What we collect, and what we don’t.

Who we are

This website is operated by Maslow Holdings Pty Ltd (ACN 672 433 519) (“we”, “us”), the company building shared infrastructure for member-owned financial institutions. Our contact point for privacy matters is contact us.

This policy covers two things: this public website, and Maslow’s invitation-only investor data room. They collect different information and are governed by different retention rules, so each is described separately below. Unless a section says otherwise, it describes this website.

The investor data room

Maslow operates a separate, invitation-only investor data room at maslow.com.au/dataroom. It is not part of this public website, and the sections describing this website do not describe it. If you have been invited to the data room, this section explains how your information is handled there.

What we collect. When you are invited to and use the data room, we collect: your name, email address, organisation and position; your confirmation that you have authority to accept a confidentiality agreement; the name you type as your signature; your IP address, browser and device information; a record of each document you view or download and when; and records of the invitations, links and documents delivered to you.

Why we collect it. To control and secure access to confidential material, to administer your invitation and communicate with you about it, to establish who accepted the confidentiality agreement and when, to know what each recipient has received, to meet our governance, record-keeping and legal obligations, and to protect the confidential information of Maslow and of third parties.

Watermarking and activity logging. PDF documents issued through your account may be watermarked with your email address and the time of issue. Sign-in events, access to documents, and the delivery of material to you are logged. This is deliberate: it is how confidential material is traced if it travels further than intended. A watermark identifies the account a copy was issued to; it is the starting point for an investigation, not proof of who disclosed a document.

Cookies. The data room sets a session cookie so you remain signed in while using it. It is necessary for the room to function and is not used for advertising or cross-site tracking.

Where it is stored. The data room and the documents in it are hosted in the United States. Australian privacy law may not apply to information held in the United States. Email delivery and encrypted backups are handled in Australia. Access is limited according to role and operational need.

How long we keep it, and what we cannot delete. Records of your acceptance of a confidentiality agreement, and records of access to and delivery of confidential material, are kept as compliance evidence for as long as they may reasonably be needed for legal purposes, including after your access to the data room closes. These records are not deleted on request — they are the evidence of an agreement you entered into and of what was provided to you under it. The deletion right described under “Your rights” applies to website enquiry information, not to these records. Other data room information not required as compliance evidence is kept only for as long as the purposes above require.

What we collect through this website

Through this website, we collect personal information only when you choose to give it to us by submitting the contact form. Depending on the route you choose (institution, investor or funder, or ally), this may include your name, work email, organisation, your country or jurisdiction (for institutions), the type of capital you work with (for investors and funders), and the message you write to us.

We use a single, privacy-first analytics tool that we run on our own servers, to understand in aggregate how the site is used — for example how many people visit and which pages are most read. It uses no cookies, does not track you across websites or across separate visits, and does not build a profile of you as an individual. It records only non-identifying, aggregate information — the page visited, the site you arrived from, an approximate region, and a general device type — and it does not store your IP address or any identifier that singles you out. We use no advertising trackers and no third-party tracking scripts, and we never share or sell this information. One exception, and only if you send us something: while you are browsing, your browser keeps a short-lived note of the pages you have viewed in the current visit. It is held only for that visit, in your browser’s per-tab storage, and it is discarded when you close the tab. If — and only if — you then submit a form, that list of pages is sent with your enquiry so we can see it in context. It is not a cookie, it is not kept between visits, it cannot connect one visit to another, and it is never used to build a profile of you.

Beyond that anonymous, aggregate measurement and the per-visit page list described above, visiting this website does not by itself collect personal information about you. (The data room, described above, is different: it is invitation-only and logs access.)

Why we collect it, and how we use it

We use the information you submit through this website only to respond to your enquiry — to understand which kind of conversation you are starting, to reply personally, and to follow up where you have asked us to. Every enquiry is reviewed and answered by a person. Maslow’s systems may route, store, classify and help the team manage an enquiry, but they do not make the substantive response or relationship decision.

We do not sell your personal information. We do not share it for advertising. Form submissions are delivered to us via Web3Forms, which processes the submission in order to email it to us.

How long we keep website enquiries

This section applies to information you send us through this website. We retain submitted contact details for as long as needed to respond to your enquiry and maintain the relationship it begins. We delete them on request at any time — use the contact point above. Data room records are dealt with separately under “The investor data room” above, and confidentiality-agreement acceptance and access records there are not deleted on request.

Where enquiry information is stored

Form submissions are delivered to Maslow through the form service identified above and may be stored in Maslow’s email, access-controlled internal enquiry system and relationship-management records so the team can respond, maintain the resulting relationship and meet its governance and record-keeping obligations. These systems may use Google and Maslow-controlled infrastructure, including infrastructure that processes or stores data outside Australia. Access is limited according to role and operational need.

Your rights

You can ask us what personal information we hold about you, ask us to correct it, or ask us to delete it. Use the contact point above and we will respond within a reasonable period. Deletion applies to the website enquiry information described above. As explained under “The investor data room”, confidentiality-agreement acceptance records and data room access and delivery records are kept as compliance evidence and are not deleted on request.

If you are in the European Union or the United Kingdom, the GDPR or UK GDPR may apply to our handling of your information. Where it does: for website enquiries, our lawful basis is your consent (you choose to submit the form) and our legitimate interest in responding to the enquiry you send us. For the investor data room, our lawful bases are the performance of, and steps taken before entering into, the confidentiality agreement you accept; our legitimate interest in protecting confidential information; and compliance with our legal obligations. You have the right to access, correct, or erase your personal information, to object to or restrict its processing, and to data portability. Those rights are subject to the limits the law allows: where we must keep records to establish, exercise or defend legal claims — including confidentiality-agreement acceptance and data room access and delivery records — we will keep them, and we will tell you when that is the reason we have not acted on a request. You may withdraw consent at any time, and you have the right to lodge a complaint with your local supervisory authority. To exercise any of these rights, use the contact point above.

Complaints

If you are concerned about how we have handled your personal information, contact us first (using the contact point above) and we will work with you to resolve it. If you are not satisfied with our response, you can complain to the Office of the Australian Information Commissioner (OAIC) at oaic.gov.au.

Changes

We may update this policy as Maslow’s work develops and as our practices change. The date at the top of this page shows when it was last revised.