Terms of Use, Privacy & Data Protection Policies, & Acceptable Use Policy
Security
Our most important priority is your security, and we go to extreme lengths to protect it. We use the same SSL encryption that the banks use and have a world class service protecting us and you. We have in place both technical and procedural QA, and we are committed to maintaining this high level of security.
GDPR Compliant
Rubric is proud to be GDPR Compliant internationally. Handling personally identifying information is a privilege we do not take lightly, and the privacy of our users and societies is of vital importance to us.
Communication
All encrypted communications are encrypted with high security SSL certificates. Sensitive data is stored in a cryptographically strong manner.
Anti-Fraud
Your credit card details are stored in an encrypted way and no one ever sees these details – not even us. Card data is stored on a PCI Compliant, Level 1 DSS certified payment system, and we use equivalent or stronger encryption than the banks do in many cases. If for any reason you would like to remove your data from Rubric, just email us and we’ll be happy to help.
Terms of Use
Rubric is committed to maintaining the confidentiality, integrity and security of all personal information of our users. This Privacy & Security Policy outlines how we protect personal information provided through Rubric and its Service (the “Service”)
1. Acceptance of Terms
1.1. The Rubric platform ("Service") is operated by QPay Holdings Pty Ltd and its affiliated entities (collectively, "Rubric"). Your agreement is with the Rubric legal entity identified during registration, checkout, or in the applicable service agreement or transaction documentation. That entity is responsible for providing the relevant Services under these Terms..
1.2. Your use of this Service is subject to these terms of use (“Terms”). The Terms include our Privacy Policy and any other policy displayed on the Service.
1.3. The Terms constitute a binding legal agreement between you and us, and your continued use of the website constitutes your acceptance of these Terms. If you do not agree to the Terms and our Privacy Policy, you must immediately cease using the Service.
1.4. We may amend or modify the Service and/or the Terms at our sole discretion and at any time. Any amendments are effective immediately upon publication on the Service. Your continued use of the Service indicates your continued acceptance of the Terms as modified.
1.5. These Terms will prevail over any other terms or agreement between you and us, and constitute the entire agreement between us and you unless another agreement issued by us explicitly states that its terms supplement these Terms.
2. Warrant of Authority
2.1. Your use of the Service is conditional on you being:
2.1.a. over 18, or if under 18 then you represent that you have reviewed these Terms with your parent or legal guardian to make sure that you and your parent or legal guardian understand these Terms. If you are a parent or guardian permitting a person under the age of 18 (a “Minor”) to create an account, you agree to exercise supervision over the Minor’s use of our website and account and assume all risks associated with the Minor’s use of our website and their account, including the transmission of content or information to and from third parties via the Internet.
2.1.b. Be located in, or otherwise authorised to use the Service in, a country where Rubric operates, including Australia, New Zealand, Canada, the United Kingdom, Ireland and the United States, subject to applicable local laws and any geographical restrictions disclosed through the Service.
3. Registration
3.1. You may be required to be a registered member to access certain features of our website.
3.2. When you register, you will provide us with personal information such as your name and email address and other details (“Personal Information”). Please note the exception to Personal Information in clause 4. You must ensure that the Personal Information is accurate and current. We will handle all Personal Information we collect in accordance with our Privacy Policy. We may disclose the Personal Information to third parties that help us deliver our services (including information technology suppliers, communication ‘suppliers and our business partners) or as required by law. If you do not provide this information, we may not be able to provide all of our services or products to you. By providing Personal Information to us, you consent to the collection, use, storage and disclosure of that Personal Information as described in the Privacy Policy and these Terms.
3.3. We will provide you with a user name and password. You are responsible for keeping this user name and password secure and are responsible for all use and activity carried out under this user name. You must not to share your account credentials with any third party. We do not authorise anyone to use the service on your behalf, and we will not be liable for any loss or damage arising from any kind of unauthorised activity that takes place under your account.
3.4. You must not impersonate any other person and you must not use the Service using anyone else’s credentials. In case you try to present yourself as another person or entity, your account may be terminated, suspended and legal action may be taken against you.
4. Critical Information
4.1. Some of the Services constitute a tool (“Tool”) that you may use to login to third parties’ portals such as (but not limited to) university student portals (“University Portal”). To do this, the Tool may ask you to provide your login credentials for your relevant university student portal and/or enter credit card details of any other login credential of that nature (together, “Critical Information”).
4.2. Your Critical Information:
4.2.a. is stored on your device only;
4.2.b. does not form a part of the Personal Information;
4.2.c. is not disclosed, visible or accessible to us or any third-party as a result of being stored on your device.
4.3. You agree that you will use the Tool to retrieve personal information about you from a University Portal (for example, your student timetable) and any such information will be treated as, and be considered, Personal Information. For clarity, the Tool is not able to delete, edit or modify any information on a University Portal.
4.4. At all times, you are able to remove or delete any data including the Critical Information. If you are having difficulty doing so, please contact our support ([email protected]) immediately.
4.5. You agree to the manner the Critical Information is stored and may be used in accordance with this clause 4. You hereby waive, forever release, and indemnify us from any claim, loss or liability howsoever arising in relation to this clause or the Critical Information (unless we breach the terms of this clause). These Terms may be pleaded as a bar to proceedings.
5. Your Content
5.1. Where the Service allows you to upload any content whatsoever to the Service (with the exception of Critical Information) (“Your Content”), you:
5.1.a. agree that Your Content be stored for you on our servers in accordance with our Privacy Policy;
5.1.b. to the full extent permitted by law, grant us a perpetual, non-exclusive, royalty-free, irrevocable, worldwide and transferable right and licence to use the Your Content in any way (including, without limitation, by reproducing, modifying, and communicating the Your Content to the public) and permit us to authorise any other person to do the same thing;
5.1.c. to the full extent permitted by law, consent to any act or omission by us which would otherwise constitute an infringement of your moral rights under the Copyright Act 1968 (Cth) (“Copyright Act”) in relation to the Your Content; and
5.1.d. acknowledge and agree that we may delete, modify, or otherwise exploit in any manner contemplated by the Copyright Act any Your Content submitted to or via the Service by you.
5.2. In each instance when you upload Your Content to or via the Service, you:
5.2.a. represent and warrant to us that you have all right, title, interest and authority in the Your Content which is necessary to grant the licences and consents set out in clauses 2.1(a) and 2.1(b);
5.2.b. represent and warrant to us that you have the permission to use the name and likeness of each person whose image appears in any Your Content in the manner contemplated by these Terms;
5.2.c. represent and warrant to us that the use or exploitation of Your Content by us or any other user of the Service will not infringe the rights of any third party (including, but are not limited to, intellectual property rights and privacy rights); and
5.2.d. agree and undertake to us to pay all amounts which become owing to any person (whether by way of royalty or otherwise) as a result of or in connection with your submission of the Your Content to or via the Service.
5.3. This clause 2 will survive termination of these Terms.
6. Your conduct
6.1. In using the Service, you must:
6.1.a. strictly comply with these Terms (including any policy);
6.1.b. obey any reasonable direction issued by us;
6.1.c. obey all laws whatsoever (including international law) which may apply in respect of your use of the Service.
6.1.d. not take any action that is likely to impose upon the Service or our (or its third party service providers) a disproportionately large load;
6.1.e. not interfere with the proper working of the Service or any activities conducted via the Service, including by using any automated or manual software or process to “crawl”, “spider” or engage in similar conduct in relation to the Service;
6.1.f. except to the extent the Copyright Act allows you to do so, not reverse engineer or otherwise seek to obtain any source code forming part of the Service;
6.1.g. adhere to limits or restrictions in any communications sent out using the Rubric platform.
6.1.g. not add any Your Content:
6.1.g.i. unless you hold all necessary rights, licences and consents to do so;
6.1.g.ii. that may result in you or us breaching any law, regulation, rule, code or other legal obligation;
6.1.g.iii. that is or could reasonably be considered to be obscene, inappropriate, defamatory, disparaging, indecent, seditious, offensive, pornographic, threatening, abusive, liable to incite racial hatred, discriminatory, profane, in breach of confidence, in breach of privacy or harassing;
6.1.g.iv. that would bring us or the Service into disrepute;
6.1.g.vi. that you know (or ought reasonably suspect) is false, misleading, untruthful or inaccurate;
6.1.g.vii. that contains unsolicited or unauthorised advertising (including junk mail or spam); or
6.1.g.viii. that contains computer or software viruses, files or programs that are designed to interfere with the ordinary functionality of the Service, or obtain unauthorised access to any system, information, security device belonging to us or any third party.
7. Merchants
7.1. The Service allows you to visit and transact with various merchants (“Merchants”).
7.2. Merchants may impose their fees for goods or services offered through the Service. When you transact with a Merchant or deal with a Merchant in any way, you are entering into a transaction with the Merchant and not with us. We merely offer the Service to facilitate payments. We are not responsible or liable for the fees or the goods or services being quoted.
7.3. We make no warranties, conditions, terms, representations, statements and promises of whatever nature, whether express or implied (“Warranties”) as to any Merchant or anything offered or quoted by the Merchant whatsoever.
7.4. We make no Warranties as to maintaining any Merchant within the Service for any period of time and we reserve the right to change Merchants at any time in our sole discretion.
7.5. Please note that Merchants may collect and store data about you, which we may process on the Merchant’s behalf, but is ultimately under the Merchant’s control and subject to the Merchant’s privacy policy and any terms and conditions you might enter into.
7.6. In the event that a Merchant elects to cease participation in the Platform, we will not continue to process your data for such Merchant. However, usage of data, if any, that you have already provided through the Platform to such Merchants will be subject to that merchant own privacy policies which you must carefully review before using their services or buying their goods.
7.7.All Merchants must read and agree to our Data Processing Addendum [below], which is incorporated into these Terms.
7.8 Merchants, including clubs and student societies, appoint Rubric as their disclosed agent to facilitate transactions and collect payments on their behalf. The Merchant remains the legal supplier of its goods and services, and customers transact directly with the Merchant. Rubric does not purchase or resell these goods or services unless expressly agreed under a separate written arrangement.
7.9. Merchants are responsible for their products and services, including pricing, fulfilment, cancellations, refunds and compliance with applicable laws. Rubric provides the platform, ticketing and payment collection services facilitating these transactions.
7.10. Rubric facilitates the collection of customer payments on behalf of Merchants through its payment service providers and remits the proceeds after deducting agreed fees, refunds, chargebacks and authorised adjustments. These settlements do not constitute purchases of goods or services by Rubric from the Merchant.
7.11. Merchants are responsible for determining and complying with taxes applicable to their own supplies, including VAT, GST, HST and sales taxes. Merchants must provide accurate legal entity and tax registration details. Rubric is responsible for taxes applicable to its own services. Transaction documentation will identify the appropriate supplier and distinguish Merchant charges from Rubric fees.
8. Fees
8.1. You agree to pay all fees disclosed on the Service (“Fees”).
8.2. Fees and transactions will be charged in the currency displayed at checkout or otherwise agreed with the Merchant. Prices and fees will identify applicable taxes, including VAT, GST, HST and sales taxes, in accordance with local law. Any currency conversion charges or additional fees will be disclosed where applicable.
8.3. Merchants may impose fees on their products or services. Such fees are entirely up to the Merchants and we have no liability or control in relation to them.
8.4. You or other users may receive offers from third parties, such as discounts, sponsorships, or other benefits. We are not involved in any dealings or payments between you and third parties, and these Terms do not govern such transactions.
8.5. A monthly inactivity fee will be applied at 12% of the available balance or $20, which ever is greater, every 30 days. These fees will be applied to accounts inactive for more than 6 months with a non-zero account balance, without required information for a settlement
8.6. By providing payment or bank account details, you authorise Rubric and its appointed payment service providers to process payments, settlements, refunds and other agreed charges in accordance with the applicable payment authorisation and local law. Additional payment service terms or authorisations may apply depending on your location and payment method.
9. Intellectual Property Rights
9.1. Except where otherwise indicated, we are the sole owners or licensee of all intellectual property comprised in the Service (including all intellectual property comprised in the Service content and any branding, logos, names etc), and nothing in these Terms constitutes a transfer of any intellectual property rights in or related to the Service or Service content.
9.2. You acknowledge and agree that the Service and the content contained therein are protected by copyright, trademarks, service marks, patents, design registrations, and other proprietary rights and laws, and you agree to comply with and maintain all copyright notices and other restrictions on content accessed on or via the Service.
9.3. You must not do anything which breaches or otherwise interferes with our intellectual property rights or the intellectual property rights of any of its third-party licensors. You may not distribute, reproduce, publish, alter, modify or create derivative works from the Service content without our prior written permission or the relevant third-party licensor or exploit such contents for commercial benefit.
9.4. You acknowledge and agree that damages may not be an adequate remedy for a breach of this clause 9 and that equitable or injunctive relief may be necessary.
10. Third party sites
10.1. The Service may contain links to websites that are owned and operated by third parties. We have no control over these external websites, which are governed by terms and conditions and privacy policies independent of us.
10.2.You acknowledge and agree that when you access a third-party website available via a link contained on the Service:
10.2.a. you do so at your own risk and understand that you should review the privacy policy and terms and conditions of that website;
10.2.b. we are not liable for the content, accuracy, lawfulness, appropriateness, or any other aspect of that third-party website; and
10.2.c. you acknowledge and agree that to the full extent permitted by applicable law, we will not be liable for any loss or damage suffered by you or any other person as a result of or in connection with your access or use of any third-party website available via a link on the Service.
11. Third party services
11.1. In order to use the Service, you may also use various other services or devices offered by other third-parties (including but not limited to, carriers, operating systems, mobile devices, software, hardware, applications etc) (“Third-Party Services”).
11.2. You warrant to us that you will comply with any terms of use or legal agreements you must agree to in order to use the relevant Third-Party Services.
11.3. We are not liable for anything loss arising in relation to a Third-Party Service, including but not limited to:
11.3.a. any failure of or issue with such Third-Party Service;
11.3.b. your breach of the terms of use for the Third-Party Service; and
11.3.c. your misuse of the Third-Party Service.
12. Disclaimer and limitation of liability
12.1. We exclude all Warranties other than those expressly set out in these Terms.
12.2. We exclude any Warranties in relation to the accuracy, suitability, completeness, fitness for purpose, quality or anything else in relation to the goods or services offered by, through, or on the Service.
12.3. You acknowledge that you must only rely on your own enquiries in relation to such goods and services or any other information or material contained on the Service. You should not rely on any information on the Service to make business decisions.
12.4. We provide the Service on an “as is” and on an “as available” basis without any Warranties as to continuous, uninterrupted or secure access to the Service, that its servers are free of computer viruses, bugs or other harmful components, that defects will be corrected, or that you will not have disruption or other difficulties in using the Service.
12.5. We are not responsible for any action of any third-party, user, or Participating Merchant. Any dealings you have with such parties are exclusively entered into between you and them.
12.6.In the event that we terminate the Service or your access to the Service pursuant these Terms, you release us from all liability, loss or claims suffered by you as result of or arising out of such termination.
12.7.To the extent that legislation or other law restricts our right to exclude Warranties under these Terms, these Terms must be read subject to those provisions and nothing in these Terms is intended to alter or restrict the operation of such provisions. If those statutory provisions apply, notwithstanding any other provision of these Terms, to the extent that we are entitled to do so, we limit our liability pursuant to such provisions:
12.7.a. in the case of goods:
12.7.a.i. the replacement of the goods or the supply of equivalent goods;
12.7.a.ii. the payment of the cost of replacing the goods or of acquiring equivalent goods; and
12.7.b. in the case of services:
12.7.b.i. the supply of the services again; or
12.7.b.ii. the payment of the cost of having the services supplied again.
12.8. Our liability arising in connection with these Terms or the Service is limited as follows:
12.8.a. we are not liable for any consequential, special, indirect or remote loss;
12.8.b. our total maximum total liability arising in connection with these Terms is capped to the total price of any goods or services subject of the liability;
12.8.c. our liability is limited to the extent that you contributed to the liability;
12.8.d. we will not be liable to any claim commenced later than 6 months after you had become aware of the facts giving rise to it; and
12.8.c. our liability is subject to your duty to mitigate your loss.
12.9. All of the above subclauses are cumulative to one another.
13. Release
13.1.You agree to release us and our officers, directors, shareholders, agents, employees, consultants, affiliates, subsidiaries, sponsors, and other third-party partners (“Released Parties”) from any loss, liability, damage, costs, expenses, claims, demands, and damages (direct and consequential) of every kind and nature, known and unknown, now and in the future (“Loss”), arising in connection with any transaction with any third-party or your interactions with other members. You further waive any and all rights and benefits otherwise conferred by any statutory or non-statutory law of any jurisdiction that would purport to limit the scope of a release or waive.
14. Indemnity
14.1. You agree to indemnify, defend and hold all the Released Parties harmless from any Claims, made by any third-party due to or arising out of:
14.1.a. your breach of these terms; and
14.1.b your negligence or your violation of any law, statute, ordinance or regulation or the rights of a third party (including intellectual property infringement).
14.2. You agree to promptly notify us of any such third-party claims, cooperate with all Released Parties in defending such claims and pay all fees, costs and expenses associated with defending such claims (including, but not limited to, legal fees). You agree not to settle any claim without our prior written consent.
15. Termination
15.1. These Terms terminate automatically if we cease to operate the Service for any reason (although any clauses which are reasonably intended to survive termination survive).
15.2. You acknowledge and agree that:
15.2.b. we may terminate your access to the Service at any time without giving any explanation without any further liability to you.
15.2.c. Termination of these Terms or your access to the Service does not release you from any of your obligations and liabilities that may have arisen or been incurred prior to the date of such termination.
16. Cookies
16.1. If you are a registered user of our Platform we will use “cookies” or similar technologies in order to ensure that you are able to stay logged into our Platform. Cookies help you personalize your online experience. A cookie is a text file that is placed on your hard disk by a Web server. Cookies are not used to run programs or deliver viruses to your computer. Cookies are uniquely assigned to you, and can only be read by a Web server in the domain that issued the cookie to you. One of the primary purposes of cookies is to provide a convenience feature to save you time. The purpose of a cookie is to tell the Web server that you have returned to a specific page. For example, if you personalize pages on the Bench Platform, a cookie helps us to recall your specific information on subsequent visits. When you return to the same page of the Bench Platform, the information you previously provided can be retrieved, so you can easily use the customized features.
16.2. You have the ability to accept or decline cookies. Most Web browsers automatically accept cookies, but you can usually modify your browser setting to decline cookies if you prefer. If you choose to decline cookies, you may not be able to fully experience the interactive features of the Platform.
17. General
17.1. You must not assign, sublicense or otherwise deal in any other way with any of your rights under these Terms.
17.2. If a provision of these Terms is invalid or unenforceable it is to be read down or severed to the extent necessary without affecting the validity or enforceability of the remaining provisions.
17.3. These Terms are governed by the laws of the jurisdiction identified for the applicable contracting Rubric entity in the relevant service agreement or country-specific terms, subject to any mandatory laws and consumer protections that apply in your location. Nothing in these Terms limits rights or remedies that cannot lawfully be excluded.
17.4. Any waiver of any term on these Terms by us can only be done in express writing. Any failure on our part to enforce a term does not constitute a waiver and we reserve the right in relation to all breaches unless expressly stated otherwise.
18. Sponsorship
18.1. All sponsorship offers provided by Rubric are bound by Terms set out in section 18
18.2. UK College Ball sponsorship offers require individual agreements issued by Rubric, tailored to specific colleges
18.3. Eligibility for sponsorship, depending on the promotional campaign, requires society organisers to sell and process memberships/tickets/merchandise through Rubric
Partnership Terms and Responsibilities
3.1. In this section, “SEN PRO” refers to SEN (The Student Experience Network) in Australia, which offers the Rubric platform to Australian student unions under its own name. While “we,” “us,” and “our” still refer to Rubric (QPay Holdings Pty Ltd) and its subsidiaries, SEN PRO operates as a partner in managing non-technical aspects of the platform for Australian clients.
3.2. Platform Development and Support Responsibilities
3.2.1. We maintain responsibility for the development, enhancement, and technical support of the Platform, including bug fixes, feature upgrades, and general platform functionality.
3.2.2. SEN PRO operates as the primary contact for Australian student unions and manages client relationships, onboarding, and all non-technical support inquiries.
3.3. Data Collection and Privacy
3.3.1. Data collected via the Platform is handled according to our Privacy Policy, and SEN PRO does not have direct access to the data collected. SEN PRO operates under our privacy and data protection standards and in compliance with relevant Australian privacy regulations.
3.3.2. SEN PRO may collect additional information as needed for its operational support. Such information is managed solely by SEN PRO and may be subject to its privacy policies.
3.4. Updates and Changes
3.4.1. We reserve the right to make changes to the Platform as needed, including updates and modifications, which will be communicated to SEN PRO for Australian student unions.
3.4.2. Any updates to these Partnership Terms will be published on our Platform and SEN PRO will be notified accordingly.
Privacy Policy - Scope and Applicable Laws
This Privacy Policy applies to the Rubric platform and services operated by QPay Holdings Pty Ltd and its affiliated entities (collectively, "Rubric", "we", "us" or "our"). Rubric is committed to protecting personal information in accordance with applicable privacy and data protection laws in the jurisdictions where we operate, including Australia, New Zealand, the United Kingdom, Ireland, Canada and the United States. Depending on the location of the individual, the relevant Rubric entity, and the nature of the processing, these laws may include the Australian Privacy Act 1988, New Zealand Privacy Act 2020, UK GDPR, EU GDPR, Canada's PIPEDA and applicable provincial legislation, and relevant US federal and state privacy laws. Where mandatory local privacy laws provide additional rights or impose additional obligations, those requirements will apply notwithstanding anything in this Policy.
1. Definitions
1.1.In this Privacy Policy, the following capitalised terms have the following meanings:
Consumers means users on the Platform who purchase goods or services on the Platform.
Critical Information means login credentials for your relevant university student portal and/or enter credit card details of any other login credential of that nature.
Merchants means users of the Platform who offer goods or services on the Platform.
Non-personal Information means information which does not relate to a person and/or cannot be used to identify a person.
Personal Information means any information which can be used to identify an individual, and described in detail in clause 3.
Platform means this website, app, platform and any service offered under the name “Rubric”.
Tool means a feature used by Users on the Platform to interact or log in to third parties’ portals such as (but not limited to) university student portals.
Users means any registered user of the Platform, whether Merchants or Consumers.
2. Use of this Platform and Application of the Policy
2.1.This Platform operates as a venue or marketplace which allows Merchants to offer goods and/or services, including memberships to organisations and societies, and for Consumers to purchase the said items on offer.
2.2.We oversee the Platform itself and we may sometimes offer goods or services through the Platform. We do collect some Personal Information about all of our Users, and this Personal Information is used, disclosed and protected according to this Privacy Policy.
2.3.Please note that Merchants use the Platform to sell you goods and services, and in those circumstances, they may be collecting your information about you through the Platform (Merchant Collected Information). It is important to note that Merchant Collected Information is collected and stored by the Merchants, and not us. As such, it is subject to the Merchants’ privacy policy and any terms and conditions the Merchants may have.
2.4.We process Merchant Collected Information as the Merchants direct and in accordance with our agreements with the Merchant (as their agent and on their behalf), and we store it on our service providers’ servers, but we do not have control over its collection or management.
2.5.Our agreements with Merchants prohibit us from using Merchant Collected Information (for example, by selling it to third-parties or other Merchants), except as necessary to provide and improve the Platform, as permitted by this Privacy Policy, and as required by law.
2.6.We acknowledge that you have the right to access your Personal Information. In relation to Merchant Collected Information, the relevant Merchant is responsible for correcting, deleting or updating information they have collected from you using the Platform. However, we will assist in this process as the agent of the Merchant only. If requested to remove data we will respond within a reasonable timeframe. We may work with the Merchant to help them provide notice to their Consumers about their data collection, processing and usage. We are not responsible for the Merchants’ use of information they collect on the Platform. If you are a Consumer of a Merchant and you have an issue relating to any Merchant Collected Information, please contact the Merchant that you interact with directly. If you are unable to do so or if you are not receiving a response, please contact us using the contact us feature below and we will attempt to resolve the issue.
2.7.To the extent any Merchant Collected Information is deemed to be under our control, it will be subject to this Privacy Policy below.
2.8.Rubric may act as a data controller, business or equivalent responsible organisation when processing personal information for its own purposes, including account administration, platform security, billing, customer support and service improvement.
2.9.Where Rubric processes personal information on behalf of a Merchant, including event registrations, ticket purchases and membership information, the Merchant generally determines the purposes of that processing, and Rubric acts as its processor or service provider, subject to applicable law and the relevant agreement.
2.10.Each party is responsible for complying with the privacy obligations applicable to its role. Rubric will process Merchant-controlled personal information in accordance with the Merchant's documented instructions, except where otherwise required or permitted by law.
3. What personal information do we collect?
3.1.We may collect Personal Information about you when you use the Platform or interact with us in anyway.
3.2.Information you provide to us: we collect all information which Users voluntarily provide to us through using the Platform or Interacting with us. This includes information provided:
(a) during registration;
(b) during correspondence, enquiries, support tickets or phonecalls, or customer surveys; or
(c) uploaded onto the Service in any way;
The Personal Information we may collect includes without limitation your name, address, age, email address, university-related information such as your university, the courses or subjects your studying, other information obtained by your use of the Tool (but not Critical Information), and other information that enables Users to be personally identified.
3.3.Information we automatically collect: We also automatically collect certain technical data that is sent to us from the computer, mobile device and/or browser through which you access the Platforms (Automatic Data). Automatic Data, includes without limitation, a unique identifier associated with your access device and/or browser (including, for example, your Internet Protocol (IP) address) characteristics about your access device and/or browser, statistics on your activities on the Platforms, details of the products and services we have provided to you or that you have enquired about, including any additional information necessary to deliver those products and services and respond to your enquiries, or information about how you came to the Platforms. We collect Automatic Data based on your consent which was granted to us by you when you registered as a User and accepted this Privacy Policy.
3.4.Merchant Collected Information: Merchants can set up registration pages to collect virtually any information from Consumers in connection with a Merchant’s goods or services listed on the Platform – including sensitive information. As stated above, we do not control a Merchant’s registration or collection process nor the Personal Information that they collect. This Personal Information is subject to the relevant Merchant’s privacy policy and terms and conditions.
3.5.Critical Information: We do not collect, store, hold, or use Critical Information in any way.
3.6.Information we obtain from others: We may also collect or receive Personal Information from third party sources, such as Merchants, other Consumers, social media or other third-party integrations.
3.7.Non-personal Information: When you interact with the Platform, we may collect Non-Personal Information. The limitations and requirements in this Privacy Policy on our collection, use, disclosure, transfer and storage/retention of Personal Information do not apply to Non-Personal Information. When you register for the Platforms or otherwise submit Personal Information to us, we may associate other Non-Personal Information (including Non-Personal Information we collect from third parties) with your Personal Information. At such instance, we will treat any such combined data as your Personal Information until such time as it can no longer be associated with you or used to identify you.
3.8.We collect and process personal information only where permitted by applicable law and for purposes disclosed in this Policy or at the point of collection. Where required, we rely on an appropriate lawful basis, including contractual necessity, compliance with legal obligations, legitimate interests or valid consent.
3.9.Where consent is legally required, we will obtain it in accordance with applicable law and provide mechanisms for its withdrawal. We will not use personal information for materially different purposes without an appropriate legal basis and any additional notice or consent required by law.
4. Why do we collect, use and disclose personal information?
4.1.We may collect, hold, use and disclose your personal information for the following purposes:
(a) to enable you to access and use our Platform, including allowing you to interact with Merchants whom you wish to purchase goods and services from;
(b) to operate, protect, improve and optimise our Platform, business and our users’ experience, such as to perform analytics, conduct research and for advertising and marketing;
(c) to send you service, support and administrative messages, reminders, technical notices, updates, security alerts, and information requested by you;
(d) to send you marketing and promotional messages and other information that may be of interest to you, including information sent by, or on behalf of, our business partners that we think you may find interesting;
(e) to administer rewards, surveys, contests, or other promotional activities or events sponsored or managed by us or our business partners;
(f) to comply with our legal obligations, resolve any disputes that we may have with any of our users, and enforce our agreements with third parties; and
(g) to consider your employment application.
4.2.We may also disclose your personal information to a trusted third party who also holds other information about you. This third party may combine that information in order to enable it and us to develop anonymised consumer insights so that we can better understand your preferences and interests, personalise your experience and enhance the products and services that you receive
4.3.All promotional material and prizes have a 45 day lock-out period
5. Do we use your personal information for direct marketing?
5.1.Rubric may send service-related communications necessary to operate the Platform and, where permitted by applicable law, marketing communications about our products and services.
5.2.We obtain consent for marketing communications where required and provide an accessible method to unsubscribe or object. Marketing preferences may be updated through available account settings or by contacting us.
5.3.Merchants are responsible for ensuring that marketing communications they initiate through the Platform comply with applicable privacy, electronic communications and anti-spam laws. Rubric will provide appropriate tools to manage consent and preferences where required.
6. To whom do we disclose your personal information?
6.1.We may disclose personal information for the purposes described in this Privacy Policy to:
(a) to relevant Merchants when you wish to purchase goods and services from them;
(b) our employees and related bodies corporate;
(c) third-party suppliers and service providers (including providers for the operation of our Platform and/or our business or in connection with providing our products and services to you);
(d) professional advisers, dealers and agents;
(e) payment systems operators (eg merchants receiving card payments);
(f) our existing or potential agents, business partners or partners;
(g) our sponsors or promoters of any competition that we conduct via our services;
(h) anyone to whom our assets or businesses (or any part of them) are transferred;
(i) specific third-parties authorised by you to receive information held by us; and/or
(j) other persons, including government agencies, regulatory bodies and law enforcement agencies, or as required, authorised or permitted by law.
6.2.Rubric operates internationally. Personal information may be accessed, stored or processed in countries other than the country in which it was collected, including through our affiliated entities and authorised service providers.
Where required by applicable law, Rubric will implement appropriate safeguards for international transfers, including contractual protections, adequacy decisions, approved standard contractual clauses or other lawful transfer mechanisms.
Such safeguards may include the EU Standard Contractual Clauses, the UK International Data Transfer Agreement or Addendum, and appropriate protections required by Australian, New Zealand, Canadian and other applicable privacy laws.
Further information about our international transfers and applicable safeguards may be requested by contacting us.
7. Security
7.1.We may hold your personal information in either electronic or hard copy form. We take reasonable steps to protect your personal information from misuse, interference and loss, as well as unauthorised access, modification or disclosure and we use a number of physical, administrative, personnel and technical measures to protect your personal information. However, we cannot guarantee the security of your personal information.
8. Retention
8.1.We retain personal information only for as long as reasonably necessary for the purposes for which it was collected, including providing our services, maintaining transaction records, meeting legal and regulatory requirements, resolving disputes and enforcing agreements.
8.2.Retention periods are determined by the category of information, its purpose, applicable legal requirements and any relevant contractual obligations. Further information about applicable retention periods or criteria is available on request.
8.3.When personal information is no longer required, we will securely delete or de-identify it, subject to applicable legal obligations and legitimate retention requirements.
9. Exclusions
9.1.Links: Our Platform may contain links to websites operated by third parties. Those links are provided for convenience and may not remain current or be maintained. Unless expressly stated otherwise, we are not responsible for the privacy practices of, or any content on, those linked websites, and have no control over or rights in those linked websites. The privacy policies that apply to those other websites may differ substantially from our Privacy Policy, so we encourage individuals to read them before using those websites.
9.2.Children – Children’s Online Privacy Protection Act: We do not knowingly collect Personal Information from children under the age of thirteen (13). If you are under the age of thirteen (13), please do not submit any Personal Information through the Platform. We encourage parents and legal guardians to monitor their children’s Internet usage and to help enforce our Privacy Policy by instructing their children never to provide Personal Information through the Services without their permission. If you have reason to believe that a child under the age of 13 has provided Personal Information to us through the Services, please contact us and we will endeavour to delete that information from our databases.
9.3.Personal Information Provided to Others: This Privacy Policy does not apply to any Personal Information that you provide to another User or visitor through the Platform or through any other means, including to Merchants on event pages or information posted by you to any public areas of the Platform.
10. Accessing or correcting your personal information
10.1.You can access the personal information we hold about you by contacting us using the contact us feature below. Sometimes, we may not be able to provide you with access to all of your personal information and, where this is the case, we will tell you why. We may also need to verify your identity when you request your personal information.
10.2.If you think that any personal information we hold about you is inaccurate, please contact us using the contact us feature below and we will take reasonable steps to ensure that it is corrected.
10.3.We will consider and respond to all requests in accordance with all applicable laws.
11. Making a complaint
11.1.If you think we have breached the Privacy Act or any other relevant privacy law, or you wish to make a complaint about the way we have handled your personal information, you can contact us using the contact us feature below. Please include your name, email address and/or telephone number and clearly describe your complaint. We will acknowledge your complaint and respond to you regarding your complaint within a reasonable period of time. If you think that we have failed to resolve the complaint satisfactorily, we will provide you with information about the further steps you can take.
12. Your Privacy Rights
12.1.Depending on your location and applicable law, you may have rights to access, correct, delete or obtain a copy of your personal information; restrict or object to certain processing; withdraw consent; or request data portability.
12.2.Where applicable, you may also have rights concerning automated decision-making, targeted advertising, the sale or sharing of personal information, and other uses of your data.
12.3.You may exercise applicable privacy rights by contacting [email protected]. We will verify and respond to requests within the timeframes required by applicable law and will not discriminate against individuals for exercising legally protected privacy rights.
12.4.Where personal information is controlled by a Merchant, we may refer your request to that Merchant or assist the Merchant in responding, as appropriate.
12.5.Individuals may lodge complaints with the relevant privacy or data protection authority where permitted by applicable law.
12.6.Any additional mandatory rights, disclosures or protections under applicable local privacy laws will apply alongside this Policy.
13. AML/CTF regulations
13.1.As a part of verification processes for the purpose of complying with the Anti-money Laundering and Counter-terrorism Financing Act 2006 (Cth) (AML/CTF Act) and associated rules and regulations, we may need to disclose your full name, residential address and date of birth to a service provider, who may provide such information to a credit reporting agency for the purpose of providing an assessment of whether this identification information matches (in whole or in part) personal information held by the credit reporting agency. Further document verification services may be conducted involving personal details being checked with the document issuer or official record holder.
13.2.The credit reporting agency may compare your details with personal information held by the agency (being the names, residential address and dates of birth of other individuals) for the purposes of making this assessment.
13.3.The assessment will be provided to Rubric , or its agent, for the sole purpose of verifying your identity. If Rubric , or its agent, is unable to verify your identity using information held by a credit reporting agency, Rubric will provide you with a notice to this effect and the name of the credit reporting agency and give you the opportunity to contact the CRB to update your information.
13.4.Records of the verification request will be made by Rubric and the credit reporting agency and retained for 7 years from the date of the request. You can request access to your records.
13.4.By agreeing to these terms, you provide your express consent to Rubric disclosing your personal information to a credit reporting agency or document issuer or official record holder for the purposes of the AML/CTF Act.
13.5.You have the right to let us know by email at [email protected] if you do not want us to disclose your personal information to a credit reporting agency for this purpose and opt for an alternate means of verifying your identity for the purposes of the AML/CTF Act.
Accessibility Statement
Rubric is committed to ensuring digital accessibility for all users, including individuals with disabilities. We strive to provide an inclusive and seamless experience in accordance with the Accessible Canada Act (ACA) and the Web Content Accessibility Guidelines (WCAG) 2.1 Level AA.
Our Commitment
We recognize the importance of accessibility in digital services and are dedicated to ensuring that all users, regardless of ability, have equal access to our platform. Our commitment includes:
– Conducting regular accessibility audits and usability testing with assistive technologies such as screen readers, voice recognition software, and alternative input devices.
– Ensuring our website and digital products meet or exceed WCAG 2.1 Level AA compliance by focusing on contrast ratios, keyboard navigation, alternative text for images, and semantic HTML structure.
– Providing accessible alternatives for non-text content, including captions for multimedia, transcripts for audio, and scalable text options.
– Training our design, development, and content teams on accessibility best practices to ensure accessibility considerations are integrated into our development lifecycle.
– Establishing a roadmap for continuous accessibility enhancements and incorporating feedback from users with disabilities.
Contact Us
For further information about our Privacy Policy or practices, or to access or correct your personal information, or make a complaint, please contact us using the details set out below:
Email [email protected]
Effective: 28th of October, 2024
Data Processing Addendum
The terms of this DPA are hereby incorporated in to the Terms of Use (“Terms”). They apply to Merchants (as defined under the Terms) who are subject to Applicable Data Protection Laws and which require us to Process Personal Information on their behalf as part of Merchant’s use of the Platform (“you”).
1. Definitions
1.1. In this DPA, the following capitalised terms have the following meanings:
(a) Applicable Data Protection Laws means all privacy, personal information protection and data protection laws applicable to the processing of Personal Data under this Addendum, including, where applicable, the Australian Privacy Act 1988, New Zealand Privacy Act 2020, UK GDPR, EU GDPR, Canada's PIPEDA and applicable provincial legislation, and relevant United States federal and state privacy laws, together with their amendments, regulations and legally binding requirements.
(b) Applicable Merchant means
(c) Data Controller, Data Processor, Data Subject, Processing and Personal Data shall have the meanings ascribed to them in Applicable Data Protection Laws;
(d) DPA means this Data Processing Addendum
(e) GDPR means EU General Data Protection Regulation (2016/EC/679)
(f) Platform means this website, app, platform and any service offered under the name “Rubric”
(g) Terms means our Terms of Use .
(h) we, us or our means QPay Holdings Pty Ltd and all subsidiaries
(i) You means a Merchant who is subject to Applicable Data Protection Laws and who requires us to Process Personal Information on their behalf as part of Merchant’s use of the Platform.
1.2.References to "Controller", "Processor", "Personal Data", "Processing" and related terms include equivalent concepts under Applicable Data Protection Laws, including "business", "service provider", "contractor" and "personal information", where relevant.
1.3.Where mandatory Applicable Data Protection Laws impose additional requirements, those requirements prevail to the extent of any inconsistency with this Addendum.
2. Applicability of DPA and scope of data Processing activities
2.1.The Merchant determines the purposes and means of processing personal information collected through its events, memberships, registrations and other products or services offered through the Platform, except where Rubric independently determines the purposes and means of particular processing activities.
2.2.When processing Personal Data on behalf of the Merchant, Rubric acts as its Processor or equivalent service provider and will process that information only in accordance with documented instructions and Applicable Data Protection Laws.
2.3.Rubric may act as an independent Controller or equivalent responsible organisation for its own legitimate platform operations, including account management, security, fraud prevention, billing and compliance with legal obligations.
2.4.Clause 3 of this DPA only applies to the extent that we Process Personal Data as a Data Processor on your behalf. When we act as a Data Controller of Consumers’ Personal Data, our Processing is not subject to this DPA.
3. Data Processing clauses.
3.1.We and any person acting under your or our authority shall Process the personal data only on documented instructions from you. You hereby instruct us, and we hereby agree, to Process Personal Data as necessary to perform our obligations under the Terms and for no other purpose.
3.2.The only exception to the requirement to Process Personal Data only on documented instructions from you is if we are required to do otherwise by any applicable law to which we are subject. If this applies we shall inform you of any such legal requirement before Processing the Personal Data, unless any such applicable law prohibits such information on important grounds of public interest.
3.3.We will ensure that persons authorised to Process Personal Data have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality.
3.4.We shall, insofar as possible and taking into account the nature of the Processing, assist you by taking appropriate technical and organisational measures for the fulfilment of your obligations, including, but not limited to your obligations to respond to requests for exercising the data subject’s rights laid down in Chapter III of the GDPR.
3.5.We shall, taking into account the nature of the Processing and the information available to us, assist you in ensuring compliance with the obligations pursuant to Articles 32 to 36 (inclusive) of the GDPR
3.6.To the extent that it is applicable to us, we shall take all measures required by or pursuant to Article 32 of the GDPR.
3.7.3.7 To the extent that it is applicable to us and without limiting the generality of clauses 3.5 and 3.6, we shall, taking into account:
(a) the state of the art;
(b) the costs of implementation;
(c) the nature, scope, context and purposes of Processing; and
(d) the risk of varying likelihood and severity for the rights and freedoms of natural persons;
implement appropriate technical and organisational measures to ensure a level of security appropriate to the risk, including, inter alia and as appropriate:
(e) the pseudonymisation and encryption of Personal Data;
(f) the ability to ensure the ongoing confidentiality, integrity, availability and resilience of Processing systems and services;
(g) the ability to restore the availability and access to Personal Data in a timely manner in the event of a physical or technical incident;
a Process for regularly testing, assessing and evaluating the effectiveness of technical and organisational measures for ensuring the security of the Processing.
3.8.Without limiting the application and/or generality of any other clause, in and when assessing the appropriate level of security, account shall be taken, amongst other things and in particular, of the risks that are presented by Processing, in particular from accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, Personal Data transmitted, stored or otherwise Processed.
3.9.We shall notify you without undue delay and as soon as possible after becoming aware of a Personal Data breach (“Data Breach Notice”).
3.10.The Data Breach shall, at the very minimum, include:
(a) the description of the nature of the Personal Data breach, including, where possible, the categories and approximate number of data subjects concerned and the categories and approximate number of Personal Data records concerned;
(b) the name and contact details of the data protection officer or other contact person/s and/or point where more information can be obtained;
(c) description of the likely consequences of the Personal Data breach;
(d) description of the measures taken or proposed to be taken by us to address the Personal Data breach, including, where appropriate, measures to mitigate its possible adverse effects; and
(e) any other relevant information.
3.11. In the event and to the extent that it is not possible for us to provide all the required and relevant information at the same time, the information may be provided in phases without undue further delay and as soon as possible.
3.12. We shall document any Personal Data breaches, including the facts and circumstances relating to the Personal Data breach, its effects and the remedial action taken.
3.13. We shall provide any documentation and/or records referred to in a Data Breach Notice to you at the time of, or as soon as possible after, providing you with the Data Breach Notice.
3.14. We shall, at your choice, delete or return to you all the Personal Data after the end of the provision of services relating to Processing and shall delete all existing copies of such data, unless the European Union or a member state law requires storage of any such Personal Data.
3.15. You agree that we may engage sub-processors to Process Personal Data on your behalf. The Sub-Processors currently engaged by us and authorized by you are listed in Annex A (“Sub-Processors”).
3.16. In the case of general written authorisation, we shall inform you of any intended changes concerning the addition or replacement of other Sub-Processors, thereby giving you the opportunity to object to any such changes.
3.17. Where we engage a Sub-Processor for carrying out specific Processing activities on your behalf, the same data protection obligations that apply to us shall be imposed on any such other Processor by way of a contract, including, but not limited to, providing sufficient guarantees to implement appropriate technical and organisational measures in such a manner that the Processing will meet the requirements of the GDPR. You acknowledge and agree that it is your obligation to ensure that protections and contractual terms and conditions in relation to any such Sub-Processors are sufficient and compliant with the GDPR and any other applicable laws and regulations.
3.18. If any such Sub-Processor fails to fulfil its data protection obligations, we shall not be liable to you for the performance of any such Sub-Processor’s obligations but will endeavour to assist you in relation to any such failure to the extent that we reasonably can.
3.19. If we or the industry in which we operate are subject to a code or standard of conduct and/or practice, we shall, and hereby warrant that we do, comply with any such code and/or standard.
3.20.If we infringe the GDPR by determining the purposes and means of Processing of the Personal Data, we shall be considered to be a controller in respect of any such Processing. You hereby authorise and instruct us to Process the data for any purpose and by any means consistent with the purposes of this DPA, the Terms, or anything contemplated by the use of the Platform.
3.21. We warrant that we and our operations comply with the GDPR to the extent that it applies to us and that we perform regular audits and/or assessments to ensure ongoing compliance with the GDPR.
3.22. We further warrant that, should we become aware of any potential or actual non-compliance with the GDPR, we will take steps to effect and ensure such compliance.
3.23. Subject to any other clause of this DPA and to the extent that it is necessary and reasonable, we shall make available to you all information necessary to demonstrate compliance with the obligations laid down in Article 28 of the GDPR or the GDPR and allow for, and contribute to, audits, including inspections, conducted by you or another auditor mandated or appointed by you.
3.24. You indemnify us against any damage, loss and/or harm sustained and/or suffered by us as a result of, or in relation to, your breach of, and/or your non-compliance with, the GDPR.
3.25. Where processing involves international transfers of Personal Data, the parties will implement any transfer safeguards required by Applicable Data Protection Laws. Where necessary, the parties will enter into applicable EU Standard Contractual Clauses, the UK International Data Transfer Agreement or Addendum, or other legally recognised transfer arrangements.
3.26. Rubric will maintain an accessible list of authorised Subprocessors, including their processing functions and relevant locations. Rubric will provide notice of material changes and an opportunity to object where required by applicable law or the agreed DPA.
3.27. Rubric will notify the Merchant without undue delay after becoming aware of a Personal Data breach affecting Merchant-controlled data and provide information and assistance reasonably necessary for the Merchant to meet its applicable notification obligations. Any stricter contractual or statutory notification period will apply where required.
3.28. The parties will comply with their respective obligations under Applicable Data Protection Laws. Where additional jurisdiction-specific contractual provisions are legally required, the parties will incorporate them into this Addendum or an applicable supplementary agreement.
Annex A – List of Sub-Processors: Available upon request