IMPETUS MEDIA PTY LIMITED

Privacy Policy

Effective Date: August 2026

1. Introduction

Impetus Media Pty Limited (ABN 31 824 528 416) and its related and associated entities (we, us, our or Impetus Media) respect your right to privacy and are committed to protecting your personal information.

This Privacy Policy explains how we collect, hold, use, disclose and protect personal information, and how you can access, correct or complain about our handling of your personal information.

In this Privacy Policy, Websites means https://impetusmedia.com.au and https://impetusmedia.co.nz.

1.1 Who this Privacy Policy applies to

This Privacy Policy applies to all individuals who interact with us, including anyone who:

• visits or uses our Websites or our other online resources;

• acquires or uses any of our products or services;

• enquires about, or expresses interest in, our products and services; or

• otherwise deals with us, including as a supplier, contractor or business partners.

This Privacy Policy does not apply to any of our employee records, under Australian law.  

1.2 The laws we comply with

We handle personal information in accordance with applicable laws, including the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs) contained in that Act, and the Privacy Act 2020 (NZ) and the Information Privacy Principles (IPPs).

1.3 What personal information means

Personal information means information or an opinion about an identified individual, or an individual who is reasonably identifiable, whether or not the information or opinion is true and whether or not it is recorded in a material form. Information that has been anonymised or aggregated so that it can no longer identify an individual, whether on its own or in combination with other information we hold, is not personal information and is not subject to this Privacy Policy.

2. How we collect personal information

2.1 Directly from you

We collect personal information directly from you, including when you:

• contact us by telephone, email, post or through our Websites or partner sites;

• complete a form, request information, or submit an enquiry through our Websites or partner sites;

• acquire or use our products or services;

• enter a promotion, competition or survey, or attend an event we host; or  

• provide us with documents in the course of dealing with us.

2.2 From third parties (indirect collection)

We also collect personal information about you from sources other than you, including from:

• our clients, where we provide media planning, buying, audience targeting, campaign delivery, measurement or related services and the client provides us with, or gives us access to, personal information about their employees, customers, subscribers, enquirers or prospects;

• media owners, publishers, advertising platforms, data providers, measurement providers and other participants in the digital advertising supply chain;

• our partners, resellers and service providers;

• third parties we engage to collect or manage data on our behalf;

• the organisation you work for or represent, where we deal with that organisation; and

• publicly available sources.

Where we obtain personal information from our clients, this is because our clients engage us to plan, buy, deliver and measure advertising campaigns. In providing those services, a client may give us personal information about individuals it deals with, or ask us to collect, upload to media platforms to match, segment or analyse that information on its behalf. This may include contact details, customer or transaction records, online and device identifiers (including cookie identifiers, advertising identifiers and hashed email addresses), audience segment membership, and information about how individuals interacted with a campaign.

Identifiers of this kind are personal information where they can be used to distinguish you from other individuals or to direct advertising to you, even if we do not know your name.

We use personal information provided by, or collected for, a client only to provide our services to that client and as permitted by our agreement with them. We do not use it for our own purposes, or for the benefit of another client.

2.3 Information we collect automatically

When you visit our Websites or use our online resources, we may collect information about your computer or device, including your Internet Protocol (IP) address, domain name, browser type, device ID, device type, the date and time of your request, and usage information about how you interact with our Website. Some of this information may constitute personal information where it can reasonably identify you, alone or in combination with other information.

We collect some of this information using cookies and similar tracking technologies. See section 12 for further detail.

2.4 Unsolicited personal information

If we receive personal information about you that we did not solicit, we will determine within a reasonable period whether we could have collected that information had we solicited it. If we could not have done so, and the information is not contained in a Commonwealth record, we will destroy or de-identify it as soon as practicable, provided it is lawful and reasonable to do so.

2.5 If you choose not to provide information

You are not obliged to provide us with your personal information, and where lawful and practicable you may deal with us anonymously or using a pseudonym. However, if you do not provide certain personal information we may not be able to provide you with the products or services you require, respond to your enquiry, or provide the level of service on which we pride ourselves. Where this occurs, we will let you know.

3. What personal information we collect

The personal information we collect and hold about you may include:

• name, gender and date of birth;

• contact details, including postal address, telephone numbers and email address;

• occupation, employer, job title and other employment related information;

• Australian Business Number (ABN) and other business details;

• purchase details, transaction information and payment information;

• account information, including user ID and account preferences;

• records of your communications with us, including enquiries, support requests and feedback;

• your marketing preferences and whether you have opted out of receiving communications from us;

• electronic network activity information, as described in section 2.4; and

• any other information you choose to provide to us.

3.1 Advertising and audience information

Where we provide advertising services to our clients, the personal information we collect and hold may also include:

• online and device identifiers, including cookie identifiers, advertising identifiers, device identifiers and IP addresses;

• client provided personal information about their customers, subscribers, enquirers or other individuals where this is required to deliver those services. This may include contact details and other information relevant to audience targeting, campaign delivery or measurement;

• customer, subscriber, enquirer or transaction records provided to us by a client;

• audience segment membership, including segments derived or inferred from the information described above; and

• campaign interaction data, such as impressions served, clicks, page views and conversions.

Information of this kind is personal information where it can be used to distinguish you from other individuals or to direct advertising to you, whether or not we know your name.

3.2 Sensitive information

We do not generally seek to collect sensitive information, and we do not require it in order to provide our services. Sensitive information includes information about your racial or ethnic origin, health information, political opinions, membership of a political association, professional or trade association or trade union, religious beliefs or affiliations, philosophical beliefs, sexual orientation or practices, criminal record, and genetic, biometric or biometric template information.

4. Why and how we use your personal information

We use your personal information for the purposes for which it was collected, for related purposes you would reasonably expect, and for other purposes to which you have consented or which are required or authorised by law. The purposes differ depending on how we obtained the information.

4.1 Information we collect for our own purposes

Where we collect personal information for our own business purposes, including from our customers, business contacts, suppliers and visitors to our Website, we use it to:

• provide, manage and improve our products and services;

• respond to your enquiries, questions, support needs and other requests;

• manage and improve our customer service;

• verify your identity and manage our business relationship;

• process payments, issue invoices and manage billing;

• communicate with you in relation to our products, services, enquiries and business relationship, subject to section 6;

• maintain business records, and conduct internal audits and quality assurance;

• protect and exercise our legal rights, including to detect, prevent and respond to fraud, misuse of our services, intellectual property infringement and breaches of our terms;

• facilitate a merger, acquisition, sale of assets, reorganisation or other change of control of our business; and

• comply with our legal and regulatory obligations.

4.2 Information we handle for our clients

Where we hold personal information that a client has provided to us, or that we have collected on a client’s behalf, we use it only to:

• plan, develop and deliver advertising campaigns for that client;

• upload to build, match, segment and analyse audiences for that client’s campaigns, including by matching identifiers against those held by advertising platforms and media owners;

• deliver advertising to individuals on the client’s behalf, subject to section 6;

• measure, verify, report on and optimise campaign performance for that client;

• respond to queries and requests from individuals about the client’s campaigns, or refer those requests to the client;

• maintain records of our work for the client, including for audit, verification and billing purposes; and

• comply with our legal obligations, and establish, exercise or defend legal claims.

We do not use personal information held for one client for the purposes of another client, or for our own marketing, product development or research, unless you have consented or we are otherwise permitted to do so by law and by our agreement with that client.

5. Who we disclose your personal information to

5.1 General disclosures

We may disclose your personal information to organisations outside Impetus Media, including:

• our related and associated entities;

• our media and technology partners;

• media owners, publishers, advertising platforms, data providers, technology providers and other media or advertising partners with whom we may exchange information where necessary to provide or facilitate our services;

• outsourced service providers who assist us in providing our products and services, including providers of:

• information technology, hosting, data storage and system administration services;

• customer research and market research services;

• mailing systems, email delivery and direct marketing services;

• financial services, payment processing and insurance;

• analytics services;

• professional advisers, including our lawyers, accountants, auditors, financial advisers, and insurers;

• an actual or proposed purchaser of our business or assets, and their advisers;

• government, regulatory and law enforcement authorities, courts and tribunals, where required or authorised by law, including in response to a subpoena or a request from an agency such as the Australian Taxation Office; and

• any other person to whom you have consented to us disclosing your personal information.

5.2 Disclosures made in delivering advertising campaigns

In planning, delivering and measuring advertising campaigns, we disclose personal information to other participants in the advertising supply chain. These include:

• the client for whom the campaign is run. Where we have collected personal information on a client’s behalf, we disclose it to that client. Where a client provided the information to us, any disclosure back to that client is limited to the information they provided and the results of our work on it;

• advertising platforms and technology providers, including social media platforms, search platforms, demand side platforms, and ad servers. We may disclose identifiers such as hashed email addresses, cookie identifiers and advertising identifiers to these providers so that they can match those identifiers against their own records and deliver advertising to you, or to individuals with similar characteristics. Generally, these platforms are Meta, Google, TikTok, LinkedIn, Pinterest, Microsoft Ads, and Reddit;

• media owners and publishers, for the purposes of booking, delivering and verifying advertising placements, such as broadcasters, publishers, out of home operators and their booking platforms; and

• measurement, verification and attribution providers, for the purposes of reporting on campaign delivery and performance, such as Nielsen, IAS, DoubleVerify.

When we disclose identifiers to an advertising platform, that platform will generally handle the information for its own purposes as well as ours, in accordance with its own privacy policy and its terms of service. We encourage you to review the privacy settings and controls made available by those platforms, which may allow you to limit the use of your information for targeted advertising.

5.3 How we deal with our service providers and partners

We generally require our service providers and contracted parties to use personal information only for the purpose for which we supplied it to them, and to protect it in a manner consistent with applicable privacy law. This does not apply to advertising platforms and media owners to the extent that they handle personal information for their own purposes, as described in section 5.2.

We do not sell your personal information.

6. Direct marketing and targeted advertising

6.1 Marketing communications from us

We may contact you by telephone, post, email or SMS with information about our services, business activities and other information relevant to our business relationship that we consider may be of interest to you, where we are permitted to do so by law.

Every direct marketing communication we send will identify us and will include a simple means by which you can opt out of receiving further marketing communications. You may also opt out at any time by contacting our Privacy Officer using the details in section 16. We will action your request within a reasonable period, and at no cost to you.

Where we have collected your personal information from a third party rather than from you, we will not use it for direct marketing unless we are permitted to do so under applicable law, and we will tell you the source of that information on request.

Our marketing communications are also subject to the Spam Act 2003 (Cth) and the Do Not Call Register Act 2006 (Cth) in Australia, and the Unsolicited Electronic Messages Act 2007 in New Zealand.

6.2 Targeted advertising

Direct marketing includes advertising that is targeted to you using your personal information, including advertising delivered through social media platforms, search platforms and other digital channels. Where we use or disclose your personal information to deliver targeted advertising, this will occur only on behalf of a client.  

We do not use or disclose sensitive information for direct marketing, including targeted advertising.

To opt out, contact our Privacy Officer using the details in section 16. Where the advertising is delivered under a client’s account with an advertising platform, or uses personal information a client provided to us, we will refer your request to that client and tell you that we have done so. You may also be able to limit targeted advertising using the privacy settings and controls made available by the relevant platform.

7. Overseas disclosure of personal information

Some of our related entities and service providers, including information technology and hosting providers, are located outside Australia and New Zealand. As a result, your personal information may be transferred to, stored in, or accessed from countries other than the country in which you are located.

Because we deliver advertising through platforms and providers that operate globally, the disclosures described in section 5.2 will usually involve recipients located outside Australia and New Zealand, including in the United States.

Before disclosing personal information to an overseas recipient, we take steps that are reasonable in the circumstances to ensure the recipient does not breach the relevant privacy principles applicable in relation to that information, including by entering into contractual arrangements requiring the recipient to handle the information in accordance with standards comparable to those under Australian and New Zealand privacy law.

This section applies to disclosures we make. Where a client holds the account with an advertising platform and we operate that account as an authorised user, the disclosure to that platform is made by the client, as described in section 5.2.

8. How we store your personal information and how long we keep it

We store your personal information in secure environments, protected by a combination of physical, technical and organisational measures. Where we use third party providers to store personal information on our behalf, we take reasonable steps to ensure those providers to maintain appropriate security safeguards.

We keep your personal information only for as long as it is reasonably necessary for the purposes for which it was collected, and for any period required under applicable legal, reporting, accounting or record retention obligations. In determining retention periods, we take into account the amount, nature and sensitivity of the personal information, the potential risk of harm from unauthorised use or disclosure, and the purposes for which we process it.

We may also retain personal information for a further period where we need to:

• maintain business records for analysis or audit purposes;

• comply with record retention requirements under law;

• establish, exercise or defend actual or potential legal claims;

• deal with any complaint about our products or services; or

• enforce our commercial agreements.

When we no longer need your personal information and we are not required by law to retain it, we will take reasonable steps to destroy it or ensure it is de-identified. Where it is not technically feasible to delete information entirely, we will implement appropriate measures to prevent any further use of it.

9. Security and data breach notification

We have implemented procedures and systems designed to protect your personal information from misuse, interference and loss, and from unauthorised access, modification or disclosure.

No method of transmission over the internet, and no method of electronic storage, is completely secure. While we take reasonable steps to protect your personal information, we cannot guarantee the security of information you transmit to us or receive from our online products or services.

9.1 Australia

If we have reasonable grounds to believe that an eligible data breach has occurred in relation to personal information we hold, we will notify the Office of the Australian Information Commissioner and affected individuals as soon as practicable, as required under the Notifiable Data Breaches scheme in Part IIIC of the Privacy Act 1988 (Cth). An eligible data breach occurs where there is unauthorised access to, unauthorised disclosure of, or loss of personal information, and a reasonable person would conclude that this is likely to result in serious harm to any of the individuals to whom the information relates.

Where we suspect an eligible data breach may have occurred, we will carry out a reasonable and expeditious assessment, and will endeavour to complete that assessment within 30 days.

9.2 New Zealand

If a privacy breach occurs in relation to personal information subject to the Privacy Act 2020 (NZ) and it is reasonable to believe the breach has caused, or is likely to cause, serious harm to an affected individual, we will notify the Office of the New Zealand Privacy Commissioner and the affected individuals as soon as practicable after becoming aware of the breach, as required under Part 6 of that Act.

10. Automated decision making

We do not currently make decisions about you using solely automated means where those decisions could reasonably be expected to significantly affect your rights or interests.  

11. Accessing and correcting your personal information

You have a right to request access to the personal information we hold about you, and to request that we correct it if it is inaccurate, out of date, incomplete, irrelevant or misleading.

To make a request, please contact our Privacy Officer using the details in section 16. We may ask you to put your request in writing and to verify your identity before we act on it.

Where the personal information you ask about was provided to us by a client, or is held by us on a client’s behalf, we may need to refer your request to that client in order to deal with it. We will tell you if we do so. You may also contact that organisation directly, which will usually be the quickest way to have your request actioned.

We will respond to a request for access:

• within a reasonable period, where the request is made under the Privacy Act 1988 (Cth); and

• as soon as reasonably practicable and no later than 20 working days after receipt, where the request is made under the Privacy Act 2020 (NZ).

We do not charge a fee for making a request for access or correction. We may charge a reasonable fee for giving access, which will not be excessive and will not apply to the making of the request. Where a charge applies, we will tell you the amount before we provide access.

In some circumstances we may refuse a request for access or correction, for example where the law permits or requires us to do so, or where granting access would have an unreasonable impact on the privacy of others. If we refuse a request, we will give you written reasons and information about how you may complain about our decision. If we refuse to correct your personal information, you may ask us to attach a statement to the information noting that you consider it to be inaccurate, incomplete, out of date, irrelevant or misleading.

We take reasonable steps to ensure the personal information we collect, use and disclose is accurate, complete and up to date. The accuracy of that information depends in large part on the information you provide, so we ask that you tell us of any errors and keep us informed of changes to your details.

12. Cookies and tracking technologies

A cookie is a small data file that is sent by a web server to your device and stored by your browser. Cookies enable a website to store small amounts of information and retrieve it later. We may use session cookies, which are temporary and are deleted when you close your browser, and persistent cookies, which remain on your device until they expire or you delete them.

We may also use single pixel tags, also known as web beacons or web tags. These are small graphics that function in a similar way to cookies. They are used to collect information in web logs, such as the pages viewed, the website you came from and the advertisement you clicked on to reach our Website, and to determine whether promotional or commercial emails we send have been opened.

We use these technologies to enable our Websites to function properly, to remember your preferences, to understand how our Websites is used, and to measure the effectiveness of our communications.

We and our clients may also use tracking technologies of this kind to collect information used to deliver targeted advertising, including advertising delivered on third party platforms. Section 5.2 describes who that information is disclosed to, and section 6.2 describes how you may opt out.

You can usually configure your browser to refuse cookies or to alert you when cookies are being sent. If you disable cookies, some parts of our Websites may not function properly.

13. Children’s privacy

Our Website, products and services are not directed at children. We do not market to children and we do not knowingly collect personal information about or from a child without the consent of a parent or guardian. If we become aware that we have collected personal information from a child without that consent, we will take steps to delete that information in accordance with applicable law.

If you believe a child has provided personal information to us, please contact our Privacy Officer using the details in section 16.

14. Links to third party sites

Our Websites may contain links to other websites, and may include interactive features and buttons operated by third parties, such as social media widgets. Those websites and features are not subject to our privacy standards and procedures, and any personal information you provide to them is governed by their own privacy policies. We are not responsible for the privacy practices or content of those websites. We encourage you to make your own enquiries about the privacy standards of each linked site.

15. Changes to this Privacy Policy

We may amend this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements and other factors. The current version is published on our Websites and takes effect from the date shown as the effective date.

Where we make a material change, we will take reasonable steps to notify you before the change takes effect, such as by posting a prominent notice on our Websites or by contacting you directly, and, where required by law, we will seek your consent to the change. We encourage you to review this Privacy Policy periodically.

16. Contact, questions and complaints

If you wish to update your details, request access to or correction of your personal information, ask a question about this Privacy Policy, or make a complaint about our handling of your personal information, please contact our Privacy Officer:

Privacy Officer, Impetus Media Pty Limited

Email: privacy@impetusmedia.com.au

Post: 617/56 Berry Street, North Sydney NSW 2060, Australia

Telephone: 02 9925 0001

16.1 How we handle complaints

We will acknowledge your complaint promptly and will usually respond within 30 days of receipt. We may need to contact you for further information in order to investigate. We will investigate your complaint, tell you the outcome and the reasons for it, and let you know what steps we propose to take. If we need more time, we will tell you and explain why.

16.2 If you are not satisfied

If you are not satisfied with our response, you may escalate your complaint to the relevant privacy regulator.

In Australia:

Office of the Australian Information Commissioner

GPO Box 5218, Sydney NSW 2001

Telephone: 1300 363 992

Website: www.oaic.gov.au

In New Zealand:

Office of the Privacy Commissioner

PO Box 10094, The Terrace, Wellington 6143

Telephone: 0800 803 909

Website: www.privacy.org.nz

‍

‍