Consumer Data Right (CDR) Policy

1. About this policy

ManageYourTax (“we”, “us”, “our”) is an Authorised Representative of NT Development Group Pty Ltd (ABN 95 676 608 610). This policy explains how we collect, use, hold and disclose Consumer Data Right (CDR) data, your rights in relation to that data, and how to contact us with a CDR-related question or complaint.

This policy is published in accordance with rule 7.2 of the Competition and Consumer (Consumer Data Right) Rules 2020 (Cth) and the requirements of Privacy Safeguards 1 and 13.

2. We act as a CDR Representative

We are a CDR Representative of Activate Wych Pty Limited (“Wych”), an ACCC-accredited Data Recipient under the Consumer Data Right regime. Wych is our CDR Principal and holds the accreditation that authorises CDR data access. We collect and use CDR data only within the scope of our representative arrangement with Wych and in accordance with the CDR Rules.

Wych's CDR Policy and details of its accreditation are available at wych.io.

3. What CDR data we collect and why

When you consent to share your banking data with ManageYourTax via the Wych consent flow, we collect the following CDR data from your nominated financial institution(s):

• Account identifiers, account name, account type and currency
• Account balances
• Transaction history (date, description, amount, counterparty, category)
• Product details for the accounts you elect to share

We use this data to:

• Import bank transactions into your accounting ledger and reconcile them against invoices, bills and journal entries
• Categorise transactions automatically using rules and AI-assisted matching
• Prepare GST and BAS calculations from your actual cash and accrual transaction data
• Generate cash-flow forecasts, financial reports and AI-driven insights
• Detect duplicate transactions, unmatched payments and reconciliation discrepancies

We do not use CDR data for marketing, on-sell CDR data to third parties, or process CDR data outside the purposes you have consented to.

4. Your consent

Sharing CDR data with us is entirely voluntary. You provide consent through the Wych consent flow, which asks you to confirm:

• Which accounts you are sharing
• What data we may collect
• The purposes for which we may use it
• How long we may hold it
• How you may withdraw consent

You can view, amend or withdraw consent at any time via the consent dashboard in your ManageYourTax account or directly through Wych. Withdrawing consent stops future CDR data collection immediately. Data already held will be de-identified or deleted in accordance with section 7 below.

5. Who we disclose CDR data to

We disclose CDR data only to the parties listed below, and only where reasonably necessary to deliver the services you have consented to:

• Wych — our CDR Principal, which collects CDR data from data holders on our behalf
• Google Cloud Platform (Sydney region) — infrastructure provider hosting our services and your data within Australia
• Your authorised representatives — for example, an accountant you have invited to your business on the Practice tier, but only the data you have authorised them to access

We do not disclose CDR data to overseas recipients. All CDR data is stored and processed in the Sydney region (australia-southeast1).

6. How we secure CDR data

CDR data is encrypted in transit (TLS 1.2 or higher) and at rest. Access is restricted to authenticated users via per-business security rules. See our Security Policy for a fuller description of our security controls.

7. How long we hold CDR data, and your rights

We retain CDR data for the duration of your consent. When you withdraw consent or close your account, we will:

• Cease collection of new CDR data immediately and notify Wych to revoke the upstream consent
• De-identify or delete CDR data held by us within a reasonable timeframe, except where retention is required for tax, audit or legal reasons (in which case the data is retained only for that purpose and access is restricted)

You may also at any time:

• Request access to the CDR data we hold about you
• Request correction of inaccurate CDR data
• Request deletion or de-identification of CDR data
• Lodge a complaint with us, with Wych, with the Office of the Australian Information Commissioner (OAIC), or with the ACCC

Requests are typically actioned within 10 business days. There is no fee for standard requests.

8. Complaints

If you believe we have not handled your CDR data in accordance with the CDR Rules or this policy, please contact us first using the details in section 10 below. We will acknowledge your complaint within 5 business days and aim to resolve it within 30 days.

If you are not satisfied with our response, you may escalate the complaint to:

• Activate Wych Pty Limited, our CDR Principal
• Office of the Australian Information Commissioner (OAIC) — oaic.gov.au
• Australian Competition and Consumer Commission (ACCC) — accc.gov.au

9. Changes to this policy

We may update this policy from time to time. Material changes will be notified by email or in-product notice. The “Last updated” date at the top of this page reflects the current version.

10. Contact us

For any CDR-related question, access request, correction request, or complaint: