1. Introduction

We know that you care how information about you is used and shared, and we appreciate your trust. References to “Shona Joy” in this Privacy Policy includes Shona Joy Trading Co Pty Limited ACN 610 512 779, Shona Joy Holdings Pty Ltd ACN 124 203 658, Shona Joy Pty Ltd ACN 124 197 851 and any related entities (as defined pursuant to the Corporations Act 2001 (Cth)). Shona Joy (also referred to as “we”, “our” and “us”) is committed to protecting your privacy and personal information when you interact with us, visit or make a purchase from any of our websites including www.shonajoy.com.au or www.shonajoy.com ("Websites").

The purpose of this Privacy Policy is to explain how and why we collect, hold, use and disclose your personal information to assist us in carrying on our business. By providing us with your personal information, you consent to us holding, using and disclosing it as set out in this Privacy Policy. We will comply with obligations under the Privacy Act 1988 (Cth) "Privacy Act" (including the Australian Privacy Principles "APPs" and the Privacy (Credit Reporting) Code 2014 "CR Code") and any other relevant legislation.

We may update this Privacy Policy from time to time and changes will take effect when published. You should periodically view our Websites to stay up to date with the current terms of this Privacy Policy.This version of the Privacy Policy was last updated on 24 May 2022.

2. Collection and Use of Personal Information

2.1     What is “Personal Information”

The Privacy Act currently defines “personal information” as meaning information or an opinion about an identified individual or an individual who is reasonably identifiable:

1. whether the information or opinion is true or not; and
2. whether the information or opinion is recorded in a material form or not. If the information does not disclose your identity or enable your identity to be ascertained, it will in most cases not be classified as “personal information” and will not be subject to this privacy policy.

2.2     Information We Collect

When you visit our Websites, we automatically collect certain information about your device and preferences, including:

1. information about your web browser;
2. IP address;
3. time zone;
4. cookies installed on your device;
5. information about the web pages or products that you view;
6. websites or search terms referred you to the Websites;
7. information about how you interact with the Websites.

We refer to this automatically-collected information as “Device Information".

Additionally, when you otherwise engage with us or make (or attempt to make) a purchase through our Websites, we may collect certain information from you that personally identifies you including:

(a)   your name;
(b)   billing address;
(c)   shipping address;
(d)   payment information;
(e)   email address; and
(f)   phone number.

We may collect additional personal information from time to time.

We refer to this information as “Order Information." When we talk about “Personal Information” in this Privacy Policy, we are talking both about Device Information and Order Information.

You don’t have to give us the Order Information requested. However, if you do not provide us with some or all of the Order Information requested, we may not be able to fulfil your order or satisfy your request, to the requested standard or at all, and you may also miss out on receiving valuable information about Shona Joy.

2.3     Consent to Collection and Use

By using our Websites or communicating and providing information via any medium (including engaging with us through any social media channel such as Facebook, Instagram, Pinterest or TikTok), you are consenting to the collection and use of your Personal Information in accordance with this Privacy Policy.

We will not normally seek to collect sensitive information, however you consent to us collecting sensitive information which you provide to us voluntarily.

2.4     Why We May Collect, Hold, Use and Disclose Personal Information

We may collect, hold, use and disclose Personal Information about you to provide and improve the quality of our products and service to customers and for our legitimate business interests. Our collection, holding, use and disclosure of your Personal Information will depend on our relationship with you, the circumstances of collection of the Personal Information and your request/s.

Generally, we use Order Information collected to:

(a)   fulfil any orders placed through the Websites (including processing your payment information, arranging for shipping, and providing you with invoices and/or order confirmations);
(b)   communicate with you;
(c)   screen our orders for potential risk or fraud; and
(d)   provide you with information or conduct advertising or marketing activities relating to our products or services (unless you tell us not to).

Device Information is collected to:

(a)   help us screen for potential risk or fraud (in particular, your IP address); and
(b)   to improve and optimise our Websites (for example, by generating analytics about how our customers browse and interact with the Websites and to assess the success of our marketing and advertising campaigns).

We may also collect, hold, use and disclose your Personal Information for other reasons where the law allows or requires us to do so, including the following:

(a)     to manage and improve our service and relationships including for data analysis to predict moving trends and identify products of value; and
(b)     to maintain our records and comply with our legal obligations.

2.5     How We Collect Personal Information

The main ways we collect Personal Information include:

1. (a)   if you access our Websites or engage with us via social networking services, including by the use of the specific technologies referred to below;
2. (b)   if you subscribe to any of our e-mailing or SMS marketing lists;
3. (c)   in connection with the fulfilling of orders;
4. (d)   if you request us to provide you with information regarding the Shona Joy products or service including online, email or telephone enquiries;
5. (e)   via third parties we may engage to assist us in improved provision of our service, marketing and advertising. Theses third parties may use cookies and other technologies to obtain information about your preferences when you access online platforms or websites other than our Websites. Your preferences collected in this manner may be disclosed to us. These third parties may include service providers that may provide lead generation advertising, market leads or marketing services to us and online platforms such as Google and social networking services.
6.  

We collect Device Information using the following technologies:

1. (a)   “Cookies” which are data files that are placed on your device or computer and often include an anonymous unique identifier. For more information about cookies, and how to disable cookies, visit http://www.allaboutcookies.org.
2. (b)   “Log files” which track actions occurring on the Websites, and collect data including your IP address, browser type, internet service provider, referring/exit pages and date/time stamps.
3. (c)   “Web beacons,” “tags,” and “pixels” which are electronic files used to record information about how you browse the Websites.

• Please note that we do not alter our Websites’ data collection and use practices when we see a "Do Not Track" signal from your browser.

3. Disclosure of Personal Information

3.1     Disclosure of Personal Information to third parties

We may disclose your Personal Information to third parties as a part of providing our products or service and for our legitimate business interests, including:

(a)     to any contractors or third parties we engage to assist with the provision of the Shona Joy products or service, specifically we use:(i)   Shopify to power our online store - you can read more about how Shopify uses your Personal Information here:https://www.shopify.com/legal/privacy; and(ii) Google Analytics to help us understand how our customers use the Websites - you can read more about how Google uses your Personal Information here:https://www.google.com/intl/en/policies/privacy.You can also opt-out of Google Analytics here:https://tools.google.com/dlpage/gaoptout.(b)     to marketing, advertising and promotions services providers and event organisers in connection with our marketing, advertising or events;(c)     to service providers of other administrative or operational services to Shona Joy, such as market research companies, IT service providers and payment processors;(d)     to law enforcement or government agencies or other third parties, if permitted or required by law; and/or(e)     otherwise with your consent.

Where possible, Shona Joy may impose contractual restrictions equivalent to those imposed on Shona Joy under the Privacy Act in respect of collection and use of Personal Information by those third parties. However, in some cases, Shona Joy's ability to impose contractual restrictions is limited. In those circumstances, we will carefully consider the risks to the protection of Personal Information when entering into arrangements with third parties.

Under no circumstances will Shona Joy sell or receive payment for licensing or disclosing your Personal Information.

In the event of a data breach likely to cause serious harm involving your Personal Information, we will notify you in accordance with our Notifiable Data Breaches scheme obligations under Part IIIC of the Privacy Act.

3.2   Cross-border disclosure of Personal Information

Some of Shona Joy's third party contractors may be located overseas or perform services overseas and as a result your Personal Information may be disclosed to a third party in a foreign country.

Under the Privacy Act, we must take reasonable steps, before Personal Information is disclosed to an overseas recipient, to ensure that the overseas recipient does not breach Australian privacy laws in relation to that information ("the Obligation").

The Obligation does not apply if you consent to disclosure of your Personal Information to an overseas recipient.

By supplying Personal Information to us you consent to the disclosure of your Personal Information to an overseas recipient and agree that the Obligation does not apply.

4. Behavioural Advertising

As described above, we may use your Personal Information to provide you with targeted advertisements or marketing communications we believe could be of interest to you.

For more information about how targeted advertising works, you can visit the Network Advertising Initiative’s (“NAI”) educational page at http://www.networkadvertising.org/understanding-online-advertising/how-does-it-work

You can opt out of targeted advertising via the relevant platform for example for Facebook via https://www.facebook.com/settings/?tab=ads.

Additionally, you can opt out of some of these services by visiting the Digital Advertising Alliance’s opt-out portal at https://optout.aboutads.info.

5. Additional Disclosure and Rights under EU Law

This section applies if you are based in the European Economic Area ("EEA") during your interactions with us and sets out the additional information that we are required to provide to you under European data protection laws.

5.1     Grounds for Use

In the table below, we have set out the relevant grounds that apply to each purpose of data use that is mentioned in this Privacy Policy.

Purposes of the data use

Use bases

To fulfil orders and provide our products and administer our service

·       contract performance

·       legitimate interests (to allow us to perform our obligations and provide services to you)

To communicate with you and provide customer support

·       contract performance

·       legal obligation

·       legitimate interests (to allow us to correspond with you in connection with our services)

To screen orders for potential risk or fraud

·       legal claims

·       legitimate interests (to prevent, detect and take action in response to fraudulent activity, including fraudulent transactions)

To conduct marketing activities and research

·       legitimate interest (in order to market to you and better understand customer's requirements) and consent (which can be withdrawn at any time)

To ensure our Websites content is relevant

·       legitimate interests (to allow us to provide you with relevant content on our Websites)

To maintain our records and comply with our legal obligations

·       legal obligation

·       legal claims

·       legitimate interests (to cooperate with law enforcement and regulatory authorities)

5.2   Cross-border disclosure of Personal Information outside the EEA

When we transfer Personal Information from inside the EEA to outside the EEA, we may be required by law to take specific measures to safeguard the relevant Personal Information. Certain countries outside the EEA have been approved by the European Commission as providing essentially equivalent protections to EEA data protection laws and therefore no additional safeguards are required to export Personal Information from the EEA to these jurisdictions. In countries which have not had these approvals, we will use appropriate safeguards to protect any Personal Information being transferred.

5.3   Additional Rights

In addition to the rights outlined elsewhere in this Privacy Policy, under certain conditions you may have the right under EU data protection law to ask us to:

1. (a)   provide you with further details on how we use and process your Personal Information;
2. (b)   delete Personal Information we no longer have grounds to process; and
3. (c)   restrict how we process your Personal Information while we consider an inquiry you have raised.
4.  

In addition, under certain conditions, you have the right to:

1. (a)   where processing is based on consent, withdraw the consent;
2. (b)   lodge a complaint with a supervisory authority;
3. (c)   object to any processing of Personal Information that we process on the “legitimate interests” or “public interests” grounds, unless our reasons for the underlying processing outweighs your interests, rights and freedoms; and
4. (d)   object to direct marketing (including any profiling for such purposes) at any time.
   

You can exercise these rights by contacting us (details at clause 7 below). These rights are subject to certain exemptions to safeguard the public interest and our interests.

6. Additional Disclosure under California Consumer Privacy Act

6.1   Additional Disclosure

This section applies solely to Californian consumers' Personal Information processing and is intended to address the relevant notice requirements of the California Consumer Privacy Act of 2018.

1. (a)   Your information, sources and purposes: please refer to the sections above explaining what Personal Information we collect (section 2.2.), how we collect it (section 2.5) and how we use the Personal Information (section 2.4) including grounds for each category of use (section 5.1).
2. (b)   Sharing your information: we may share your information with certain categories of third parties, please refer to disclosure of Personal Information to third parties (section 3.1) above. We reiterate that under no circumstances will Shona Joy sell or receive payment for licensing or disclosing your Personal Information. We may allow certain third parties to collect your personal information via automated technologies on our Websites to serve you content and advertisements that may be of interest to you. You have the right to opt out of these as described in sections 2.5 and 3.1 above.
3. (c)   Additional rights: subject to exceptions under applicable law, you may have certain choices regarding our use and disclosure of your Personal Information as described below:

(i)     Access: you have the right to request (twice in a 12 month period) that we disclose to you the Personal Information we have collected about you during the past 12 months and details regarding our collection, use and disclosure of such information.(ii)     Deletion: you have the right to request that we delete Personal Information collected from you.(iii)     Opt-out: you have the right to opt out of the activation of cookies (as detailed in section 2.5) and of collection of Personal Information via Google Analytics (as detailed in section 3.1).

You can exercise these rights by contacting us (details at clause 7 below). If you choose to exercise any of these rights, you will not receive discriminatory treatment by us.

7. Accessing your Personal Information

You have the right to request access to Personal Information that is held by Shona Joy about you.

You also have the right to request the correction of any of your Personal Information that Shona Joy holds. We will take reasonable steps to make appropriate corrections to Personal Information so that it is accurate, complete and up-to-date.

To seek access to, or correction of, your Personal Information please contact Shona Joy as follows:

info@shonajoy.com.au

Shona Joy also welcomes any comments on its Privacy Policy to assist with the evaluation of its effectiveness. Comments will be handled confidentially.

8. Use of your Personal Information to contact you (including via SMS)

We will never knowingly send you unsolicited commercial electronic messages. More information on the Spam Act 2003 (Cth) is available from the regulator’s website:

www.acma.gov.au/spam

We may use information that we know about your likes and interests to tell you about Shona Joy products or promotions. We may know about your likes and interests because you have provided that information.

By entering your phone number in the checkout (while initiating a purchase) or subscribing via our subscription form (or Facebook form), you agree that we may send you SMS notifications. These notifications may relate to an order (including abandoned cart reminders) or be SMS marketing offers.

SMS marketing messages will not exceed 20 messages per month and you acknowledge that consent is not a condition for any purchase order.

9. Opting out

If you decide that you do not want to be contacted by Shona Joy please contact us (details at clause 7 above). You may also opt out of receiving communications by following the unsubscribe function on any Shona Joy communications.

You understand and agree that alternative methods of opting out, such as using key word replies or request replies may not be accounted as a reasonable means of opting out and message or data rates may apply.

We will use reasonable endeavours to remove your name from the mailing/SMS lists within a reasonable period of receiving your request.

10. Storage and protection of your Personal Information

Shona Joy stores Personal Information electronically on servers hosted by our service providers. Shona Joy has implemented appropriate physical, electronic and managerial security procedures in order to protect Personal Information from loss, misuse, alteration or destruction. Shona Joy regularly reviews security and encryption technologies and will strive to protect information to the fullest extent possible.

Due to the nature of the internet, Shona Joy cannot give any warranties as to the security of any Personal Information transmitted by you to Shona Joy over the internet, or that Personal Information will not be accessed by unauthorised persons.

We encourage you to be vigilant about the protection of your own Personal Information when using any digital services.

11. Linked Sites

Our Websites may contain links to other sites. We are not responsible for the privacy practices or the content of such websites. We encourage you to read the privacy statements of any linked sites as their privacy policy may differ from ours.

12. Personal Information About Other People

If you give us Personal Information about any other person in relation to or in connection with the provision of our services:

(a)   we are entitled to assume that you have sought their consent to the disclosure of such Personal Information to us; and(b)   we will collect, hold, use and disclose their Personal Information in accordance with this Privacy Policy.

13. Complaints

If you wish to make a complaint about our handling of your Personal Information, you should first make a complaint in writing to us. We will handle your complaint seriously and confidentially and will provide you with a response in a reasonable time period (usually 30 days). If we are unable to resolve your complaint, or you are not satisfied with the response, you may seek to have the matter resolved through mediation.

14. National Privacy Commissioner

If you are not satisfied with the way in which we handle your enquiry or complaint, or you wish to make a complaint about any perceived breach by Shona Joy of the APPs you can contact the Office of the relevant Privacy Commissioner on:

Tel 1300 363 992 or email: privacy@privacy.gov.au