Privacy Policy
How we collect, use and protect your personal information
| PAC PLATFORM PRIVACY STATEMENT | |
| Effective date | January 2025 |
| Applies to | All visitors, buyers & sellers on the PAC platform |
| Governed by | Australian Privacy Act 1988 & Australian Privacy Principles (APPs) |
| Contact | hello@pilbaraartcollective.com.au |
1. About This Policy
Pilbara Art Collective (PAC, "we", "us", "our") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, store, disclose and protect personal information in accordance with the Australian Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs).
This policy applies to all personal information collected through our website, Shopify storefront, and any communications with PAC. By using our platform, you consent to the practices described in this policy.
PAC is a small business operator. If our annual turnover exceeds $3 million, or if we are otherwise required to comply with the Privacy Act, we will comply fully with all applicable obligations. Regardless of this threshold, we treat your privacy seriously and apply the APPs as best practice.
2. What Personal Information We Collect
2.1 From Buyers
- Name and contact details (email address, phone number)
- Delivery address
- Payment information — processed by Stripe; PAC does not store card details
- Order history and transaction records
- Communications you send to PAC or sellers through the platform
- Device and browser information collected automatically when you visit our website
2.2 From Sellers
- Name, trading name, and contact details
- Bank account details for payment disbursement
- ABN or business registration details
- Artist biography, photographs, and portfolio content
- Information about your connection to the Pilbara region
- Cultural background where voluntarily provided
- Communications with PAC
2.3 Sensitive Information
Some sellers may voluntarily share information about their Aboriginal or Torres Strait Islander heritage or cultural background as part of their artist profile. This is sensitive information under the Privacy Act. We will only collect, use, and disclose this information with your consent and for the purposes you provide it (i.e. to represent your cultural connection on the platform).
2.4 Automatically Collected Information
When you visit our website we may automatically collect:
- IP address and approximate location
- Browser type and version
- Pages visited and time spent on the site
- Referring website
This information is collected via Shopify's analytics tools and may include cookies. See Section 8 for more on cookies.
3. How We Collect Personal Information
We collect personal information:
- Directly from you when you register as a seller, place an order, or contact us
- Through our Shopify storefront when you browse or transact
- Through payment processing via Stripe at checkout
- Via email, phone, or social media when you communicate with us
- From publicly available sources (e.g. your public social media profiles, if relevant)
Where possible, we collect personal information directly from you. We will tell you why we are collecting it at or before the time of collection.
4. Why We Use Your Personal Information
4.1 Primary Purposes
- Processing and fulfilling orders
- Facilitating payment and disbursing funds to sellers
- Communicating with you about your order, account, or enquiry
- Verifying seller eligibility and managing seller accounts
- Resolving disputes between buyers and sellers
4.2 Secondary Purposes
- Sending marketing communications (with your consent)
- Improving our website and platform experience
- Complying with legal obligations
- Promoting sellers and their work through PAC's marketing channels
We will not use your personal information for purposes unrelated to those described above without your consent, unless required by law.
5. Disclosure of Personal Information
5.1 Third-Party Service Providers
We share personal information with trusted third parties who assist us in operating the platform:
| Provider | Purpose | Data Shared |
|---|---|---|
| Shopify | E-commerce platform & storefront | Name, email, address, order data |
| Stripe | Payment processing & disbursements | Payment details, bank account (sellers) |
| Sellers | Order fulfilment | Buyer name, delivery address, order details |
| Australia Post / Couriers | Delivery services | Delivery address, contact name |
| Email / Marketing Tools | Communications & newsletters | Name, email address |
All third-party service providers are required to handle your information securely and only for the purpose for which it was shared. Shopify and Stripe have their own privacy policies which we encourage you to review.
5.2 Other Disclosures
We may also disclose personal information:
- Where required or authorised by Australian law or a court order
- To protect the rights, property, or safety of PAC, our users, or the public
- With your consent
6. Data Storage & Security
Personal information is stored on Shopify's secure servers. Shopify maintains ISO 27001 certification and employs industry-standard security measures including encryption in transit and at rest.
PAC takes reasonable steps to protect personal information from misuse, interference, loss, and unauthorised access. These steps include:
- Restricting access to personal information to authorised PAC personnel only
- Using secure, password-protected systems
- Not retaining personal information longer than necessary
Despite these measures, no system is completely secure. If you believe your information has been compromised, please contact us immediately.
7. Data Retention
We retain personal information for as long as necessary to fulfil the purposes for which it was collected, including:
| Data Type | Retention Period |
|---|---|
| Order records | 7 years (for tax and legal compliance) |
| Seller account records | Duration of the seller relationship plus 7 years |
| Marketing contact lists | Until you unsubscribe or request removal |
| Website analytics | Typically 26 months (Shopify default) |
When personal information is no longer needed, we will take reasonable steps to destroy or de-identify it.
9. Your Rights
Under the Australian Privacy Principles, you have the right to:
- Access — Request a copy of the personal information we hold about you.
- Correction — Ask us to correct information that is inaccurate, incomplete, or out of date.
- Complaint — Lodge a complaint if you believe we have handled your information incorrectly.
- Opt-Out — Unsubscribe from marketing communications at any time.
To exercise any of these rights, contact us at hello@pilbaraartcollective.com.au. We will respond within 30 days.
If you are not satisfied with our response, you may lodge a complaint with the Office of the Australian Information Commissioner (OAIC) at www.oaic.gov.au.
10. Cross-Border Disclosure
Some of our third-party service providers (including Shopify and Stripe) are based overseas and may store or process your data on servers located outside Australia. By using our platform, you consent to this transfer. We only use providers who maintain privacy standards consistent with the APPs.
11. Children's Privacy
Our platform is not directed at children under the age of 13. We do not knowingly collect personal information from children. If you believe a child has provided us with their personal information, please contact us and we will delete it promptly.
12. Changes to This Policy
We may update this Privacy Policy from time to time. When we do, we will post the updated version on our website and update the effective date above. Where changes are significant, we will notify users by email. Continued use of the platform after changes are posted constitutes your acceptance of the updated policy.
13. Contact Us
For any privacy-related questions, requests, or complaints:
📧 Email: hello@pilbaraartcollective.com.au
🌐 Website: www.pilbaraartcollective.com.au/privacy
We take all privacy enquiries seriously and aim to respond within 30 days.