At 28 by Sam Wood Pty Ltd (28), we recognise the importance of your privacy and understand your concerns about the security of the personal information you provide to us. We comply with the Australian Privacy Principles (APPs) as contained in the Privacy Act 1988 (Cth). The APPs detail how personal information may be collected, used, disclosed, stored and destroyed, and how an individual may gain access to or make complaints about the personal information held about them.
This policy details how 28 manages personal information about you (including sensitive information and health information).
In the course of doing business with you, the collection of personal information in some instances is necessary or unavoidable.
What personal information we collect and hold
The kinds of personal information we collect from you or about you depend on the transaction you have entered into with us, the services you have contracted us to provide, and the services you are interested in or the information you have requested.
“Personal information” is information or an opinion about an identified individual, or about an individual who is reasonably identifiable.
The kinds of personal information that we may collect and hold from you or about you include: your name, email address, measurements, questions asked, address, phone numbers and credit card details.
When you browse the 28 by Sam Wood (Sit”) or contact us electronically, we may also record geographical tagging, cookies and statistical data. This may include your IP address, date and time of your visit, pages visited and information downloaded and type of browser used to access the Site.
We use this information to help us to make decisions about maintaining and improving our Site and online services.
How we collect and hold personal information
We aim to collect personal information only directly from you, unless it is unreasonable or impracticable for us to do so.
For example, we collect personal information from you or about you from information you submit to us, emails, telephone calls with us, and from your activity on our Site and social media platforms.
You can be anonymous or use a pseudonym when dealing with us, unless:
- the use of your true identity is a legal requirement; or
- it is impracticable for us to deal with you on such basis.
Why we collect, hold, use and disclose personal information
We collect, hold, use and disclose personal information from you or about you where it is reasonably necessary for us to carry out our business functions and activities. For example, we collect, hold, use and disclose your personal information as necessary to provide our services to you.
If we do not collect, hold, use or disclose your personal information, or if you do not consent, then we may not be able to answer your enquiry, complete the transaction you have entered into, or provide the services that you have contracted us to provide.
We also collect, hold, use and disclose your personal information for related purposes that you would reasonably expect, such as our administrative and accounting functions, fraud checks, providing you with information about other services offered by us, marketing and promotions, market research, newsletter communications, statistical collation and website traffic analysis.
Where we wish to use or disclose your personal information for other purposes, we will obtain your consent.
Where we use your personal information for marketing and promotional communications, you can opt out at any time by notifying us. Opt out procedures are also included in our marketing communications.
We may also disclose your personal information to third parties (including government departments and enforcement bodies) where required or permitted by law.
How we hold and store personal information
Your personal information is held and stored on paper, by electronic means or both. We have physical, electronic and procedural safeguards in place for personal information and take reasonable steps to ensure that your personal information is protected from misuse, interference, loss and unauthorized access, modification and disclosure:
- Data held and stored on paper is stored in lockable offices and in secure premises.
- Data held and stored electronically is protected by internal and external firewalls, limited access via file passwords, and files designated read-only or no access.
- Data held and stored “in the cloud” is protected by internal and external firewalls, limited access via file passwords and files designated read-only or no access. We also require our IT contractors and other third parties to implement privacy safeguards.
- Where we disclose personal information to third parties (including contractors and affiliated businesses located locally and overseas), our contractual arrangements with them include specific privacy requirements.
- Our staff receive regular training on privacy procedures.
Destruction and de-identification
We will retain your personal information whilst it is required for any of our business functions, or for any other lawful purpose.
We use secure methods to destroy or to permanently de-identify your personal information when it is no longer needed:
- Paper records are shredded or destroyed securely.
- Electronic records are deleted from all locations, to the best of our ability, or encrypted and/or placed beyond use.
We do not disclose your personal information to overseas recipients.
Requests for access and correction
We have procedures in place for dealing with and responding to requests for access to, and correction of, the personal information held about you.
In most cases, we expect that we will be able to comply with your request. However, if we do not agree to provide you access or to correct the information as requested, we will give you written reasons why. For further information, please see contact us.
To assist us to keep our records up-to-date, please notify us of any changes to your personal information.
Complaints and concerns
We have procedures in place for dealing complaints and concerns about our practices in relation to the Privacy Act and the APPs. We will respond to your complaint in accordance with the relevant provisions of the APPs. For further information, please see our Privacy Access, Correction & Complaints brochure or contact us.
General data protection regulation
If you are a resident of the European Economic Area, we are required to comply with the General Data Protection Regulation (GDPR) in respect of residents of the European Economic Area.
If you are a resident of the European Economic Area, you have the following rights under the GDPR:
- to correct or change your personal information.
- to request that we delete your personal data unless we are required or permitted to hold it by the relevant law.
- to request that your personal data is transferred to a third party.
- to limit the personal information we hold about you.
- to object to your personal information being used in a certain manner. We will comply with your request unless we are otherwise permitted or required by law.
- to access your personal information and enquire what information we hold about you.
- to request further clarification regarding the treatment of your data; and
- to make a complaint. Our response will be in accordance with our Terms and Conditions.
28 by Sam Wood Pty Ltd
Last Updated July 2019