Privacy policy

1. General

This website (Site) is operated by The Sheet Society Pty Ltd (ACN 618 285 886) (we, us or our).

Your privacy is important to us and we are committed to protecting your personal information in accordance with the Privacy Laws. Privacy Laws means the Privacy Act 1988 (Cth), including the Australian Privacy Principles, and any other applicable privacy laws, including the GDPR where applicable.

This policy outlines how and when we collect, process, use, share, store, disclose, alter and destroy your personal information and applies to all personal information collected, including when you access the Site and in relation to the products and services we offer. 

We reserve the right to review, amend, update, or change our Privacy Policy from time to time to reflect its practices and obligations under the Privacy Laws.

If you have any questions about this policy, you can contact us using the details below.

2. What personal information we collect

Personal information is information or an opinion about an identified individual or an individual who is reasonably identifiable, whether or not the information is true or recorded in a material form.

This may include:

1. your name, date of birth, billing address, shipping address, phone number, email address, occupation, order and transaction history, styling preferences, financial and payment information (such as credit card number and bank account details), method of payment and any additional information required for user authentication processes or order completion (Order Information); 
2. information about your web browser, your internet protocol (IP) address and approximate location, your internet service provider, the cookies installed on your device, the date and time (including time zone) of your visit, the links, pages and products you have access on the Site, the websites and search terms that referred you to the Site and that you accessed after exiting the Site and other information related to your interactions with the Site (Device Information); 
3. where you visit one of our retail stores, we may collect aggregated information about visitor numbers and store traffic using people-counting technology. This information is collected on an anonymised basis and is not used to identify individuals or through facial recognition or other biometric technologies;
4. information about the products or services you order or enquire about, including how the products or services are used; and
5. any other information relating to you that you provide to us, including the information you provide by email, social media or telephone, in-store interactions (including at the point of sale), through customer account or mailing list sign-ups, surveys, competition forms, customer activations, special events and other promotional activities we may run from time to time.

We collect and use personal information from customers, authorised users or visitors of the Site, staff (actual or prospective), purchasers of our products or services, and any other individual who interacts with us.

We do not intend to collect your sensitive information (as defined by the Privacy Laws).  However, some of our services are automated and we may not recognise that you have accidentally provided us with sensitive information. If you have accidentally sent us sensitive information, please contact us using the details below.

3. How we collect personal information

We collect your personal information in several ways, including: 

1. through your use, or orders, of our products or services (and our records of these); 
2. when you visit or interact with our stores or the Site, contact us, make a purchase, sign up to our mailing list or customer database, participate in an in-store activation or event, or complete any forms or documents in relation to our products or services;
3. when you participate in our surveys, competitions, promotions, questionnaires or other customer activations, events or promotional activities we may run from time to time, whether online or in-store;  
4. from third parties (which we discuss further in clause 7 of this policy); and 
5. from publicly available sources of information. 

The personal information we collect will track and enhance your use of the Site or our products or services and assist us in providing a better service to you.

We will only collect personal information that is necessary for one or more of our functions or for a purpose outlined in this policy or otherwise disclosed to you.

By providing your personal information to us, you acknowledge that you are authorised to provide such information to us.

4. How we notify you when we collect your personal information

When we collect personal information directly from you, we will take reasonable steps to notify you at, before, or as soon as practicable after, the time of collection including through this Privacy Policy and collection notices. 

Where personal information is collected automatically, notice may only be provided through this Privacy Policy and website notices such as browser pop-ups. 

When we collect your personal information from your authorised representative, we will take reasonable steps to make sure you are aware of the collection.

If you provide us with personal information about another individual (as their authorised representative), we rely on you to: 

1. inform them that you are providing their personal information to us; and  
2. advise them that they can contact us for further information. 

You must take reasonable steps to ensure the individual is aware of, and consents to, the matters outlined in this policy, including that their personal information is being collected, the purposes for which that information is being collected, the intended recipients of that information, the individual's right to access that information, and who we are and how to contact us. 

As a collection notice is specific to a particular collection of personal information, it will provide more specific information about our information-handling practices than this policy. 

This policy is subject to any specific provisions contained in our collection notices and the terms and conditions of any offers, products and services. We therefore encourage you to read those provisions carefully.

Upon our request, you must also assist us with any requests by the individual to access or update the personal information you have collected from them and provided to us.

5. Legal basis for processing personal information (EU Only)

This clause applies only to the extent that the GDPR applies to our processing of your personal information. 

We rely on several legal bases under the GDPR to collect, process, store, use and disclose the personal information of individuals residing in the European Union (EU), including:

1. consent - where you have freely and expressly consented to the collection, use, storage, processing and disclosure of your personal information for a specific purpose. The provision of personal information to us is voluntary. However, if you do not provide your personal information to us, we may not be able to provide you with access to, and use of, our products, services or Site. You may withdraw your consent at any time by contacting us using the details below;
2. contract performance - where the collection, use, storage, processing and disclosure of your personal information is necessary for the performance of a contract to which you are a party. For example, when collection and use is necessary to fulfil our obligations to provide you with access to, and use of, our products, services or Site;
3. our legitimate business interests - where we need to do so for legitimate business interests, including:
   • providing, operating and improving our products, services or Site;
   • marketing new promotions, deals, offers, competitions, products, services provided by us or our Authorised Affiliates that we consider may interest or benefit you;
   • managing, analysing, understanding and developing our relationship with you; and
   • responding to your queries or complaints; and
4. compliance with legal obligations - where there is a legal obligation to collect, use, store, process or disclose your personal information. For example, we may be obliged to disclose your personal information by reason of any applicable law, regulation or court order and/or to protect our interests and legal rights.

6. How we use your personal information

We only collect, hold, use, process and disclose your personal information for the purposes for which it is collected and any other purposes permitted by law. 

In particular, we use and process your personal information to: 

1. provide you with our products or services, or the Site;  
2. fulfill orders placed via the Site, including processing your payment information, arranging for shipping, and providing you with invoices and/or order confirmations;
3. improve, develop and manage our products, services and the Site;
4. operate, maintain, test and upgrade our systems; 
5. notify you of important changes to our Site; and
6. notify you of opportunities and promotions we think you might be interested in, including new product or service offerings.

We may also use and process your personal information: 

1. to customise the advertising and content on our Site;
2. to communicate with you and provide information that we think may interest or benefit you, including information about our products or services, the Site, offers, competitions, promotions, events and surveys;
3. to charge and bill you for our products and services;
4. to verify your identity;
5. to conduct fraud, risk reduction and creditworthiness checks;
6. to perform research and analysis about our products, services and the Site; 
7. to comply with regulatory or other legal requirements;
8. for any purpose to which you have consented; and
9. for any other purpose notified to you at the time of collection.

In the event of a merger, acquisition or sale of the whole or part of our business or assets, we reserve the right to transfer your personal information as part of the transaction, without your consent or notice to you.

7. Disclosure of personal information to third parties

We may provide your personal information to: 

1. our employees, related entities, business partners, third party contractors, suppliers and agents from time to time for the purpose of delivering, providing and administering our products, services or Site; and
2. third party service providers who process or use your personal information for the purpose of performing functions on our behalf, but may not process or use such information for any other purpose. 

Examples of these third party service providers include marketing and analysis organisations, financial and credit card institutions to process payments, billing providers and payment gateways, hosting companies, web developers, internet service providers, customer service providers, customer support specialists, fulfilment and delivery companies, external business advisors (including auditors and lawyers), our insurer, and research and data analysis firms, (collectively, Authorised Affiliates). 

Our third-party service providers may include providers of:

• website hosting and cloud services; 
• ecommerce platforms and payment processing services; 
• order fulfilment and delivery services; 
• customer relationship management and customer support services; 
• marketing, advertising and analytics services; 
• information technology and cybersecurity services; 
• professional advisers, including legal, accounting, audit and insurance advisers; and 
• other service providers who assist us in operating our business. 

These service providers process personal information only to the extent reasonably necessary to provide services to us or as otherwise permitted by law.

When we disclose your personal information to our third-party service providers and other recipients described in this Privacy Policy, we take reasonable steps to ensure they handle your personal information in a manner consistent with applicable Privacy Laws and only for the purposes for which it is disclosed.

In some circumstances, our third-party service providers may also collect personal information on our behalf or provide us with personal information they have collected in connection with the services they provide to us.

We may also disclose your personal information where required or authorised by law, including to comply with a legal obligation, court order, regulatory requirement or lawful request from a government authority.

8. Overseas disclosure of personal information

Our Authorised Affiliates may be located in or outside Australia including in the European Union and the United States and other countries from time to time, whose laws are not recognised by the European Commission as providing an adequate level of protection to personal information. 

Where we do transfer your personal information to our overseas Authorised Affiliates, we take steps reasonably necessary to ensure that: 

1. there is a legal basis for the transfer of your personal information; and
2. your personal information is treated securely (including, using reasonable endeavours to ensure that each overseas Authorised Affiliate receiving your personal information are bound by Standard Contractual Clauses approved by the European Commission, which can be found at https://commission.europa.eu/law/law-topic/data-protection/international-dimension-data-protection/standard-contractual-clauses-scc_en).

By accessing or using our products, services or Site, or providing your personal information to us, you explicitly and freely consent to the transfer of your personal information to our overseas Authorised Affiliates.

If you do not wish to receive information from any of our Authorised Affiliates, please let us know using the details below. 

We will not disclose your personal information to any third party (other than our Authorised Affiliates) without your written consent, unless: 

1. we are required or authorised by the relevant Privacy Laws; 
2. it is necessary to comply with any applicable law, regulation, legal process, governmental request or industry code or standard;
3. we are permitted to under this policy; or 
4. such disclosure is, in our opinion, reasonably necessary to protect our rights or property, avoid injury to any person or ensure the proper functioning of the Site. 

This policy only covers the use and disclosure of information we collect from you. The use of your personal information by any third party is governed by their privacy policies and is not within our control. 

If we collect any information that is not referred to or contemplated in this policy, we will give you notification of the collection at the time that we or one of our services collects the information.

9. Storage and security 

a. Protecting your personal information

We take reasonable steps in the circumstances to keep your personal information safe and secure. We use a combination of technical, administrative and physical controls to protect and maintain the security of your personal information. 

Our officers, employees, agents and third party contractors are expected to observe the confidentiality of your personal information.

Wherever possible, we procure that Authorised Affiliates who have access to your personal information take reasonable steps to:

1. protect and maintain the security of your personal information; and 
2. comply with the relevant APPs when your accessing and using your personal information. 

b. No guarantee

The transmission of information via the internet is not completely secure. While we do our best to protect your personal information, we cannot guarantee the security of any personal information transmitted through the Site. 

You provide your personal information to us at your own risk and, to the extent permitted by law, we are not responsible for any unauthorised access to, and disclosure of, your personal information.

c. Destruction of personal information

We will destroy or de-identify personal information where it is no longer required, unless we are required or authorised by law to retain the information. 

To ensure we do not keep your personal information for longer than necessary, we consider several criteria, including:

1. the purpose for which we are holding your personal information; 
2. legal or regulatory obligations in relation to your personal information (eg financial reporting obligations);
3. whether we have an ongoing relationship (eg you have an account with us or our brands, you receive ongoing marketing communications or regularly visit or use our products, services or Site); 
4. any specific requests you have made regarding the deletion of your personal information; and  
5. our legitimate business interests (eg defending claims, statistical analysis or research).  

d. Access to personal information

You can access, change or delete your personal information at any time by contacting us at hello@thesheetsociety.com and we will help you access or change your personal information. 

Under some circumstances you can: 

1. request the restriction of processing relating to your personal information; 
2. object to the processing of your personal information; or 
3. request to receive a portable copy of your personal information.  

To exercise any of these rights, please contact us at hello@thesheetsociety.com.

We may ask you for further information to be able to verify your identity or the reasons for your request. Provided we have received all necessary information from you, we will endeavour to provide you with an answer within 30 days of receipt of your request.

e. Storage of your information

The information you provide to us will be stored by us for no longer than legally required following your information request or following the closure of your account.

f. Suspected data security

We have a comprehensive data breach notification policy and response plan (Response Plan), which outlines the steps our personnel are required to take in the event of a data breach. This allows us to identify and deal with a data breach quickly to mitigate any harm that may result.

As part of the Response Plan, we will notify you as soon as practicable if we:

1. discover or suspect that your personal information has been lost, accessed by, or disclosed to, any unauthorised person or in any unauthorised manner; 
2. believe that you are likely to suffer serious harm as a result; and
3. are unable to prevent the likely risk of harm. 

If you would like more information about our Response Plan, please contact us using the details below.

10. Direct marketing

a. Your consent

At the time of accessing, or using, our products, services, Site or otherwise from time to time, we may seek your express consent, including by requesting that you tick the appropriate check box when providing us with your personal information, for us to send you marketing or promotional materials and other information. 

Where we have obtained your prior consent or are otherwise permitted under the GDPR, we may, from time to time, use your personal information to send you information about the promotions, deals, competitions, products or services we offer, and any other information that we consider may be relevant to you.

These communications may continue, even after you stop using our products or services. 

b. Communication channels

We may send this information to you via the communication channels specified at the time you provide your consent. 

These communication channels include mail, email, SMS telephone, digital marketing using Google, Facebook and Instagram or by customising online content and displaying advertising on our Site.

c. Opting-out

You can opt out of receiving these communications by:  

1. contacting us using the details below; or
2. using the unsubscribe function in the email or SMS.

You may re-subscribe at any time by re-registering.

11. Links to other sites from our Site

Our Site may contain hyperlinks or banner advertising to or from third-party websites such as Shopify. 

We do not endorse any of these third parties, their products or services, or the content on these websites. 

These websites are not subject to our privacy standards, policies and procedures. Therefore, we recommend that you make your own enquires about their privacy practices and review any applicable privacy policy of any third-party website you visit. 

We are in no way responsible for the privacy practices or content of these third-party websites.

12. Cookies and other technologies

We may collect information when you access and use our Site by utilising features and technologies of your internet browser, including cookies, log files, web beacons, tags, pixels and similar technologies. 

The types of information we collect using cookies and other technologies includes but is not limited to, Device Information.

The technologies we use to collect personal information include:

1. Cookies: Data files that enables us to track and target your preferences. They often include a unique identifier. For more information about cookies, and how to disable cookies, visit http://www.allaboutcookies.org.
2. Log Files: Track actions occurring on the Site and collect a range of Device Information. 
3. Web beacons, tags and pixels and similar technologies: Electronic files used to record information about how you browse the Site. 
4. Third Parties: Authorised Affiliates including Impact, Meta and Google collect personal information using cookies and similar technologies from the Site. Third parties may share this information with other parties where necessary for the provision of their services, for instance, where such other parties process personal information on their behalf. 

We use personal information collected through cookies and similar technologies to: 

1. enable us to identify you as a return user and personalise and enhance your experience and use of our Site including through the provision of personalised advertising services on third party websites and platforms (remarketing); and
2. help us improve our service to you when you access our Site and to ensure that our Site remains easy to use and navigate including by producing analytics to help us understand how our customers use the site.

Most browsers are initially set up to accept cookies. However, you can reset your browser to refuse all cookies or warn you before accepting cookies. 

If you reject or disable our cookies or similar technologies, you may still use the Site but may only have limited functionality of the Site. 

We may also use your IP address to analyse trends, administer the Site and other websites we operate, track traffic patterns and gather demographic information. 

Your IP address and other personal information may be used for credit fraud protection and risk reduction.

13. Your rights in relation to privacy

Under the GDPR, you have a number of important rights. We must ensure your information is:

1. processed lawfully, fairly and transparently;
2. collected for specified, explicit and legitimate purposes (and processed accordingly);
3. adequate, relevant and limited to what is necessary for purpose;
4. accurate;
5. stored in a minimal way; and
6. processed to ensure integrity and confidentiality.

Subject to certain exceptions, you have the following rights:

You can exercise any of these rights by contacting us using the details below.

We also have further obligations to you under the GDPR in relation to how we look after and treat your information. You can find further details here.

b. Access rights

We will use our reasonable endeavours to keep your personal information accurate, up-to-date and complete.

You have the right to access any personal information we hold about you, subject to some exceptions provided by relevant Privacy Laws. 

You can access, or request that we correct, your personal information by writing to us using the details below. We may require proof of identity. 

If we do not allow you to access any part of your personal information, we will tell you why in writing. 

We will not charge you for requesting access to your personal information, but may charge you for our reasonable costs in supplying you with access to this information.

We will endeavour to respond to your request for access or correction within 1 month from your

14. Children's policy

We do not knowingly collect personal information from children where parental or guardian consent is required under applicable privacy laws. Where the GDPR applies, we do not knowingly collect or process personal information relating to children under the age required by the GDPR (which may vary between 13 and 16 years depending on the relevant EU member state) without the consent of a person holding parental responsibility for the child.

If we become aware that any personal information relating to a Child has been provided without the consent of a parent or guardian, we will use reasonable endeavours to:

1. delete the personal information from all relevant files as soon as possible; or
2. ensure, where deletion is not reasonably practicable, that the personal information is not used further for any purpose or disclosed further to any Authorised Affiliate.

Any parent or guardian with queries regarding our collection, use, processing or disclosure of personal information relating to their Child should contact us using the details below.

15. Consent

Where your consent is required under applicable Privacy Laws, you consent to our collection, use, processing, storage, disclosure and handling of your personal information in accordance with this Privacy Policy. Where consent is not required, we will collect, use and otherwise handle your personal information in accordance with applicable Privacy Laws and for the purposes described in this Privacy Policy.

16. Changes to this policy

We may amend this policy from time to time at our sole discretion. 

Any revised policy will be posted on our Site and will be effective from the time of posting. 

Your continued use of our products, services or the Site following the posting of any revised policy indicates your acceptance of the changes to this policy. 

You should regularly check and read this policy.

17. Complaints

If you have any issues about this policy or the way we handle your personal information, please contact us using the details below and provide full details of your complaint and any supporting documentation.

At all times, privacy complaints:

1. will be treated seriously;
2. will be dealt with promptly;
3. will be dealt with in a confidential manner; and
4. will not affect your existing obligations or your commercial arrangements with us.

We will endeavour to:

1. respond to you within 10 business days; and
2. investigate and attempt to resolve your concerns within 30 business days or any longer period necessary and notified to you by us.

If you are dissatisfied with the outcome of your complaint, you may refer the complaint to the Office of the Australian Information Commissioner (OAIC). To lodge a complaint with the OAIC and for more information, please visit: https://www.oaic.gov.au/privacy/privacy-complaints/lodge-a-privacy-complaint-with-us#section-what-your-written-privacy-complaint-must-include  

If you are in the EU, you may refer the complaint to your local supervisory authority in the relevant EU member state.

18. Updates

We are committed to:

1. clearly expressing our Privacy Policy and keeping it up to date; and
2. making sure we take reasonable steps to implement and the practices, procedures and systems to ensure we comply with all the relevant Privacy Laws.

19. Contact us

You can contact us using the following details: 

Sheet Society Pty Ltd

Attention: Data Privacy Officer

35-37 Tinning St Brunswick VIC 3056, Australia

hello@thesheetsociety.com