Consumer Data Right (CDR) Policy

This CDR Policy explains how Hanno (operated by Desert Rose Investments Pty Ltd, ABN 93 672 354 022) handles data collected under the Consumer Data Right (CDR). It is required by the Competition and Consumer (Consumer Data Right) Rules 2020 and sits alongside our Privacy Statement. If anything here conflicts with the Privacy Statement in relation to CDR data, this policy prevails.

Status: Hanno’s CDR bank-feed access is not yet live. We are currently applying to operate as a CDR representative of Fiskil (an Accredited Data Recipient) and have not received approval yet. We do not collect any CDR data today. This policy describes how we will handle CDR data once that access is approved and enabled.

We are applying to access CDR data as a CDR representative of an Accredited Data Recipient (our prospective principal), Fiskil (Fiskil Pty Ltd). Once that arrangement is approved, we will adopt and comply with our principal’s CDR policy, and this policy must be read together with it.

1. What CDR data we collect and why

Once our CDR bank feeds are live, we will collect - with your consent - bank-account details and transaction data through the CDR. We will collect only what is reasonably needed for the purposes you consent to - reconciliation, bookkeeping and financial reporting within Hanno (data minimisation). We will not collect CDR data for any other purpose.

2. Your consent

We will collect CDR data only with your express, informed consent. Consents will be specific (limited to the data and purposes shown to you) and time-limited. You will be able to review, manage or withdraw your consents at any time through Hanno. Withdrawing consent does not affect data already lawfully processed before withdrawal.

3. How we use and disclose CDR data

We use CDR data only for the purposes you consented to. We do not use it for direct marketing, do not sell it, and do not disclose it to third parties except:

• to outsourced service providers that help us deliver the service, bound by contract to CDR-consistent obligations - currently Supabase (database, hosted in Australia), Railway (application hosting) and Anthropic (AI features); and
• where required or authorised by law.

Where CDR data is processed by our AI provider to generate suggestions or answer your questions, it is processed under a Data Processing Addendum, is not used to train any model, and is retained for no more than 30 days before deletion. CDR data is never used to improve the Service or train models.

4. How we store and protect CDR data

CDR access is token-based and read-only - we never see or store your bank login credentials. We protect CDR data with encryption in transit and at rest, access controls and audit logging, and we host CDR data in Australia (Supabase, Sydney region). Our security controls are designed to meet the CDR information security requirements, relying on our principal’s accreditation.

5. Deletion and de-identification

When your consent is withdrawn or expires, or the CDR data is no longer needed for the consented purpose, we delete or de-identify it according to the election you made when you gave consent, and we instruct our bank-feed provider to do the same. Where we are required by law to retain certain records, we retain only what the law requires.

6. Your CDR rights

• Give, manage and withdraw consent at any time.
• Elect whether redundant CDR data is deleted or de-identified.
• Access and seek correction of the CDR data we hold about you.
• Make a complaint (see below).

7. Complaints

If you have a concern about how we handle your CDR data, contact us first at hello@hannohanno.com; we will acknowledge and respond within the timeframes required by the CDR Rules. You may also complain to our accredited principal, or to the Office of the Australian Information Commissioner (OAIC) at oaic.gov.au.

8. Our principal’s CDR policy

As a CDR representative, we adopt the CDR policy of our accredited principal. You can read it here: Fiskil CDR Policy.

9. Contact us

Hanno (Desert Rose Investments Pty Ltd, ABN 93 672 354 022) - hello@hannohanno.com.

This policy will be finalised with our accredited principal (including the exact principal entity and accreditation details) before live CDR access is enabled, and should be reviewed by legal counsel as part of the CDR representative arrangement.