Data Ethics Statement
Powour is in the business of understanding how people move — not who they are.
This statement explains how Powour handles the data that makes its platform work — verified movement data, patron personal information, and the institutional insights we derive from both. It is written in plain language for patrons, venue operators, sporting organisations, transport authorities, and anyone who wants to understand our data practices before engaging with us. It should be read alongside our Privacy Policy and Terms & Conditions, both available at powour.io.
Full legal privacy framework. Governs all personal data collection, use, and retention.
Patron app licence, reward economy, location consent, and dispute resolution.
Plain-language ethics principles — the ‘why’ behind both legal documents.
Who we are and what we do
Powour (Pelo Powr Pty Ltd, ABN 92 657 796 864, trading as Powour) is an Australian technology company headquartered in Sydney, New South Wales. We are a verified movement platform — infrastructure that converts everyday walking, cycling, and public transport into measurable commercial, health, and environmental outcomes through the Body + Planet dual-track mechanic.
Movement that rewards patrons. Verified active travel and exercise build the Body ring, earn Powour Coins through the Hour of Powour, and support personal health outcomes.
Movement that rewards the planet. Verified public transport and active travel build the Planet ring and generate auditable Scope 3 transport attribution data.
Powour operates across two connected audiences. Patrons use our app to earn value from their everyday movement. Institutional operators — venue operators, sporting organisations, transport authorities, and event operators — use our platform to derive commercial and operational insights from aggregated, anonymised patron movement data.
We are not a consumer surveillance platform. We are not a data broker. We are infrastructure — and that distinction defines everything about how we treat data.
The data we collect
Verified movement data. Location and locomotion signals — walking, cycling, transport mode detection — collected via the Powour app and, where applicable, through our technology partner Sentiance. This is the core input of the platform. Without it, movement cannot be verified, Powour Coins cannot be awarded, and Scope 3 attribution cannot be generated.
Identity and contact information. Name, email address, and phone number, collected when patrons register an Account.
App and usage data. Device type, operating system, session data, and interaction patterns, used to understand how the App is used and to improve it.
Event and venue engagement data. Arrival timing, transport mode, dwell patterns, and app engagement data collected when patrons use the App at or near a participating venue or event.
Communications data. Information patrons provide when contacting us, including support requests and feedback.
Biometric data, facial images, health records, financial account details, or any sensitive information as defined under the Privacy Act 1988 (Cth) — unless separately and explicitly consented to. We do not collect data passively or speculatively. Every data point collected has a stated purpose.
Why we collect movement data — the verification imperative
Powour collects precise location and locomotion data continuously — including when the app is running in the background. We are transparent about why, because the reason is fundamental to the platform’s integrity.
The Hour of Powour, Powour Coins, and the Scope 3 attribution outputs that underpin our government and transport authority partnerships are only meaningful if the movement they represent is real and verified. Estimated or self-reported movement cannot serve as the basis for a commercial reward, a government data supply, or a carbon reporting metric. Verification requires active location sensing. That is not a data-maximisation choice — it is the minimum data necessary to make the product honest.
Movement verification. Confirming walking, cycling, and public transport use to award Powour Coins and complete the Hour of Powour.
Scope 3 attribution. Generating verified transport mode-shift data for carbon reporting — supplied in aggregated, anonymised form to transport authority partners.
Venue arrival and precinct sensing. Detecting arrival timing and movement within a venue catchment to enable the Powour Hour match-day unlock.
Platform integrity. Detecting anomalous patterns that may indicate fraudulent movement claims — protecting the reward economy’s credibility for all patrons.
Patrons can disable location services at any time through the app or device settings. Doing so means movement cannot be verified and core platform features will not function. That trade-off is stated clearly in our Terms & Conditions, and patrons accept it knowingly when they choose to use the platform.
Data integrity and the reward economy
Powour Coins are not loyalty points issued on goodwill. They are earned through verified patron behaviour — movement that has been confirmed by the platform’s verification engine. This connection between data integrity and reward value is deliberate. It means:
The reward is real because the data is real. Powour Coins represent verified movement, not estimated or assumed activity. A patron who earns 200 Coins has genuinely completed the movement events that earned them.
Data accuracy protects every patron. Fraudulent movement claims — simulated location, tampered sensors — degrade the reward economy for genuine users. Our platform integrity measures exist to protect patrons as much as they protect Powour.
Scope 3 data is auditable because patron data is verified. The transport mode-shift data we supply to government and transport partners is defensible precisely because it traces back to verified individual movement events, aggregated and de-identified before supply. We do not supply government data based on estimates or proxies.
We do not monetise patron data through advertising or data sales. Powour’s commercial model is based on institutional operator partnerships, not on selling patron data to advertisers or data brokers. Powour Coins are redeemed at venues — not traded, converted to cash, or used to fund advertising.
Our core commitments
These are the principles that govern every data decision we make. They are not aspirational — they are operational. Where our Privacy Policy and Terms set the legal standard, this statement articulates the ethical intent behind them.
Powour does not sell personal information or behavioural data to third parties, advertisers, or data brokers — under any circumstances, in any form.
Data collected for one purpose is not repurposed without consent. Movement data collected in connection with a sporting event is not redirected to unrelated commercial uses. Scope 3 data supplied to transport partners is not used for patron profiling.
Our commercial outputs — dashboards, reports, Scope 3 datasets — operate on aggregated, anonymised data wherever technically possible. We are not building individual surveillance profiles. Institutional operators receive collective insights, not personal dossiers.
Institutional operators who access Powour’s platform are bound by data handling obligations under written Data Processing Agreements. We do not permit our partners to misuse patron data. Operators receive aggregated insights only — personally identified data is accessible only where the individual patron has expressly consented.
We collect only what is necessary to verify movement, deliver the platform, and generate institutional insights. We retain data only as long as it serves its stated purpose — verified movement data is retained for 24 months to support annual Scope 3 reporting cycles, not indefinitely.
Personal information is stored and transmitted with encryption, access controls, and the principle of least privilege applied across our systems and data layers. Contractual security obligations are imposed on all third-party service providers.
Your rights as a patron
Under the Privacy Act 1988 (Cth) and the Australian Privacy Principles, patrons have the following rights in relation to personal information Powour holds about them. To exercise any of these rights, contact us at privacy@powour.io.
Ask us what personal information we hold about you and request a copy. We will respond within 30 days.
If information we hold is inaccurate, out of date, or incomplete, ask us to correct it.
Ask us to delete your personal information, subject to legal retention obligations and active dispute resolution.
Withdraw consent to data collection at any time through the app settings or by contacting us. Withdrawing location consent limits core features.
Opt out of marketing communications at any time via the unsubscribe link in any message we send, or by contacting privacy@powour.io.
Lodge a complaint with us first. If unresolved, escalate to the OAIC at oaic.gov.au or by calling 1300 363 992.
Institutional operator relationships
Powour’s institutional partners — the organisations that access our platform to derive operational and commercial insights — are described below by type. No individual partner is named in this statement. Partner relationships are governed by written agreements; the ethical principles that apply to all of them are consistent and are set out here.
Access aggregated arrival, dwell, and precinct flow insights. Receive no raw individual patron data without express patron consent.
Receive mode-shift and patron flow data as buyers of attribution and event-day insights. Bound by Data Processing Agreements.
Access verified, aggregated Scope 3 transport attribution data under regulated data supply terms. The strongest data governance standards apply.
Use aggregated arrival and engagement data to manage congestion, timing, and commercial activation. No individual profiling.
In all institutional relationships, Powour acts in one of two legal roles. Where Powour collects patron data directly (via the app), Powour is the data controller — we determine the purpose and means of processing. Where Powour processes patron data on behalf of an institutional operator, Powour acts as a data processor — operating under the operator’s instructions and within contractually defined limits. In both roles, the same ethical commitments apply: aggregation before individual, purpose limitation, and no data sales.
Children and young people
Powour’s platform is designed for adults aged 16 and over. We are acutely aware that the venues, sporting events, and occasions at which Powour operates attract significant numbers of children and young people — including NRL matches, cricket, and football events. Our approach to minors reflects that context.
Age threshold. We do not knowingly collect personal information from individuals under 16 without verifiable parental or guardian consent.
Patron app. The Powour app requires users to confirm they are 16 or over at registration. A parent or guardian may register on behalf of a minor and accepts the Terms & Conditions on the minor’s behalf.
Venue and event context. Institutional operators who partner with Powour at events likely to attract minors are required under our operator agreements to ensure appropriate consent and age-verification processes are in place for their patron-facing communications.
Incident response. If we become aware that we have inadvertently collected personal information relating to a child under 16 without appropriate consent, we will delete it promptly. Contact privacy@powour.io immediately if you believe this has occurred.
Compliance and legal framework
Powour is an Australian company and operates under Australian law. Our data practices are designed to meet and where possible exceed the following obligations.
We comply with all 13 Australian Privacy Principles (APPs), including open and transparent management, purpose limitation, data quality, and security.
We are subject to the NDB Scheme under Part IIIC of the Privacy Act. In the event of an eligible data breach, we will notify the OAIC and affected individuals as soon as practicable.
Any commercial electronic messages we send to patrons comply with Australian spam law, including consent requirements and opt-out rights.
Nothing in our Terms or this statement limits patron rights under the ACL. Our liability framework is consistent with our Terms & Conditions v2.0.
Some service providers process data outside Australia. We take reasonable steps to ensure overseas recipients handle personal information consistently with the APPs.
Where Powour processes data relating to individuals outside Australia, we apply privacy standards at least equivalent to those required under Australian law.
Transparency, accountability and updates
This statement, our Privacy Policy, and our Terms & Conditions are the three documents that govern Powour’s relationship with the data it holds. They are designed to be read together. This statement is the plain-language ‘why’; the Privacy Policy is the legal ‘how’; the Terms & Conditions are the contractual framework for patrons.
All three documents are living instruments. As the platform evolves — new venue partnerships, new data uses, new regulatory obligations — we will update them. Material changes to any of the three documents will be communicated through the Powour app and published on powour.io. The version date on each document tells you when it was last reviewed. We commit to an annual review cycle at a minimum.
Powour’s leadership team is accountable for our data practices. If anything in this statement is unclear, we want to know. The right way to tell us is below.
Complaints and contact
If you have a concern about how Powour has handled your personal information, please contact our Privacy Officer first. We will acknowledge your complaint promptly and respond in writing within 30 days. If you are not satisfied with our response, you have the right to escalate to the Office of the Australian Information Commissioner (OAIC) at oaic.gov.au or on 1300 363 992.