1. About This Policy

Sensor Dynamics is committed to protecting your privacy and handling your personal information with care, transparency, and respect. This Privacy Policy explains how we collect, use, disclose, store, and protect personal information across our business operations, platforms, and services.

This Policy applies to:

Sensor Dynamics Pty Ltd (ABN provided on request), 23 Research Dr, Croydon South VIC 3136, Australia
Sensor Dynamics UK Limited (Company Registration No. 16086827), Suite A2, Building 3 Heathrow Boulevard, 282 Bath Road, Sipson, West Drayton, UK, UB7 0DQ

Together referred to in this Policy as ‘Sensor Dynamics’, ‘we’, ‘us’, or ‘our’.

This Policy covers all individuals whose personal information we collect or process, including:

Visitors to our website at sensordynamics.com.au
Users of the Nymble platform, including drivers, operators, rank agents, and administrators
Users of multiScanhub and related companion mobile applications
Individuals whose vehicle information is collected via our Traffic AI, multiScan, or Licence Plate Recognition (LPR) systems
Individuals whose information is provided to us by our clients or operators in connection with our services
Prospective customers, partners, and other individuals who communicate with us

We operate under and comply with the Australian Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs) in respect of our Australian operations. A copy of the Australian Privacy Principles is available from the Office of the Australian Information Commissioner at www.oaic.gov.au.

For our UK operations, Sensor Dynamics UK Limited complies with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. References to applicable law in this Policy should be read as referring to the relevant legislation for your jurisdiction.

2. What Personal Information We Collect

We collect different categories of personal information depending on how you interact with Sensor Dynamics, our platforms, and our clients’ sites. These categories include:

2.1 Identity and Contact Information

Full name
Email address
Phone and facsimile numbers
Postal and business addresses
Driver badge number or employee identification number (where applicable)
Driver photo (where provided or required by the relevant platform operator)

2.2 Account and Profile Information

Username and account credentials
Account type and access role
Account status (e.g. active, suspended, inactive)
Vehicle registration information linked to your account
Driving licence details (where required)
Personal preferences and settings within our platforms

2.3 Vehicle and Licence Plate Information

A core function of our technology is vehicle identification using camera-based Licence Plate Recognition (LPR) and machine learning systems. We collect:

Licence plate numbers
Vehicle make, model, colour, and type
Vehicle identification images captured at detection checkpoints
Vehicle classification data (e.g. vehicle category, axle configuration, body type)
Vehicle seating capacity and fuel type (where registered in our systems)
Watchlist and compliance status associated with a vehicle

Vehicle and licence plate data may be associated with the registered operator or driver of that vehicle. Where this creates a record capable of identifying an individual, it is treated as personal information under applicable privacy law.

2.4 Location and Movement Data

Where you use our mobile applications or operate at sites where our technology is deployed, we may collect:

GPS location data while you are within or near an authorised Sensor Dynamics operational site
Bluetooth Low Energy (BLE) signal data for in-precinct movement tracking
Zone entry and exit timestamps
Queue position and in-transit status
Journey logs recording your movement through site checkpoints

GPS and Bluetooth tracking via our mobile applications is limited to authorised operational sites. Tracking ceases automatically when you exit the site boundary or close the application. We do not track your location outside of these boundaries.

2.5 Financial and Payment Information

Pre-paid account balance and transaction history
Virtual credit balance
Payment card details (collected and processed via authorised payment providers; we do not store raw card numbers)
Records of fees charged, refunds processed, and payment failures
Financial eligibility status at site entry points

2.6 Operational and Compliance Data

Records of site access, entry and exit events, and compliance checks
Compliance status against applicable site or regulatory rules
Blacklist and watchlist status
Shortfare and journey type records
Rank transfer and dispatch records
Operational notes recorded by site operators or rank agents
Flagged journey records and review outcomes

2.7 Device and Technical Data

Device type, operating system, and mobile application version
Push notification and audio alert preferences
App usage and connectivity status
Authentication tokens and session data

2.8 Traffic and Road Data

Our Traffic AI platform collects data at road sites operated by or for government authorities and regulated transport bodies. This data includes:

Licence plate reads and associated vehicle identification images
Vehicle classification, counting, and volume data
Speed, weight, and height measurements
Emission monitoring data
Tyre and brake condition readings
Acoustic monitoring data
Bluetooth sniffing data for vehicle detection
Weigh-in-motion (WIM) data
Lane compliance data
Classification alerts (e.g. emergency vehicle identification)

Where Traffic AI data relates to an identifiable individual — for example, through the combination of a licence plate and a vehicle registration — it is treated as personal information. Much of this data relates to vehicles and compliance outcomes rather than individuals directly; however, we apply appropriate protections to all data collected.

2.9 Communication Data

Enquiries, feedback, and correspondence sent to us by email, phone, or post
Records of communications sent to you via our platforms (push notifications, VMS messages, system alerts)
Marketing preferences and unsubscribe requests

2.10 Website and Cookie Data

When you visit our websites, we may collect information automatically through cookies and similar tracking technologies. See Section 11 (Cookies and Website Data) for full details.

3. How We Collect Personal Information

We collect personal information in the following ways:

3.1 Directly from You

When you register for an account on our platforms
When you complete forms, applications, or onboarding processes
When you contact us by phone, email, or in writing
When you use our mobile applications
When you subscribe to marketing communications

3.2 Automatically

Through LPR cameras and vehicle detection systems at client-operated sites
Through GPS and Bluetooth sensors in our mobile applications while you are within authorised sites
Through website cookies and analytics tools when you visit our websites
Through kiosk interactions at multiScan and Nymble-enabled sites
Through Variable Message Sign (VMS) interactions and push notification delivery logs

3.3 From Our Clients and Operators

We may receive personal information from the operators of sites where our technology is deployed — for example, when an airport operator or car park manager registers driver or vehicle details on our behalf, or provides us with compliance or watchlist information. Where this occurs, we rely on the operator to ensure appropriate notice has been given to affected individuals.

3.4 From Third Parties

Government agencies and regulatory bodies (e.g. vehicle registration authorities for compliance verification purposes)
Payment service providers (transaction confirmation and failure notifications)
Integration partners where your information has been shared with your consent or under applicable law

4. Why We Collect and Use Personal Information

We collect and use personal information for the following purposes. Where the UK GDPR applies, we have identified the relevant lawful basis for processing.

4.1 Providing Our Platforms and Services

Creating and managing your account
Operating site entry, exit, queuing, and dispatch functions
Processing payments and managing account balances
Sending push notifications, audio alerts, and operational communications essential to site operations
Enabling site operators, rank agents, and administrators to carry out their functions
Generating operational reports, dashboards, and analytics

Lawful basis (UK GDPR): Performance of a contract; legitimate interests of the operator.

4.2 Compliance and Safety

Conducting eligibility checks at site entry points (financial eligibility, profile status, blacklist screening)
Detecting and reporting vehicle non-compliance against regulatory or site rules
Enforcing site access controls and watchlists
Providing data to government transport authorities and regulators as required
Supporting road safety initiatives and infrastructure planning

Lawful basis (UK GDPR): Legal obligation; legitimate interests; performance of a contract.

4.3 Security and Fraud Prevention

Authenticating users and managing secure sessions
Detecting and investigating unauthorised access or fraudulent activity
Maintaining audit and activity logs for operational security

Lawful basis (UK GDPR): Legitimate interests; legal obligation.

4.4 Product Improvement and Analytics

Understanding how our platforms are used in order to improve functionality and performance
Conducting traffic analysis and reporting to support transport planning clients
Identifying technical issues and system performance metrics

Lawful basis (UK GDPR): Legitimate interests.

4.5 Marketing and Communications

Sending you information about our products, services, and updates
Contacting you in response to enquiries
Inviting you to events, webinars, or product demonstrations

Lawful basis (UK GDPR): Consent (where required); legitimate interests (existing customers).

You may unsubscribe from marketing communications at any time by contacting us in writing or using the unsubscribe link in any marketing email.

4.6 Legal and Regulatory Obligations

Complying with court orders, subpoenas, or regulatory requests
Retaining records as required by law
Responding to data subject access requests
Meeting our obligations under the Privacy Act 1988 (Cth), UK GDPR, and other applicable laws

Lawful basis (UK GDPR): Legal obligation.

5. Licence Plate Recognition and Vehicle Identification

Licence Plate Recognition (LPR) and AI-powered vehicle identification are core technologies underpinning our multiScan, Nymble, and Traffic AI platforms. These systems operate at fixed and portable checkpoints at car parks, airports, transport facilities, road corridors, and other sites where our technology is deployed.

When a vehicle passes through a detection checkpoint, our systems may:

Capture an image of the vehicle and its licence plate
Read and record the licence plate number
Classify the vehicle by type, make, model, colour, and relevant compliance attributes
Match the vehicle against registered accounts, watchlists, and regulatory databases
Log the detection event with timestamp, location, and relevant compliance data

LPR and vehicle detection data is retained in accordance with our data retention policies set out in Section 12, and may be shared with site operators, regulatory bodies, and law enforcement authorities as described in Section 8.

Where a vehicle detection forms part of a personal account record, the individual linked to that account may access their detection history through the relevant platform portal or by contacting us as described in Section 14.

6. Location and Bluetooth Data

Our Nymble mobile application and certain other platform components use GPS and Bluetooth Low Energy (BLE) technology to support site operations. The following applies to the collection and use of this data:

Scope of tracking: GPS and Bluetooth tracking via our mobile applications is active only while you are within or near an authorised operational site and have the application running.
Automatic cessation: Tracking ceases automatically when you close the application or leave the site boundary. We do not monitor your location outside these contexts.
Purpose: Location data is used to direct your movement through site zones, manage queue positions, verify compliance at checkpoints, coordinate dispatching, and support on-site safety and operational functions.
Your control: You must enable GPS and Bluetooth permissions on your device for the application to function as intended. You may withdraw permissions at any time through your device settings; however, this may prevent certain features from operating or may restrict your access to the relevant site.
Privacy by design: No location data is retained beyond the operational period required for the specific site session, except where retention is required for compliance, dispute resolution, or legal obligations.

7. AI Technology and Model Context Protocol (MCP)

Sensor Dynamics has developed a proprietary Model Context Protocol (MCP) framework that enables AI models to query live and historical data held within our platforms. This capability powers the Nymble AI integrated chat and supports connections to compatible AI platforms including ChatGPT, Claude, Copilot, Grok, Gemini, Mistral, Cohere, Nemo, custom government models, and OpenAI-compatible models.

The following safeguards apply to AI and MCP access:

No raw personal data is exposed directly to AI models. All AI access is mediated through structured, permission-controlled queries.
Access is governed by token-managed authentication with automatic renewal. Unauthorised access attempts are blocked.
AI queries are subject to the same access controls and role-based permissions as human operators.
AI-generated outputs are structured analytical responses, not raw data exports.
All data accessed via MCP remains hosted within Sensor Dynamics’ sovereign infrastructure and is not transmitted to or stored by external AI providers except as required to process the query.

We do not use AI systems to make automated decisions that produce legal or similarly significant effects on individuals without human oversight. Where automated compliance checks are performed (for example, eligibility checks at site entry), these are based on predefined business rules applied to your account data, and are subject to human review and override as described in Section 10.

8. How We Share Personal Information

We do not sell personal information. We may share personal information in the following circumstances:

8.1 With Site Operators and Clients

Where our technology is deployed at a site operated by a third party (for example, an airport operator, a car park manager, a transport authority, or a port operator), that operator may have access to personal information processed through our platforms in connection with their site. This access is governed by data processing agreements with those operators and is limited to information relevant to their site operations.

8.2 With Service Providers and Subprocessors

We engage carefully selected third-party service providers to support our operations, including:

Data centre and hosting providers (Equinix — Melbourne, Sydney, and London)
Content delivery and security services (Cloudflare CDN)
Payment processing providers
Mobile application platform providers (Apple App Store, Google Play)
Software development and support contractors

These providers access personal information only as necessary to perform their services and are contractually required to protect it in accordance with applicable privacy law.

8.3 With Government Authorities and Regulators

We may share personal information with government transport authorities, road safety regulators, law enforcement agencies, and other public bodies where:

We are required to do so by law, regulation, or court order
The information relates to compliance data collected on behalf of that authority under an existing contract or arrangement
There is a genuine safety or security concern requiring disclosure

8.4 With Regulatory Databases

Our Traffic AI platform integrates with national vehicle registration and compliance databases operated by relevant government authorities for real-time compliance verification. Vehicle data is transmitted to and received from these systems in accordance with applicable regulations and our contractual arrangements with the relevant authority.

8.5 Business Transfers

If Sensor Dynamics undergoes a merger, acquisition, asset sale, or similar corporate transaction, personal information held by us may form part of the assets transferred. We will notify affected individuals where required by law.

8.6 With Your Consent

We may share your personal information with other parties where you have given explicit consent to that disclosure.

9. Client Contractual Arrangements

Sensor Dynamics deploys and operates its platforms and solutions across a wide range of client sites, including car parks, airports, transport facilities, road corridors, ports, and other venues. In every such engagement, all data handling, processing, and operational activities are conducted strictly within the contractual terms agreed between Sensor Dynamics and the relevant client.

These contractual arrangements:

Define the scope and purpose of data collection and processing at each site
Establish what personal information may be collected, retained, and used, and for what operational purposes
Allocate data controller and data processor responsibilities between Sensor Dynamics and the client in accordance with applicable privacy law
Set out the security, access, and confidentiality obligations that apply to all data handled at the site
Specify any requirements for data to be shared with third parties, regulatory bodies, or government authorities

Sensor Dynamics operates within these agreed guardrails at all times. We do not use client site data for purposes beyond those specified in the relevant contractual arrangement. Where a client’s contractual terms impose obligations on individuals using their site, those terms are the responsibility of the client as the site operator to communicate and enforce.

Where you have a question about how your personal information is handled at a specific site, you may direct your enquiry to the operator of that site or contact Sensor Dynamics directly using the details in Section 21.

10. Automated Decision-Making

Our platforms use automated systems to make certain operational decisions in real time. These include:

Eligibility checks at site entry points, assessing financial balance, profile status, and blacklist status
Automated queue placement and dispatch routing based on predefined business rules
Vehicle compliance checks against registered business rules and regulatory thresholds
Flagging of journeys that meet defined exception criteria

These automated checks are designed to support efficient site operations and regulatory compliance. Where an automated check results in a consequential outcome for an individual — such as access denial or account suspension — the following apply:

Site operators and authorised administrators have the ability to review and override automated decisions.
Affected individuals will be notified of the outcome via push notification, VMS signage, or other available communication channels.
You may request that a decision be reviewed by contacting the relevant site operator or Sensor Dynamics directly as described in Section 14.

Where the UK GDPR applies, you have the right not to be subject to a decision based solely on automated processing that produces legal or similarly significant effects, except where such processing is necessary for a contract, authorised by law, or based on your explicit consent. Contact us using the details in Section 21 to exercise this right.

11. Cookies and Website Data

When you visit our website (sensordynamics.com.au), we may collect information about your visit through cookies and similar technologies.

11.1 What Cookies We Use

Strictly necessary cookies: Required for the website to function. These cannot be disabled.
Analytics cookies: Help us understand how visitors use our websites so we can improve them. We use analytics tools that process data in an anonymised or pseudonymised form where possible.
Functional cookies: Remember your preferences and settings to improve your experience.

We do not use cookies for targeted advertising or for profiling unrelated to your use of our platforms and websites.

11.2 Managing Cookies

You can control cookies through your browser settings. Disabling certain cookies may affect the functionality of our websites. Where required by applicable law, we will seek your consent before placing non-essential cookies.

12. Data Retention

We retain personal information only for as long as necessary for the purposes for which it was collected, or as required by law. The following general retention guidelines apply:

Account and profile records: Retained for the duration of your account and for a minimum of 7 years following account closure, or longer where required by applicable law.
Financial and payment records: Retained for a minimum of 7 years to meet financial reporting and tax obligations.
LPR detection and journey records: Retained for the period specified by the relevant site operator’s contract and applicable regulations. Some compliance and enforcement records may be retained for longer periods as required by relevant transport or road safety authorities.
Location and Bluetooth data: Retained for the minimum period required to fulfil the operational purpose for which it was collected. In-session location data is not retained beyond operational necessity except where required for compliance or dispute resolution.
Website and cookie data: Retained in accordance with our cookie policy and analytics provider settings, typically 26 months for analytics data.
Marketing communications records: Retained until you unsubscribe or withdraw consent.
Correspondence: Retained for a minimum of 7 years.

When personal information is no longer required, we take reasonable steps to destroy or permanently de-identify it.

13. Security of Personal Information

Sensor Dynamics takes the security of personal information seriously. We implement technical and organisational measures appropriate to the nature and sensitivity of the information we hold.

13.1 Infrastructure Security

All personal data is hosted in Equinix sovereign data centres located in Melbourne, Sydney, and London. We do not rely on public cloud providers for sensitive personal data.
Full SSL/TLS encryption is applied across all data in transit. Cloudflare CDN is deployed at the network perimeter.
No raw personal data is exposed to AI models or external systems. All data access is governed by structured, permission-controlled interfaces.
Token-managed authentication with automatic renewal is used to manage all system access.
Sovereign deployment options are available for government and regulatory environments requiring enhanced data isolation.

13.2 Operational Security

Role-based access controls restrict operator access to the minimum information required to perform their function.
Activity and audit logs are maintained for operational security monitoring.
Staff who handle personal information are subject to confidentiality obligations and receive appropriate privacy training.

Despite these measures, no system is completely secure. We encourage you to use strong passwords, protect your account credentials, and contact us immediately if you become aware of any unauthorised access to your account.

14. Your Privacy Rights

14.1 Rights Under the Australian Privacy Act (APPs)

If you are located in Australia, you have the right to:

Access the personal information we hold about you
Request correction of personal information that is inaccurate, incomplete, or out of date
Make a complaint about our handling of your personal information

To exercise these rights, please contact us in writing using the details in Section 21. We will respond within a reasonable time and will not charge a fee for access requests, though an administrative fee may apply where we are required to provide copies of large volumes of records.

In order to protect your information, we may require proof of identity before releasing personal information.

14.2 Rights Under the UK GDPR

If you are located in the United Kingdom, you have the following rights:

Right of access: To request a copy of the personal information we hold about you.
Right to rectification: To request correction of inaccurate or incomplete personal information.
Right to erasure (‘right to be forgotten’): To request deletion of your personal information in certain circumstances.
Right to restriction of processing: To request that we restrict how we use your personal information while a concern is being resolved.
Right to data portability: To request your personal information in a structured, commonly used, machine-readable format.
Right to object: To object to processing based on legitimate interests or for direct marketing purposes.
Right to withdraw consent: Where processing is based on your consent, you may withdraw it at any time without affecting the lawfulness of prior processing.
Rights related to automated decision-making: As described in Section 10.

To exercise any of these rights, contact us using the details in Section 21. We will respond within one calendar month of receiving your request. If your request is complex, we may extend this period by a further two months, in which case we will notify you.

You also have the right to lodge a complaint with the Information Commissioner’s Office (ICO) at ico.org.uk, or to seek a judicial remedy.

15. International Data Transfers

Sensor Dynamics operates across Australia and the United Kingdom. Personal information may be transferred between our Australian and UK entities and infrastructure in the course of providing our services. These transfers are governed by appropriate safeguards, including:

Data processing agreements incorporating standard contractual clauses where required
Our sovereign hosting infrastructure in Equinix data centres in Melbourne, Sydney, and London, which maintains data within the relevant jurisdiction where operationally possible

Where personal information is transferred from the UK to a third country without an adequacy decision, we will ensure appropriate safeguards are in place in accordance with UK GDPR requirements. We will provide details of the specific safeguards applied upon request.

16. Children’s Privacy

Our platforms and mobile applications are not intended for use by persons under the age of 13. Users of the Nymble mobile application must be at least 13 years of age. If you are under 18, you must have the permission of a parent or legal guardian to use our applications, and must hold any licences or certifications required by law to operate in a commercial driving context.

We do not knowingly collect personal information from children under the age of 13. If you believe we have inadvertently collected such information, please contact us immediately using the details in Section 21 and we will take prompt steps to delete it.

17. Data Breach Notification

In the event of a data breach that is likely to result in serious harm to affected individuals, Sensor Dynamics will comply with its notification obligations under applicable law, including:

The Notifiable Data Breaches (NDB) scheme under the Australian Privacy Act 1988 (Cth), including notifying the Office of the Australian Information Commissioner (OAIC) and affected individuals as required
The UK GDPR requirement to notify the Information Commissioner’s Office (ICO) within 72 hours of becoming aware of a breach that poses a risk to individuals’ rights and freedoms, and to notify affected individuals without undue delay where the breach is likely to result in high risk

We maintain an internal data breach response procedure and conduct regular reviews of our security controls to minimise the risk of breaches occurring.

18. Sensitive Information

Sensitive information is defined under the Privacy Act 1988 (Cth) as information relating to an individual’s racial or ethnic origin, political opinions, membership of a political association, religious or philosophical beliefs, criminal record, health information, and certain other categories.

We will only use or disclose sensitive information:

For the primary purpose for which it was collected
For a secondary purpose that is directly related to the primary purpose
With your consent
Where required or authorised by law

19. Accuracy of Personal Information

We take reasonable steps to ensure that personal information we hold is accurate, complete, and up to date. If you believe that information we hold about you is inaccurate or out of date, please contact us as soon as possible so we can update our records. You can update certain profile information directly through our platforms. For other corrections, please contact us using the details in Section 21.

20. Updates to This Policy

This Policy may be updated from time to time to reflect changes in our practices, products, or applicable law. The current version of this Policy is always available on our website at sensordynamics.com.au. Where changes are significant, we will take reasonable steps to notify affected individuals, for example by posting a notice on our website or by email where we hold your contact details.

Your continued use of our platforms or websites following an update to this Policy constitutes your acknowledgement of the updated terms.

21. Contact Us and How to Make a Complaint

If you have any questions about this Privacy Policy, wish to exercise your privacy rights, or wish to make a complaint about our handling of personal information, please contact us:

Australia

Entity: Sensor Dynamics Pty Ltd

Address: 23 Research Dr, Croydon South VIC 3136, Australia

Phone: +61 3 8727 6000

Email: sales@sensordynamics.com.au

Website: sensordynamics.com.au

United Kingdom

Entity: Sensor Dynamics UK Limited (CRN 16086827)

Address: Suite A2, Building 3 Heathrow Boulevard, 282 Bath Road, Sipson, West Drayton, UK, UB7 0DQ

Phone: +44 1895 392500

Email: sales@sensordynamics.co.uk

Website: sensordynamics.com.au

We will acknowledge your complaint within a reasonable time and aim to resolve it promptly. If you are not satisfied with our response, you may escalate your complaint to the relevant supervisory authority:

Australia: Office of the Australian Information Commissioner (OAIC) — oaic.gov.au
United Kingdom: Information Commissioner’s Office (ICO) — ico.org.uk | 0303 123 1113

Appendix: Key Definitions

APPs: The Australian Privacy Principles, set out in Schedule 1 of the Privacy Act 1988 (Cth).
BLE (Bluetooth Low Energy): Short-range wireless technology used for in-precinct device tracking in our mobile applications.
LPR (Licence Plate Recognition): Camera-based automated technology for reading and recording vehicle licence plates.
MCP (Model Context Protocol): Sensor Dynamics’ proprietary framework enabling AI models to query live and historical platform data in a controlled, permission-based manner.
Nymble: Sensor Dynamics’ next-generation enterprise platform for parking, access control, and transport management.
Personal information / personal data: Information or an opinion about an identified individual, or an individual who is reasonably identifiable. Under the UK GDPR, ‘personal data’ carries the equivalent meaning.
Site Operator: The entity responsible for operating a site at which Sensor Dynamics technology is deployed, as defined in the applicable Nymble or platform terms and conditions.
Traffic AI: Sensor Dynamics’ intelligent traffic detection and compliance platform, deployed at road sites for transport authorities and regulatory bodies.
UK GDPR: The UK General Data Protection Regulation, which retains the provisions of EU GDPR as they applied in the UK prior to 31 December 2020, as amended by the Data Protection Act 2018.