1. About This Policy

The Posy Post (ABN: 52 634 266
023) is an online floral delivery service. The Posy Post (referred to in this
policy as “we”, “us” and “The Posy Post”) is committed to managing your
information in a secure and responsible manner and in accordance with the
Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs). This
policy sets out the way in which The Posy Post collects, uses and discloses
personal information and also explains your rights and how to contact us.

2. Your Personal Information

2.1 In the course of its
operations, The Posy Post may collect, use and disclose the personal
information of its customers for the purpose of managing accounts, fulfilling
orders, providing delivery notifications, and marketing, and as further
described in the remainder of this Policy. The precise nature of the
collection, use and disclosure of personal information depends on the services
you request and receive from, and your interaction with, The Posy Post.

2.2 The types of personal
information held by The Posy Post may include your name, address, phone
numbers, email address, date of birth, gender, occupation and social media
details. Depending on the services you receive from The Posy Post, we may also
collect and hold details about your purchase history, delivery preferences,
gift messages, recipient details, and payment information.

2.3 Please note that The Posy
Post does not directly store your credit card or payment card details. All
payment processing is handled securely by our third-party payment providers
(such as Shopify Payments, Stripe, PayPal, or Afterpay). Your payment information
is processed and stored by these providers in accordance with their own privacy
and security policies, including PCI-DSS compliance standards.

2.4 In certain circumstances,
The Posy Post may collect information about your health or other sensitive
information about you (for example, allergy information relevant to floral
products).

2.5 The Posy Post may use
de-identified information to carry out research and analysis. De-identified
information is information which has been aggregated or otherwise de-identified
so that it cannot be used to identify you or any other individual.

2.6 When you provide The Posy
Post with personal information, this Policy will apply to the manner in which
the information is collected, used, disclosed and stored. If you choose not to
provide certain personal information, The Posy Post may not be able to
communicate with you or provide you with the products and services you require.

3. Collecting Your Personal Information

3.1 Personal information about
you may be collected by The Posy Post from you or from a third party. The Posy
Post uses forms, online portals, and other electronic or paper correspondence
to collect this information.

3.2 For example, The Posy Post
may collect personal information from you:

(a)  
via The Posy Post website and online store;

(b)  
when you place an order, including details of the
recipient you are sending flowers to;

(c)  
when you provide it to The Posy Post by filling in
forms;

(d)  
when you contact The Posy Post by phone, email, SMS, or
online chat;

(e)  
when you engage with The Posy Post via social media
platforms;

(f)   
when you subscribe to receive newsletters, SMS
marketing, or other communications;

(g)  
when you enter a competition or promotion conducted by,
or on behalf of, The Posy Post.

4. Using Your Personal Information

4.1 The Posy Post may use the
personal information collected about you in a variety of ways, including:

(a)  
to verify your identity;

(b)  
to process and fulfil your orders, including
coordinating delivery;

(c)  
to send you delivery notifications via email or SMS
(such as order confirmation, dispatch notifications, and delivery updates);

(d)  
to provide customer support and respond to your
enquiries;

(e)  
to develop and improve our products, services, and
customer experience;

(f)   
to provide you with information about our products and
services;

(g)  
to carry out market research and surveys;

(h)  
to contact you if you win a prize in a competition;

(i)   
any use that is reasonably apparent at the time the
information is collected.

4.2 The Posy Post may also use
the personal information collected about you:

(a)  
to administer, manage and improve our website;

(b)  
to ensure that content from our website is presented in
the most effective manner for you and your device;

(c)  
to allow you to participate in interactive features of
our website;

(d)  
for direct marketing communications from The Posy Post
via email, SMS, social media, or other channels in relation to products,
services and special offers. You may opt out of direct marketing at any time
(see Section 11);

(e)  
any use that is reasonably apparent at the time the
information is collected.

5. Disclosing Your Personal Information

5.1 The Posy Post may share your
personal information with third parties in relation to the operation of our
business, including:

(a)  
the posy/flower recipient (including their name,
delivery address, and any gift message);

(b)  
our e-commerce platform provider (Shopify) for order
processing and website functionality;

(c)  
payment processors (such as Shopify Payments, Stripe,
PayPal, or Afterpay) for processing transactions;

(d)  
delivery and logistics partners for order fulfilment
and delivery notifications;

(e)  
email and SMS marketing platforms (such as Klaviyo or
similar) for sending marketing communications and transactional messages;

(f)   
analytics and advertising platforms (such as Google
Analytics, Meta/Facebook, and TikTok) for website analytics and targeted
advertising;

(g)  
review platforms for collecting and displaying customer
reviews;

(h)  
our professional advisors, including accountants,
auditors and lawyers;

(i)   
as required or authorised by law or where we have a
public duty to do so;

(j)   
where you have consented to your personal information
being disclosed to others.

5.2 If your information is
collected by a third party, the relevant third party may have a separate
privacy policy which applies to their handling of your personal information. We
encourage you to review the privacy policies of these third parties.

6. Cookies, Tracking Technologies and Analytics

6.1 When you visit our website,
we may record information such as your Internet Protocol (IP) address, browser
type, Internet Service Provider (ISP), referring/exit pages, operating system,
pages accessed, and any information downloaded. This information is used for
statistical, reporting and website administration purposes.

6.2 Our website uses “cookies”
and similar tracking technologies. A cookie is a small piece of data stored on
your device that helps us identify and interact more effectively with your
browser. Cookies help maintain browsing session continuity and remember your
details and preferences when you return.

6.3 We use the following types
of cookies and tracking technologies:

(a)  
Essential cookies: required for the website to
function properly (e.g., shopping cart, checkout, account login);

(b)  
Analytics cookies: used to understand how
visitors interact with our website (e.g., Google Analytics), including page
views, traffic sources, and user behaviour;

(c)  
Marketing/advertising cookies: used to deliver
relevant advertisements and track campaign performance (e.g., Meta/Facebook
Pixel, TikTok Pixel, Google Ads);

(d)  
Preference cookies: used to remember your
preferences and personalise your experience.

6.4 You can configure your web
browser to reject cookies; however, some parts of our website may not function
properly if you do so. You can also manage your cookie preferences through our
cookie consent banner when you first visit our website.

6.5 When we send you emails or
SMS messages, we may record whether you open the message and click on
particular links. This helps us understand what information is of interest to
you and improve our communications.

7. Protecting Your Personal Information

7.1 The Posy Post takes the
security of personal information seriously. We have appointed a Privacy Officer
to oversee our management of personal information in accordance with this
Policy and the Privacy Act 1988 (Cth).

7.2 We take reasonable steps to
protect the security and privacy of your personal information, including using
SSL encryption on our website, secure payment processing through PCI-DSS
compliant providers, and restricting access to personal information to
authorised personnel only.

7.3 If you are considering
sending us personal information through electronic means, please be aware that
information may be insecure in transit, particularly where no encryption is
used (e.g., standard email). Any transmission is therefore at your own risk.

7.4 Where you have chosen a
password which enables you to access certain parts of our website, you are
responsible for keeping this password confidential. We recommend that you do
not share the password with anyone and change it regularly.

8. Data Retention

8.1 The Posy Post will retain
your personal information for as long as necessary to fulfil the purposes for
which it was collected, including to satisfy any legal, accounting, or
reporting requirements.

8.2 To determine the
appropriate retention period, we consider the amount, nature, and sensitivity
of the personal information, the potential risk of harm from unauthorised use
or disclosure, the purposes for which we process the information, and applicable
legal requirements.

8.3 When personal information
is no longer required, we will take reasonable steps to destroy or de-identify
it in accordance with the Privacy Act 1988 (Cth).

9. Disclosing Your Personal Information Abroad

9.1 The Posy Post will store
personal information on data servers located within Australia where reasonably
possible. However, some of the third-party services we use (such as Shopify,
payment processors, email marketing platforms, and analytics providers) may
store data on servers located outside Australia, including in the United
States, Canada, and the European Union.

9.2 By providing your personal
information to us or using our services, you consent to the disclosure of your
personal information outside Australia as set out in this Policy. Where
practicable, we will take reasonable steps to ensure that overseas recipients
handle your personal information in a manner consistent with this Policy and
applicable privacy laws.

10. Access to and Correction of Your Personal Information

10.1 The Posy Post takes all
reasonable precautions to ensure the personal information we collect, use and
disclose is accurate, complete and up-to-date. However, the accuracy of that
information depends on the information you provide. We recommend that you let
us know if there are any errors in your personal information.

10.2 You have the right to
access the personal information we hold about you, and can request the
correction of your personal data if it is inaccurate, incomplete or out of
date. To do so, please contact our Privacy Officer using the details in Section
14.

10.3 You also have the right to
request the deletion of your personal information, subject to any legal
obligations that require us to retain certain records. We will respond to such
requests within a reasonable timeframe.

11. Opting Out of Marketing Communications

11.1 You can opt out of
receiving marketing communications from The Posy Post at any time by:

(a)  
clicking the “unsubscribe” link in any marketing email;

(b)  
replying “STOP” to any marketing SMS message;

(c)  
sending an email to hello@theposypost.com.au requesting
to be removed from our marketing lists.

11.2 Please note that opting
out of marketing communications does not affect transactional messages related
to your orders (such as order confirmations and delivery notifications), which
are necessary for us to provide our services.

12. SMS Communications

12.1 The Posy Post may send you
SMS messages for the following purposes:

(d)  
transactional notifications, including order
confirmations, dispatch notifications, and delivery updates;

(e)  
marketing communications, where you have provided your
consent.

12.2 By providing your mobile
phone number and opting in, you consent to receiving SMS messages from The Posy
Post. Standard message and data rates may apply. You may opt out of marketing
SMS at any time by replying “STOP” to any marketing message.

13. Children’s Privacy

Our services are not directed
at children under the age of 16, and we do not knowingly collect personal
information from children under 16. If we become aware that we have
inadvertently collected personal information from a child under 16, we will
take reasonable steps to delete that information as soon as practicable.

14. Changes to This Policy

We may modify, alter or
otherwise update this Policy at any time by publishing the new version on our
website. We will indicate any changes by updating the “Last Updated” date at
the top of this Policy. We encourage you to review this Policy periodically. If
you have any questions about this Policy, please contact our Privacy Officer
using the details below.

15. Contacting The Posy Post Privacy Officer and Making Complaints

15.1 You may contact The Posy
Post Privacy Officer by emailing hello@theposypost.com.au.

15.2 You may complain about our
collection, use or disclosure of your personal information by contacting our
Privacy Officer with your full name and contact details, together with a
detailed description of the complaint. We will respond to your complaint within
30 days and inform you of the next steps we will take in dealing with your
complaint.

15.3 If you are not satisfied
with our response to your complaint, you may lodge a complaint with the Office
of the Australian Information Commissioner (OAIC) at www.oaic.gov.au.

 

Note for International Customers

If you are located in the
European Union, United Kingdom, or other jurisdictions with specific data
protection laws (such as the GDPR or UK GDPR), you may have additional rights
regarding your personal data, including the right to access, rectification, erasure,
restriction of processing, data portability, and the right to object to
processing. To exercise these rights, please contact our Privacy Officer at
hello@theposypost.com.au.

If you are a resident of
California, USA, you may have additional rights under the California Consumer
Privacy Act (CCPA), including the right to know what personal information is
collected, the right to request deletion, and the right to opt out of the sale
of your personal information. The Posy Post does not sell personal information.
To exercise your rights, please contact our Privacy Officer.