Privacy Policy

1. Purpose of this Policy

This Privacy Policy explains how we collect, use, store, and disclose personal information relating to:

• Customers (including EU/UK customers under GDPR)
• Prospective customers and marketing leads
• Employees and job applicants
• Contractors and service providers
• Suppliers
• Website visitors and stakeholders

We comply with the Privacy Act 1988 (Cth), the Australian Privacy Principles (APPs), and, where applicable, the EU/UK General Data Protection Regulation (GDPR).

We operate as a wholesale purchaser and exporter of Australian essential oils, with a sustainability-led ethos (EcoVadis Platinum, B-Corp). Our business model emphasises direct-to-brand relationships rather than distributors.

2. What Personal Information We Collect

2.1 Customers (including EU/UK)

• Name, contact details
• Company details
• Order and purchase history
• Payment and transactional data (processed by secure third-party providers)
• Export documentation details (where required)
• Sustainability, traceability and quality information requests
• Website and communication records

2.2 Prospective Customers & Marketing Leads

• Name, email, phone number, job title and company information
• Notes from sales conversations
• Expressions of interest in products
• Information collected from events, business cards or online forms
• Publicly available business information (e.g., LinkedIn)
• Newsletter sign-ups and marketing preferences

2.3 Employees, Contractors & Job Applicants

• Contact details
• Resume/employment history
• Bank, TFN, superannuation details
• Emergency contacts
• Compliance, training, and WHS information
• Background checks (with consent)

2.4 Suppliers & Business Partners

• Contact details
• Business and regulatory information
• Payment and invoicing details
• Traceability and sustainability documentation (where required)

2.5 Website Visitors

• Internet service provider
• Cookies and analytics data
• IP country location summary
• Devices summary

2.6 Website Contact

• Form submissions
• Specific IP country location, source, and browser

3. How We Collect Information

We collect personal information when:

• You place an order, make an enquiry, request a sample or work with us directly
• You apply for or commence employment
• You supply goods or services to us
• You visit our website or complete an online form
• We meet at trade events or receive business cards
• We identify potential brand partners using publicly available information
• We are required to process export documentation or traceability data

We may also collect information from:

• Recruitment partners
• Referees
• Service providers handling payments, logistics, HR or IT systems

4. Why We Collect and Use Personal Information

Customers:

• Processing orders and export documentation
• Providing traceability information for essential oils
• Direct brand communication and account management
• Marketing (with opt-out options)
• Improving sustainability reporting and service quality

• Prospective Customers & Marketing Leads:
  • Responding to enquiries and providing product information
  • Qualifying sales leads and creating proposals
  • Adding individuals to marketing or newsletter lists (with consent or legitimate interest)
  • Building direct-to-brand commercial relationships

Employees & Contractors:

• • Recruitment, onboarding, payroll
  • Safety, compliance, and performance management
  • Legal and regulatory requirements

Suppliers & Partners:

• • Business relationship management
  • Compliance with sustainability and traceability requirements
  • Invoice processing

Website Visitors:

• • User experience improvement
  • Analytics and site optimisation
  • Responding to enquiries

5. GDPR Compliance (EU/UK Customers & Prospects)

Where GDPR applies, individuals have additional rights including:

• • Right of access
  • Right to rectification
  • Right to erasure (“right to be forgotten”)
  • Right to restrict processing
  • Right to data portability
  • Right to object
  • Right to withdraw consent at any time

Our lawful bases for processing include:

• • Contract performance
  • Legal obligations (e.g., export compliance)
  • Legitimate interests (business operations, B2B sales outreach)
  • Consent (marketing communications)

We will not transfer data outside the EU/UK unless appropriate safeguards exist (e.g., adequacy decisions, standard contractual clauses).

6. Disclosure of Personal Information

We may disclose personal information to:

• • Logistics and export agents
  • Payment processors
  • IT and cloud service providers
  • HR/payroll platforms
  • Regulatory or legal authorities
  • Sustainability certification bodies (e.g., B-Corp, EcoVadis assessments)

We do not sell personal information.

7. Data Storage and Security

We protect data through:

• • Encryption, firewalls, secure servers
  • Access controls and strong authentication
  • Confidentiality agreements
  • Monitoring and periodic security review

We comply with the Australian Notifiable Data Breaches (NDB) Scheme and GDPR breach notification requirements.

8. Access and Correction

You may request access or correction by contacting:

Email: info@downunderenterprises.com

Phone: +61 2 9539 7801

Link to form: Down Under Enterprises - Data Privacy Request

9. Marketing Communications

You may opt out at any time via unsubscribe links or by contacting us.

10. Cookies & Analytics

Our website uses cookies for:

• • Performance optimisation
  • Analytics insights
  • Enhanced functionality

Users may disable cookies in browser settings.

11. Employment Records

Employee records (as defined under the Privacy Act) are partly exempt from APPs, but we maintain confidentiality and security regardless.

12. Complaints

Concerns can be raised directly with us. If unresolved:

• • OAIC (Australia)
  • Appropriate EU/UK supervisory authority (GDPR)

13. Updates

This policy may be updated as required. The latest version will be available on request or on our website.