Version 1.0

TRUCK-EATS-TECH PTY LTD | ABN 99 703 240 126 | ACN 703 240 126

Registered office: 259 Blacktown Road, Seven Hills NSW 2147, Australia

Privacy Officer and all privacy enquiries: admin@catero.com.au

1. About this policy and Catero

1.1 Catero is event enquiry and quoting software operated by TRUCK-EATS-TECH PTY LTD (Catero, we, us or our). This policy explains how we collect, hold, use and disclose personal information through our website, business accounts, customer-facing widgets, quotes, invoices, support channels and enabled integrations. Personal information is information or an opinion about an identified individual, or an individual who is reasonably identifiable.

1.2 This policy applies to business owners, account holders, staff and invitees, prospective subscribers, people requesting or accepting event quotes, event contacts and guests whose information is supplied through Catero, and people contacting us. A business record may contain personal information even where the business itself is a company. We provide a copy of this policy free of charge on request and can discuss an accessible format.

1.3 We handle personal information in accordance with applicable Australian privacy law, including the Privacy Act 1988 (Cth) and Australian Privacy Principles where they apply to us. This policy describes our privacy practices; it does not ask you to waive legal rights, consent to every possible use or agree to unrelated marketing. Specific notices and consent requests may accompany particular features.

1.4 Your business subscription terms apply from account creation and acceptance as recorded against your account. This Privacy Policy explains information handling from the time information is collected, including for people who do not create an account. Changes to this policy are addressed in section 20; an account's commencement date does not authorise undisclosed future uses of its data.

2. Catero and the event business have different responsibilities

2.1 The catering or event business identified on a form or quote decides what Event Services to offer, how to configure its enquiry questions and pricing, who in its team can access its workspace and how to use information for its bookings. Catero provides the software and processes the business's event records to operate it. We also handle account, billing, support and security information for Catero's own administration.

2.2 A business's collection notice and privacy policy explain its own information handling. A supplier may keep copies in its own records or use separate email, accounting and payment systems. This policy does not control those independent records or replace the supplier's obligations. Catero remains responsible for its own handling of information and the obligations applicable to it.

2.3 If your request concerns an event, menu, booking, invoice or information entered by the supplier, contacting that business may resolve it fastest. You may also contact us at admin@catero.com.au. We will assess our own obligations and coordinate with the relevant business where appropriate rather than automatically refusing a request because it concerns a business workspace.

3. Information collected about accounts and businesses

3.1 Account and team information includes names, email addresses, phone numbers where provided, account identifiers, authentication and session records, team invitations, role permissions, business membership and account activity. Authentication is handled through the account service. Do not send passwords or login codes to our support inbox.

3.2 Business information includes trading and legal names, ABN or ACN, business and service addresses, time zone, contact people, branding, logos, photographs, website details, menu items, package descriptions, service areas, pricing rules and business settings. Some information may be displayed publicly or on quotes at the business's direction; an internal record is not necessarily public.

3.3 Subscription and account administration information includes plan selections, linked Business Profiles, billing contact details, Catero fee calculations, invoices, credit and refund records, subscription status, pauses, deletion requests and evidence of acceptance of applicable terms. An account commencement record can include account creation time, acceptance time and the accepted terms version.

3.4 We also collect correspondence, support requests, feedback and attachments you send us. Where an enquiry, waitlist or product feedback facility is available, we collect the details you choose to submit and use them for that stated purpose. We do not treat every support enquiry as a marketing subscription.

4. Information collected about events and customers

4.1 Depending on the questions enabled by a business and the information supplied, event records can include a Customer's name, contact details, organisation, communication preference, event type, event date and time, venue or delivery address, guest counts, adults and children counts, service duration, chosen packages, extras, budget, instructions and requested changes.

4.2 Quote and booking records can include prices, discounts, GST treatment, deposits, payment schedules, expiry dates, quote versions, acceptance or decline records, revision requests, event lock-in information, operational notes, run sheets, invoice references and payment status. Activity records may show when a quote was opened, accepted or changed and which account performed an action.

4.3 A venue address or event date may reveal a person's movements or location. Use business or venue information where appropriate and avoid unnecessary residential details. Guest counts do not require the collection of every guest's name. Only supply information that is reasonably needed for the event.

4.4 A business may upload images or documents that contain people or personal details, including in the background or file metadata. The person uploading must have the appropriate rights and permissions. Public branding images and operational records can have different audiences; check the selected use before uploading.

5. Dietary, allergy and other sensitive information

5.1 Dietary requirements may reveal health information, allergies, disability-related needs or religious beliefs. This may be sensitive information. Catero can hold such information where it is supplied through an enabled event workflow and reasonably needed to help the supplier assess or fulfil the requested service. We seek consent where required by law, unless a lawful exception applies. General acceptance of terms or merely displaying this policy is not, by itself, express consent to all sensitive-information handling.

5.2 Provide only the practical details needed to communicate the requirement. Prefer aggregate dietary counts when names are unnecessary. Do not upload medical histories, diagnoses, identity documents or unrelated sensitive records. A person supplying identifiable guest information should make the guest aware of its proposed use and obtain any required authority or consent.

5.3 The supplier and its authorised team may need to see relevant dietary requirements to plan an event. A run sheet or export may include them. We do not use identifiable dietary or allergy information for advertising, and we do not use it to infer unrelated characteristics or create marketing audiences.

5.4 Menu tags and AI generated suggestions do not certify that food is safe. Serious allergies should be confirmed directly with the supplier. For privacy requests about dietary information, contact the supplier or our Privacy Officer. If sensitive information is not reasonably needed, was sent without a lawful basis or cannot lawfully be retained, we will take appropriate steps to restrict, delete or de-identify it, subject to applicable law.

6. How information reaches us

6.1 We collect information directly when you create an account, complete a form, configure your business, request or respond to a quote, use an enabled payment feature, contact support or provide feedback. Information can also be supplied by a business owner or team member, an event organiser, a person booking for an organisation, or another person authorised to act for you.

6.2 Connected providers may supply information needed for an enabled function, such as authentication status, payment confirmations, refunds, delivery results or calendar entries. The data exchanged depends on the permissions granted and the integration used. We do not treat connection of one service as permission to access unrelated records.

6.3 You can generally browse public information without providing your name, although technical data may still be processed. You may ask general questions anonymously or under a pseudonym where practicable. Accounts, payments and event bookings may need identifying or contact information to function. If you choose not to provide required information, we or the supplier may be unable to create the account, provide an accurate quote, contact you, process payment or accommodate a requirement. Optional fields should not be treated as mandatory without a clear reason.

6.4 Information entered into a form may be processed before final submission if an enabled function provides live pricing, validation or draft saving. Stopping before the final button should not be assumed to erase information already processed. The relevant collection notice should explain any server-side draft retention. Contact us if you want to ask about an unfinished enquiry.

7. Technical information, analytics and cookies

7.1 Our website and infrastructure may process IP addresses, browser and device information, operating system, access times, requested pages, referring sources, session identifiers, error reports and security events. Analytics can report visits, pages viewed, device categories, approximate country and lead-source tags. Approximate location inferred from a connection is different from a venue address you enter.

7.2 Cookies and similar browser storage may be used to keep you signed in, maintain a session, remember necessary preferences, protect the service and support enabled analytics. Blocking essential storage may prevent sign-in or cause forms to lose state. You can use your browser controls to manage cookies and stored site data.

7.3 Quote activity can record an open or acceptance event. Such records help a business follow up and administer a quote but are not proof that a particular person read every term. We do not describe operational quote tracking as anonymous where it is associated with an identifiable quote.

7.4 Any optional advertising, cross-site tracking, session replay or non-essential analytics must be accurately identified and presented with the choices or consent required for the location and technology involved. We do not treat this policy as authorisation to introduce undisclosed tracking. The current provider and technology details are identified in Schedule 1 and must reflect the functions actually enabled.

8. Why we use personal information

8.1 We use account information to establish and administer accounts, authenticate users, manage team roles and linked businesses, provide support, administer subscriptions and keep records of terms acceptance. We use event information to collect enquiries, calculate configured prices, generate and revise quotes, record customer responses, create invoices and payment schedules, prepare run sheets and support the business's event administration.

8.2 Where enabled, we use relevant information to send operational quotes, invitations, receipts and reminders, connect payment or calendar services, record transaction results and process refunds. A feature that is not connected does not become active merely because this policy describes it. Essential service messages may continue where necessary even if you opt out of marketing.

8.3 We use limited technical and activity information to diagnose errors, prevent fraud and unauthorised access, investigate incidents and improve reliability and usability. Access to identifiable records for support must be limited to what is reasonably necessary. We may also use information to handle complaints, enforce lawful rights, meet legal obligations and respond to valid regulatory or court requirements.

8.4 We use genuinely de-identified or aggregated information for service analysis where people are not reasonably identifiable. Removing a name alone does not necessarily de-identify a detailed event record. We will not use identifiable Customer Data for unrelated advertising or sell identifiable Customer Data.

9. AI assisted features and automated quoting

9.1 Catero includes automated quoting based on business settings and AI assisted functions that can draft descriptions, pricing rules, event terms or responses and interpret requests for changes. Rules-based calculations and generative AI are different functions, and the information needed for each depends on the feature used.

9.2 For an AI function, the prompt, relevant business context and selected event or customer details may be sent through an AI service provider and returned as generated content. Examples can include menu text, pricing instructions, a customer's first name, event type, guest counts or the wording of a change request. Prompts, outputs and associated activity records may themselves contain personal information.

9.3 We aim to minimise information sent for a task. Do not submit passwords, full payment card details or unnecessary sensitive information in AI requests. Identifiable dietary or medical information should not be sent to a general-purpose AI feature unless that handling has been specifically assessed and authorised with a lawful basis and any required consent.

9.4 We will not use identifiable Customer Data to train general-purpose AI models without a separate lawful basis and any required consent. AI processing does not imply permission for unrestricted model training. The actual AI providers, their retention and training settings, and countries of processing must be reflected in Schedule 1 before the relevant disclosure occurs.

9.5 Generated text and inferred information may be wrong. Businesses should review AI outputs before using them, particularly information about individuals, pricing and dietary requirements. You may ask us or the relevant business to review an error or explain an automated quote, and may seek correction of personal information. A quote result does not independently verify availability, identity, allergy safety or the enforceability of an event contract.

10. Payments and financial information

10.1 Online payment processing is available only after the relevant payment integration is enabled. Stripe is the intended connected payment provider. Where enabled, payment details entered into its secure interface are handled by the provider under its own privacy notice and applicable agreement. Do not provide full card details or bank login credentials in Catero notes, AI prompts or support emails.

10.2 Catero and the event business may receive transaction references, amounts, currency, payment status, payment method information made available by the provider, settlement or refund information, dispute records and limited verification or billing details needed for administration. A provider may collect identity and business verification information directly when a business opens or connects a payment account.

10.3 Catero does not need your full card number or card security code to calculate its platform fee or mark an invoice status. Any payment-provider collection and storage must be described accurately in the enabled checkout. A business may also manually record cash or bank payments, and that record does not mean Catero collected the money or accessed your bank account.

10.4 Payment providers may have independent fraud prevention, compliance, recordkeeping and dispute-resolution responsibilities. Their retention periods may differ from Catero's. Deleting a Catero workspace does not delete records a payment provider must retain independently. Ask the provider or us for help identifying the correct contact for a payment privacy request.

11. Who may receive information

11.1 A Customer's enquiry and related event information are made available to the identified supplier and the team members it authorises. Team access depends on roles and settings, and relevant information may be included in supplier exports and run sheets. Linked billing does not by itself mean every business user should have access to every linked business's customer records.

11.2 Catero personnel and contracted support personnel may access information where reasonably needed to operate, secure or support the Service. Service providers can process information for cloud hosting, databases, authentication, file storage, delivery infrastructure, email, AI functions, analytics and payments, but only as relevant to an enabled function and subject to appropriate arrangements.

11.3 We may disclose information to professional advisers and insurers where reasonably necessary, to law enforcement, courts or regulators where required or authorised by law, and to protect people from a serious threat where a lawful exception applies. We assess requests rather than granting unrestricted access merely because a third party asks.

11.4 If Catero undergoes a genuine sale, restructure or transfer, limited information may be provided for due diligence under appropriate confidentiality and security arrangements and transferred to a successor responsible for the service. Any transfer must be consistent with applicable law, required notices and the purposes described to affected people.

11.5 We do not make private event records publicly searchable as a feature of the Service. However, a business may publish selected branding or content, and quote or invoice links may allow access to the information they display by anyone who obtains them. Keep those links private. A recipient's screenshot, forwarded email or exported file can remain outside Catero's control.

12. Storage and overseas handling

12.1 Catero uses managed cloud infrastructure for its database, account authentication and storage functions. Its current primary database location is US East (North Virginia), United States. Personal information held in that database is therefore stored outside Australia. This is not an Australian-only hosting service.

12.2 Database location does not identify every place where files, backups, delivery systems, support access, email or AI requests may be processed. Those services can involve overseas recipients or access outside the primary database region. The confirmed recipient categories and countries are set out in Schedule 1. We do not infer an AI processing location from the database location.

12.3 Where the Australian Privacy Principles apply, we take the steps required for overseas disclosures, including reasonable steps to address the recipient's handling where applicable, or rely on a valid statutory exception. Reading this policy or creating an account is not a blanket waiver of those protections. We will seek separate informed consent where we propose to rely on consent to a particular disclosure and the law requires it.

12.4 Contact admin@catero.com.au for information about relevant overseas handling or a data location requirement before supplying information. If our service cannot meet your requirement, we will explain that rather than promise a location we have not verified. The location and provider information must be updated if infrastructure changes.

13. Security and incident response

13.1 We take reasonable technical and organisational steps to protect personal information from misuse, interference, loss and unauthorised access, modification or disclosure. Appropriate measures include limiting access according to duties, managing credentials and sessions, protecting data in transit, reviewing access and configuration, and responding to vulnerabilities and incidents. No online service can guarantee absolute security.

13.2 Business owners should use individual logins, apply available security controls, remove access when staff leave, check the selected Business Profile and share customer links and exports carefully. Do not send confidential guest information through public channels or publish a quote link. We do not ask for your password in a support email.

13.3 If you suspect a privacy or security incident, notify admin@catero.com.au promptly with enough information to locate the issue. Avoid sending exploit details or affected personal information beyond what is necessary. We will assess the incident, take appropriate containment and remediation steps and coordinate with affected businesses and relevant providers.

13.4 Where notification duties apply, including under the Notifiable Data Breaches scheme, we will make the required assessment and notify affected individuals and the appropriate authority as required. A security incident does not always meet the legal notification threshold, but we will not use that distinction to avoid our applicable obligations.

14. Retention, account pauses and deletion

14.1 We retain personal information for the period reasonably needed for the purpose for which it may lawfully be used, including providing the Service, maintaining necessary transaction records, resolving disputes and meeting legal obligations. The relevant period depends on the record and context. Information should not be retained indefinitely merely because storage is available.

14.2 Active Business Profiles hold operational records for the business's use, subject to available deletion controls and lawful retention requirements. The business should review its records and remove information no longer needed, especially individual dietary details after an event. Catero may assist with a specific privacy request even if a general workspace deletion is not requested.

14.3 A paused Business Profile stops accepting new enquiries through its widget. Operational data is retained for up to two calendar months from confirmation of the pause and then scheduled for permanent deletion from the live Service unless reactivated beforehand. Under the subscription terms, the Owner should export records before pausing and receives a reminder before scheduled deletion. An individual guest's privacy request does not have to wait for the business to pause.

14.4 An Owner who chooses immediate Business Profile deletion causes its associated operational records and team access to be removed from the live Service without an ordinary recovery period. Ordinary subscription cancellation has the access and 30-day export arrangements described in the subscription terms unless immediate deletion or pause is chosen. Exported files and copies already supplied to a business, Customer or provider are not erased by Catero's deletion process.

14.5 Limited backup, audit, security, billing and legal records may remain after live deletion where there is a lawful need. We restrict those records to that purpose, prevent routine reuse and remove or de-identify them when the need ends. A legal hold must be limited to relevant records. We do not promise that an immediate deletion request instantly erases every copy in a provider's backup system.

14.6 Maximum backup expiry and the routine periods for security logs, support records and AI request logs are specified in Schedule 1. If retained information is restored from a backup for recovery, applicable deletion instructions must be reapplied before it is returned to ordinary use. De-identification must make individuals no longer reasonably identifiable, rather than merely hide a name.

15. Access and correction

15.1 You may ask for access to personal information Catero holds about you and ask us to correct information that is inaccurate, out of date, incomplete, irrelevant or misleading. Email admin@catero.com.au with a description of the information and enough context to locate it, such as the business name or quote reference. You do not need to send a full identity document with your initial request.

15.2 We may take proportionate steps to verify identity and authority, particularly before releasing event records or sensitive information. We will not disclose another person's information merely because it is requested from the same organisation or email domain. We will discuss a practical alternative where verification would otherwise collect unnecessary information.

15.3 We aim to respond within 30 calendar days and will explain if a complex request needs longer, subject to applicable legal requirements. We do not charge for making a request or correcting information. If a lawful reasonable access charge is proposed, we will explain it in advance. We will provide access in the requested form where reasonable and practicable.

15.4 Some information may be withheld or redacted where law permits or requires, for example to protect another person's privacy or legally privileged material. If we refuse access or correction, we will explain our decision and complaint options in writing unless we are legally prevented from doing so, and consider reasonable alternative access.

15.5 Where appropriate, we will take reasonable steps to notify relevant recipients of a correction. If we do not agree to a correction, you may ask for a statement of your disagreement to be associated with the record where applicable. Correcting a factual error may require a linked amendment rather than deleting a valid historical invoice or acceptance record.

16. Deletion, consent and other choices

16.1 You can ask us to delete or de-identify personal information that is no longer needed or has been handled unlawfully. Australian privacy law does not give an unrestricted right to erase every record on demand. We will assess the request, explain any lawful retention need and apply an appropriate restriction or deletion where required. Additional rights may apply under a law relevant to your circumstances.

16.2 Where we rely on consent, you may withdraw it by contacting us. Withdrawal applies prospectively and does not itself invalidate earlier lawful handling. We will explain any effect on a requested feature or service and will not treat it as permission to retain unnecessary information indefinitely.

16.3 Account owners can use available settings to manage team permissions, connected services and marketing preferences. Guests can raise requests with the event business or our Privacy Officer. Disconnecting an integration stops future authorised access through that connection but does not necessarily erase records already lawfully retained by the provider.

17. Marketing and communications

17.1 We may send Catero product news or offers only where we have the required permission or another lawful basis. We identify the sender and provide a working opt-out for marketing communications. We do not treat a Customer's event enquiry as permission to send unrelated Catero or third-party advertising.

17.2 You may unsubscribe using the mechanism in a marketing message or email admin@catero.com.au. We will honour opt-outs within applicable time limits. A limited suppression record may be kept to ensure that an unsubscribed address is not added back inadvertently.

17.3 Operational communications, including requested quotes, booking changes, security alerts and account notices, may still be necessary. A supplier is responsible for the marketing messages it chooses to send through or outside Catero, and must respect applicable consent and unsubscribe requirements.

18. Children and information about other people

18.1 Catero's business accounts are intended for adults with authority to act for a business. Event records may include children's meal counts or requirements supplied by an adult organiser. We do not need a child's full identity, birth date, photograph or contact details merely to calculate a children's package.

18.2 Where identifiable information about a child is necessary, the person supplying it must have appropriate authority, and consent or other legal requirements must be addressed according to the circumstances. Avoid naming children in open text where an aggregate requirement will do. Contact our Privacy Officer if you believe a child has supplied personal information without appropriate involvement or that unnecessary child information is held.

18.3 If you provide information about another person, make them aware of the supplier's and Catero's involvement where appropriate and only supply what you are authorised to share. Do not assume that an event invitation gives unrestricted authority to disclose a guest's health or religious information.

19. Privacy complaints

19.1 Send a privacy complaint to the Privacy Officer at admin@catero.com.au or write to TRUCK-EATS-TECH PTY LTD, 259 Blacktown Road, Seven Hills NSW 2147, Australia. Explain what happened, the relevant account or event and the outcome you are seeking. We can discuss an accessible way to lodge the complaint. Do not include unnecessary sensitive information.

19.2 We aim to acknowledge your complaint within five Business Days and provide a substantive response within 30 calendar days. We will assess the relevant facts, may ask for clarification, and will explain our findings and any proposed remedy. If more time is needed, we will give an update and expected response date. These targets do not extend a shorter deadline required by law.

19.3 If you remain dissatisfied, you may contact the Office of the Australian Information Commissioner where it has jurisdiction. Its complaint process and current contact options are available at https://www.oaic.gov.au/privacy/privacy-complaints. The OAIC generally expects you to complain to the organisation first and allow a reasonable opportunity to respond. This does not prevent another complaint avenue or remedy available to you.

19.4 We do not require you to waive privacy rights, accept confidential arbitration or refrain from contacting a regulator as a condition of making a complaint. A complaint about the event business's own conduct may also need to be addressed to that business, but Catero will consider any part concerning its own handling.

20. Updates and contacting us

20.1 We may update this policy when our services, providers, information practices or legal obligations change. We will make the current version available through Catero and communicate material changes in a way appropriate to the change, including directly to account holders where appropriate. We will identify the new version and its publication date.

20.2 An updated policy does not retrospectively authorise an incompatible use of previously collected information. Where a proposed new use or disclosure needs consent or an additional notice, we will provide that process before proceeding. Your subscription commencement date remains separate from the version date of this policy.

20.3 For access, correction, deletion, a privacy question or a security report, contact admin@catero.com.au and address the message to the Privacy Officer. Our postal contact is 259 Blacktown Road, Seven Hills NSW 2147, Australia. The same email also handles support and complaints; please identify the nature of your request so it can be directed appropriately.

SCHEDULE 1 — SERVICE PROVIDERS, COUNTRIES AND RETENTION

S1. Hosting, database, authentication and storage

S1.1 Recipient category: managed cloud hosting, database, authentication, file storage and associated infrastructure providers. Current primary database: PostgreSQL in US East (North Virginia), United States. Information processed can include account and event records, authentication data and uploaded files as relevant to the component. Primary database location is confirmed; it is not a promise that all supporting services run in that location.

S1.2 Additional countries for file storage, backups, delivery infrastructure and provider support access: [VERIFY AND INSERT ACTUAL COUNTRIES, OR CONFIRM THE UNITED STATES IS THE COMPLETE LIST].

S2. AI services

S2.1 OpenAI models are used through a managed AI service for enabled AI functions. Information can include prompts, relevant business and event context and outputs as described in section 9. Processing may involve the managed service operator as well as the model provider. Additional model providers, processing countries, request-log retention and the applicable training settings: [VERIFY AND INSERT ACTUAL CONFIGURATION]. Do not interpret primary database location as AI data residency.

S3. Payments

S3.1 Stripe is intended for online payments and connected business payment accounts when activated. Its privacy notice is available at https://stripe.com/privacy. Current activation status, relevant Stripe contracting entity and countries receiving Catero payment information: [VERIFY BEFORE ENABLING PAYMENTS]. If payments are not enabled, no payment collection is initiated by this policy.

S4. Email, analytics and optional integrations

S4.1 Recipient categories can include transactional email, authentication email, website analytics and any calendar or address service enabled for a particular feature. Website analytics is used to report visits, pages, sources, approximate countries and device categories. Transactional email was not enabled at the time this version was prepared; authentication and support email may use separate services.

S4.2 Provider configuration, recipient countries, cookie or browser-storage details, optional tracking choices and any enabled address or calendar integrations: [VERIFY AND INSERT THE SERVICES ACTUALLY IN USE]. New services must be assessed and this information updated before associated disclosures begin.

S5. Retention schedule

S5.1 Paused Business Profile operational data: up to two calendar months before scheduled live deletion, unless reactivated. Immediate Business Profile deletion: removal from the live Service after the confirmed request, subject to limited lawful retention. Ordinary cancellation: end-of-paid-period access followed by the 30-day export arrangements in the subscription terms.

S5.2 Backup expiry; authentication and security logs; support correspondence; analytics records; unfinished enquiry drafts; AI prompts, outputs and request logs; and retained billing or legal records: [INSERT VERIFIED RETENTION PERIODS AND ANY APPLICABLE LEGAL BASIS]. These periods must be limited to the purpose and obligations described in section 14, with deletion or de-identification at the end of the applicable period.