Overview

Privacy Policy Overview Thankyou Group Pty Ltd ACN 132 861 879 (TYG, we, us and our) recognises the importance of safeguarding your personal information.

Your privacy is important to us and we want to manage your personal information in a professional and responsible manner.

This Privacy Policy sets out how we will protect your privacy rights in the collection, storage, use and disclosure of your personal information. We seek to comply with the applicable privacy laws, specifically the Australian Privacy Act 1988 (Cth) (Privacy Act) and the Australian Privacy Principles (APPs), the European Union General Data Protection Regulation (GDPR), and the California Consumer Protection Act (CCPA) (collectively, Privacy Laws).

Collection of Personal Information

Personal information has the meaning set out in the Privacy Laws. Depending on the applicable Privacy Law, personal information may be referred to as "personal data". In general terms, personal information is any information or opinion (whether true or not), which either identifies you or from which your identity can reasonably be determined.

We only collect your personal information where that personal information is necessary for one or more of our functions or activities.

The types of personal information we collect may differ depending on your relationship with us. Personal information includes:

 

• in the case of our launch team members, representatives, and supporters who register their interest to receive more information about the business – your full name, mailing or street address, email address, phone number/s, date of birth and occupation;
• in the case of the general public contacting our customer service function wishing to make a complaint, provide feedback, submit an enquiry, request a call-back or request a product replacement – your full name, mailing or street address, email address and phone number/s;
• in the case of the general public contacting us through social media platforms – your social media account names and your publicly disclosed names;
• in the case of the general community of supporters and subscribers who wish to be kept informed of our latest business news, promotions, events or products or to receive our regular company newsletter – your full name, mailing or street address, email address and phone number/s; in the case of impact partners – organisation information, organisational representative's name and contact details, and organisation proposal;
• in the case of customers purchasing our products via our online store or through an online corporate order – your full name, billing or shipping address, email address, phone number/s, order details, and payment details;
• in the case of our suppliers, key customer account managers and distributors - your name, mailing or street address, email address, phone number/s, and payment details;
• in the case of market research participants – your name, mailing or street address, email address, phone number/s; age, gender and occupation;
• in the case of workforce candidates (including potential employees, contractors and volunteers) – information which may be contained in a resume and which may be recorded during any interview or pre-employment checking, visa details, and government-issued identifiers such as tax filer numbers. Once we offer you a role, we will also collect additional personal information including your bank details and emergency contact details; and
• in the case of trade credit applicants – information which we may require to assess your credit worthiness, for example your credit or business history.
• in the case of website visitors and users generally – customer demographics information (such as age range, gender and location) obtained through various analytics tools, and technical information as described below in "Digital Information and Cookies".

Collection of Sensitive Information

Sensitive information is a type of personal information that is subject to additional protection under the Privacy Laws. Depending on the applicable Privacy Law, sensitive information may be referred to as "special category of data". Sensitive information includes, but is not limited to, information about your racial or ethnic origin, political opinions, sexual preferences or practices, criminal record or health.

In general, we do not collect sensitive information about you. However, we may only collect this sensitive information if it is necessary to do so and you have expressly consented to its collection. For example, if you report a health concern or issue related to our products, we would ask you for details of any illness or injury you have suffered and other health related details. We may also require you to undertake a police check as part of your employment with us or if you have been invited to participate in a projects trip to visit one of our funded programs. We will not use or disclose your sensitive information other than as allowed by the law or with your express consent.

Children’s personal information

We will not knowingly collect personal information from children under 16. If we learn that we have collected personal information of a child under 16 other than with parental or guardian consent, we will delete that information.

Can you choose not to disclose your personal information?

If you contact us to make a general inquiry about our business or products, you do not have to identify yourself or provide any personal information unless you require us to get back in touch with you at a later stage, address a complaint or request that necessarily requires us to use your personal information, or if you would like us to send you further information or products.

You can also notify us that you wish to deal with us by not identifying yourself or using a pseudonym. However, if we are not able to collect personal information about you we may not be able to provide you with the products, services, information or assistance you require.

For example, we will not be able to send you information about our products if you have not provided us with a valid email address or phone number.

How we collect your personal information

We collect your personal information directly from you, including when you:

• contact our customer service in person, by telephone, email or webchat, via our website or otherwise;
• sign up as a launch team member via our web page; sign up to receive our newsletter or other marketing materials;
• sign up during our events or speaking engagements;
• complete your purchase order details in our online store; enter a survey, competition or promotion, or register for an event;
• apply to work with us or are engaged by us as a contractor; conduct business with us;
• agree to participate in a market research initiative; apply for trade credit with us;
• supply goods and/or services to us; submit any personal information through a Facebook Lead Ad; or
• visit or use our website.

 

When collecting this personal information, we will do so only by lawful and fair means and not in an unreasonably intrusive way.

TYG may use third party service providers to collect and store personal information on our behalf. Where it is reasonable and practicable to do so, we will only collect personal information about you from you directly and not from third parties. However, in some instances, this will not be practicable. In some cases, we collect personal information about you from publicly available sources (such as the internet) and from third parties (such as mutual contacts or your referees provided during the recruitment process if you apply for a job with us).

How secure is my personal information?

TYG takes reasonable steps to protect and store your personal information, including limiting access to such information to internal employees on a need-to-know basis and using password protected servers.

However, when submitting any personal information about yourself on the internet, it is important to note that internet security is not absolute. TYG takes reasonable steps as required by the Privacy Laws to ensure that our website is protected from outside sources, however we cannot guarantee the security of transmission of personal information you disclose to us online. You transmit your personal information to us online at your own risk and we encourage you to make sure your computer is adequately protected. If you post personal information on our website, we will consider that you have consented to the collection of this information.

Please notify us immediately if you become aware of any breach of security.

In all instances, regardless of the method used to collect your personal information, we will deal with it in accordance with this Privacy Policy.

Use of your personal information

In general, we use your personal information for purposes connected with our business.

The purpose for using your personal information will vary depending on the nature of your relationship with us. Some of these purposes are:

• to provide our products and services to our customers, whether purchased via our online store or through an online corporate order;
• to enable the proper operation and functionality of our products and services; to verify your identity (for example, if you request access to the personal information we hold about you);
• to keep you informed about our latest business news, direct marketing initiatives, promotions, products, giving-model and upcoming events, including through our regular company newsletter;
• to respond to your complaint, feedback, enquiry or to send you information or replacement products;
• to maintain a business relationship with and receive goods or services from third parties (including our suppliers, distributors and key customer account managers);
• to discuss and negotiate partnership opportunities;
• to discuss and negotiate, either directly through us or through a third party service provider, sales or business opportunities;
• to perform research and analytics to help us understand and better serve you, develop marketing insights and improve the quality of the products we offer;
• to consider you for a job at Thankyou or other relationships with us (including potential employees, contractors and volunteers) as well as consider you for any future suitable job opportunities;
• for direct marketing and other digital marketing campaigns (see "Direct marketing communications" section below);
• and to contact you regarding the above, including via electronic messaging such as SMS and email, by mail, by phone or in any other lawful manner.

We may also use or disclose your personal information for other purposes to which you have consented, or as otherwise permitted or required by law.

We will only use personal information about you if we have a lawful basis to do so, for example:

• where you have given us your consent;
• where processing of your personal information is necessary for the performance of a contract with you;
• to meet our legal obligations; and
• to pursue our legitimate business interests.

We may use or disclose your personal information:

• for the purposes for which we collected it (and related purposes which would be reasonably expected by you);
• for other purposes to which you have consented; and
• as otherwise authorised or required by law.

Do we disclose your personal information to third parties?

When you provide your personal information to us, we may disclose it to third parties in connection with the purposes described above (see the "Use of your personal information" section).

The types of persons and organisations to which we may disclose your personal information include the following:

our related companies;

any potential third party acquirer of our business or assets, and advisors to that third party;

organisations with whom we have arrangements or agreements for the purpose of promoting our products or services and any agents used by us in administering such arrangements or agreements;

our employees, agents, contractors, distributors, licensees and third party service providers who assist us to carry on our functions and activities e.g. payment systems operators and financial institutions, cloud service providers, data storage providers, shipping companies, telecommunications providers and IT support services providers (including to maintain our website);

third party service providers authorised by us to conduct promotional, research, analytics or marketing activities;

our professional advisors (such as lawyers, accountants or auditors) and insurers, when needed; third parties to whom you have authorised us to disclose your information (e.g. referees); and

other parties to whom we are authorised or required by law to disclose information.

If we disclose your personal information to third parties we will use commercially reasonable efforts to ensure that such third parties only use your personal information as reasonably required for the purpose of disclosure and in a manner consistent with the Privacy Laws. For example, to the extent commercially reasonable, by including suitable privacy and confidentiality clauses in our agreement with a third party service provider to which we disclose your personal information.

Although we do not actively disclose your personal information to third parties, we do engage digital service providers such as Google and Facebook, which will have access to certain Digital Information relating to you. Please refer to the section below relating to "Digital Information and Cookies".

Direct marketing communications

We will only send you direct marketing communications (either through mail, SMS or email), including offers any news and exclusive offers, promotions, or events, where you have consented to do so.

If you do not wish to receive ongoing promotional news or information about our products and services, you can request to be withdrawn from our contact list or marketing database at any time, either by contacting us or by using the opt out function contained in our direct marketing, newsletter or other emails.

Once you have made this request, TYG will remove your personal information (to the extent permitted by law) and will no longer continue to engage in any direct marketing communications with you.

TYG does not sell or share your personal information with any other company for that company’s direct marketing services.

For clarity, we may share your personal information to our service providers who may use the personal information for direct marketing services on our behalf, however we will not share your personal information with other companies for the purpose of those companies marketing their own products to you unless we specifically ask for, and receive, your permission to do so.

Disclosure of personal information overseas

Due to the nature of our business, personal information collected by us is likely to be disclosed to overseas recipients, being to related bodies corporate or service providers we may engage in connection with our business. Personal information is likely to be disclosed to overseas recipients located in the United States of America, the Netherlands, New Zealand, and Hong Kong. This is not an exhaustive list.

Except where an exception applies under the Privacy Laws, we will take commercially reasonable steps to ensure that overseas recipients to whom we disclose personal information do not breach the Privacy Laws in relation to such information.

How long will we keep your personal information?

In general, we will retain and use your personal information for the period necessary for the purposes for which your personal information was collected (as outlined in this Privacy Policy) unless a longer retention period is required by law or if it is reasonably necessary for us to comply with our legal obligations, resolve a dispute or maintain security.

For certain types of personal information, particularly some employee records, we are obliged in Australia to retain these for seven (7) years after an employee finishes their employment with us.

If you submit your personal information as part of a job application, your details are stored on a secure recruitment database for our records. This allows us to consider your application for future vacant positions if you are unsuccessful in obtaining a position with us at first instance. It is our usual practice to request your permission to contact you about future job vacancies. You may request that we remove your personal information from this database (please see "Your rights" below).

Digital Information and Cookies

We also use technologies to collect technical information and general analytics.

"Cookies" are a standard for storing small pieces of data on a web client (i.e. the web browser on your computer). TYG websites store a unique ID on your web client in order to identify you while using the website. Some cookies are necessary to make our website work or to facilitate the transmission of a communication. You may be able to disable these in your browser settings but this may negatively affect your experience with our website. For more information about cookies, and how to disable cookies, visit www.allaboutcookies.org.

In addition, TYG has implemented certain Google Analytics Advertising Features on its website. These include Data Collection for Google Analytics Search & Display Network Remarketing, Audience Demographics & Interests Reporting and Display Network Impression Reporting. As part of the Google Analytics Features used on the website, TYG may also use Google Analytics cookies and advertising cookies.

You can opt-out of the Google Analytics Advertising Features you use, including through your browser Ads Settings, Ad Settings for mobile apps, or any other available means. Please refer to Google Analytics' currently available opt-out add-on to your web browser to prevent access to your Digital Information.

These features may provide us with marketing insights into certain customer attributes and preferences when using the internet and various digital platforms (Digital Information).

Digital Information we may collect may include the Internet protocol (IP) address used to connect your computer to our website, login information (if applicable), browser type and version, time zone setting, browser plug-in types and versions, operating system and platform, the full Uniform Resource Locators (URL) clickstream to, through and from TYG's website (including date and time), products you viewed or searched for, page response times, download errors, length of visits to certain pages, page interaction information (such as scrolling, clicks, and mouse-overs), and methods used to browse away from the page.

However, given that this information may not always be personally identifiable information, it may not constitute personal information.

By using our websites, you are consenting to the use of these technologies in accordance with this Privacy Policy.

Links to Other Sites

You should be aware that when you are on our website, you could be directed to other sites that are beyond our control. These other sites may send their own cookies to users, collect data or solicit personally identifiable information. You therefore need to check the individual privacy policy of any third party when accessing other websites that may be linked to our websites. This Privacy Policy is strictly limited to TYG’s collection, storage and use of personally identifiable information and does not apply to third party websites. Please keep in mind that whenever you give out personal information online, for example, via message boards or chat, that information can be collected and used by people you do not know. TYG does not guarantee the security of any information you disclose online and you do so at your own risk.

Your rights

How can you seek to access and correct your personal information?

You may request access to the personal information we hold about you and seek the correction of such information by contacting us as described in the "How to contact us" section below.

We will provide access to that information in accordance with the Privacy Laws, subject to any exemptions which may apply. We may require that the person requesting access provide suitable identification and where permitted by law we may charge a fee for giving access to your personal information. We will inform you of any charges payable upon your request.

TYG will respond to requests for access to personal information within 30 days, unless certain circumstances under the Privacy Laws apply.

Where any personal information we hold about you is not accurate, up-to-date or complete, you can request that the information be corrected.

How you can complain about a privacy issue

You may make a privacy complaint in relation to personal information we hold about you by contacting us as described in the "How to contact us" section below.

If you make a privacy complaint, our Privacy Officer or another suitable staff member will investigate the matter and attempt to resolve it as soon as reasonably possible (usually within 30 days of receipt of the complaint). TYG takes such matters seriously and we will use all reasonable efforts to promptly deal with the matter.

We will at first seek to deal with you via phone. If your complaint is not satisfactorily resolved after the phone call, we would seek to meet with you in person, if reasonably practicable. If after these steps you consider your concerns have not been resolved satisfactorily by us, or you wish to obtain more information on privacy requirements you can contact:

• the Office of the Australian Information Commissioner on 1300 363 992 or visit their website at www.oaic.gov.au; and
• if you are located in the European Union, your local data protection authority: www.edpb.europa.eu/about-edpb/board/members_en.

Individuals located in the EU

For the purpose data protection legislation, the "data controller" is Thankyou Group Pty Ltd of Level 4, 459 Church Street, Richmond, Victoria, Australia.

If you are located in the European Union, you may have the following rights:

• The right to access, rectify or update the personal information we hold about you.
• The right to request erasure of personal information we hold about you, for example if the personal information is no longer necessary to provide services to you.
• The right to require us to stop using all or some of your personal information (for example, if we no longer has a legal right to keep using it) or to restrict its use of your personal information (for example, if you consider that the personal information we hold about you is inaccurate or if it is unlawfully held).
• The right to data portability. In some circumstances you have the right to be provided with a copy of the personal information we hold about you in a structured, machine-readable and commonly used format.
• The right to withdraw consent. You may withdraw your consent at any time where we relied on your consent to process your personal information.

We may ask you to provide suitable identification when you seek to exercise any of these rights.

Notice to Residents of California

For the purpose of the CCPA, in addition to the information contained elsewhere in this Privacy Policy, residents of California are advised that we may:

• collect the following categories of personal information: Identifiers/Contact Information, Personal information described Section 1798.80(e); Characteristics of Protected Classifications Under Federal and State Law, Commercial information, Internet or other electronic network activity information, Professional or employment-related information, and inferences drawn from the above; and
• disclose the following categories of personal information for a business purpose: Identifiers/Contact Information, Personal information described Section 1798.80(e); Characteristics of Protected Classifications Under Federal and State Law, Commercial information, Internet or other electronic network activity information, Professional or employment-related information and inferences drawn from the above. Please see table below for further details.

Californian residents also have the following rights:

To exercise any of these rights, you can contact us using the methods set out below under "How to contact us". We may need to verify your identity or, if applicable, require you to log into an account established with us. We do not sell or share your personal information for cross-context behavioural advertising, as defined under the CCPA. We will not discriminate against a person who exercises these rights.

• up to two times every 12 months, you may request a copy of the personal information that we have collected about you in the prior 12 months, including the categories of personal information we collect, the categories of sources, the business or commercial purposes for collecting your personal information, and, if applicable, the categories of third parties with whom we may disclose personal information;
• you may request that we delete personal information that we have collected about you, except some exceptions apply to that right, such as if the information is publicly available, we cannot verify your request, we need the information to complete a transaction, for certain business security practices or internal uses under certain circumstances, to detect and protect against fraudulent and illegal activity, to exercise certain rights, or to comply with a legal obligation;
• you can request us to correct any inaccurate personal information we hold about you;
• you can direct us to only use your sensitive personal information (as defined under the CCPA) for limited purposes, such as providing you with the services you requested; and
• you have the right to designate an agent to exercise these rights on your behalf. If you do, we may require you to verify your identity or require proof that you gave the agent signed permission to submit the request on your behalf.

 

Local exemptions and inconsistency with law

Where local laws allow for an exemption to compliance with certain legal obligations (for example, the employee records exemption in Australia), we may rely on such an exemption.

This Privacy Policy will not apply to the extent that it is inconsistent with any applicable law.

Changes to our Privacy Policy

TYG reserves the right to modify or update this Privacy Policy at any time at our discretion. If we modify or update our Privacy Policy, we will post the revised policy on our website. Your continued dealings with us, for example use of our website, products or services, will signify your agreement to this Privacy Policy as amended.

How to contact us

If you wish to access or correct your personal information, or if you have any concerns or enquiries about how we deal with your personal information, you can contact us at hello@thankyou.co or, if you are in Australia, you may call us on 1300 655 887.

If you no longer want us to use your personal information collected in the manner described in this Privacy Policy, please contact us using the details provided above.

Last updated on: 24 June 2023

 2020 Privacy Policy