Threebyone recognises the importance of your privacy and is committed to the protection of your Personal Information in accordance with the Privacy Act 1988 (Cth) as updated or amended from time to time (“Privacy Act”) and the Australian Privacy Principles.

In this policy (“Privacy Policy”) the terms “Threebyone”, “TBO”, “we”, “us”, and “our” refers to Threebyone Holdings Pty Ltd ACN 616 443 022 and its associated entities.

This Privacy Policy applies to your dealings with any TBO business or brand including via any of our websites and through any of our physical store locations. We own and operate the following apparel brands:

TBO is also committed to handling Personal Information in accordance with the EU General Data Protection Regulation (“GDPR”) to the extent that we collect the Personal Information of individuals who are located in, or residents of, the European Union (“EU”).

If you are based in the EU, Schedule A sets out the additional privacy information applicable to you under the GDPR.

If you are a California resident, please review Schedule B which contains privacy disclosures where we act as a business under the California Consumer Privacy Act of 2018.

1 Application of our Privacy Policy

This Privacy Policy describes the way in which TBO collects, holds, uses and discloses your Personal Information in connection with its wholesale and retail operations. 

This Privacy Policy also covers how we make the Personal Information we hold available for access and correction by you and how you can make a complaint.

This Privacy Policy applies whether you're interacting with us online via any of our websites (the “Websites”), in our stores or through our customer service team whether using your mobile phone, personal computer, or any other means, or by otherwise providing Personal Information to us, you are taken to have agreed to the provisions of this Privacy Policy and you consent to the collection, use and disclosure of your Personal Information in accordance with this Privacy Policy.

What is Personal Information and Sensitive Information?

Personal Information is defined in section 6 of the Privacy Act and broadly means any information or opinion that identifies you or can be used to identify you, or from which you are reasonably identifiable, whether the information or opinion is true or not, and whether recorded in a material form or not.  Common examples of Personal Information include your name, address, telephone number or date of birth.

Sensitive Information is a specific type of Personal Information that includes health information and information about an individual’s race, ethnic origin, political opinions, membership of political, professional or trade associations, religious or philosophical beliefs, sexual preferences and criminal history.

In this Privacy Policy, except as otherwise stated, all references to “Personal Information” include “Sensitive Information”.

It is completely up to you whether or not you choose to share your Personal Information with us, but you may not be able to access some areas of our Websites, or effectively use the services offered through our Websites, without providing us with certain Personal Information.

2 What kinds of Personal Information we collect?

We only collect Personal Information about you that is necessary to provide our products and services to you and to perform our functions and activities.  If you do not provide us with the Personal Information we request, we may not be able to provide you with our services, access to our Websites, provide you information or other assistance you seek. We may collect information including:

• full name;
• delivery and billing address;
• email address;
• telephone number and other contact details;
• date of birth;
• payment information, including credit card information;
• purchase history and order details;
• returns and exchange history;
• gender preferences and interests, including sizing, style preferences and wish list items;
• responses to surveys, competitions and promotional campaigns;
• device identity and type, IP address, geo-location information, page view statistics, advertising data and standard web log information;
• customer service interactions; 
• video footage via the use of CCTV and other video recording devices in use at our stores;
• product reviews & ratings, including age, location, sizing, review of experience; and
• any other information provided by you to us via this website or our online presence, or otherwise required by us or provided by you.

3 How we collect Personal Information

We may collect Personal Information in the following circumstances: 

• when you make a purchase through one of our Websites or other retail channels;
• when you create an account on one of our Websites, sign up to a mailing list, or participate in a promotion or competition;
• when you correspond with our customer service team or correspond with our staff;
• when you interact with us via social media or other digital platforms;
• when you leave a product review or rating;
• when you apply, or register your interest for, employment or a work placement opportunity with us (see section 9 of this policy);
• when you visit our Websites, including through use of cookies and analytics tools;
• when you provide us with your Personal Information in-store, online or at a TBO event;
• when you visit one of our stores and CCTV, surveillance cameras or other recording devices are in use;
• when you request a product return; and
• when required by law.

We generally collect Personal Information directly from the individuals concerned.  However, if this is not practicable, we may collect Personal Information about individuals from third parties, including from publicly available sources.  If we do, we will take reasonable steps to ensure that the individuals concerned are made aware of the collection of their information.

We also collect Personal Information to communicate updates about our products, promotions and other marketing information, including events.  If you prefer not to receive these communications, please contact us using the details in section 13.

If you are a wholesale partner, we may collect your contact information through enquiry forms on our Websites, including (but not limited to) your name, email address, phone number, postal address, and payment information.

4 Information collected via our Websites

Except as otherwise provided for in this Privacy Policy, TBO will not collect any Personal Information from you when you use our Websites except when you knowingly provide it (e.g., by submitting a ‘Contact Us’ form, signing up for a ‘Newsletter subscription’, creating an account, making a purchase, using our ‘live chat’ feature or completing any other ‘enquiry’ form on one of Websites) or as otherwise described below. 

Click Stream Data

When you visit and browse our Websites, our third party service providers may collect information (which may or may not include Personal Information) for statistical, reporting and maintenance purposes.  The information may include:

• the number of users visiting our Websites and the number of pages viewed;
• the date, time and duration of a visit;
• the IP address of your device;
• the path taken through our Websites; and
• your behaviour on the Website such as viewed products, abandoned carts, and products added to cart.

Our third party service providers use this information to help administer and improve the performance of our Websites.

Cookies

Our website uses cookies to provide the functionality necessary to deliver our products and services.

Our website also uses a number of third party services such as analytics and security that also utilise cookies. We do not control these third parties or their cookies and we refer you to the third party’s website for details on how they use their cookies. 

Cookies are small text files that are placed in your web browser when you visit a Website. Cookies are used to personalise content and advertising, for security and session management, and to enhance your experience when using our Website.

Most web browsers are configured to accept cookies, however you may configure your browser to reject cookies or to notify you when a cookie is sent.  If you reject all cookies, you may not be able to access our Websites or the functionality of our Websites may be reduced.  

The information they collect may be associated with your Personal Information or they may collect information, including Personal Information, about your online activities over time and across different websites and other online services. They may use this information to provide you with interest-based (behavioural) advertising or other targeted content.

For further information, please refer to our Cookies Policy.

Web Beacons

Web beacons are images that originate from a third-party site to track visitor activities.  TBO and/or its third-party service providers may use web beacons to collect aggregate data and provide this information to our Website hosting providers to help administer and improve the performance of our Websites.

5 Information we collect from third parties

TBO may collect Personal Information about you from third parties (as described in this Privacy Policy).  We are not responsible for how those third parties collect or process your Personal Information.  Any information request regarding the disclosure to us of your Personal Information by a third party, should be directed to those third parties.

If you click on an online advertisement for TBO (e.g., ads on Google or social media platforms) the third party service hosting that advertisement will collect certain information and may provide that information to us to allow us to measure the effectiveness of our advertising.

6 Sensitive Information

The Australian Privacy Principles impose greater obligations on us regarding our collection, use or disclosure of your Sensitive Information.

We will only collect your Sensitive Information, if:

• it is reasonably necessary to allow you to use our Websites and for you to receive our products or services; or
• you have consented to us doing so; or
• we are required or authorised to do so by law.

7 Use of Personal Information

TBO uses the Personal Information we collect about you to provide products and services and for our business functions and activities, which may include the following:

For our Websites

To maintain, operate and improve our Websites, including to:  

• enable you to access and use our Websites and provide our products and services;
• enable you to create, manage and update your customer account and profile;
• maintain and update our customer records;
• operate, improve, and optimise our Websites and related services, such as by performing analytics and conducting research;
• help us provide effective customer service and support to customers;
• notify you when products are available for purchase again;
• remind you of appointments or orders;
• process orders and manage and administer payments, refunds and order fulfillment; and
• send you order confirmation emails, shipping updates and account notifications and other service-related communications.

For security and risk management

For security and risk management purposes, including to:  

• verify or authenticate information or documents provided by you;
• detect and prevent fraud, spam, abuse, exploitation, neglect, and other harmful activity;
• conduct security investigations and risk assessments;
• resolve any disputes or issues with you;
• to ensure the safety of our customers and staff who visit our stores and to prevent theft;
• enforce our agreements with you, including this Privacy Policy and our terms of use; and
• comply with our legal obligations and protect our lawful interests.

For secondary purposes

TBO may use your Personal Information for a secondary purpose if: 

• that secondary purpose is related to the purposes listed above, and you would reasonably expect us to use it for that secondary purpose; 
• we have your consent; or 
• otherwise provided for under the Privacy Act.

For marketing

TBO may use your Personal Information to provide you with direct, targeted, or other marketing materials on an ongoing basis.  Subject to and in accordance with applicable law, TBO may provide you with these materials by telephone, electronic messages (e.g. email), through social media sites and marketing platforms managed, used or owned by TBO and other means.  

TBO will only provide you with direct marketing materials where you would reasonably expect us to, or if you consent to receive direct marketing materials.  We will seek your consent to provide you with direct marketing materials if we have obtained your Personal Information from a third party.  

Direct marketing communications may include promotional material about us or may relate to the services that we and our related entities provide and other products and services which may be of interest to you.

You may opt out of receiving direct marketing material by clicking ‘unsubscribe’ link in the direct marketing materials and following the instructions to unsubscribe or by contacting us using the details set out in the “Contact us” section below. 

Compliance with law

Generally, we will only collect and use your Personal Information in accordance with this Privacy Policy.  In the event that we collect or use Personal Information in ways other than as stated in this Privacy Policy, we will ensure that we do so in accordance with the Privacy Act.

8 Disclosure of Personal Information

Who we may disclose Personal Information to

Depending on the nature of your dealings with TBO, we may disclose your Personal Information to our associated entities, officers, employees, contractors, consultants, freelancers, advisers, interns and agents of TBO, third parties that provide products and services to or through TBO or our Websites, directly to you (at your request), suppliers and other third parties, or otherwise as required by law. 

• Our brands and associated entities: When you provide Personal Information to one of our brands, we may share it with our other brands or associated entities within the TBO group to fulfill any purpose described in this Privacy Policy.
• Service providers: We may also disclose your Personal Information to our third-party service providers, including those that provide the following services:  website hosting; payment processing; shipping and logistics; marketing and advertising;  social media;  analytics; IT and cloud providers; and security and fraud prevention. 

We may also share non-personal, de-identified and aggregated information for research or promotional purposes. We will not sell your Personal Information to third parties for marketing purposes.

• Government and public authorities: We may share your Personal Information with government and public authorities if necessary or appropriate, in our good faith judgment, to comply with laws or regulations, including in response to a valid subpoena, order, investigative demand, request for cooperation from a law enforcement agency or similar request from a self-regulatory body or government agency.
• Relevant third parties in connection with a sale or business transaction: We may disclose your Personal Information to relevant third parties in connection with a sale or business transaction. We may disclose or otherwise transfer your personal information to an acquirer, successor, or assignee as part of any merger, acquisition, debt financing, sale of assets, or similar transaction as well as in the event of any insolvency, bankruptcy, or receivership in which information is transferred to one or more third parties as one of our business assets.

Unless otherwise specified in this Privacy Policy, TBO or our Websites host will not disclose any of your Personal Information to any other organisation unless the disclosure is required by law or is otherwise permitted by the Australian Privacy Principles.

Overseas disclosure 

We may from time to time transfer or disclose your Personal Information to our overseas affiliates or third party service providers, including those located in New Zealand, the United Kingdom, Israel, India, China, Vietnam, Pakistan, Iraq and the United States of America.

Where we transfer information overseas, we will take reasonable steps to ensure that the overseas recipient does not breach the applicable Australian Privacy Principles.

We also use some third parties to administer part of our service delivery, so some of the uses and disclosures may occur outside of your country of residence. This means that sometimes we'll need to transfer your personal information between countries (as listed above) and in particular to and from Australia.

By providing your Personal Information to us, you agree to this transfer, storage and processing. We will take reasonable steps to protect your Personal Information and prevent any third parties outside of your country of residence using your Personal Information in any way that's not consistent with this Privacy Policy.

9 How do we handle the Personal Information of job applicants? 

TBO collects information about and from individuals who apply for employment with TBO including job placements and internships.  The information we collect may include an individual’s Personal Information, and includes the applicant’s:

• contact details;
• gender;
• in some cases, racial background (see below);
• educational and employment history, and relevant qualifications;
• eligibility to work in Australia; and
• referees’ contact details.

Additionally, TBO may collect any Personal Information that an applicant voluntarily discloses during the application process, which could include Sensitive Information.

This information may be collected directly from the applicant in response to a job listing or indirectly from third parties, such as recruitment agencies.  If necessary, we may also obtain information from referees and public sources, such as professional networking sites like LinkedIn.

If an applicant advances to the interview stage, we may collect further details regarding their participation and performance during the interview.

TBO is committed to diversity and inclusion, and as part of this commitment, we collect information on whether a job applicant identifies as Aboriginal or Torres Strait Islander. This information is used solely for diversity purposes and will not be used for any other reason.

If you do not provide us with the information we request, we may not be able to process or assess your job application.

TBO uses the Personal Information of job applicants to evaluate their eligibility and suitability for specific roles.  While our primary focus is on the role for which the application was made, we may retain and use the information to consider applicants for other positions within the company.  

As required or permitted by applicable laws, TBO may obtain police, background, other checks on you.  We may use your Personal Information, including your full name and date of birth, to obtain such reports. Personal information may also be received from service providers who conduct background and eligibility checks on our behalf.

TBO will not ask to collect Sensitive Information about you except where it is needed as part of our equal employment opportunities policy, for the purpose of assessing dietary requirements or another reason for which we have your consent and collection is necessary for that purpose.

10 Access to Personal Information

How you can access your Personal Information

You have a right to access your Personal Information.  If you would like to do so, please direct your request to TBO by email or post using the contact details set out in the “Contact us” section below.

Sometimes, we may not be able to provide you with access to all of your Personal Information.  This may include where giving you access would be unlawful or would have an unreasonable impact on the privacy of other individuals.  If we refuse you access, we will tell you why.  

We reserve the right to charge a fee for searching for and providing access to your Personal Information (but not for the request itself).  We may need to verify your identity as part of this process.

Accuracy of Personal Information

We will take reasonable steps to ensure that the Personal Information that we hold is accurate, up-to-date and complete.  You have a right to request that your Personal Information be corrected.  If you think that the Personal Information we hold about you is not accurate, complete or up-to-date, please contact us using the contact details set out in the “Contact us” section below and we will take all reasonable steps to correct the information.  

11 Security of Personal Information

Precautions taken 

We understand the importance of protecting your Personal Information.  We take all reasonable steps to protect the Personal Information we hold about you from misuse, interference and loss, and from unauthorised access, modification or disclosure.

Our Websites are hosted on secure servers and have electronic security systems in place, including the use of firewalls and data encryption. 

User identifiers and passwords are also used to control access to your personal information. Multi-factor authentication is utilised and access to your Personal Information is restricted to only those members of staff who require access for their role and job-function.

TBO aims to keep your Personal Information secure and up to date.  We will comply with our obligations under the Privacy Act in relation to any Personal Information that we handle, including information which is held on TBO’s systems.

Personal Information that is held by TBO in hard copy is stored securely on our premises and is only disclosed or used for the purposes described in this Privacy Policy.

Links

TBO’s Websites and systems may link to other websites which are outside our control, and other websites outside our control may link to TBO’s Websites and systems.  We are not responsible for the handling and protection of any Personal Information which you provide while you are visiting or using those other sites, online products or services.  Those websites are not governed by this Privacy Policy.  You should exercise caution and review the privacy policies applicable to those other sites.

How long we keep your Personal Information for

TBO will keep your Personal Information only for as long as required for the purposes described in this Privacy Policy and otherwise as required by Australian law.

Where we no longer need to keep your Personal Information in accordance with this Privacy Policy, we will take reasonable steps to destroy or de-identify your Personal Information.

If you wish to have your Personal Information destroyed or de-identified, please let us know using the “Contact us” form on our Websites, or by using the contact details listed in the “Contact us” section below, and we will take reasonable steps to do so (unless we need to keep it for legal, auditing or internal risk management reasons).

12 Anonymity and pseudonymity  

Where practicable, you may choose to interact with us anonymously or by using a pseudonym. However, in most circumstances, we may not be able to provide our services or respond to your inquiries unless you provide certain personal information. For example, identification may be required by law or so that we can provide our products and services to you. 

13 Contact us 

If you have any questions or would like further information about our privacy policies or practices, please contact our privacy team using any one of the following means:

• Email: privacy@threebyone.com.au 
• Telephone: +61 (3) 9415 6652 
• Post:  68-70 Hanover Street, Fitzroy VIC 3065

14 Data breaches or complaints

If you wish to report a data breach or make a complaint about the way we have collected, handled or disclosed your Personal Information, please contact us using the contact details listed in the “Contact us” section above. 

Any complaint should be first made in writing and include the date, details of your complaint or the alleged breaches, and how you would like your complaint resolved.

We aim to resolve all enquiries and complaints within a reasonable period.  Some complaints can be resolved quickly, but more complex complaints may take longer.  You may withdraw your complaint at any time.  

If we do not resolve your complaint to your satisfaction and no other complaint resolution procedures are agreed or required by law, we will inform you that your complaint may be referred to the Office of the Australian Information Commissioner (OAIC) for further investigation and will provide you with the OAIC’s contact details.

15 Changes to our Privacy Policy

We reserve the right to change our Privacy Policy at any time.  We will notify you about changes to this Privacy Policy by posting an updated version on our Websites.

Schedule A: GDPR

This Schedule is to be read in conjunction with the Privacy Policy and provides additional privacy information as required under the GDPR, as to how we collect, hold, use or otherwise process the Personal Information of individuals who are located in the EU or the European Economic Area (“EEA”).  TBO is committed to upholding these practices when dealing with the Personal Information of EU residents. 

For the purposes of this Schedule, Personal Information will also include “personal data” as defined in GDPR.

In most cases, TBO is primarily the “controller” of Personal Information and will provide its services in a way such that Personal Information will be processed fairly, lawfully and in a transparent manner, and collected and processed only for specified and lawful purposes.

1 Legal Bases for Processing

TBO will only collect and process your Personal Information where we have legal bases for doing so.  Depending on the services you seek or use, TBO may rely on the following legal bases for processing Personal Information:

• when it is necessary for the performance of a contract to which you are a party (such as fulfilling your order), or to take steps at your request, or to respond to your inquiries before entering into such a contract;
• where you give consent to us to process your Personal Information for a legitimate purpose;
• where there is a legitimate interest for TBO to process the Personal Information (e.g. to protect our legal rights and interests); and
• where TBO must process the Personal Information to comply with its legal obligations.

In addition to the purposes set out in section 3 of the Privacy Policy, TBO may process your Personal Information: 

• by collecting and storing customer and wholesale client details (such as name, contact information, and purchase history) in internal systems including our accounting, and e-commerce platforms; 
• by backing up databases and systems that contain Personal Information to ensure business continuity and data integrity; 
• by transferring Personal Information between systems or entities within the TBO group for operational, administrative or support purposes; 
• by sharing Personal Information with third-party service providers (such as logistics, IT support, marketing platforms, and payment processors) to enable service delivery and business operations; 
• by analysing aggregated or anonymised Personal Information to understand customer demographics, purchasing behaviour, and product performance; 
• by maintaining records of customer interactions, including enquiries, complaints, and feedback, for quality assurance and training purposes; 
• by managing and updating marketing preferences and mailing list subscriptions, including processing opt-ins and opt-outs; 
• by verifying your identity when you request access to your Personal Information or exercise your data rights; 
• by conducting internal audits, compliance reviews, and reporting activities; 
• by anonymising or securely deleting Personal Information in accordance with our data retention policies; 
• by using cookies, pixels, and analytics tools to understand how users interact with our Websites and digital platforms; 
• by storing Personal Information in cloud-based systems hosted by third-party providers; 
• by monitoring and securing our systems and networks to prevent fraud, unauthorised access, or other security threats; or
• as required or authorised by law.

If you have consented to our use and processing of your Personal Information for specific purposes, you have a right to withdraw your consent at any time. 

Third parties will only process your Personal Information in accordance with TBO’s instructions and where the third party complies with the GDPR requirements or other data protection laws for the processing and transfer of Personal Information.

2 Profiling and Automated Processing of Personal Information

TBO does not make decisions or predict personal aspects of an individual using automated processing of Personal Information.  However, we may collect certain information from you in relation to your visits on our Websites and online activity.  This may in some circumstances constitute “profiling” under the GDPR.  Furthermore, TBO may undertake “profiling” to personalise your experience on our Websites, our communications with you and improve our service offerings to you. 

3 Cookies

Our Websites use cookies to provide the functionality necessary to deliver our products and services.  Our Websites also use a number of third party services such as analytics and security that also utilise cookies.  We do not control these third parties or their cookies and we refer you to the third party’s website for details on how they use their cookies.

Cookies in use may identify individuals who log into our Websites.  You can reject cookies by changing the settings on your browser but doing so may limit your functionality and user experience within our Websites.  

For further information, please refer to our Cookies Policy.

4 Direct Marketing

TBO will not use direct marketing as outlined in the Privacy Policy to market its products and services to you unless: 

• TBO has received express consent from you to use your Personal Information for that purpose; or
• as otherwise permitted by law.

If an individual has agreed to receive marketing, the individual may always opt out at a later date.  

Refer to the Privacy Policy for the process in which this can be done.

5 Transfers Outside the EEA

While we aim to process your Personal Information within the EEA, there are some circumstances under which your Personal Information may be transferred and processed outside of the EEA. This may include when we share your information with a related foreign entity or with third party service providers based overseas.

In some cases, the overseas recipient will reside in a country that has been deemed to offer an adequate level of data protection by the EU Commission (Adequacy Decision). For transfers to the United States, we may rely on U.S. recipients that are certified under the EU-US Data Privacy Framework in accordance with Article 45 of the GDPR. We will only rely on the Framework where the relevant U.S. recipient holds an active and valid certification.

When Personal Information is transferred outside the EEA and the recipient is not subject to an Adequacy Decision, or the EU-US Data Privacy Framework, in addition to the procedures and safeguards used to secure Personal Information set out in the Privacy Policy, TBO will also implement other appropriate safeguards in accordance with the GDPR which may include: 

• binding corporate rules;
• the European Commission’s Standard Contractual Clauses; and
• additional contractual, organisational, and technical measures designed to ensure that individuals retain enforceable rights and effective legal remedies.

For further information, contact us using the details set out in section 13 of the Privacy Policy.

6 Correct, Update or Delete Personal Information

You have the following right to request:

• the correction of Personal Information that TBO holds of you that you believe to be incorrect;
• the completion of Personal Information that TBO holds of you where you believe this is incomplete; and
• the deletion or erasure of certain Personal Information, in certain circumstances and in accordance with our obligations under the GDPR.

7 Your Rights Regarding Your Personal Information

You have the right to:

• access a copy of the Personal Information TBO holds about you;
• obtain from TBO further information as to details about the processing of your Personal Information, including the purposes of the processing;
• obtain from TBO a copy of the Personal Information that TBO has collected about you;
• withdraw consent where TBO is processing your Personal Information based on that consent;
• object to the processing of your Personal Information in the particular circumstances outlined in the GDPR; 
• restrict or limit how TBO processes your Personal Information in the particular circumstances outlined under the GDPR;
• have your Personal Information transferred to you or a third party a portable format, in the particular circumstances outlined in the GDPR;
• request the erasure or deletion of Personal Information held of you by TBO (in certain circumstances).

Please note that in some cases, we may then be unable to offer or provide our services to you once we process your request.  If you ask us to restrict the collection or use of your Personal Information, we will let you know how the restriction may affect the services we can provide to you. 

In addition, your objection to certain processing may not be granted if TBO believes it has legitimate grounds to process Personal Information which overrides your rights and freedoms under the GDPR.

8 Requests and Complaints

Requests

You can exercise your rights by contacting TBO using the details set out in section 13 of the Privacy Policy.  When TBO responds to a request under this Schedule, TBO may not refuse to act on the request, unless it can demonstrate that it is not in a position to verify you or we are not obligated to do so by law or the GDPR.

We will otherwise endeavour to respond to your request in a timely manner and within one month of receipt of the request.  This period may be extended by two further months where necessary, taking into account the complexity and number of the requests.  TBO will inform you of such an extension within one month of receipt of the request, together with the reasons for the delay.

If TBO decides not to take action in response to your request, we will inform you of our decision within one month of receipt of the request, provide our reasons for not taking action, and provide you with details on how you may lodge a complaint with a supervisory authority and seek a judicial remedy, if you are dissatisfied with the outcome.

Complaints

If you have a complaint about our processing of your Personal Information or our response to your requests or complaint, you have a right to lodge a complaint with the relevant supervisory authority.

Schedule B: CCPA

This Schedule to the Privacy Policy applies to residents of the State of California, USA.

This Schedule is to be read in conjunction with the Privacy Policy and provides you with a comprehensive description of our online and offline practices and your rights regarding our collection, use, disclosure, and sale of your Personal Information. This Schedule provides details regarding the Personal Information that we have collected or disclosed within the preceding 12 months about California residents.

In the event of any conflict or inconsistency between the Privacy Policy and the terms of this Schedule, this Schedule will govern and prevail. Any terms not defined in the Privacy Policy but defined in the California Consumer Privacy Act of 2018 (CCPA) will have the same meaning when used in this Schedule.

1 Personal Information that we collect

We have collected the following categories of Personal Information in the past 12 months:

2 Sources of Personal Information collected by us

We obtain the categories of Personal Information listed above from a variety of sources, as described in our Privacy Policy, including from the following categories of sources:

• You provide it to us directly – e.g., by submitting a form, contacting us or making a purchase from us;
• We receive it from another party or source – e.g., our associated entities, public information and the parties described under section 5 of our Privacy Policy;
• We collect it automatically – e.g., via cookies and web beacons relating to your use of our Websites;
• User devices, such as visits to our Websites or mobile applications;
• Third party vendors who provide services on TBO’s behalf;
• Online advertising companies; and
• Publicly available sources.

3 Purposes for which we use Personal Information

As described further in section 2 of our Privacy Policy, we may use the categories of Personal Information identified above for certain business purposes specified in the CCPA, including the following:

• To provide our products and deliver our services to you and to administer, assess, maintain and improve our products and the performance of our services.
• To allow you to access and use our Websites.
• To personalise and optimise your experience when using our Websites and to ensure our products and services are relevant to you, your device, and to deliver targeted content based on your information, location and preferences.
• To provide you with assistance and support in relation to your use of our products and services and to processes and respond to a request or complaint that you may have.
• To research and develop our products and services for the purposes of improving our products and services, and to allow you to participate in surveys, competitions and promotional activities when you choose to do so.
• To communicate with you about our products and services and deliver promotional materials, special offers and general information about our products and services which are similar to those you already use or enquired about unless you have opted not to receive such information.
• To protect the safety and security of our Websites and TBO systems including detecting and responding to security incidents and other malicious or unlawful activity, and to detect, prevent and address technical issues.
• To protect TBO’s legitimate business interests including for fulfilling and exercising our obligations and rights including in circumstances where we are required to comply with regulatory orders and audit processes, and for exercising or defending legal claims.
• To generate de-identified statistical data to uncover collective insights about the use of our products and services (and not to specifically analyse personal characteristics).
• To verify your identity and to detect fraud and potential fraud, including fraudulent payments and fraudulent use of our Websites.
• In connection with business transfers to facilitate the sale, purchase, merger or demerger of any business by us, including assessing potential transfers and managing transitional arrangements.
• Other uses where you have provided your express consent.

4 Sharing and disclosure of your Personal Information

We have shared or disclosed the following Personal Information to third parties (such as our service providers, business affiliates and strategic business partners) for our operational business purposes:

• Technology and media partners (e.g. hosting service providers) that perform services for us or connect with our Websites or TBO systems (e.g. third-party applications, data storage services).
• Social media platforms (e.g. where you interact with our accounts).
• Our lawyers, accountants and professional advisors.
• Other third-party service providers, such as third-party branding service providers.
• Our related companies.
• Law enforcement authorities and government agencies where we are required or permitted to do so by law, or as a result of a legal process.
• TBO operates in multiple countries and regions including Australia, New Zealand, USA, the United Kingdom and the EU. We may handle personal information, and transfer it to recipients, in these countries and other countries, including Israel, India, China, Vietnam, Pakistan, and Iraq.
• We also may share your Personal Information in other ways for which we have provided specific notice to you, or for which you have specifically consented.

5 California Individual Privacy Rights

Under the CCPA, if you are a California resident, you may request that we:

• Disclose to you the following information covering the 12 months preceding your request:  The categories of Personal Information we collected about you and the categories of sources from which we collected such Personal Information; The specific pieces of Personal Information we collected about you; The business or commercial purpose for collecting or selling (if applicable) Personal Information about you; The categories of Personal Information about you that we sold and the categories of third parties to whom we sold such Personal Information (if applicable); and The categories of Personal Information about you that we otherwise shared or disclosed, and the categories of third parties with whom we shared or to whom we disclosed such Personal Information (if applicable).
• Delete Personal Information we collected from you. 

Under California’s “Shine the Light” law, you have the right to ask us if we have shared your Personal Information with third parties for direct marketing purposes. Such requests may be made once per year.

To make a request for the disclosures or deletion described above under the CCPA or California’s Shine the Light law, please contact us at:

• Email: privacy@threebyone.com.au 
• Telephone: +61 (3) 9415 6652 
• Post:  68-70 Hanover Street, Fitzroy VIC 3065

We will respond to your request consistent with applicable law. We will not discriminate against you for exercising your rights as described above.

When submitting a request, the request must:

• Provide sufficient information that allows us to reasonably verify you are the person about whom we collected Personal Information (or an authorised representative of such person); and
• Describe your request with sufficient detail that allows us to properly understand, evaluate, and respond to it.

We cannot respond to your request or provide you with Personal Information if we cannot verify your identity (or the authority of your authorised representative to make the request) and confirm that the Personal Information relates to you. As part of your request, please specify which right you are exercising and be prepared to provide your name and contact information. We may ask for additional information to verify your identity.

We will only use Personal Information provided in a request to verify the requestor's identity or authority to make the request.

6 No Children under 13

Our Websites are not suitable for use by children under the age of 13. TBO does not knowingly collect personal or other information from anyone under the age of 13.