communication features and related services (collectively, the “Platform”).

By creating an account or using the Platform, you acknowledge that you have read this Privacy Policy. Where applicable law requires consent, we will obtain the relevant consent before collecting or processing personal information.

1. OUR COMMITMENT TO PRIVACY

SHIFFTO recognises that privacy and security are important.

We aim to:

collect only information that is reasonably necessary for our functions and services;
explain clearly why information is collected and how it is used;
protect personal information against unauthorised access, misuse, loss, alteration and disclosure;
provide appropriate access, correction and deletion mechanisms;
retain personal information only for as long as reasonably necessary or legally required;
use appropriate safeguards when information is processed or disclosed outside Australia;
provide appropriate controls where sensitive personal information is involved; and
respond to privacy enquiries, requests and complaints in accordance with applicable privacy laws.

Our privacy practices are intended to operate consistently with applicable privacy laws, including the Privacy Act 1988 (Cth) and Australian Privacy Principles where they apply, as well as applicable privacy and data-protection laws in other jurisdictions in which SHIFFTO operates or provides services.

2. WHO THIS POLICY APPLIES TO

This Privacy Policy applies to information collected from or about:

Senders;
Travellers;
independent third-party carriers;
recipients and delivery contacts;
users who create or maintain an SHIFFTO account;
people who communicate with SHIFFTO;
people who contact customer support;
visitors to the SHIFFTO website;
people who submit verification or onboarding information; and
other individuals whose information is provided to us in connection with a shipment, trip, payment, support request or other Platform activity.

If you provide us with personal information about another person, you should only do so where you are authorised or otherwise permitted to provide that information.

3. INFORMATION WE COLLECT

Depending on how you use SHIFFTO, we may collect the following categories of information.

3.1 Account and identity information

This may include:

full name;
preferred name;
date of birth;
email address;
mobile phone number;
profile photograph;
residential or mailing address;
country and city;
account username or identifier;
password or authentication information;
account status;
verification status; and
information you provide when updating your profile.

3.2 Identity verification and KYC information

Where identity verification is required, we may collect information such as:

passport;
national identity document;
driver’s licence or other identity document where accepted;
document number;
document issue and expiry dates;
nationality;
date of birth;
photograph or selfie;
identity verification results;
document authenticity results;
information required to detect identity mismatch, fraud or suspicious activity; and
other information reasonably required for identity verification.

Some identity-verification information may constitute sensitive or biometric information under applicable law.

Where we use an independent verification provider, that provider may process information on our behalf or in accordance with its own applicable privacy terms.

We will not intentionally request sensitive identity information that is unnecessary for the relevant verification or security purpose.

4. TRAVEL AND TRIP INFORMATION

If you use SHIFFTO as a Traveller, we may collect:

origin city;
destination city;
travel date;
estimated departure and arrival information;
available luggage or parcel capacity;
travel route;
travel ticket or booking information;
boarding pass or other travel evidence;
travel-document verification information;
trip status;
verification and approval status;
information about accepted shipments; and
information relating to handover and delivery.

Travel documents are collected to help verify that a Traveller has a genuine and relevant trip before the trip is made available for matching.

5. SHIPMENT AND PARCEL INFORMATION

If you create or manage a shipment, we may collect:

sender information;
recipient information;
origin city;
destination city;
parcel weight;
parcel category;
parcel description;
quantity;
declared value;
photographs;
fragile-item information;
packaging information;
prohibited/restricted-item declarations;
battery, liquid, food, medicine or other risk-related declarations;
special handling requirements;
shipment status;
pickup and delivery information;
proof-of-handover information;
proof-of-delivery information;
dispute information; and
other information reasonably necessary to facilitate the transaction.

You are responsible for ensuring that information you provide about a parcel is accurate and complete.

6. INFORMATION ABOUT RECIPIENTS AND OTHER PEOPLE

Where necessary to facilitate a shipment, we may collect limited information about recipients or other people involved in the transaction, including:

name;
phone number;
email address;
city or delivery location;
delivery instructions; and
information necessary to arrange or confirm delivery.

You should only provide another person’s information where you have permission or another lawful basis to do so.

7. COMMUNICATIONS AND MESSAGES

SHIFFTO may provide in-platform communication between relevant participants, including:

Sender;
Traveller;
independent third-party Carrier; and
SHIFFTO support personnel.

We may collect and retain:

messages;
attachments;
photographs;
communication timestamps;
transaction references;
support communications; and
records of communications relevant to a shipment or trip.

Communication records may be retained for purposes including:

facilitating transactions;
customer support;
dispute resolution;
fraud prevention;
safety;
investigating suspected misuse;
enforcing our Terms and policies; and
complying with legal obligations.

Users should not use SHIFFTO messaging to exchange prohibited content or arrange transactions outside the Platform in violation of SHIFFTO’s policies.

8. LOCATION INFORMATION

Depending on the features you use and the permissions you provide, SHIFFTO may collect or process:

city-level location;
route information;
approximate location;
device location;
location associated with a trip or shipment; and
live or near-real-time location information where a tracking feature is enabled.

Location information may be used to:

support route matching;
provide tracking;
improve delivery visibility;
prevent fraud;
improve Platform security;
provide relevant functionality; and
support customer service.

Where a feature requires device location permission, you may control that permission through your device settings, subject to the effect this may have on the relevant feature.

Under applicable law, certain precise or real-time location information may be treated as sensitive personal information.

9. PAYMENT AND FINANCIAL INFORMATION

SHIFFTO may facilitate payments, refunds, payouts, fees and other financial transactions through third-party payment providers such as Stripe.

We may receive information such as:

payment status;
transaction amount;
currency;
transaction identifier;
payout status;
refund status;
payment method type;
limited payment-related information; and
information necessary to prevent fraud and resolve payment disputes.

Where payment information is processed directly by a third-party payment provider, that provider may process payment-card or financial information in accordance with its own privacy policy and applicable legal requirements.

SHIFFTO does not need to store your full payment-card number where the payment provider processes the card information directly.

10. TECHNICAL AND DEVICE INFORMATION

When you use our website or mobile application, we may automatically collect certain technical information, including:

IP address;
device type;
operating system;
browser type;
app version;
device identifiers where permitted;
language and regional settings;
network information;
timestamps;
crash information;
diagnostic information;
security logs;
authentication logs;
approximate location derived from technical information; and
information about how the Platform is used.

This information may be used for:

security;
fraud prevention;
troubleshooting;
performance monitoring;
analytics;
service improvement;
debugging;
authentication; and
maintaining the reliability of the Platform.

11. COOKIES AND SIMILAR TECHNOLOGIES

Our website may use cookies, local storage, SDKs, pixels or similar technologies.

These technologies may be used for:

essential website functionality;
authentication;
security;
remembering preferences;
analytics;
performance monitoring;
improving the Platform; and
understanding how users interact with our website.

Where required by applicable law, we will provide appropriate choices regarding non-essential cookies or similar technologies.

You can also control cookies through your browser settings, although disabling certain cookies may affect website functionality.

12. HOW WE USE PERSONAL INFORMATION

We may collect, hold, use and disclose personal information for purposes including:

Platform operation

creating and managing accounts;
providing SHIFFTO services;
facilitating shipments and trips;
matching Senders and Travellers;
facilitating independent Carrier participation;
managing profiles and dashboards;
providing tracking and status updates.

Verification and safety

identity verification;
KYC;
travel-document verification;
fraud detection;
suspicious-activity detection;
preventing prohibited shipments;
protecting users and the Platform;
investigating reports and complaints.

Payments

processing payments;
processing refunds;
processing Traveller or Carrier payouts;
calculating commissions and fees;
preventing payment fraud;
resolving payment disputes.

Communication

sending transaction notifications;
sending verification messages;
communicating about trips and shipments;
responding to support requests;
sending service-related announcements.

Platform improvement

analytics;
troubleshooting;
testing;
product development;
improving matching;
improving security;
monitoring performance.

Legal and regulatory purposes

We may use or disclose information where reasonably necessary to:

comply with applicable laws;
respond to lawful requests from authorities;
comply with court orders;
establish, exercise or defend legal claims;
investigate fraud or unlawful activity;
protect users, SHIFFTO or third parties; or
enforce our Terms, policies and agreements.

13. MATCHING AND AUTOMATED SYSTEMS

SHIFFTO may use automated systems to assist with activities such as:

route matching;
shipment matching;
identity verification;
fraud and risk detection;
account security;
transaction monitoring; and
Platform recommendations.

Automated systems may use information such as route, city, date, capacity, verification status, transaction information and other relevant Platform information.

Where applicable law provides rights concerning automated decision-making, SHIFFTO will provide the applicable information and mechanisms required by law.

Where a decision that significantly affects an individual is made solely or substantially through an automated process, the individual may have rights to request information, review or human intervention, subject to applicable law, security requirements and legitimate exceptions.

As Australian privacy rules concerning certain automated decisions are scheduled to introduce additional Privacy Policy requirements from 10 December 2026, SHIFFTO should ensure its production implementation and Privacy Policy remain aligned with those requirements if applicable.

14. HOW WE SHARE PERSONAL INFORMATION

SHIFFTO does not sell personal information as a business model.

We may disclose or make information available to the following categories of recipients where reasonably necessary:

14.1 Other SHIFFTO users

Depending on the transaction, limited information may be made available to the relevant:

Sender;
Traveller;
recipient; or
independent third-party Carrier.

For example, information necessary to facilitate a shipment may be visible to the relevant participant.

Identity documents, passport images, KYC documents and other highly sensitive verification information should not be made publicly visible or unnecessarily disclosed to other users.

14.2 Independent third-party Carriers

Where an independent Carrier participates in a shipment, SHIFFTO may provide the Carrier with information reasonably necessary to perform the relevant service.

The Carrier may receive information such as:

shipment reference;
parcel information;
relevant pickup/delivery information;
sender/recipient details necessary for delivery;
status information; and
information required to communicate about the shipment.

Carriers are independent third parties and are responsible for handling information in accordance with applicable law and their contractual obligations.

14.3 Service providers

We may use third-party service providers for services including:

cloud hosting;
database infrastructure;
authentication;
identity verification/KYC;
payment processing;
payout processing;
email;
SMS;
push notifications;
mapping;
location services;
analytics;
security;
fraud prevention;
customer support;
file and image storage;
error monitoring; and
technical infrastructure.

These providers may process personal information on our behalf or provide services that involve processing information in accordance with their applicable terms.

15. THIRD-PARTY SERVICE PROVIDERS

SHIFFTO may use services such as:

Stripe for payment processing;
Google/Firebase for authentication, notifications, analytics and/or other Platform infrastructure;
Cloudflare for DNS, security, CDN and/or storage infrastructure;
Hostinger or other hosting providers for server infrastructure;
identity/KYC providers;
mapping/location providers;
communication providers; and
other technology providers required to operate the Platform.

The specific providers used by SHIFFTO may change over time.

For example, Firebase states that some Firebase services process data in the United States and that many Firebase services operate on global Google infrastructure.

Cloudflare states that it primarily stores information in the United States and European Economic Area and may transfer/access information from other countries as part of its global operations.

Hostinger’s current Data Processing Addendum expressly addresses Australian Privacy Principles and processing outside a user’s country of origin.

16. OVERSEAS DISCLOSURE AND INTERNATIONAL DATA PROCESSING

Because SHIFFTO uses technology and service providers that may operate in different jurisdictions, personal information may be stored, accessed or processed outside Australia.

Depending on the service providers and infrastructure used, information may be processed in countries including:

Australia;
United States;
countries within the European Economic Area;
countries in which our technology, verification, payment, communications or infrastructure providers operate; and
other jurisdictions permitted under applicable law.

The exact location of processing may change as our service providers and infrastructure change.

Where Australian Privacy Principles apply, SHIFFTO will take reasonable steps in accordance with applicable law when disclosing personal information to overseas recipients.

Where another applicable privacy law imposes additional cross-border requirements, SHIFFTO will seek to comply with those requirements where applicable.

17. BANGLADESH DATA PROTECTION

SHIFFTO may process personal information relating to individuals in Bangladesh or information connected with services provided in Bangladesh.

Where applicable, SHIFFTO will consider and comply with the Personal Data Protection Act 2026 of Bangladesh and other applicable Bangladeshi laws.

The Act recognises personal information including identification information, financial information, location information and biometric information, and establishes obligations concerning lawful processing, security, retention, access, correction and other data-subject rights.

Where applicable, SHIFFTO will implement appropriate safeguards for cross-border processing and transfers.

18. SENSITIVE PERSONAL INFORMATION

Depending on the services you use, SHIFFTO may process information that is considered sensitive under applicable law.

This may include:

biometric verification information;
identity-document information;
health-related information where voluntarily provided and reasonably necessary;
criminal-record information where legally permitted and necessary for safety/compliance;
precise or real-time location information;
nationality or other information where classified as sensitive under applicable law; and
other categories that may be treated as sensitive by applicable law.

SHIFFTO will only collect and process sensitive information where there is an appropriate lawful basis and where reasonably necessary for the relevant purpose.

We will apply additional safeguards appropriate to the sensitivity and risk of the information.

19. IDENTITY DOCUMENTS

Where you provide a passport, national identity document, driver’s licence or similar document:

it may be used for identity verification;
it may be reviewed using automated and/or human processes;
it may be processed by an authorised verification provider;
it may be used to prevent fraud and impersonation;
it may be used to comply with legal or safety requirements; and
it may be retained for as long as reasonably necessary for the relevant purpose or as required by law.

SHIFFTO will not intentionally publish identity documents or make them available to unrelated users.

20. TRAVEL DOCUMENTS

Travel documents such as flight tickets, boarding passes or booking confirmations may be collected to verify:

that a Traveller has a genuine trip;
route;
travel date;
relevant travel details; and
eligibility to participate in a particular trip.

Travel documents will be accessible only to authorised personnel and service providers who reasonably require access for verification, security or Platform operations.

21. DATA SECURITY

SHIFFTO takes reasonable technical and organisational measures to protect personal information against:

unauthorised access;
unauthorised disclosure;
misuse;
loss;
destruction;
alteration;
interference; and
other security threats.

Depending on the nature and sensitivity of the information, safeguards may include:

access controls;
authentication;
role-based permissions;
encryption in transit;
secure storage;
server security;
logging and monitoring;
administrative controls;
restricted staff access;
secure third-party integrations;
backup and recovery procedures; and
security testing and updates.

However, no internet transmission, application, database or electronic storage system can be guaranteed to be completely secure.

Users are responsible for maintaining the confidentiality of their passwords, authentication information and account access.

22. DATA BREACHES

If SHIFFTO becomes aware of a suspected or confirmed data security incident, we will assess and respond to it in accordance with applicable law.

Where a data breach is legally required to be notified, SHIFFTO will make the required notifications to affected individuals and/or the relevant regulator.

For entities covered by Australia’s Notifiable Data Breaches scheme, eligible breaches likely to cause serious harm must be notified in accordance with the scheme.

SHIFFTO will also take reasonable steps to contain, investigate and remediate security incidents.

23. DATA RETENTION

SHIFFTO does not intend to retain personal information indefinitely.

We generally retain information only for as long as reasonably necessary for:

providing the Platform;
maintaining your account;
completing transactions;
processing payments;
resolving disputes;
preventing fraud;
maintaining security;
complying with accounting, tax or other legal obligations;
establishing, exercising or defending legal claims; or
other lawful purposes.

Different categories of information may be retained for different periods.

For example:

Account information

Generally retained while your account remains active and for a reasonable period afterward where necessary for security, dispute resolution or legal obligations.

KYC and identity information

Retained only for as long as reasonably necessary for verification, safety, fraud prevention, legal and regulatory purposes, subject to applicable law and the retention practices of authorised verification providers.

Transaction and payment records

May be retained for the period reasonably necessary for accounting, tax, fraud prevention, dispute resolution and legal obligations.

Communications

May be retained for support, safety, dispute resolution, fraud prevention and legal purposes.

Technical/security logs

May be retained for security, troubleshooting and fraud-prevention purposes for a reasonable period.

When personal information is no longer required, SHIFFTO will take reasonable steps to delete, destroy or de-identify it where required by applicable law. Australian APP 11 expressly requires reasonable steps to destroy or de-identify personal information that is no longer needed, subject to applicable exceptions.

24. ACCOUNT DELETION

You may request deletion of your SHIFFTO account.

Where required, SHIFFTO will provide an appropriate account-deletion mechanism through the Platform and/or an external web-based process.

When an account is deleted, we will delete or de-identify associated personal information that we are no longer legally or legitimately required to retain.

Some information may need to be retained where reasonably necessary for:

legal compliance;
accounting or tax obligations;
fraud prevention;
security;
dispute resolution;
chargebacks;
payment records;
legal claims;
regulatory requirements; or
other lawful purposes.

Where information is retained after account deletion, SHIFFTO will restrict its use to the purposes for which retention is necessary.

Google Play currently requires apps that allow account creation to provide both an in-app deletion pathway and an external web resource for account deletion.

Developer action required: the app must actually implement this functionality before the Play Store submission.

25. YOUR PRIVACY RIGHTS

Depending on applicable law, you may have rights to:

request access to personal information we hold about you;
request correction of inaccurate or incomplete information;
request deletion of personal information;
withdraw consent where processing is based on consent;
object to certain processing;
request restriction of processing where applicable;
request information about how your personal information is processed;
request information about certain automated decisions;
request a copy or portability of certain personal information where applicable; and
lodge a privacy complaint.

These rights are subject to applicable legal exceptions.

For example, SHIFFTO may need to retain certain information to comply with legal obligations or protect against fraud.

Bangladesh’s 2026 personal-data legislation expressly provides rights relating to access/portability, correction and deletion in applicable circumstances.

26. HOW TO ACCESS OR CORRECT YOUR INFORMATION

You may contact us to request access to or correction of personal information we hold about you.

Your request should include:

your name;
email address associated with your SHIFFTO account;
a description of the information you are requesting; and
any information reasonably necessary for us to verify your identity.

We may need to verify your identity before processing an access, correction or deletion request.

27. WITHDRAWING CONSENT

Where SHIFFTO processes personal information based on your consent, you may withdraw your consent where permitted by applicable law.

Withdrawal of consent does not necessarily affect the lawfulness of processing that occurred before consent was withdrawn.

Withdrawal may also affect our ability to provide certain services.

For example, if identity verification is necessary to use a Traveller feature, withdrawing consent for the relevant verification information may mean that you cannot continue using that feature.

28. ANONYMITY AND PSEUDONYMOUS USE

Where reasonably practicable and where identification is not necessary for the relevant service or legal requirement, SHIFFTO may allow certain interactions without identifying yourself or by using limited identifying information.

However, some Platform functions necessarily require identification, including:

account creation;
KYC;
payment;
payouts;
fraud prevention;
shipment transactions;
Traveller verification;
Carrier verification; and
compliance with legal obligations.

29. CHILDREN

SHIFFTO is not intended to be used by children under 18 unless permitted by applicable law and SHIFFTO expressly provides an appropriate process.

We do not knowingly collect personal information from children in circumstances where such collection is prohibited.

If you believe a child has provided personal information to SHIFFTO without appropriate authorisation, please contact us.

Where applicable law requires parental or guardian consent, SHIFFTO will implement appropriate measures.

30. DIRECT MARKETING

SHIFFTO may send service-related communications necessary for operating your account and transactions.

Where permitted by applicable law, SHIFFTO may also send promotional communications.

You may unsubscribe from marketing communications using the unsubscribe mechanism provided in the communication or by contacting us.

Unsubscribing from marketing communications will not prevent us from sending essential service messages such as:

security alerts;
account notifications;
payment notifications;
shipment updates;
verification messages; or
important changes to our services or policies.

31. THIRD-PARTY WEBSITES AND SERVICES

The Platform may contain links to third-party websites, applications or services.

Those third parties may have their own privacy policies.

SHIFFTO is not responsible for the privacy practices of third-party websites or services that are outside our control.

You should review the relevant third party’s privacy policy before providing information to them.

32. USER-GENERATED CONTENT

Users may upload:

photographs;
parcel images;
profile photographs;
documents;
messages;
reviews;
shipment information; and
other content.

You should not upload unnecessary sensitive personal information belonging to yourself or another person.

You remain responsible for ensuring that information you upload is lawful and does not improperly disclose another person’s personal information.

33. FRAUD, SAFETY AND SECURITY

SHIFFTO may process personal information to identify and prevent:

identity fraud;
account takeover;
payment fraud;
prohibited shipments;
suspicious activity;
abuse of the Platform;
false travel information;
fraudulent KYC documents;
unsafe behaviour; and
attempts to circumvent Platform rules.

Where reasonably necessary, SHIFFTO may suspend, restrict or investigate an account or transaction.

Where applicable law provides rights concerning automated decisions or significant decisions, those rights will apply.

34. LEGAL DISCLOSURES

SHIFFTO may disclose personal information where reasonably necessary to:

comply with Australian or foreign law;
comply with a court order;
comply with a lawful government request;
cooperate with law enforcement;
investigate suspected unlawful activity;
protect someone’s safety;
protect SHIFFTO’s legal rights;
enforce contractual terms; or
establish, exercise or defend legal claims.

Where legally permitted, SHIFFTO will seek to limit disclosures to information reasonably necessary for the relevant purpose.

35. BUSINESS TRANSFERS

If SHIFFTO is involved in:

a merger;
acquisition;
investment;
restructuring;
sale of assets;
transfer of business operations; or
similar corporate transaction,

personal information may be transferred as part of that transaction, subject to applicable privacy laws and appropriate safeguards.

36. DATA OWNERSHIP AND USER RESPONSIBILITY

You remain responsible for the accuracy of personal information you provide.

You should:

keep your account information accurate;
update outdated information;
protect your password;
avoid sharing authentication credentials;
notify us of suspected unauthorised account access; and
avoid uploading unnecessary personal information.

SHIFFTO may take reasonable steps to maintain accurate and up-to-date information as required by applicable law.

Australian APP 10 requires covered entities to take reasonable steps to ensure personal information is accurate, up-to-date, complete and relevant for its intended use or disclosure.

37. PRIVACY COMPLAINTS

If you believe SHIFFTO has mishandled your personal information or breached an applicable privacy obligation, you may contact us.

We will:

acknowledge your complaint;
review the relevant circumstances;
investigate where appropriate;
request additional information if necessary;
communicate the outcome to you; and
take appropriate corrective action where required.

You may contact us using the details below.

Privacy Contact

SHIFFTO Privacy Team

Email: privacy@shiffto.com

Website: https://shiffto.com

Postal Address: 18a Springfield, Old Guildford Nsw 2161

If you are in Australia and are not satisfied with our response, you may also be able to complain to the Office of the Australian Information Commissioner (OAIC).

38. CHANGES TO THIS PRIVACY POLICY

We may update this Privacy Policy from time to time to reflect:

changes to the Platform;
new features;
new service providers;
changes in data-processing practices;
changes in applicable law;
regulatory guidance; or
security and operational requirements.

When we make material changes, we may provide notice through the Platform, website, email or another appropriate method.

The “Last Updated” date at the beginning of this Privacy Policy indicates when it was most recently updated.

39. CONTACT US

If you have questions, requests or concerns about this Privacy Policy or how SHIFFTO handles personal information, contact:

Shiffto Pty Ltd

Trading as: SHIFFTO

Privacy Contact: Privacy Team

Email: privacy@shiffto.com

Support: support@shiffto.com

Website: https://shiffto.com

Registered Address: 18a Springfield, Old Guildford Nsw 2161

ABN/ACN: ACN 702 570 278

40. GOVERNING PRIVACY REQUIREMENTS

This Privacy Policy is intended to describe SHIFFTO’s information-handling practices in a manner consistent with applicable privacy and data-protection requirements.

Depending on the individual, transaction, location and service involved, this may include:

Privacy Act 1988 (Cth);
Australian Privacy Principles;
applicable Australian data-breach requirements;
applicable consumer and electronic-communications requirements;
Personal Data Protection Act 2026 of Bangladesh;
applicable laws concerning cross-border data transfers;
applicable laws governing sensitive and biometric information; and
other privacy or data-protection laws that may apply to SHIFFTO or its users.

Where laws conflict, SHIFFTO will seek to comply with the requirements applicable to the relevant processing activity and jurisdiction.

SHIFFTO PRIVACY POLICY

SHIFFTO (“SHIFFTO”, “we”, “us” or “our”) is operated by Shiffto Pty Ltd (“SHIFFTO”).

14. HOW WE SHARE PERSONAL INFORMATION

SHIFFTO does not sell personal information as a business model.

We may disclose or make information available to the following categories of recipients where reasonably necessary:

14.1 Other SHIFFTO users

Depending on the transaction, limited information may be made available to the relevant:

Sender;
Traveller;
recipient; or
independent third-party Carrier.

For example, information necessary to facilitate a shipment may be visible to the relevant participant.

Identity documents, passport images, KYC documents and other highly sensitive verification information should not be made publicly visible or unnecessarily disclosed to other users.

14.2 Independent third-party Carriers

Where an independent Carrier participates in a shipment, SHIFFTO may provide the Carrier with information reasonably necessary to perform the relevant service.

The Carrier may receive information such as:

shipment reference;
parcel information;
relevant pickup/delivery information;
sender/recipient details necessary for delivery;
status information; and
information required to communicate about the shipment.

Carriers are independent third parties and are responsible for handling information in accordance with applicable law and their contractual obligations.

14.3 Service providers

We may use third-party service providers for services including:

cloud hosting;
database infrastructure;
authentication;
identity verification/KYC;
payment processing;
payout processing;
email;
SMS;
push notifications;
mapping;
location services;
analytics;
security;
fraud prevention;
customer support;
file and image storage;
error monitoring; and
technical infrastructure.

These providers may process personal information on our behalf or provide services that involve processing information in accordance with their applicable terms.