Privacy Policy

1. About this Privacy Policy

In this Privacy Policy, Utilizer, we, us and our means Commercial Connections Australia Pty Ltd trading as Utilizer ABN 35 619 577 061.

This Privacy Policy explains how we collect, hold, use and disclose personal information in connection with our energy, utilities, procurement, brokerage, advisory, technology, customer support, marketing and related business activities.

We are bound by the Privacy Act 1988 (Cth) and the Australian Privacy Principles to the extent they apply to us. We may also have obligations under the Notifiable Data Breaches scheme, the Spam Act 2003 (Cth), the Do Not Call Register Act 2006 (Cth), energy laws, consumer laws and other applicable laws.

This policy applies to personal information we handle about customers, prospective customers, authorised representatives, business contacts, suppliers, contractors, website users, job applicants and other individuals who interact with us.

This policy does not generally apply to information about companies or other organisations unless that information identifies an individual, such as a director, employee, authorised representative or account contact.

2. What is personal information?

Personal information means information or an opinion about an identified individual, or an individual who is reasonably identifiable, whether the information or opinion is true or not and whether it is recorded in a material form or not.

Examples include your name, contact details, role, date of birth, identification information, account details, billing information, supply-address information, communications with us and information about the services you request or receive.

Sensitive information is a special category of personal information. It may include information about health, racial or ethnic origin, political opinions, religious beliefs, membership of associations or unions, criminal record and biometric information. We only collect sensitive information where it is reasonably necessary for our functions or activities and where you consent, or where collection is otherwise permitted by law.

3. What personal information we collect and hold

The kinds of personal information we may collect and hold include:

• name, title, role and contact details;
• business name, ABN, ACN and business contact information where it relates to an individual;
• mailing address, street address, site address, supply address and previous addresses;
• email address and telephone number;
• date of birth or age, where required for identity verification or service connection;
• job title, occupation, employer and authority to act for a business or account holder;
• information contained in letters of authority, consent forms, agreements, procurement documents, tenders, account-opening forms and related service documents;
• utility account information, including retailer, distributor, metering provider, NMI, MIRN, DPI, meter number, account number, site details, tariff, contract, quote, billing, payment, usage and consumption information;
• information about your energy needs, sites, operational profile, procurement preferences, sustainability objectives and service requirements;
• records of your enquiries, requests, complaints, instructions and communications with us;
• billing, payment and transaction records;
• marketing preferences and survey responses;
• website and technology information, including IP address, device information, browser type, pages visited, online identifiers, cookies, analytics information and interaction data;
• identity verification information, where required;
• credit-related, financial or payment information where lawful and reasonably necessary;
• recruitment information, including CVs, employment history, qualifications, references, interview notes and background-check information; and
• any other personal information you provide to us, or that we lawfully collect in connection with our business.

We aim to collect only the personal information that is reasonably necessary for our functions and activities.

4. How we collect personal information

We usually collect personal information directly from you. This may occur when you:

• contact us by phone, email, webform, SMS, post, social media, online channel or in person;
• use our website, portals, platforms, applications or digital services;
• request a quote, proposal, procurement process, connection, renewal, advisory service or other service;
• enter into an agreement, letter of authority or service arrangement with us;
• provide documents or information so we can act on your behalf;
• subscribe to updates, attend events, complete surveys or interact with marketing;
• apply for a role with us; or
• otherwise deal with us in the ordinary course of business.

We may also collect personal information from third parties where lawful and appropriate, including from:

• your employer, business, authorised representatives or advisers;
• energy retailers, distributors, metering providers, embedded network operators and other utilities participants;
• brokers, consultants, referral partners and business partners;
• data providers, comparison tools, publicly available databases and public registers;
• credit reporting bodies, payment processors, identity verification providers and debt recovery providers, where lawful;
• government agencies, regulators, law enforcement bodies and dispute resolution bodies;
• recruitment agencies, referees and background-check providers;
• technology, analytics, marketing, CRM and customer-support providers; and
• contractors and service providers who assist us to operate our business.

Where we collect personal information about you from someone else, we will take reasonable steps, where required, to make sure you are aware of the collection and the matters set out in this policy.

5. How we hold personal information

We may hold personal information in electronic records, cloud systems, CRM systems, document-management systems, email systems, databases, business applications, backups and, where required, physical files.

We take reasonable steps to protect personal information from misuse, interference, loss, unauthorised access, modification and disclosure.

6. If you do not provide personal information

You may choose not to provide personal information to us. However, if we cannot collect the information we reasonably need, we may not be able to:

• verify your identity or authority;
• provide a quote, recommendation, procurement process, connection, renewal, advisory service or other service;
• communicate with retailers, distributors, metering providers or other service providers on your behalf;
• respond to your enquiry or complaint;
• tailor services, content or communications to your needs;
• comply with legal, regulatory, accounting or operational requirements; or
• assess an application for employment or engagement.

7. Why we collect, hold, use and disclose personal information

We collect, hold, use and disclose personal information for purposes including:

• providing, managing, improving and supporting our products and services;
• assessing your energy, utility, procurement, billing, connection or account needs;
• obtaining, analysing, comparing, negotiating and presenting energy or utility offers;
• arranging or supporting services with retailers, distributors, metering providers and other service providers;
• verifying your identity, authority and eligibility to receive services;
• communicating with you by phone, email, SMS, mail, online channels or other methods;
• managing customer relationships, service delivery, records, billing and payments;
• providing information, insights, reporting, advice and recommendations;
• conducting market research, customer surveys, product development, analytics and business planning;
• improving our website, platforms, systems, security, service quality and customer experience;
• managing complaints, disputes, investigations, fraud prevention and compliance matters;
• marketing our services where permitted by law, including tailoring information we think may be relevant to you or your business;
• managing events, campaigns, promotions and referrals;
• assessing and managing job applications, contractor engagements and supplier relationships;
• conducting due diligence, business transactions, audits, reporting and corporate governance activities;
• complying with laws, regulations, court orders, regulator requests and lawful directions; and
• any other purpose you consent to, or that is required or permitted by law.

We may also use de-identified or aggregated information for analytics, reporting, benchmarking, product development, market intelligence and service improvement. Where information is properly de-identified, it is not personal information.

8. Cookies, website data and analytics

We use cookies, pixels, tags, analytics tools and similar technologies on our website and digital services.

These technologies may help us:

• recognise your browser or device;
• understand website traffic and user behaviour;
• improve website performance, content and usability;
• measure campaigns and service interest;
• personalise content or communications; and
• maintain security and detect misuse.

You can manage cookies through your browser settings. Some website features may not work properly if cookies are disabled.

Where analytics or digital advertising technologies collect information that identifies you or makes you reasonably identifiable, we handle that information as personal information in accordance with this policy.

Advertising and remarketing

We use the LinkedIn Insight Tag and Google Ads to measure campaign performance and to show you relevant ads on other platforms (remarketing). These set cookies that identify your browser across sites.

We use Apollo.io for business-to-business visitor identification: it matches the network a visit comes from to publicly available company information, so we can see which organisations are interested in our services. Apollo.io is loaded through Google Tag Manager and only runs subject to your consent choices.

Product analytics and chat

We use Zoho PageSense to analyse on-page behaviour (such as heatmaps and aggregate interaction data) and Zoho SalesIQ to provide live chat support.

If you use the live chat, the conversation is recorded and stored by Zoho on our behalf, together with your browser and page information, so our team can respond and follow up. Starting a chat means you agree to that recording. Please don’t share sensitive information in the chat. The chat may first be answered by an automated assistant before a person joins.

Your choices

When you first visit, our cookie notice lets you accept or switch off non-essential cookies. For visitors in Australia and most other countries, analytics and advertising cookies are on unless you switch them off; visitors in the EEA, UK and Switzerland are opted out by default until they accept. You can change your choice at any time with the Cookie settings link in the footer of every page, and you can also control cookies through your browser settings.

Global Privacy Control. If your browser sends a Global Privacy Control (GPC) signal, we treat it as a request to opt out: analytics and advertising cookies stay off unless you accept them on our cookie notice.

Do not sell or share my personal information. We do not sell your personal information. To opt out of the sharing of your browsing data with our advertising partners (targeted advertising), choose “Essential only” in Cookie settings, turn on GPC in your browser, or email us at the address below.

If you arrive from a campaign link, we store the campaign parameters from that link in a first-party cookie (uz_attr) for 90 days. It is only used to record how you found us if you later submit an enquiry form, and it is not shared with third parties.

Third-party services

We use Google Tag Manager to manage tags, and Google Analytics 4 to understand how the site is used (pages viewed, approximate location, device). This helps us improve the site.

The non-essential tracking technologies we use are:

• Google Analytics 4 (Google): site usage analytics.
• Google Ads (Google): ad conversion measurement and remarketing.
• Meta Pixel (Meta Platforms, also called the Facebook Pixel): ad conversion measurement and remarketing on Facebook and Instagram.
• LinkedIn Insight Tag (LinkedIn): ad measurement and remarketing.
• Apollo.io (Apollo IO): business visitor identification.
• Zoho PageSense (Zoho): heatmaps and on-page analytics.
• Zoho SalesIQ (Zoho): live chat.

Essential cookies (such as the uz_consent cookie that remembers your cookie choice) are always on because the site needs them to work.

Our enquiry forms use Cloudflare Turnstile to check that a submission comes from a person rather than a bot. It runs when a form is shown, processes technical information about your browser and device to do that check, and is not used for advertising or tracking. Because it protects the forms from spam and abuse, it is treated as essential and is not affected by your cookie choice.

The services above (Google, Meta, LinkedIn, Apollo.io, Zoho, Cloudflare) process data under their own privacy policies.

9. Technology-assisted tools, AI and automated decisions

We use analytics, automation, document-processing tools and artificial intelligence (AI) tools to help us process information, manage enquiries, analyse energy usage and invoices, compare offers, draft documents, support customer service, detect errors and improve our operations.

Where these tools involve personal information, we use them responsibly, securely and consistently with this policy and our internal AI Use Policy. We do not enter sensitive information into general-purpose AI tools, and some AI tools we use are provided by suppliers that process information outside Australia (see Overseas disclosure and storage).

How we use AI in our work

We use commercial AI tools to help our staff research, analyse data and draft reports, proposals, tender responses and other documents. Our staff review all AI-assisted work before it is provided to clients or anyone else, and remain responsible for its accuracy. AI tools do not make recommendations or decisions on our behalf.

We use approved business AI tools with model training switched off, so suppliers do not use our information to train their models. Client information is used in AI tools only as our confidentiality obligations and the client’s contract allow, and we follow any client’s requirements on AI use. We do not mark individual documents as AI-assisted; our Disclaimer explains how we use AI in our work.

Decisions that use computer programs

Some of our computer programs use personal information to do things that are substantially and directly related to decisions we make, but a person makes the decision. These are:

• validating energy invoices and preparing payment files for clients: our platform extracts and checks invoice data, which may include the names and contact or account details of individuals such as sole traders or client contacts, and flags exceptions; our staff review exceptions and approve every payment file;
• comparing energy offers and preparing recommendations: our tools analyse consumption, tariff and site data, which may relate to an identifiable individual where the client is a sole trader or the site is a residence; our staff review the analysis and make the recommendation;
• handling enquiries and support requests: tools may sort, summarise or suggest responses to enquiries using the enquirer’s name, contact details and message; our staff decide how the enquiry is handled.

We do not make decisions that could significantly affect an individual’s rights or interests solely by the operation of a computer program. If that changes, we will update this policy before we do so.

Meeting transcription and recording

We may use approved tools to transcribe or record meetings and calls. A transcript may include your name, your voice and what you say. We tell participants before we start and do not transcribe or record if anyone objects. Transcripts may be stored by our suppliers outside Australia (see Overseas disclosure and storage) and are deleted once our notes of the meeting are saved.

10. Direct marketing

We may send you marketing communications about products, services, insights, events, offers or information that we consider may be relevant to you or your business.

Marketing communications may be sent by email, SMS, phone, mail, online advertising or other channels, in accordance with applicable laws.

You may opt out of marketing communications at any time by:

• using the unsubscribe facility in the communication;
• replying with the relevant opt-out instruction, where available; or
• contacting us using the details at the end of this policy.

We will not charge you for opting out. We will take reasonable steps to action opt-out requests within a reasonable period and, for electronic marketing, within 5 business days in accordance with applicable spam laws.

Even if you opt out of marketing, we may still send you non-marketing communications, including service, transactional, safety, legal, account, billing and operational messages.

11. Who we disclose personal information to

We may disclose personal information to:

• our employees, officers, contractors and related entities;
• energy retailers, distributors, metering providers, embedded network operators and other utilities market participants;
• brokers, consultants, agents, referral partners and business partners;
• technology, hosting, CRM, cloud, communications, analytics, cybersecurity, data storage and software providers;
• payment processors, billing providers, credit reporting bodies and debt recovery providers, where lawful;
• mailing houses, printers, couriers, call centres and customer-support providers;
• professional advisers, including lawyers, accountants, auditors, insurers, bankers and consultants;
• regulators, government agencies, law enforcement bodies, courts, tribunals and dispute resolution bodies;
• prospective purchasers, investors, financiers or advisers in connection with a business sale, restructure, merger, investment, financing, transfer or due diligence process;
• third parties you authorise us to disclose information to; and
• any other person where required or permitted by law.

We do not sell personal information.

12. Overseas disclosure and storage

We are based in Australia and our business systems, where we store the personal information we hold, are hosted in Australia. Some approved AI and meeting transcription tools process or store information outside Australia, as set out below. Some of our team members and service providers access our systems remotely from outside Australia, through virtual desktops that are also hosted in Australia; personal information is not stored on their devices or on systems outside Australia. Because that remote access occurs from outside Australia, we treat it as a disclosure to an overseas recipient.

This may occur where we use cloud, software, analytics, customer relationship management, communications, cybersecurity, support, document-processing or other technology providers with operations or infrastructure outside Australia.

Because our providers and their support or processing locations may change from time to time, it is not always practicable to list every country in which overseas recipients may be located. Countries may include Malaysia (remote access to our systems) and, where a technology provider supports or processes information from outside Australia, the United States (including AI tools we use), New Zealand, the United Kingdom, countries in the European Economic Area and Singapore.

Where we disclose personal information overseas, we will take reasonable steps required by the Privacy Act to protect that information, unless an exception applies.

13. Security of personal information

We take reasonable steps to protect personal information we hold from misuse, interference, loss, unauthorised access, modification and disclosure.

These steps may include:

• access controls and user permissions;
• password, authentication and account-security measures;
• secure cloud and server environments;
• encryption where appropriate;
• network, endpoint and email security controls;
• staff training and confidentiality obligations;
• vendor due diligence and contractual controls;
• monitoring, logging and incident-response processes;
• secure document handling and disposal; and
• regular review of systems, policies and processes.

No method of transmission or storage is completely secure. If you suspect misuse, loss, unauthorised access or unauthorised disclosure of your personal information, please contact us immediately.

14. Data breaches

If we suspect a data breach involving personal information, we will assess the incident promptly.

Where we determine that an eligible data breach has occurred under the Notifiable Data Breaches scheme, we will notify affected individuals and the Office of the Australian Information Commissioner where required by law.

We will also take steps to contain, investigate and remediate the breach and reduce the risk of further harm.

15. Accuracy, access and correction

We take reasonable steps to make sure personal information we collect, use and disclose is accurate, up to date, complete and relevant, having regard to the purpose of the handling.

You may request access to personal information we hold about you. You may also ask us to correct information you believe is inaccurate, out of date, incomplete, irrelevant or misleading.

We may ask you to verify your identity before responding. We will respond within a reasonable period.

We will not charge you for making an access or correction request. We may charge a reasonable fee for giving access where permitted by law, but we will tell you before doing so.

In some cases, we may refuse access or correction where permitted by law. If we refuse, we will give you written reasons where required and explain available complaint options.

16. Anonymity and pseudonymity

Where lawful and practicable, you may deal with us anonymously or using a pseudonym. However, in many cases we will need to identify you or confirm your authority to provide services, communicate with energy market participants, manage accounts, respond to enquiries or comply with legal obligations.

17. Retention and destruction

We keep personal information for as long as reasonably necessary for the purposes described in this policy, including to provide services, manage customer relationships, comply with legal and accounting obligations, resolve disputes, maintain business records and enforce agreements.

When personal information is no longer required, we will take reasonable steps to destroy it or de-identify it, unless we are required or permitted by law to retain it.

18. Third-party websites and services

Our website, platforms, emails or documents may contain links to third-party websites or services.

We are not responsible for the privacy practices, content, security or terms of third-party websites or services. You should review their privacy policies before providing personal information to them.

19. Children and young people

Our services are directed to businesses and adults. We do not knowingly target or collect personal information from children.

If we become aware that we have collected personal information from a child without appropriate authority or lawful basis, we will take reasonable steps to delete or de-identify the information, unless we are required or permitted by law to retain it.

20. Complaints

If you have a question, concern or complaint about how we handle personal information, please contact our Privacy Officer using the details below.

Please include enough detail for us to understand and investigate the issue.

We will acknowledge your complaint within a reasonable period and aim to respond within 30 days. If we need more time, we will let you know.

If you are not satisfied with our response, you may contact the Office of the Australian Information Commissioner.

21. Contact us

Privacy Officer
Commercial Connections Australia Pty Ltd trading as Utilizer
Phone: 1300 501 000
Email: support@utilizer.com.au
Website: utilizer.com.au
Address: Level 7, 600 Bourke St, Melbourne VIC 3000

22. Changes to this Privacy Policy

We may update this Privacy Policy from time to time to reflect changes to law, technology, our business operations or our information-handling practices.

The current version will be made available on our website. The version published on our website will apply from the date stated in that version.