Privacy policy

This policy explains how BizExchange (www.bizexchange.com.au) handles personal information. We handle it in line with the Australian Privacy Principles in the Privacy Act 1988 (Cth). In this policy, "we" and "us" mean the operator of BizExchange.

The short version

You can browse listings, search, use the map and tools, and read guides without an account and without telling us who you are.
When you send an enquiry, we pass your details to the seller so they can reply to you. That is the main way your information leaves BizExchange.
We do not sell personal information, and we do not use it for advertising.
We use only the cookies the site needs to work. There are no analytics or advertising cookies.
Our emails do not track whether you open them or click their links.
Every newsletter has a one-click unsubscribe link, and every alert a one-click link to stop it.

What we collect

When you visit

We do not ask who you are. Like any website host, our hosting provider processes your IP address to deliver pages to you.

Forms that could be abused (enquiries, newsletter sign-up, sign-in and listing reports) limit how often they can be used. To do this we turn your IP address into a one-way code (a hash) and count requests against it. Our database stores that code, never the IP address itself. The counting records are deleted after about a day. For enquiries and newsletter sign-ups we also count by email address, in the same short-lived records.

When you open a listing, we count a view so the seller can see how many people looked at it. Your browser sends one request with no cookies. We make a one-way code from your IP address and that listing, so each person counts once a day per listing, and the code is deleted after that day. We keep only the number of views for each listing on each day. Search engines and other bots are not counted.

Your account

You sign in with a link we email to you, or with Google. Sign-in links work once and expire after an hour.
We keep your email address, your name if we have it, your account type (buyer, owner, broker, franchisor or administrator) and the brokerages or brands you belong to.
If you sign in with Google, Google tells us your name, your email address and, if you have one, a link to your profile picture. We never see your Google password.

Contact form

When you use the contact form we collect your name, email address, the topic you choose, your message and, if you give one, a listing link or number. We email them to our team, with a copy to you, and keep a record that the emails were sent. The message itself is not stored on the site; it stays in our inbox for as long as we need it to reply and keep a record of the conversation.

Enquiries

When you enquire about a business we collect your name, email address, phone number (optional) and message, and whether you ticked "sign a confidentiality agreement first" or "tell me about finance options". We also record the listing, the time, the address we sent the enquiry to, and the hashed IP address. We email you a copy.

If you ask about finance, we pass that request to the seller with your enquiry. We do not pass it to lenders or anyone else. If you ask for a confidentiality agreement, we pass the request to the seller, who decides how to handle it.

Newsletter, alerts and saved listings

Newsletter. Your email address, the industries and states you choose, where you signed up, when you confirmed, and the hashed IP address at confirmation. Nothing is sent until you click the confirmation link, and sign-ups that are not confirmed are deleted after 7 days.
Saved searches and alerts (signed in). The filters and name of each search, how often you want alerts, and which listings we have already sent you.
Saved listings (signed in). The listings you save. The seller sees how many people saved a listing, never who.

Listings by owners, brokers and franchisors

The details you enter, the photos you upload, and the ABN if you give one.
For brokerage and franchise listings, the contact who receives enquiries: their name, email address and phone number.
For a brokerage or brand, its profile (name, location, website, description, email addresses, phone, ABN and licence number), the people on its team and their roles, invitations sent, and the files and feeds used to add listings.
If you mark a listing sold and choose to tell us the sale price, that price. It is used only in aggregate (see the Asking Price Report).

What the public sees: the listing details you publish, and the suburb unless you choose to keep it confidential, in which case only the region is shown. A private owner's listing shows "Private owner", not your name. A brokerage or brand profile shows its name, location, website and description. We do not show ABNs, or the email addresses and phone numbers you give us, on the site; buyers reach the seller through the enquiry form.

ABN checks

When you give an ABN with a listing, we check that the number is valid and store it with the listing. The ABN stays private.

Payments

Payments are taken by Stripe on its own checkout and billing pages. Your card details go to Stripe and never reach us. We keep a record of each order (the plan, amount, status and Stripe's reference numbers) and a copy of the payment notices Stripe sends us, which include the payer's email address.

Brokers named on listings from public sources

Some listings are short factual summaries of businesses that brokers advertise publicly elsewhere. For these we store the broker's business name, the contact email address and phone number published with the original advertisement, and a link to the original. We use the email address to forward buyer enquiries, each with a link to claim or remove the listing. We do not publish the broker's email address, phone number, description or photos. Our checking tool, BizExchangeBot, visits the original listing about once a week to see whether it is still available.

Reports, removals and claims

Reporting a listing. The reason you choose, what you tell us about the problem, and your email address if you give it. Reports go to our team.
Remove and claim links. We record the email address each link was sent to and when it was used. A claim is approved when you sign in with that address.
Brokerage claims. When you ask to manage a brokerage already shown on BizExchange, we compare the domain of your email address with the brokerage's.
"Remove every listing under my name". If a broker chooses this, we keep their email address on a list so we do not add their listings again.

Emails we send

We keep a log of every email we send: the type of email, the recipient, the subject and its delivery status. If an address bounces or marks our email as spam, it goes on a list we check before every send so we stop emailing it. If your address bounced by mistake, you can lift the block from your account page.

Cookies

We use only the cookies the site needs to work:

Sign-in cookies (names starting with sb-). Keep you signed in. They last up to 400 days and are removed when you sign out. Another is set while you sign in, to complete the sign-in link securely, and is removed once you are signed in.
bx_org. Remembers which brokerage or brand you are working on, if you belong to more than one. Lasts a year.
bx_preview. Used only while the site is closed for maintenance, so people with a preview link can see it. Lasts 30 days.

We do not use analytics or advertising cookies. Stripe's checkout pages and Google's sign-in pages are run by those companies under their own cookie and privacy policies.

How we use it

To run your account, publish and manage listings, and deliver enquiries.
To send the newsletter and alerts you asked for, and emails about your account, listings, enquiries and payments.
To take payments and keep payment records.
To check ABNs, review listings before they go live, keep listings from public sources up to date, and act on reports, claims and removal requests.
To stop spam and abuse.
To answer your questions and requests.
To publish the Asking Price Report from listing data, in aggregate only.
To meet our legal obligations.

The seller you enquire with. Your enquiry goes to the private owner who listed the business (to their account email), the brokerage (to the listing agent, or the brokerage's enquiry address), the franchisor (to the contact on the opportunity, or its recruitment address), or, for a listing from a public source, the broker at the email address published with the original listing. Brokerage and franchise team members can also see enquiries in their dashboard. The seller replies to you directly, and from then on their own privacy obligations apply to what they do with your details.
The public. The listing details and profiles described above.
The Australian Business Register, which receives the ABN when we check it.
Our service providers, listed below, who handle information for us to run the site.
Others when the law requires or allows it, for example a court order, a request from a regulator or police, or to prevent serious harm.

Our team can see the information in our systems in order to run and support the site.

Service providers and overseas disclosure

These providers store or process personal information for us. Some are based overseas or use servers outside Australia, so your information may be disclosed to recipients in the countries named here:

Supabase: our database, accounts, sign-in and photo storage. Our data is stored in Sydney, Australia. Supabase is a United States company.
Vercel: hosts the site. Our server code runs in Sydney, and pages are delivered through Vercel's global network, so a request may be handled outside Australia. Vercel is a United States company.
Resend: sends our emails, including enquiries, so it handles your name, email address, phone number and message when you enquire. Our email is sent from Resend's Tokyo region in Japan. Resend is a United States company.
Stripe: takes payments and holds card details. Stripe processes payment information in the United States and other countries.
Cloudflare: runs Turnstile, the spam check on our forms, which receives your IP address and information about your browser; manages our domain; and forwards email sent to our addresses to our inbox. Cloudflare is a United States company with a global network.
Google: Google sign-in, if you use it, and the email service our team uses to read and answer messages. Google is a United States company.
OpenFreeMap: supplies the map images on our map page, so it receives your IP address and the area of the map you view. We have not confirmed where its servers are.
OpenStreetMap: supplies the map images on listing pages, so its tile servers receive your IP address and the area of the map shown. The OpenStreetMap Foundation is based in the United Kingdom, and its map images are delivered through a global network.

The Asking Price Report

The BizExchange Asking Price Report is built from listings on BizExchange and from sale prices sellers choose to report. It publishes medians with their sample sizes, and any figure based on fewer than 20 listings is withheld. It contains no names, contact details or individual listings. See the methodology.

How long we keep it

Newsletter sign-ups that are never confirmed: deleted after 7 days.
Records used to limit form use, and the codes used to count a listing view once a day: deleted after about a day.
If you unsubscribe, we keep your address marked as unsubscribed so we do not email you again.
Addresses blocked after a bounce or spam complaint stay blocked until the block is lifted.
An owner's listing comes off the site when it expires, and a sold listing shows as sold for 30 days and then comes off the site. We keep the listing records after that, so an expired listing can be renewed and the Asking Price Report can count it.
Payment records: for as long as tax law requires.
Your account, enquiries and other records: while your account is open, and for as long as we need them for the purposes in this policy or the law requires.

When we no longer need personal information for any of those purposes, we take reasonable steps to delete it or remove what identifies you.

Security

The site is served only over encrypted connections.
Database rules limit each account to its own information. Only our administrators can see across accounts.
IP addresses are stored only as one-way hashes.
Card details are handled by Stripe and never reach our systems.

No system is completely secure. If a data breach is likely to cause serious harm, we will tell the people affected and the Office of the Australian Information Commissioner, as the law requires.

Seeing, correcting and deleting your information

You can change a lot yourself:

Your listings and photos, and whether a listing is live, paused or sold, from your dashboard.
Saved listings and saved searches, and how often alerts arrive, from your account.
Your newsletter industries and states, a pause of 30, 60 or 90 days, or unsubscribing, from the link in every newsletter.
A brokerage or brand profile and its team, from the broker dashboard (owners of the brokerage or brand only).

For anything else, including a copy of the information we hold about you, a correction, or closing your account and deleting your information, email support@bizexchange.com.au. We may need to confirm it is you, for example by asking you to write from the email address on your account. There is no charge to ask, and we will reply within a reasonable time. We may keep some information where the law requires it, such as payment records.

Emails and unsubscribing

We send the newsletter only after you confirm your subscription, and alerts only for searches you save.
Every newsletter has a one-click unsubscribe link, and every alert a one-click link to stop alerts for that search. Both work straight away.
Emails about your account, your listings, your enquiries and your payments are part of the service and are sent whether or not you subscribe.
Brokers who receive enquiries about a listing from a public source can remove the listing, and stop those emails, from the link in each one.

Questions and complaints

If you have a question or a complaint about how we handle your personal information, email support@bizexchange.com.au with the details. We will look into it and reply. If you are not satisfied with our response, you can complain to the Office of the Australian Information Commissioner at oaic.gov.au.

Changes to this policy

We update this policy when what we collect, or how we use it, changes. The date at the top shows when it last changed.