Consumer Data Right (CDR) Policy

Last updated: 5 July 2026

1. About This Policy

This Consumer Data Right Policy (“CDR Policy”) explains how VYLA TECH PTY LIMITED (ABN 16 683 366 538), trading as Omnidash (“we”, “us”, “our”), manages CDR data — the banking data you choose to share with us under Australia’s Consumer Data Right.

It supplements our Privacy Policy, which covers all other personal information we handle. Where this policy and the Privacy Policy overlap in relation to CDR data, this policy applies.

We are required to have this policy under rule 7.2 of the Competition and Consumer (Consumer Data Right) Rules 2020, and we will provide a copy in an alternative format (for example, a printed or accessible copy) on request, free of charge.

2. What Is the Consumer Data Right?

The Consumer Data Right (CDR), often called open banking in the banking sector, is an Australian Government initiative that gives you the right to share data your bank holds about you — securely, with your consent, and only with accredited or authorised recipients.

Unlike older approaches such as screen-scraping, CDR data sharing never requires you to hand over your bank login details. Your bank sends the data directly through regulated, encrypted channels, and you can see and manage every sharing arrangement from your bank’s app.

The CDR regime is overseen by the Australian Competition and Consumer Commission (ACCC) and the Office of the Australian Information Commissioner (OAIC). You can learn more at cdr.gov.au.

3. Our CDR Representative Arrangement

Omnidash intends to access CDR data as a CDR representative of an unrestricted accredited data recipient (ADR) — our CDR principal. Under this model:

• Our CDR principal holds ACCC accreditation and makes the actual data requests to your bank
• Omnidash provides the app experience — you see your data and manage your connection inside Omnidash
• A written representative arrangement between us and our principal governs how we must collect, use, store, and delete CDR data, and our principal oversees our compliance

When our representative arrangement commences, this section will be updated with our principal’s legal name, accreditation number, and a link to their entry on the CDR provider register.

4. The CDR Data We Collect

We follow the principle of data minimisation: we only ask for the data needed to power the features you use, and nothing more. If you choose to connect a bank account, we may collect the following classes of CDR data through our principal:

• Account details — account name, type, and masked account number, so you can identify which account is connected
• Account balances — to display your current position in the dashboard
• Transaction data — transaction dates, amounts, descriptions, and merchant details, so we can identify and categorise your gig income and work-related expenses

We do not collect CDR data about anyone other than you (for example, joint account holders’ separate accounts), and we do not request data clusters we don’t need — such as direct debits, scheduled payments, or payee lists.

5. How We Use CDR Data

We use CDR data only for the purposes you consent to, which are:

• Importing income — detecting deposits from gig platforms (such as Uber, Uber Eats, and DoorDash) and matching them to your earnings records
• Importing expenses — identifying and categorising work-related transactions such as fuel, tolls, and vehicle costs
• Powering your reports — feeding your dashboard, BAS summary, and tax estimates so they reflect your real income and spending

We will never:

• Sell your CDR data
• Use your CDR data for advertising or marketing
• Disclose your CDR data to anyone except as described in this policy or as required by law
• Use your CDR data for purposes beyond those you consented to

6. Consent — You Are in Control

CDR data sharing only ever happens with your express, informed consent. When you connect a bank account you will be shown exactly:

• What data will be shared
• What it will be used for
• How long the sharing arrangement lasts (up to a maximum of 12 months before it must be renewed)

You can withdraw your consent at any time — from within Omnidash, via the consumer dashboard provided through our CDR principal, or from your own bank’s data-sharing settings. Withdrawing consent stops all further data sharing, and we will then delete or de-identify the CDR data we hold, as described in Section 9.

Withdrawing consent does not affect your Omnidash account — features that rely on bank data will simply stop updating, and you can keep using manual imports and receipt scanning.

7. How We Store & Protect CDR Data

CDR data is subject to the Privacy Safeguards in the Competition and Consumer Act 2010 (Cth) — a stricter regime than standard privacy law. Our protections include:

• Encryption of CDR data in transit (TLS) and at rest
• Storage in access-controlled infrastructure, with access limited to systems and personnel that need it to provide the service
• No storage of your bank login credentials — ever. CDR connections never involve your bank password.
• Monitoring, logging, and regular review of our security controls, as required under our representative arrangement

Our CDR data is stored in Australia. If that changes, we will update this policy to list the countries where CDR data may be held before any overseas storage occurs.

8. Who Can Access CDR Data

The following parties may access CDR data in the course of providing our service:

• Our CDR principal — the accredited data recipient who collects the data from your bank and discloses it to us under our representative arrangement (details to be listed here when the arrangement commences)
• Supabase — our database and hosting provider, which stores CDR data on our behalf as an outsourced service provider

Outsourced service providers may only use CDR data to provide their services to us, under contractual obligations consistent with the CDR Rules. We do not disclose CDR data to any other third party unless you direct us to or the law requires it.

9. Deletion & De-identification

When your consent expires or is withdrawn, or when CDR data is no longer needed for the purposes you consented to, we will delete the redundant CDR data (or, where permitted and appropriate, de-identify it so it can no longer be associated with you).

You can also elect at any time to have your CDR data deleted rather than de-identified — just tell us at support@omnidash.app or use the deletion controls in the app. Records derived from your CDR data that we are legally required to keep (for example, records of the consents themselves) are retained only as long as the law requires.

10. Access & Correction

You can ask us at any time, free of charge:

• What CDR data we hold about you, and to be given access to it — most of it is visible directly in the app
• To correct CDR data that is inaccurate, out of date, or incomplete. Because CDR data comes from your bank, correction may involve asking your bank to fix the source record — we will help coordinate this and let you know the outcome.

We will acknowledge correction requests and respond within 10 business days, either by making the correction or explaining why it was not needed, along with a notice of your right to complain.

11. Questions & Complaints

If you have a question, concern, or complaint about how we handle CDR data, please contact us first at support@omnidash.app with “CDR complaint” in the subject line. We will:

• Acknowledge your complaint within 2 business days
• Investigate and respond with our decision within 30 days

If you are not satisfied with our response, you can escalate your complaint externally:

• Australian Financial Complaints Authority (AFCA) — the external dispute resolution scheme for CDR complaints: afca.org.au, phone 1800 931 678
• Office of the Australian Information Commissioner (OAIC) — for privacy-related CDR complaints: oaic.gov.au
• ACCC — for other CDR concerns: accc.gov.au

12. Updates to This Policy

We will update this policy when our CDR representative arrangement commences (adding our principal’s accreditation details), and whenever our CDR data practices change. Material changes will be notified by email or in-app notification before they take effect. The “Last updated” date at the top of this page always reflects the current version.

13. Contact Us

For anything relating to this CDR Policy or your CDR data: