Privacy Policy.

1. About this policy

Relay Strata is a digital platform designed to bring together the people, property information, documents, actions and decisions involved in strata insurance.

Relay Strata is operated by Naked Rivals Pty Ltd ABN 72 665 070 477, trading as Relay Strata (“Relay Strata”, “we”, “us” or “our”).

This Privacy Policy explains how we collect, hold, use, process and protect personal information when you visit our website, use the Relay Strata platform, participate in a property risk record, upload information or otherwise interact with us.

We seek to manage personal information consistently with the Privacy Act 1988 (Cth) and the Australian Privacy Principles where they apply.

2. Our data promise

We do not provide customer data to third parties for advertising, marketing, data brokerage, profiling or any unrelated purpose.

We do not make one customer's property, insurance or customer information available to another customer simply because both use Relay Strata.

We do not use customer data to train our own general-purpose artificial intelligence models.

Where we use third-party artificial intelligence services through business APIs, we do not opt customer data into model training or model improvement programs.

Customer data is only:

• available to users and organisations specifically authorised to access the relevant property, risk record or workflow; or
• processed by technology providers acting on our behalf where reasonably necessary to operate, secure, maintain or support Relay Strata.

Those technology providers do not receive customer data for their own independent marketing or commercial use.

Relay Strata does not independently distribute customer data across the insurance or strata industry.

3. What information we collect

Depending on how you use Relay Strata, we may collect and hold information including:

• your name, email address, telephone number, organisation, job title and role;
• account, authentication and login information;
• information about the organisation you represent;
• property addresses, strata plan details and property characteristics;
• insurance policies, quotations, premiums, limits, excesses and coverage information;
• claims and loss history;
• valuations, surveys, reports and risk recommendations;
• maintenance, defect, fire safety and other property risk information;
• declarations, decisions, actions and workflow information;
• documents, correspondence and data uploaded to Relay Strata;
• communications with us; and
• technical information about how you access and use the platform.

Documents uploaded to Relay Strata may contain information about owners, occupants, committee members, contractors, claimants or other individuals.

We do not intentionally seek sensitive personal information unless it is reasonably necessary for the relevant insurance or property process and its collection and use is lawful.

4. How we collect information

We may collect information directly from you, from your employer or organisation, when another authorised participant invites you to Relay Strata, when an authorised participant uploads information or documents relating to a property, when users enter, update or approve information within a property risk record, through communications with us, from publicly available sources where appropriate, and automatically through website and platform technologies such as analytics, security logs and cookies.

Because Relay Strata is collaborative, information about an individual may sometimes be provided by another authorised participant rather than directly by that individual.

5. Why we use information

We use information only for purposes connected with operating and providing Relay Strata, including to:

• create and administer accounts;
• authenticate users;
• verify organisations, participants and permissions;
• create and maintain property insurance risk records;
• enable authorised collaboration;
• manage insurance preparation and renewal workflows;
• store and process documents;
• extract structured information from documents;
• identify missing, inconsistent or outstanding information;
• track actions, recommendations and decisions;
• prepare insurance market information;
• record quotations, terms and comparisons;
• communicate with users about relevant properties and workflows;
• provide support;
• secure and monitor the platform;
• improve functionality and user experience;
• investigate misuse, fraud or security incidents; and
• comply with legal or regulatory obligations.

We may use aggregated or de-identified information for service analysis, benchmarking, security and product improvement where individuals and customers are not reasonably identifiable.

6. Where and how your data is stored

Relay Strata's primary application database and document storage are hosted using Supabase, a managed cloud data platform built on PostgreSQL.

Our primary Supabase project is configured in the Sydney, Australia region.

Property and insurance documents uploaded to Relay Strata's risk-document environment are stored in a private storage bucket rather than a publicly accessible document repository.

Supabase provides encryption of hosted data at rest and encrypted transmission of data in transit.

Relay Strata combines these infrastructure protections with authentication, organisation controls, property-level permissions and database-level security policies.

Our security model is designed so that authority is enforced at the data layer and is not dependent only on whether information is hidden or displayed in the website interface.

7. Who can see your data

Relay Strata is a controlled collaboration environment. It is not an open marketplace or an industry-wide shared database.

Being registered with Relay Strata does not automatically provide access to property or insurance information. A user must have authority relating to the relevant organisation, property or risk record.

Depending on the authority granted, a user may separately be permitted to:

• view a risk;
• edit risk information;
• add documents;
• invite participants;
• manage recommendations;
• manage declarations;
• prepare insurance market information;
• view insurance market information;
• manage a market process;
• provide insurance terms; or
• view insurance terms.

Different participants working with the same property may therefore have different levels of access.

Relay Strata uses authenticated accounts, organisation membership, property-specific access records and permission controls to determine what an individual user can access or change.

For core platform information, these restrictions are also enforced using PostgreSQL Row Level Security, meaning access rules operate within the database itself.

8. Authorised collaboration

The purpose of Relay Strata is to enable authorised parties involved in a strata insurance process to collaborate around a controlled property risk record.

Information may therefore be visible to organisations such as a broker, strata manager, owners corporation or body corporate, insurer, underwriting agency or other professional where that organisation or its users have been authorised to participate in the relevant property or workflow.

This is controlled access within Relay Strata, not the independent sharing or commercial distribution of customer data by Relay Strata.

Users who invite another participant, grant access or provide information about another person are responsible for ensuring they have appropriate authority to do so. Access can be changed or removed as responsibilities change.

9. Technology providers

We use specialist technology providers where necessary to operate Relay Strata. These may include providers of database and cloud infrastructure, document storage, authentication, artificial intelligence and document processing, email and communications, analytics, system monitoring and security services.

These providers process information on our behalf for the purpose of supplying their services to Relay Strata. They are not provided with customer data for unrelated advertising, marketing, profiling or data brokerage.

Supabase currently provides Relay Strata's primary database, authentication and document-storage infrastructure. Relay Strata's primary Supabase project is hosted in Sydney, Australia.

Artificial intelligence processing. Relay Strata uses artificial intelligence to assist with functions such as document extraction, structuring information, identifying gaps, producing summaries and extracting risk recommendations.

Where a document is submitted for AI processing, relevant document content is transmitted securely to our AI service provider for that processing. Relay Strata currently uses the OpenAI API for certain AI functions.

Relay Strata does not opt customer API data into OpenAI model training or improvement programs. Relay Strata also configures applicable API requests not to create stored response objects for product history where that functionality is not required.

AI processing is used to assist users. It does not replace professional judgment.

10. Automated processing and decisions

Relay Strata may use software and artificial intelligence to extract information from documents, classify and structure information, identify potential missing or conflicting information, compare insurance information, produce summaries, and support workflow and risk-record management.

AI-generated or automatically extracted information may be incomplete or inaccurate and should be reviewed where material.

Relay Strata does not itself make binding decisions about whether insurance will be offered, whether a risk will be accepted, what premium will be charged or whether a particular insurance product should be purchased. Those decisions remain with the relevant authorised insurer, underwriting agency, broker, owners corporation or other responsible party.

11. Overseas processing

Relay Strata's primary database and document-storage environment is hosted in Sydney, Australia.

Some specialist technology providers may process limited information outside Australia when providing services to Relay Strata. This may include processing in the United States, particularly in connection with artificial intelligence and website analytics services.

Where we use overseas service providers, we take reasonable steps appropriate to the circumstances to ensure personal information is handled consistently with applicable privacy obligations.

We do not transfer customer data overseas for sale, marketing or independent commercial use.

12. Website analytics and cookies

Relay Strata may use cookies and analytics technologies, including Google Analytics, to understand how visitors use our website and platform.

Information collected may include device and browser information, approximate geographic location, pages viewed, session information, referral information and interactions with the website.

We use this information to monitor usage, diagnose problems and improve Relay Strata. Analytics services are not given access to property documents or risk records for advertising or data brokerage purposes.

You can restrict cookies through your browser settings, although some functionality may be affected.

13. Security

We take the security of customer information seriously.

Relay Strata uses a combination of technical and organisational safeguards including, where applicable:

• authenticated user accounts;
• organisation membership controls;
• property-specific user access;
• role and permission-based authority;
• database-enforced Row Level Security;
• private document storage;
• encryption of hosted data at rest;
• encryption of data in transit;
• controlled administrative access; and
• platform and infrastructure monitoring.

Security is an ongoing process and we review our technical controls as Relay Strata develops.

No internet-connected system can guarantee absolute security. Users are responsible for protecting their account credentials and should contact us promptly if they believe their account has been compromised.

14. How long we keep information

We retain customer and personal information for as long as reasonably necessary to provide Relay Strata, maintain relevant property and insurance records, meet customer requirements, maintain appropriate audit and transaction history, satisfy legal obligations and resolve disputes.

Where information is no longer reasonably required, we may securely delete or de-identify it, subject to legitimate legal, backup and archival requirements.

Customers may contact us to discuss deletion or export of their information.

15. Access and correction

You may request access to personal information we hold about you or ask us to correct information that is inaccurate, incomplete or out of date.

We may need to verify your identity and authority before providing access or making a change. Where information forms part of an organisation-controlled property record, we may also need to involve the organisation responsible for that record.

16. Communications

We may contact you about your account, properties or risk records you participate in, insurance and renewal workflows, outstanding actions, security, service changes and support matters.

We may also send information about Relay Strata products or developments where permitted by law. You can opt out of marketing communications. Operational communications necessary to provide the service may still be sent.

17. Data breaches

If we become aware of unauthorised access, disclosure or loss of personal information, we will investigate the incident and take reasonable steps to contain and remediate it.

Where the Notifiable Data Breaches scheme or another applicable law requires notification, we will notify affected individuals and the Office of the Australian Information Commissioner as required.

18. Privacy enquiries and complaints

If you have a question or concern about how Relay Strata handles personal information, contact us. We will investigate privacy concerns and respond within a reasonable period.

If you are not satisfied with our response and Australian privacy law applies, you may have the right to contact the Office of the Australian Information Commissioner.

19. Changes to this policy

We may update this Privacy Policy as Relay Strata develops, our technology changes or applicable laws change.

The current version will always display its effective date and will be available through the Relay Strata website.