Legal

Privacy Policy

Last updated: 23 June 2026

TLY Investments Pty Ltd (ACN 677 990 617), trading as TopNDISAustralia (“TopNDISAustralia”, “we”, “us” or “our”), operates the website at topndisaustralia.com.au (the “Platform”) — an independent Australian directory of NDIS providers backed by verified reviews from participants, families and carers. We respect your privacy and are committed to handling your personal information in accordance with the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs). This policy explains what we collect, why, how we use and disclose it, and the choices you have.

The information we collect

We collect personal information in three main ways:

Information you give us

Enquiries: when you contact a provider through the Platform — your name, phone number, email (optional), suburb, and the details of the support or service you’re looking for.
Contact & “list my service” forms: your name, email, phone (optional), message, and, if relevant, business name, service type, suburb and website.
Reviews: your name, email address (for verification), star rating, and review content.
Newsletter: your email address if you subscribe to our updates.
Accounts (providers): your email address and password (handled by our authentication provider), and the profile, business, credential and registration information you choose to add — which may include your ABN, NDIS registration details, insurer, and any documents you upload.

Information from public sources

Many provider listings on the Platform are compiled from publicly available sources (such as public business directories, public web listings and business registers). This may include a provider’s name, contact details, location, service type, and publicly displayed ratings or photos. If you are a provider, you can claim your listing to manage it, or contact us to correct or remove information (see Accessing, correcting or removing your information below).

Information collected automatically

When you use the Platform we collect limited technical and usage data — such as your IP address (which we store in a hashed form), browser and device type, the pages you view, and the page that referred you — using our own first-party analytics. We use cookies and similar technologies for essential functionality and to understand how the Platform is used. When we run advertising campaigns we also use the Meta (Facebook) Pixel — see Cookies & advertising below.

How we use your information

To operate, maintain and improve the Platform and the directory.
To connect participants, families and carers with providers — when you submit an enquiry, we pass your details to the relevant provider so they can respond.
To verify reviews (by email) and to verify provider credentials (for example, checking an ABN against the Australian Business Register).
To send service communications (such as review verifications and enquiry notifications) and, where you have opted in, our newsletter.
To process subscriptions and payments for paid plans.
To detect, prevent and respond to spam, fraud, abuse and security issues.
To comply with our legal obligations.

When we disclose your information

We disclose personal information in the following circumstances. We do not sell your personal information.

To providers: the enquiry or contact details you submit are provided to the relevant provider so they can contact you.
To our service providers: trusted third parties who help us run the Platform, including hosting, database, authentication and file storage (Supabase), website hosting and delivery (Vercel), email delivery (Resend), payment processing (Stripe), and verification/data sources (such as ABN Lookup and Google). They may only handle your information to provide their service to us.
Publicly on the Platform: reviews (shown with the reviewer’s name), provider profile and business information, and recognition results are displayed publicly.
Where required or permitted by law, or to protect our rights, users or the public.

Sensitive information in reviews

Reviews on the Platform are written by participants, families and carers, and may touch on personal circumstances — including, in some cases, sensitive personal or health information. We ask reviewers not to share personal medical details, diagnoses, or other sensitive information about themselves or others when writing a review, and our review form and guidelines reflect this.

Every review is moderated before it is published, and we may edit or decline a review that contains sensitive personal or health information. If a published review includes sensitive information about you or someone you care for, contact us at admin@topndisaustralia.com.au and we will review it promptly and remove or redact the content on request.

Overseas disclosure

Some of our service providers store or process information on servers located outside Australia (for example, in the United States or other countries). Where we disclose information to an overseas recipient, we take reasonable steps to ensure it is handled consistently with the Australian Privacy Principles.

Payments

Subscription payments are processed by Stripe. Your card details are entered directly with Stripe and are handled in accordance with their security standards — we do not store your full card number.

Security & retention

We take reasonable steps to protect personal information from misuse, loss, and unauthorised access, modification or disclosure. No method of transmission or storage is completely secure, so we cannot guarantee absolute security. We keep personal information only for as long as we need it for the purposes described above or to meet legal obligations, after which we delete or de-identify it.

Accessing, correcting or removing your information

You may request access to, or correction of, the personal information we hold about you by contacting us at admin@topndisaustralia.com.au. If you are a provider, you can also claim your listing to update it yourself, or ask us to correct or remove information compiled from public sources. We will respond within a reasonable time and may need to verify your identity first.

Direct marketing

We will only send you our newsletter if you have subscribed. You can unsubscribe at any time using the link in any newsletter email, or by contacting us.

Cookies & advertising

We use cookies and similar technologies for essential site functionality and for our own first-party analytics. When we run advertising campaigns, we also use the Meta (Facebook) Pixel— a third-party technology from Meta Platforms, Inc. that sets cookies and sends limited event data (such as pages viewed and whether you submit an enquiry) to Meta so we can measure and improve our advertising. This may involve your information being processed by Meta on servers overseas (including in the United States). We do not sell your personal information. You can control or delete cookies through your browser settings, and you can manage ad tracking through your Meta account settings and your device’s ad-preference controls; note that some parts of the Platform may not work as intended if you disable essential cookies.

Complaints

If you have a concern about how we have handled your personal information, please contact us first at admin@topndisaustralia.com.au and we will try to resolve it. If you are not satisfied with our response, you may contact the Office of the Australian Information Commissioner (OAIC) at oaic.gov.au.

Children

The Platform is intended for users aged 18 and over and is not directed at children. We do not knowingly collect personal information from children.

Changes to this policy

We may update this policy from time to time. The current version will always be available on this page, with the “Last updated” date shown above.

Contact us

Questions about this policy or your personal information? Email us at admin@topndisaustralia.com.au.