Privacy policy: DRAFT for Jaeger's review

---

PART A: POLICY TEXT

Dimples Privacy Policy

Dimples is a brand operated by the company Wild Grocers Pty Ltd 
ABN: 72 678 410 378

 NSW. In this policy "we", "us" and "Dimples" mean Wild Grocers Pty Ltd.

We deliver fresh produce and groceries to Sydney homes. To do that we need to know who you are, where to deliver, and what you ordered. This policy explains what personal information we collect, why, who we share it with, and how you can see, fix or limit it. We handle personal information under the Privacy Act 1988 (Cth) and the Australian Privacy Principles.

1. What we collect

Information you give us

• Your name, email address, mobile number and delivery address (including suburb, postcode and delivery instructions such as gate codes or where to leave the box).
• Your account details and order history: what you ordered, when, how much you paid, discounts or credit used, and your chosen delivery window.
• Messages you send us: emails, SMS replies, phone calls, chat, feedback, complaints, product reviews and delivery ratings.
• Preferences you tell us, such as how you'd like to hear from us, and any answers you choose to give to questions about your household or diet. Answering is always optional.

Information collected when you use our website and emails

• Device and browser information, IP address, approximate location derived from your IP address, pages and products viewed, items added to your cart, and how you arrived at our site.
• Whether you open or click our emails and SMS messages.
• We collect this using cookies, pixels and similar tools placed by us and by the service providers in section 4. You can block or delete cookies in your browser; the site will still work, but some features (like staying signed in or keeping your cart) may not.

Information from delivery

• Delivery status, the time your box was delivered, photo proof of delivery where taken, and any rating or comment you leave about the delivery.

Payment information

• Payments are processed by Shopify and its payment partners. We do not see or store your full card number. We receive a record that payment was made, the card type and the last four digits.

Sensitive information

• We don't ask for sensitive information (such as health information). If you tell us about an allergy or a dietary need so we can get your order right, we'll only use it for that purpose and only with your consent.

We don't knowingly collect information from children under 16. Our service is for adults who run a household.

2. Why we collect it

We use personal information to:

• take, pack and deliver your orders, and tell you when they're on the way;
• take payment, issue refunds and credits, and keep our accounts;
• answer your questions and fix problems with an order or delivery;
• recognise you as one customer even if you have used more than one email or account, so your order history and credit stay together;
• understand how often customers order and when they stop, so we can improve our range, our service and our delivery days;
• send you marketing about our products and offers, where you have agreed or where the law otherwise allows (see section 5);
• show you Dimples ads on other websites and social media (see section 5);
• prevent fraud and misuse, and meet our legal obligations.

We use your information only for these purposes, for purposes related to them that you would reasonably expect, or where the law allows or requires it.

3. How we hold and protect it

Your information is stored in the systems of the service providers in section 4, which are secured with access controls and encryption in transit. Only staff and contractors who need it to do their job can access it. If a data breach is likely to cause you serious harm, we will tell you and the Office of the Australian Information Commissioner (OAIC) as the Notifiable Data Breaches scheme requires.

4. Who we share it with

We don't sell your personal information. We share it only with businesses that help us run Dimples, and only what they need.

We may also disclose information where the law requires it, or to a buyer of our business (who must keep handling it under this policy).

Overseas. Several of these providers store data outside Australia, mainly in the United States, and may also use other countries where they or their sub-processors operate. We choose providers that commit to protecting personal information, but by using Dimples you understand that your information may be held overseas.

5. Marketing and how to opt out

• We send marketing emails and SMS only where you have agreed or where the Spam Act 2003 otherwise allows. Every one has a free, simple way to unsubscribe, and we act on it within 5 business days.
• Unsubscribing from marketing doesn't close your account. You can still order, and you'll still get messages you need about your orders and deliveries (confirmations, delivery times, problems).
• Email and SMS are separate. You can stop one and keep the other. You can also tell us you'd like less frequent messages.
• Ads. We may show you Dimples ads on social media and other websites, based on your visits to our site or by matching a hashed (scrambled) version of your email or phone number with the platform. To opt out of list-based ads, email hello@dimples.au and we'll exclude you from future uploads. You can also use the ad settings in your Meta and Google accounts, or block cookies.
• To stop all direct marketing from us in any channel, including post, just ask using the details in section 9.

6. How long we keep it

We keep order and payment records for at least 7 years because tax law requires it. We keep your account and contact details while you're a customer and for a reasonable period after your last order so you can come back without starting again. When we no longer need information for any purpose in this policy, we delete it or de-identify it.

7. Seeing and correcting your information

You can ask to see the personal information we hold about you, or ask us to correct it. Email hello@dimples.au. We'll check who you are, then respond within 30 days. Access is free; if a request is unusually large we'll tell you first if there is any reasonable cost. If we can't give access or make a correction, we'll explain why in writing. Many details (address, phone, email) you can update yourself in your account.

8. Automated decisions

We use your order history to group customers (for example, by how recently and how often they order) so we can decide which messages and offers are relevant. These groupings don't decide whether you can order from us, what you pay as a standard price, or how your order is delivered. 

9. Questions and complaints

Contact our privacy officer:

• Email: hello@dimples.au
• Phone: +61 489 081 853
  

We'll acknowledge your complaint within 5 business days and aim to resolve it within 30 days. If you're not satisfied, you can complain to the Office of the Australian Information Commissioner: www.oaic.gov.au, 1300 363 992.

10. Changes to this policy

We may update this policy. The current version is always at dimples.au with the date it was last updated. If a change significantly affects how we use information you've already given us, we'll tell you.