Consumer Data Right Policy

Last updated: 08 Jul 2026

Version: 1.0

Prepared by Wagepay Pty Ltd (ABN 15 645 114 629) (“we”/“us”/“our”). This Consumer Data Right Policy explains how Wagepay collects, uses, and protects your financial data under Australia’s Consumer Data Right framework.

What is the Consumer Data Right?

The Consumer Data Right (CDR) is an Australian Government initiative that gives you the right to safely share your data with accredited businesses. Under the CDR, you can securely share your financial data held by banks and other institutions with accredited data recipients, giving you greater control over your own information and enabling access to better financial products and services.

Principal disclosures

Wagepay operates as a CDR Representative of an accredited data recipient. The following disclosures are required by the CDR Rules.

Party	Disclosures
CDR Representative Principal: TaleFin	Accreditation Number: ADR777834 CDR Role: Accredited Data Recipient CDR Policy: View TaleFin’s CDR Policy
CDR Representative: Wagepay	ABN: 15 645 114 629 CDR Role: CDR Representative Privacy Policy: View Wagepay’s Privacy Policy

How your CDR data is collected and shared

When you use Wagepay’s CDR-enabled features, TaleFin (ADR777834) collects your CDR data on Wagepay’s behalf as an Accredited Data Recipient under the CDR Rules. TaleFin then discloses that data to Wagepay solely for the purposes you have consented to. Wagepay does not collect CDR data independently; all CDR data collection is performed by TaleFin acting as our CDR Representative Principal.

Consent and dashboard

You are in control of your CDR data at all times. You can view active consents and withdraw them whenever you choose, no questions asked.

1. Consumer Dashboard

The Consumer Dashboard is provided by TaleFin and gives you full visibility of your active CDR consents, including the ability to manage or withdraw them at any time.

An email will be sent following the completion of your Wagepay application providing access to the Consumer Dashboard, where you can view your active consents and withdraw consent at any time.

Withdrawal of consent takes effect immediately. Once withdrawn, Wagepay will cease using the relevant CDR data and TaleFin will stop collecting it on our behalf.

2. Alternative methods to manage consent

If you are unable to access TaleFin’s Consumer Dashboard, you can manage or withdraw your CDR consents through any of the following methods:

• Email request: send an email to our privacy team at hello@wagepay.com.au with your full name, account email, and the specific consent(s) you wish to withdraw.
• Contact form: submit a data withdrawal request through the Wagepay app or web portal. Responses are provided within 5 business days.

For manual requests, we will process your withdrawal and send a confirmation within 5 business days. CDR data collection by TaleFin on our behalf will cease upon confirmation.

Dispute resolution and complaints

If you have a concern about how your CDR data has been collected, used, or disclosed, Wagepay has a clear three-step process to ensure your complaint is heard and resolved.

Step 1. Internal Dispute Resolution (IDR)

We encourage you to contact Wagepay directly first. Our team is committed to resolving CDR-related complaints promptly and fairly. We aim to acknowledge all complaints within 2 business days and provide a resolution within 30 calendar days.

• Email: hello@wagepay.com.au — please include “CDR Complaint” in the subject line.
• Suggested subject line: CDR Complaint – [Your Full Name].
• Please include your account email and a clear description of the issue.

Step 2. Regulatory escalation (OAIC)

If your complaint remains unresolved after completing the AFCA external dispute resolution process, you may escalate your concern to the Office of the Australian Information Commissioner (OAIC), the government body responsible for overseeing compliance with the Consumer Data Right.

Office of the Australian Information Commissioner (OAIC)	Contact details
CDR complaints portal	oaic.gov.au/consumer-data-right
Phone	1300 363 992

Note: the OAIC recommends completing internal and external dispute resolution processes before lodging a complaint with them. The OAIC has the power to investigate, make determinations, and enforce compliance with the CDR Rules.

Frequently asked questions

What CDR data does Wagepay access?

Wagepay, through TaleFin (ADR777834), may access the following categories of CDR data with your explicit consent:

• Account information (account name, number, type, balance).
• Transaction history (income, expenses, recurring payments).
• Account holder details (name, contact information).

We only access the minimum data necessary for the purpose you have consented to. The specific data accessed for each consent is always disclosed to you before consent is granted.

How long is my CDR data retained?

CDR data is retained only for as long as necessary to fulfil the purpose for which it was collected and as required by law. Upon withdrawal of consent, Wagepay will delete your CDR data within 5 business days unless we are required by law or a regulator to retain it.

TaleFin’s data retention practices are outlined in their CDR Policy, available at the link provided under Principal disclosures above.

Is my CDR data shared with third parties?

Your CDR data is collected by TaleFin (ADR777834) on Wagepay’s behalf and disclosed to Wagepay for the purposes you have consented to. Wagepay does not on-disclose your CDR data to other third parties except:

• where required by law or a court order;
• to regulators such as the OAIC or ACCC in the context of compliance or investigation;
• with your explicit additional consent.

How is my CDR data secured?

Wagepay and TaleFin maintain industry-standard technical and organisational security measures to protect your CDR data, including:

• encryption in transit (TLS 1.2+) and at rest (AES-256);
• access controls and audit logging;
• regular security assessments and penetration testing;
• compliance with the CDR security standards as mandated by the ACCC.

What happens if there is a data breach?

In the event of a data breach involving your CDR data, Wagepay and TaleFin are required to notify affected individuals and the OAIC as soon as practicable, in accordance with the Notifiable Data Breaches scheme and the CDR Rules.

You will be contacted via your registered email address with information about the nature of the breach, the data affected, and steps taken to mitigate harm.

Contact us

Our privacy team is here to help. For any questions about this CDR Policy, your data rights, or to submit a complaint, reach out to us directly at hello@wagepay.com.au. You can also view TaleFin’s CDR Policy at talefin.com.au/cdr-policy.