Our Privacy Policy

Last updated: September 2026

TrackThis Pty Ltd (ABN 55 631 495 906) ("TrackThis", "we", "us", "our") is a GPS tracking company based in Melbourne, Australia. This policy explains what information we collect, why we collect it, where it is stored, and what rights you have over it.

We have written this policy in plain language. If anything is unclear, contact us at info@trackthis.com.au.

This policy applies to:

  • The TrackThis website at trackthis.com.au

  • The TrackThis GPS portal (the "Portal"), whether accessed from a desktop computer or installed as a web app on a mobile device

  • GPS tracking devices supplied by TrackThis and the data they send to us

  • Remote commands sent from the Portal to those GPS tracking devices described in section 5

We handle personal information in accordance with the Privacy Act 1988 (Cth) and the Australian Privacy Principles.

1. Who we collect information about

We collect information about two groups of people.

Account holders. The people and businesses who buy our devices and use the Portal. This includes individual customers tracking their own vehicles or assets, and business customers such as fleet operators and hire companies.

People connected to a tracked asset. If a device is fitted to a vehicle or asset that is driven or used by someone other than the account holder (for example an employee, contractor, or hire customer), the device will record information about that vehicle's movements. Where a remote function such as the immobiliser is fitted, those people may also be directly affected when a command is sent to the vehicle they are using. See section 4 for what this means for business customers and section 5 for how remote commands may impact them, what information you should share with them as well as what data is recorded.

2. What information we collect

Account and contact information

When you create an account or enter into an agreement with us, we collect the details we need to set up your account and invoice you. This is limited to:

  • Name

  • Business name and ABN (business customers)

  • Email address

  • Phone number

  • Billing and postal address

We do not ask for anything we do not need.

Device and location data

Our tracking devices record information and send it to the Portal over the mobile network. Exactly what is recorded depends on how the device is installed and which inputs the customer has connected. A device wired only to power will record less than a device that is also wired to the ignition or to additional sensors.

Depending on the installation, device data may include:

  • GPS location, direction of travel and speed

  • Date and time of each recorded position

  • Trip history and distance travelled

  • Ignition status and movement status (if connected)

  • Vehicle battery voltage and the device's own battery level

  • Digital inputs and outputs the customer has wired up (for example an immobiliser or door sensor)

  • Driver identification, if the customer has fitted a driver ID reader

  • Harsh driving events such as sudden braking, acceleration or impact, detected by the device's accelerometer

  • Readings from optional external sensors such as temperature probes

  • Geofence entry and exit events set up by the customer in the Portal

  • Mobile network signal strength and device diagnostics

Where a device is fitted to a vehicle regularly driven by an identifiable person, this data may be personal information about that person, and we treat it as such.

Remote command data

Where a customer has had a remote function such as the immobiliser fitted, we record information about every command sent to the device. This is separate from ordinary tracking data because it records a deliberate action taken by a person, not a passive measurement. For each command we record:

  • Which command was sent (for example immobiliser engage or immobiliser release

  • The Portal user account that sent it

  • The date and time it was sent

  • The device and vehicle it was sent to

  • The vehicle's location, speed and ignition state at the moment the command was issued

  • Whether the device confirmed the command was carried out, and when

  • Whether the command was refused by the device or the Portal, and why

This log is retained as described in section 9 and is available to the account holder in the Portal.

Website visitor information

When you visit trackthis.com.au, our website host (Squarespace) records basic technical information such as your IP address, browser type, pages visited and an approximate location derived from your IP address. We use this only to understand general website traffic. We do not run advertising trackers or third-party analytics on the website whatsoever.

Portal usage information

When you use the Portal, our servers record standard technical logs such as your IP address, browser type and the time of your login. We use these logs for security and to keep the Portal working properly.

Payment information

We do not collect or store credit card or bank account details. Card payments are processed by Stripe, and invoices are issued through Xero. If you pay by bank transfer, we see only the payment reference on our bank statement. Stripe and Xero handle payment details under their own privacy policies.

3. How we use your information

We use the information we collect to:

  • Supply and support the devices and Portal you have purchased

  • Set up your account and any additional users you authorise

  • Display your device data to you in the Portal

  • Carry out remote commands you send from the Portal, and keep a record of them

  • Invoice you and manage your account

  • Send service emails such as account invitations, password resets and invoices

  • Respond to your enquiries and support requests

  • Meet our legal obligations

We do not use your information for marketing. We do not send promotional emails, and we do not use device data or account data to build profiles, target advertising, or for any purpose other than delivering the service you have paid for.

4. Business customers and the people they track

If you are a business customer, you are responsible for the people whose movements are recorded by devices on your vehicles or assets. This includes employees, contractors and hire customers.

You must:

  • Tell those people that the vehicle or asset is fitted with a GPS tracker and what information it records

  • Tell them, separately and clearly, if the vehicle is fitted with a remote immobiliser, that it can be triggered from the Portal, and in what circumstances you would use it

  • Make sure you have a lawful basis for that tracking, including any consent or notification required by workplace surveillance or privacy laws that apply to you or your business sector

  • Make sure your hire agreements, employment contracts or site terms cover the use of remote immobilisation before you rely on it

  • Make this privacy policy, or your own equivalent policy, available to them

Workplace surveillance laws differ between states, and some require written notice before tracking begins. Remote immobilisation is not addressed identically in every jurisdiction, and in some cases it may be treated as more than surveillance. If you are unsure of your obligations, get your own legal advice as we are not responsible to provide it to you.

TrackThis does not have a relationship with your staff, contractors or hire customers, and it is not practical for us to contact them individually. We rely on you to communicate with them. This is consistent with the terms of the Legal Business Agreement between you and TrackThis.

5. Remote command functions

Some TrackThis devices can be wired to control a vehicle as well as monitor it. These functions are optional, are not enabled by default, and only work if a qualified installer has physically wired the relevant output during installation. If you have not had any fitted, nothing in this section applies to your assets or vehicles.

The remote immobiliser is described below as an example of how these functions work. Where we offer other remote functions, they follow the same rules: the same permission model in section 5.2, the same logging in section 5.3, and the same obligations on you in section 5.4.

5.1 What the immobiliser does

When engaged, the immobiliser prevents the vehicle from being started. It is used for theft prevention, for recovering a stolen or unreturned vehicle, and by hire businesses to stop use of a vehicle outside the agreed hire period.

5.2 Who can send commands

Only Portal users on your account who have been given permission to use remote functions can send these commands. Account administrators control who has that permission and can withdraw it at any time.

5.3 Every command is recorded

Every command is logged with the detail listed in section 2, including which user sent it and where the vehicle was at the time. You can view this log in the Portal.

We keep these logs because they matter to more than one person. They let you audit your own staff's use of the feature, they give a driver or hire customer a record of what happened and when, and they let us investigate if something goes wrong.

5.4 What we ask of you

Prior to fitting your vehicles with immobiliser capablity, you must:

  • Tell the people who drive or hire the vehicle that it exists and can be used remotely

  • Only use it for the purposes described in section 5.1

  • Not use it as a way to punish, coerce or pressure a driver, or to strand someone

  • Consider the safety of the driver and any passengers before immobilising a vehicle, including where the vehicle is stopped and whether the person has a way to get home

  • Keep the list of users with remote command permission current

We may suspend access to remote functions on an account if we have reasonable grounds to believe they are being used unsafely or unlawfully.

5.5 Law enforcement

Police and other agencies sometimes ask for a vehicle to be immobilised, usually during a theft investigation. We do not act on those requests ourselves. We direct the agency to the account holder, who decides whether to send the command, unless we are compelled by a warrant or court order to do otherwise.

6. Who we share information with

We do not sell, rent or trade your information to anyone.

Your device data and account data stay inside the TrackThis platform. We do not send it to advertisers, data brokers, insurers, the hardware manufacturer, or any other third party for their own use.

The only organisations that come into contact with your information are the service providers we use to run the business. Each of them acts on our instructions and is contractually limited in how it can handle the information:

  • Digital Ocean and Rackspace provide the physical infrastructure our servers run on. All servers are located in Australia. Your data on those servers is encrypted with keys held only by TrackThis, so these providers cannot read it.

  • Resend delivers transactional emails such as account invitations. Only the recipient email address and the content of the email pass through this service.

  • Xero holds the billing details listed in section 2 so that we can issue invoices.

  • Stripe processes card payments if you choose to pay by card.

  • Our telco supplies the SIM cards inside our devices. The SIMs are registered to TrackThis, not to you. Our telco handles the network connection but does not receive your name, account details or the contents of your location data.

  • Squarespace hosts our public website and records the visitor information described in section 2.

We may also disclose information where the law requires us to, for example in response to a court order, warrant or other lawful request from a regulator or law enforcement agency. We will only disclose what we are legally required to, and we will tell you if we are permitted to do so.

7. Where your information is stored

All TrackThis servers are located in Australia. Your device data, account data and Portal data are stored in Australia and are not transferred overseas. This data is encrypted, and the companies that supply our server infrastructure do not have the keys needed to read it. Only TrackThis can access it.

One of the service providers listed in section 6 operates outside Australia is Resend, which delivers our transactional emails. The only information that passes through Resend is the recipient's email address and the content of the message; for example an account invitation or a password reset. Resend does not receive device data, location data or command data.

Every other provider we use operates within Australia.

8. How we protect your information

We take security seriously. Device data and account data are encrypted in transit and at rest. Access to production systems is restricted to authorised TrackThis personnel, and the Portal uses account-based access controls so that each customer sees only their own data.

Remote command permission is separate from ordinary Portal access and must be granted deliberately by an account administrator to each user who needs it. Beyond that permission, sending a command requires no additional confirmation step or re-authentication; a signed-in user who has access to the asssets or vehicles and holds the permission can issue a command directly from the portal.

This makes it important that you manage that permission carefully. Grant it only to people who genuinely need it, review the list regularly, and remove access as soon as someone leaves or changes role. If a Portal session belonging to a permitted user is left open or falls into the wrong hands, that person can immobilise your vehicles.

No online system is completely secure. If we become aware of a data breach that is likely to cause serious harm to you, we will notify you and the Office of the Australian Information Commissioner as required by the Notifiable Data Breaches scheme.

9. How long we keep your information

While your account is active, we keep your device data and location history indefinitely so that you have a complete record for as long as you use the service. We do not truncate or delete historical data during your subscription.

Remote command logs are kept for the life of the account and are not deleted while the account is active, even if the vehicle or device is removed. This is deliberate: these records may be needed long after the event to resolve a dispute about what happened to a vehicle and who authorised it.

When you cancel your service or close your account, we permanently delete all data associated with your account by destroying your tenancy on our platform. This includes all device data, location history, user accounts and settings. We do not keep copies. Once deleted, this data cannot be recovered, so please export anything you need before closing your account.

Billing records held in Xero are retained for the period required by Australian tax and corporate law, which is generally seven years.

10. Your rights

You can ask us at any time to:

  • Tell you what personal information we hold about you

  • Correct information that is inaccurate or out of date

  • Delete your account and all associated data

Account holders can view and update their own contact details in the Portal. For anything else, email info@trackthis.com.au. We will respond within 30 days.

If you are an employee, contractor or hire customer of one of our business customers and you have a question about tracking data recorded about you, please contact that business first. They control the account and the data. If you cannot resolve it with them, you can contact us and we will help where we are able to.

If a vehicle you were driving or hiring was immobilised and you want to know who authorised it and when, this is also something to raise with the business that holds the account, since the record sits in their tenancy. If you cannot get an answer from them and you believe the function was misused, contact us and we will look into it.

11. Cookies

The Portal uses a small number of cookies that are necessary for it to work. These keep you logged in and remember settings such as your display preferences. They do not track you across other websites.

The public website uses cookies set by Squarespace for basic site function and visitor statistics. You can block cookies in your browser settings, but the Portal will not work without them.

12. Links to other websites

Our website and the Portal may contain links to other websites. We are not responsible for the privacy practices of those websites, and we recommend that you read their privacy policies.

13. Changes to this policy

We may update this policy from time to time. When we do, we will publish the new version on our website and update the date at the top of the page. If a change is significant, we will also notify account holders by email before it takes effect.

14. Complaints

If you believe we have mishandled your personal information, contact us at info@trackthis.com.au. We will investigate and respond within 30 days.

If you are not satisfied with our response, you can lodge a complaint with the Office of the Australian Information Commissioner (OAIC) at www.oaic.gov.au or by calling 1300 363 992.

15. Contact us

TrackThis Pty Ltd
ABN 55 631 495 906

5A Hartnett Close
Mulgrave, VIC 3169
Australia

Email: info@trackthis.com.au or fill out a form on our Contact Page.