Privacy Policy

Last Updated: September 2026

Redspot Franchising Pty Ltd and its franchise network (“Redspot”, “we”, “us”, “our”) are committed to protecting your privacy and handling your personal information in accordance with the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs). The entity providing your rental is identified on your rental agreement. Our privacy contact can assist with enquiries concerning the entities listed in section 11.

This Privacy Policy explains how we collect, use, store and disclose your personal information when you rent a vehicle from us, interact with our websites or mobile tools, contact us, or engage with any Redspot service.

We operate entirely within Australia. All customer personal information is stored and processed within Australian borders. No personal information is transferred overseas.

1. The Kinds of Personal Information We Collect (APP 1 & APP 3)

We collect personal information that is reasonably necessary to provide and manage our rental services, assist customers, verify identity, prevent fraud, manage incidents and operate our business. We explain which information is required and which is optional.

Depending on your dealings with us, this may include information about the person making a booking, the hirer, additional drivers, corporate account contacts and other people involved in a rental or incident.

Identity and contact information

Name, address, email address and telephone numbers.
Date of birth.
Driver licence details.
Passport or other identification details where reasonably necessary for identity verification.

Payment information

We collect information needed to process rental payments, security deposits and refunds, and to manage payment disputes. This includes payment transaction records, payment tokens and masked card details.

Payment tokens are references issued by our payment provider that allow payments to be processed without storing the full card number in our systems. Masked card details display only part of the card number to help identify the card used.

We do not store full credit card numbers or card security codes in our systems. Our payment security arrangements are explained in section 7.

Rental, booking and account information

Reservation details, rental dates and collection and return locations.
Corporate account and association membership details.
Vehicle preferences and optional extras.
Rental history and records of relevant incidents or misuse.
Customer communications, service notes, complaints and support requests.
Call recordings and transcripts, where we notify you that a call is being recorded or transcribed, for customer service, training and quality assurance.

Identity verification and rental eligibility records

Information extracted from identity documents using optical character recognition, which converts text in a scanned image into electronic data.
Results and warnings generated by our ID verification system about potential document fraud or falsification.
Do-Not-Rent flags, relevant supporting rental records and results of matching driver licence details against our internal database.
Relevant staff assessments and decisions about verification concerns and rental restrictions.

Our ID verification system examines identity documents using ultraviolet, infrared and standard white light and checks them against a document-validation system for signs of potential fraud or falsification. We do not use facial recognition as part of this verification process.

Section 6 explains how these systems support or make decisions affecting rentals.

Corporate account applications and assessments

When a business applies for a corporate account or credit facility, we collect:

Business name and Australian Business Number (ABN).
Director names and contact details.
The name, email address and telephone number of nominated booking contacts or account administrators, such as employees responsible for making bookings or managing the account.

We also obtain or generate results from checks assessing the business’s legitimacy and financial viability. Where these results relate to an identifiable individual, we handle them as personal information.

Section 6 explains the role of automated corporate account assessments.

Vehicle usage and incident information

Fuel consumption, kilometres travelled and vehicle condition.
Accident reports, damage records, claims information and enforcement notices.
Toll, parking, speeding and other traffic infringement information.
Relevant details of people involved in an accident or incident.

Where reasonably necessary to manage an accident or claim, this may include health information about injuries. We obtain consent to collect sensitive information where required, unless an applicable legal exception permits collection.

Corporate telematics information

For long-term corporate rentals, we generally provide telematics where the corporate customer specifically requests it for employees driving our vehicles.

For vehicles with this service enabled, we collect location coordinates, including latitude and longitude, driving behaviour, detected impacts that may indicate damage, fuel consumption and kilometres travelled.

The purposes and sharing arrangements for this information are explained in sections 3 and 4.

Photographs, CCTV and identity document scans

CCTV footage at rental locations.
Photographs of hirers, authorised drivers or passengers where reasonably necessary for operational purposes.
Copies of identity documents where reasonably necessary for identity verification and fraud prevention.

We explain the information required and how it will be handled when collecting identity documents. Security safeguards and retention arrangements are explained in sections 7 and 8.

Online and technical information

When you use our websites and digital services, we may collect:

IP addresses and device and browser information.
Pages visited and interactions with our services.
Information collected through cookies and analytics tools.
Session replay records showing how you interact with our website.

We configure session replay to exclude payment details, identity document details and other sensitive form contents. Further information about cookies and online tracking is provided in section 5.

AI-assisted processing

Personal information processed through AI-assisted tools may include information you provide in customer-service conversations and summaries or assessments generated from that information. Section 6 explains our use of AI and other automated systems.

Information about children

Our rental services are directed to adults. We may incidentally collect information about children in CCTV footage, photographs or incident records where reasonably necessary for our activities. We limit this collection and handle the information in accordance with this policy and applicable law.

2. How We Collect Your Information (APP 3 & APP 5)

We collect personal information:

Directly from you (online, by phone, at rental counters, via email)
Through ID scanning and validation
We generally provide telematics only where the corporate customer specifically requests it for employees driving our vehicles. For vehicles with this service enabled, we collect location coordinates (latitude and longitude), driving behaviour, detected impacts that may indicate vehicle damage, fuel consumption and kilometres travelled. We use this information to provide the requested vehicle monitoring service and support driver safety, incident management and monitoring of vehicle usage. We make this information available to the corporate customer that requested the service.
From third parties such as:
- Booking agents and travel platforms
- Corporate clients and authorised account holders
- Law enforcement or road authorities for fines/infringements
- Insurance partners
- Service and technology providers supporting Redspot operations

We provide further information about particular collections through notices on our forms, websites and at relevant service locations.

If you do not provide required information, we may be unable to offer rental services, optional products or support. You may make general enquiries without identifying yourself or by using a pseudonym. We need to verify your identity to provide a vehicle rental and to deal with requests involving your personal information.

3. Why We Collect and Use Your Personal Information (APP 6)

We use your information to:

Provide and Manage Your Rental

Confirm reservations
Validate your identity and licence
Process payments and security deposits
Deliver optional extras
Provide roadside assistance, support and incident management

Operate Our Business

Manage fleet, vehicle safety and maintenance
Prevent fraud, theft and unlawful use of vehicles
Conduct accounting, reporting and compliance
Handle insurance claims

Improve Customer Experience

Analyse website and operational performance
Train staff and enhance customer interactions
Develop new services, systems and digital tools

Marketing (APP 7)

We may send marketing communications if:

You have opted in; or
The law otherwise permits us to do so

You can opt out of marketing at any time by using the unsubscribe facility in our messages or contacting us using the details in section 12. We do not charge for opting out. We may still send communications needed to administer your booking or rental We do not sell or rent personal information to external marketers.

4. When We Disclose Your Information (APP 6 & APP 8)

We disclose information to:

Operational Partners

Redspot franchisees and network partners — to arrange and manage bookings, provide rental services and assist with customer enquiries.
Booking agents, travel platforms and brokers — to administer bookings, payments, changes and refunds made through their services.
Corporate customers and authorised account managers — to administer corporate rentals, confirm eligibility, manage billing and provide relevant rental information.
Vehicle servicing, repair and roadside assistance providers — to maintain vehicles, arrange assistance and manage incidents.
Insurers and claims handlers — to assess and manage accidents, damage and claims.
Payment processors and financial institutions — to process payments, deposits and refunds, and address payment disputes or suspected fraud.
Technology and service providers — to support our rental systems, hosting, communications, identity verification, security, analytics and customer service.
Professional advisers and debt collection providers — where necessary to obtain advice, resolve disputes or recover outstanding amounts.
Government, regulatory and law enforcement bodies — where disclosure is required or authorised by law or otherwise permitted under the Australian Privacy Act.

Telematic Services

Where a corporate customer requests telematics, we may make information from equipped vehicles available to that customer and its authorised account managers. This may include location coordinates, driving behaviour, detected impacts, fuel consumption and kilometres travelled, to provide the requested monitoring service and support driver safety, incident management and oversight of vehicle usage.

We explain the applicable monitoring and information-sharing arrangements to drivers through relevant rental documentation or collection notices.

Important: No Overseas Disclosure

All personal information is stored, processed and retained within Australia.

We do not transfer personal data to overseas recipients.

Any system integrations or cloud services utilised by Redspot are hosted on Australian infrastructure or Australian-region environments.

5. Cookies, Analytics & Online Tracking

We use cookies and analytics tools (e.g., Google Analytics) to:

Understand website use
Improve performance and customer experience
Deliver personalised content and offers

You can disable cookies through your browser settings, although some site features may not function correctly.

Our full Cookie Policy is available on our website: https://www.redspot.com.au/cookie-policy/.

6. AI, Automation & Decision Transparency

We use computer systems, including AI-assisted tools, to support identity verification, fraud detection, customer service and internal analysis.

Some systems check information, identify potential issues or generate assessments that our staff use when making decisions. Other tools assist with routine activities, such as responding to enquiries and summarising customer communications.

Decisions supported by computer systems

The following describes how computer systems use personal information to support decisions that may significantly affect your access to our services or your rights under a rental agreement.

Kind of decision	Personal information used	Role of the computer system
Whether identity verification raises concerns affecting rental approval	Scanned driver licence images, information contained in the licence and verification results generated by ID system.	Our ID system checks driver licences for signs of potential fraud or falsification. It provides results and warnings to staff, who decide whether further verification is required and whether the rental can proceed. The system’s recommendation does not itself determine rental approval.
Whether a person is restricted from renting because of a Do-Not-Rent record	Driver licence details, matching customer records and Do-Not-Rent flags associated with recorded past rental misuse.	Our rental system automatically compares driver licence details with our internal database. A matching Do-Not-Rent flag may automatically block the rental from proceeding. An authorised manager can review and override the block.
Whether to approve a corporate account and provide credit	Business identification and registration details; director names and contact details; nominated booking or account-administration contacts’ names, email addresses and telephone numbers; and assessment information relating to identifiable individuals.	Automated systems assess the applicant business’s legitimacy and financial viability. The system may automatically decline an application, preventing the applicant from opening a corporate credit account.

Decisions made entirely by computer systems

Our corporate account assessment systems may automatically decline an application without a staff member making the initial decision.

Our rental system may also automatically block a rental where driver licence details match a Do-Not-Rent record. An authorised manager can review and override that block.

Our ID verification system provides document-verification results and warnings to staff; it does not itself determine rental approval.

Questions and human review

You can contact us using the details in section 12 to ask about a decision involving your personal information, request correction of inaccurate information or raise a concern.

How information is handled

Personal information processed through these systems is subject to the collection, use, disclosure, security and retention practices described in this policy. Relevant disclosures to external providers and overseas handling are explained in section 4.

7. How We Store and Protect Your Information (APP 11)

We hold personal information in electronic systems operated by Redspot and our service providers, and in paper records where required. Relevant service-provider disclosures and overseas handling are explained in section 4.

We take reasonable technical and organisational steps to protect personal information from misuse, interference, loss, unauthorised access, modification and disclosure. Our safeguards reflect the nature and sensitivity of the information and the risks associated with how it is handled.

Security measures

Our security measures include:

Restricting access to personal information according to staff roles and responsibilities.
Using authentication controls, including multi-factor authentication, to protect access to relevant systems.
Using encryption to protect information during transmission and storage, as appropriate to the system and information.
Access to stored identity document scans is restricted to authorised personnel and requires an additional two-factor authentication check each time a scan is opened. Access to verification records is also restricted to authorised personnel.
Using network security controls and monitoring to help detect and respond to unauthorised activity.
Assessing service providers’ security arrangements and establishing appropriate information-handling requirements.
Training staff in privacy, cybersecurity and the secure handling of customer information.
Securing paper records and disposing of them safely when no longer required.

Our retention and disposal practices are explained in section 8.

Data breaches

If we become aware of a suspected data breach, we take steps to contain it, assess the information involved and the potential harm, and address the cause.

Where notification is required under the Privacy Act’s Notifiable Data Breaches scheme, we notify the Office of the Australian Information Commissioner and affected individuals as soon as practicable. Our notification explains the breach, the kinds of information involved and recommended steps individuals can take in response.

If you suspect that personal information held by Redspot has been compromised, please contact us using the details in section 12.

8. Information Retention (APP 11)

We retain personal information only for as long as reasonably necessary for the purposes described in this policy, or as required by law. Retention periods depend on the type of information, why it is needed and any applicable legal obligations.

Identity document scans

We retain driver licence and passport scans only while reasonably needed and ordinarily delete them no later than 90 days after the rental is closed.

A relevant scan may be retained longer where it remains necessary for a specific purpose permitted by privacy law, such as investigating suspected fraud or managing an active claim or dispute, or where retention is required by law. We review these exceptions and delete the scan when the need ends.

This period applies to document images. Licence details extracted from those images and verification results may be retained separately where necessary for rental administration, legal obligations or justified fraud-prevention purposes.

Other records

Information	How we determine retention
Rental, account and payment records	The time needed to administer rentals and accounts, resolve outstanding payments or disputes, and meet applicable accounting, taxation and other legal requirements.
Accident, damage and claims records	The time needed to investigate incidents, manage claims and legal proceedings, and meet applicable retention obligations.
Do-Not-Rent records	Whether the restriction and supporting information remain necessary and relevant to managing rental misuse and risk. We review these records for accuracy and continued need.
Corporate account applications and assessments	The time needed to assess applications, administer approved accounts, address queries or disputes and meet legal obligations. Unsuccessful applications are not retained indefinitely simply because they were assessed.
Telematics information	The time reasonably needed to provide the requested corporate monitoring service and address relevant vehicle usage, safety or incident matters.
CCTV, photographs, communications and technical records	The purpose of collection and the time needed for security, customer service, operational analysis or a specific investigation. These records have separate retention arrangements from identity document scans.

Secure disposal

When personal information is no longer needed and does not have to be retained by law, we take reasonable steps to securely destroy it or de-identify it so that it is no longer about an identifiable person.

Our disposal processes cover records held by us and copies within our control held by service providers, including archives and backups. We manage backup deletion through appropriate retention and disposal processes and take steps to prevent deleted information from being reintroduced into active use when backups are restored.

You can contact us using the details in section 12 with questions about the retention of your personal information.

9. Access and Correction (APP 12 & APP 13)

You can request access to personal information we hold about you, or ask us to correct information that is inaccurate, out of date, incomplete, irrelevant or misleading.

Making a request

Contact us using the details in section 12. You may make a request verbally or in writing, including through an authorised representative. Providing a booking reference or describing the relevant information can help us locate your records.

We may take reasonable steps to verify your identity and any representative’s authority, using only the information necessary for that purpose.

Our response

We will respond within a reasonable period, generally within 30 days. If more time is needed, we will explain why and provide an expected response date.

Where reasonable and practicable, we will provide access in the manner you request.

Correcting information

We take reasonable steps to correct information where we are satisfied that it requires correction, having regard to the purpose for which it is held. This includes relevant personal information in rental records, identity verification results, Do-Not-Rent records and account assessments.

If we correct information previously disclosed to another organisation covered by the Australian Privacy Principles, you can ask us to notify that organisation. We will take reasonable steps to do so unless it is impracticable or unlawful.

Fees

We do not charge for making an access request or for requesting or making a correction.

We generally provide access free of charge. For unusually complex access requests, we may charge for providing access. Any charge will not be excessive and will be explained beforehand.

If a request is refused

We may refuse access where permitted by law. We will provide written reasons, except where it would be unreasonable to do so, and explain how to complain.

If we refuse a correction request, we will provide a written explanation and complaint options. You may ask us to associate a statement with the information explaining why you consider it incorrect. We will take reasonable steps to make that statement apparent to users of the information, without charge.

Our privacy complaints process is explained in section 10. Marketing opt-out options are explained in section 3.

10. Privacy Complaints (APP 1.4 & APP 7)

If you believe we have mishandled your personal information or breached the Australian Privacy Principles, you can make a complaint to our Data Privacy Officer using the contact details in section 12.

You may complain verbally or in writing, or through an authorised representative. To help us investigate, please describe what happened, when it occurred and the outcome you are seeking. Include any relevant booking reference or supporting information.

We do not charge for making or handling a privacy complaint.

How we handle complaints

We will:

Acknowledge your complaint as soon as practicable.
Review the relevant records and, where necessary, seek further information from you and the staff or service providers involved.
Assess your concerns and explain our findings and any action we propose to take.

We aim to provide a substantive response within 30 days of receiving your complaint. If we need more time, we will explain the delay and provide an expected response date.

If you remain dissatisfied

If you are not satisfied with our response, or we have not responded within 30 days, you can lodge a complaint with the Office of the Australian Information Commissioner (OAIC). You do not need to wait for an extended timeframe we have proposed before approaching the OAIC.

Information about lodging a complaint is available on the OAIC privacy complaints website.

OAIC complaints must be made in writing. For assistance or enquiries, you can call 1300 363 992.

11. Companies Covered by This Privacy Policy

This policy applies to the following Redspot entities and their respective operations:

Legal entity	ABN	Role or operations covered
Redspot Head Office Pty Ltd	60 607 643 416	Corporate headquarters
Redspot Franchising Pty Ltd	13 164 739 708	Franchisor
WCC QLD Pty Ltd	64 603 065 729	Corporate branches in Queensland and the Northern Territory
WCC NSW Pty Ltd	41 604 481 021	Corporate branches in New South Wales, Western Australia and the Australian Capital Territory
WCC VIC Pty Ltd	50 604 464 931	Corporate branches in Victoria, Tasmania and South Australia
Hastings Co-Operative Pty Ltd	86 601 035 121	Port Macquarie branches

References to “Redspot”, “we”, “us” and “our” in this policy mean the relevant entity listed above that handles your personal information.

If you are unsure which entity handles your information or provides your rental, please contact us using the details in section 12.

12. Contact Us

For privacy enquiries, requests to access or correct your personal information, or privacy complaints, please contact:

Data Privacy Officer — Redspot Car Rentals
Email: privacy@redspot.com.au
Phone: +61 2 8303 2222
Post: Data Privacy Officer, Redspot Head Office, 7 Coleman Street, Mascot NSW 2020

Our privacy contact can assist with matters relating to any entity listed in section 11 and direct your enquiry to the appropriate team.

You can request a copy of this policy free of charge. If you need it in another format or require assistance making a privacy request, please let us know and we will take reasonable steps to assist.

Other Pages

Rental Terms and Conditions
Cookie Policy
Code of Conduct
Local Renter Policy
Prepaid Terms and Conditions
Vehicle Damage Policy