1. BACKGROUND Thanks for visiting our Privacy Policy (Policy), we are Shym Solutions Pty Ltd ACN 643 148 725 of 17 Napoleon Street, Perth, Tas 7300 (Shym Saunas and Spas, we, our, us, and other similar terms). We are committed to providing quality services to you and this Policy outlines our ongoing obligations in respect of how we manage your Personal Information. It applies to our terms of sale and other agreements we may form with you. When we talk about Personal Information, we mean information or an opinion about an identifiable individual (not a company), whether or not that information or opinion is true or in a material form (Personal Information). 2. DISCLAIMER While your privacy is important to us, nothing in this Privacy Policy constitutes a voluntary opt-in to any privacy laws, anywhere in the world, which we are not statutorily bound to comply with. 3. COLLECTION OF PERSONAL INFORMATION 3.1 How we collect Personal Information We collect Personal Information in the ordinary course of our business, which includes the design, manufacture, distribution and sale of saunas and hot tubs. Personal Information is collected when you: 1. contact or correspond with us via email, telephone or via our website; 2. subscribe to our newsletters or complete surveys and online forms; 3. purchase or enquire about our goods and services; 4. seek support in relation to our goods and services; or 5. make customer service-related inquiries. Information will only be collected directly from you unless you authorise another person to provide the information. 3.2 What Personal Information is collected? The types of Personal Information we collect include your name, address, telephone number, email, IP address, device identification, your social media details, and any additional information you provide to us. Where you contact us on behalf of your employer, the information you provide often contains information about your employment, position, and employer’s contact details. In those circumstances, certain employment information is collected. 4. HOW SHYM SAUNAS AND SPAS USES PERSONAL INFORMATION 4.1 Why we collect Personal Information We collect your Personal Information for the primary purpose of providing our goods and services to you. We may also use your Personal Information for secondary purposes closely related to the primary purpose, in circumstances where you would reasonably expect such use or disclosure. Examples of when we may use your Personal Information include: 1. informing you about our goods and services; 2. providing you with the goods and services you have requested; 3. administration needs in relation to providing you with goods and services, including the administration of your account; 4. dealing with requests, inquiries or complaints, and other customer care related activities; 5. arranging for the delivery of goods you purchase; and 6. carrying out any activity in connection with a legal, governmental or regulatory requirement imposed on us or in connection with legal proceedings, crime or fraud prevention, detection or prosecution. 4.2 Direct marketing Where you provide us with consent to do so (e.g. if you have subscribed to our email or have indicated that you are interested in receiving offers or information from us), we may send you marketing communications by email about products and services that we feel may be of interest to you. You can opt-out of such communications if you would prefer not to receive them in the future by using the “unsubscribe” facility provided in the communication itself. 5. COOKIES AND BROWSER ANALYTICS 5.1 What are cookies Cookies are small text files that are placed on your computer by the websites you visit. They are processed and stored by your web browser. When you visit a website or engage with a business through social media, certain information is collected by cookies. This is generally anonymous information and it does not reveal your identity. In and of themselves, cookies are harmless and serve crucial functions. They are widely used in order to make websites work more efficiently and improve the user experience, as well as to provide information about the use of a website. 5.2 Why we use cookies By storing and using information about your use of our website, including preferences and habits, we are able to make your visit to our website more productive. For example, some cookies remember your language or preferences so that you do not have to repeatedly make these choices. 5.3 We may use the following types of cookies: Required cookies. These are cookies that are required for the operation of our website. They include, for example, cookies that pass information from one web page to another and to use online forms. Analytical cookies. These allow us to recognise and count the number of visitors and to see how visitors move around our website when they are using it. This helps us to improve the way our website works, for example, by ensuring that users are able to find what they are looking for easily. We also use third-party cookies, such as those provided via the Google Analytics service. The information passed back to such third-party providers is anonymous. Marketing cookies. These are used to recognise you when you return to our website. This enables us to personalise our content for you and remember your preferences. These cookies also record your visit to our website, the pages you have visited, and the links you have followed. We may use this information to make our website and communications sent to you more relevant to your interests. 5.4 How can I remove cookies Your web browser can choose whether or not to accept cookies. Most web browser software is initially set up to accept them. If you do not want your browser to use cookies, you can manage and control their use through your browser, including removing cookies by deleting them from your “browser history” (cache) when you leave the site. However, if you choose to reject cookies some parts of our website may not work properly. 6. DATA RETENTION AND SECURITY 6.1 Security mechanisms we employ Generally, we store your Personal Information using secure servers protected from unauthorised access, modification and disclosure. However, like most businesses, we hold some information on our staff’s computers (such as emails from you) and where necessary as hard copy files (such as printed invoices). Personal Information that we store or transmit is protected by security and access controls, including username and password authentication, multi-factor authentication, and data encryption (such as SSL) where appropriate. In our dealings with third-party service providers, we take care to work with subcontractors and service providers who we believe maintain an acceptable standard of data security compliance. 6.2 How long we keep your Personal Information We retain your Personal Information for as long as is necessary to provide our goods and services to you, as required for our internal business operations, and to comply with our legal obligations. If we hold Personal Information about you, and we do not need that information for any purpose, we will take reasonable steps to destroy or de-identify that information, in accordance with the Australian Privacy Principles (APP), unless we are prevented from doing so by law. Under Australian law, financial records, such as those relating to financial transactions, must be retained for 7 years after the transactions associated with those records are completed. 7. DISCLOSURE OR YOUR PERSONAL INFORMATION 7.1 Who we share your Personal Information with? Your Personal Information may be disclosed to: 1. our employees, a related company, and our professional advisers (lawyers, accountants, financial advisers, etc.); 2. regulators and government authorities in connection with our compliance procedures and obligations, including law enforcement agencies to assist in the investigation and prevention of criminal activities; 3. third party contractors, suppliers, and service providers with whom we have a business association, including: • delivery and transportation providers; • payment gateway providers, such as Google via its GPay services; • administration service providers; • marketing service providers; and • information technology service providers, including cloud application providers. We will not disclose your Personal Information other than in accordance with this Policy without your consent. 7.2 Offshore transfers While we do not otherwise actively disclose your Personal Information to overseas entities, our engagement of service providers, such as those who operate cloud services, may have international data centers and disaster recovery sites. Consequently, these providers may have access to your information offshore. We rely solely on reputable organisations for such cloud services. 8. ANONYMITY AND USE OF PSEUDONYMS If you contact us with a general enquiry, we may interact with you anonymously or through the use of pseudonyms. However, you are required to provide true and accurate details when requesting the supply of goods or provision of services. You agree you will provide accurate information if we require it. 9. ACCESS OF PERSONAL INFORMATION AND CORRECTIONS We endeavor to only hold Personal Information that is accurate, complete and up-to-date. You have the right to make a request to access Personal Information which we hold about you and to request corrections of any errors in that data. To make an access or correction request, contact us using the contact details provided at the end of this Policy. In order to protect your Personal Information, when you contact us, we may require identification from you before releasing the requested information or making the correction. 10. COMMUNICATIONS AND PRIVACY CONCERNS Your privacy is important to us. If you have any complaints, concerns or questions about our handling of your Personal Information, we ask that you first contact our privacy officer whose contact details are listed below. We will investigate your complaint and reply to you in writing if you provide us with contact details and request us to do so. Email: art@shymsaunas.com.au Telephone: 0422 880 083 Post: 1B 17 Napoleon Street, Perth, Tas 7300 If, after we have conducted our investigations you are still not satisfied, then we ask you to consult with the Office of the Australian Information Commissioner: Email: enquiries@oaic.gov.au Telephone: 1300 363 992 (from overseas +61 2 9284 9749) Post: GPO Box 5218 Sydney NSW 2001 11. VARIATIONS TOP THIS POLICY We will need to change this Policy from time to time in order to make sure it stays up to date with the latest legal requirements and any changes to our privacy management practices. When we do change the Policy, we’ll make sure to notify you about such changes, where required. A copy of the latest version of this Policy will always be available on this page. This Policy was last updated on 15 July 2022