Express consent statements

These are the only things a person actively opts into. They are deliberately separate and unbundled — each is its own choice, none is pre-ticked, and declining any of them does not stop a person from making a booking (except that we may not be able to meet a specific accessibility need without the relevant detail).

Design rules (do not break these — they are what make the consent valid):

• Not pre-ticked. Each opt-in starts unchecked. Silence/inaction is never consent.
• Unbundled. Never combine these into one "I agree to everything." Each is captured independently, per purpose.
• Informed. The person can see the Privacy Policy and what they're agreeing to, in plain language, before choosing.
• Voluntary. Booking a trip must never be conditional on marketing consent.
• Withdrawable. Each consent can be withdrawn later, as easily as it was given.
• Recorded. Capture what was shown (exact document versions), when, how, and what was chosen (see Consent record below).

Statement A1 — Sensitive information, given by the person themselves

Show only when the person indicates an accessibility, mobility, disability or health-related need relevant to their own trip. Never invite health details into free-text fields.

Sharing your accessibility or health-related needs. So we can provide your trip safely, we'd like to record any accessibility, mobility or health-related details that are relevant to your trip, and share them with the driver/operator assigned to your trip — only to the extent they need to carry the trip out. This is sensitive information, so we only record and use it with your consent.

☐ I consent to Jolly Frog Transfers (John Gentner, ABN 59 570 116 144) collecting these details and sharing them with my assigned driver/operator — and, where needed to arrange or bill my trip, with Jolly Frog Pty Ltd (ABN 38 637 828 874) — for the purpose of providing my trip.

Your accessibility or health details stay in your booking record for operational and complaint-handling purposes. You can decline, or withdraw later, in your account or by contacting privacy@jollyfrog.net.au. If you decline, we may not be able to meet a specific accessibility need.

Statement A2 — Sensitive information, given by a booker on a passenger's behalf

Show only when the person making the booking indicates an accessibility, mobility, disability or health-related need for someone else (the passenger). This is JD's signature third-party case: a parent, carer, assistant or colleague booking for the person travelling.

Sharing the passenger's accessibility or health-related needs. So we can provide [passenger]'s trip safely, we'd like to record the accessibility, mobility or health-related details you provide about them, and share those details with the driver/operator assigned to the trip — only to the extent needed to carry the trip out. This is sensitive information about another person, so we need you to confirm you can speak for them.

☐ I confirm that I am the [relationship — e.g. parent / guardian / carer / personal assistant / family member] of [passenger name], and that I have authority to provide these details and to consent on their behalf.

☐ On [passenger]'s behalf, I consent to Jolly Frog Transfers (John Gentner, ABN 59 570 116 144) collecting these details and sharing them with the assigned driver/operator — and, where needed to arrange or bill the trip, with Jolly Frog Pty Ltd (ABN 38 637 828 874) — for the purpose of providing the trip.

Please make sure [passenger] knows their details have been provided. If [passenger] later tells us something different — including asking us to stop using these details — their own instruction prevails. Withdraw any time via privacy@jollyfrog.net.au.

Both boxes are required for A2 — an on-behalf consent without the authority attestation is not captured. Record both the attestation and the stated relationship in the consent ledger. Where the passenger is a child travelling with the booking adult (our usual case), the parent/guardian relationship in the attestation is the capacity basis.

Statement B — Marketing communications

We send no marketing today — this statement is dormant until a marketing capability exists (building it is a material change; see README). When live: show as an optional opt-in, clearly separated from the booking, never required to complete one.

Stay in the loop (optional). ☐ Yes, I'd like Jolly Frog Transfers (John Gentner, ABN 59 570 116 144) to send me offers, news and updates by:   ☐ SMS   ☐ email

Each marketing message will identify Jolly Frog Transfers (ABN 59 570 116 144) and include an easy, free way to unsubscribe (reply STOP to any marketing SMS, or use the unsubscribe link in any marketing email). You can also unsubscribe any time via privacy@jollyfrog.net.au. This is separate from the operational messages we send to manage a trip you've booked (like confirmations), which you'll still receive.

Spam Act 2003 notes: marketing messages must identify the sender and carry a functional unsubscribe; honour STOP/unsubscribe promptly and keep the opt-out record permanently. Operational/transactional messages must stay strictly promo-free or they lose their exemption. Surveys/feedback requests are a separate category — lawyer to classify before any are sent. If we ever market to drivers (recruitment, bonuses, zones), that is a separate B-Driver opt-in with its own purpose code — never reuse the rider opt-in.

Statement C — Overseas disclosure acknowledgement (use only if relying on consent as the APP 8 basis)

Default position: cross-border disclosures to our providers rest on the "reasonable steps" basis (provider commitments + our assessment), in which case this statement is not used — the Privacy Policy §11 + collection notice disclosure are sufficient, and we remain accountable under APP 8.1. Include this statement only if the lawyer decides to rely on consent as the cross-border basis for a particular provider, because that path requires expressly warning that APP 8.1 accountability falls away. One basis per provider — never present this alongside the reasonable-steps basis for the same provider.

Some of our providers are overseas. Our booking assistant is powered by Anthropic (United States), and address lookup and sign-in use Google (the United States and other countries where Google operates). Normally, the Privacy Act makes us accountable for how overseas providers handle your information (APP 8.1). If you consent to us disclosing your information to them on this consent basis instead, that accountability protection will no longer apply — meaning we could not enforce Australian privacy standards against these providers directly if something went wrong. (They have their own privacy commitments; see their privacy policies.)

☐ I consent to Jolly Frog Transfers (John Gentner, ABN 59 570 116 144) disclosing my information to [provider] on this basis.

Consent record (what JD's ledger captures, and what JF receives)

Every choice above is recorded in JD's append-only consent ledger (Phase 2) so it can be proven later. At a minimum:

• who — the subject reference. Because bookings can be made without an account, the ledger supports user-scoped, customer-card-scoped and booking-scoped subjects. If someone consents on a passenger's behalf (A2), record: who they are, their stated relationship, the authority attestation, and whether the passenger is a minor or has limited capacity.
• what — which statement(s), and each granular choice (agreed / declined / not shown), per purpose.
• which version — version number + content hash of the consent statement, collection notice and privacy policy in force when shown, so the exact wording is replayable.
• when — UTC timestamp + timezone.
• how — capture channel and method: in-app accept / checkbox / verbal-recorded (phone bookings, per the verbal notice script — an internal document) / SMS reply / signed form.
• status — active / withdrawn / superseded (replaced by a newer record) / re-consent-pending (a material document change occurred while the consent was active and the person hasn't yet responded to the new statement). Each transition appends a new record referencing the one it replaces — never an in-place edit.

Purpose codes (frozen with the JF side — protocol v1.3.10): sensitive_accessibility, marketing_sms, marketing_email, overseas_consent_basis (only if Statement C is ever adopted). The transactional core is not a purpose code — it doesn't rest on consent. JD-internal purposes recorded in the ledger but never sent on the wire: contact_sharing_with_driver (the "My Drivers" share-my-details link) and privacy_notice_ack (a record that a person acknowledged the privacy policy / collection notice — evidence of notice, not a consent).

JD-ledger-only fields that never go on the wire: OnBehalfOfRef / OnBehalfOfAuthority and the relationship text, capacity/guardian fields, capture channel detail, withdrawal history. JF only ever needs the current receipt:

"consent": {
  "receiptId": "uuid",
  "version": "consent-statements@1.0+sha256:abc123",
  "acceptedAtUtc": "2026-07-01T03:25:00Z",
  "scope": [
    { "purpose": "sensitive_accessibility", "agreed": true },
    { "purpose": "marketing_sms", "agreed": false },
    { "purpose": "marketing_email", "agreed": true }
  ]
}

On withdrawal or supersession, JD emits a fresh receipt with the new decisions — a previously-emitted receipt is never mutated. JF treats the absence of a receipt as "unknown" — never as consent given.

Withdrawal

Withdrawing is a first-class action, as easy as the grant:

• Marketing (when it exists) — reply STOP, use the unsubscribe link, toggle it off in your account, or contact us; we stop promptly and keep the opt-out record permanently.
• Sensitive information — withdraw in your account or via privacy@jollyfrog.net.au; we stop using it for future trips (we may need to retain records of past trips where law requires).
• Driver contact sharing — unlink the driver in "My Drivers" at any time; the link is severed immediately.
• Conflicting instruction (third-party consent). If a passenger objects to information a booker/carer/parent consented to on their behalf, honour the passenger's own instruction immediately and log the conflict for review — the passenger prevails.
• A withdrawal supersedes the prior consent from that moment forward — it never retroactively edits the ledger, and past consent can't be relied on for handling after withdrawal.