PRIVACY POLICY

Last Updated: 23 August 2026

100% Collective Foundation Ltd ("100% Collective", "we", "us", "our") is committed to protecting your privacy. This Privacy Policy explains how we collect, hold, use, and disclose your personal information in accordance with the Privacy Act 1988 (Cth), the Australian Privacy Principles (APPs), the Spam Act 2003 (Cth), and applicable Australian state privacy laws.

1. Anonymity and Pseudonymity

Where practical and lawful, you have the option of dealing with us anonymously or using a pseudonym (such as when making general public inquiries or browsing our informational resources). However, we require accurate personal details to process transactions, deliver physical orders, issue tax-compliant invoices, or allocate impact contributions to nominated charities.

2. Personal Information We Collect

We collect personal information reasonably necessary to operate our social enterprise model, fulfill purchases, and measure impact:

●      Contact & Order Details: Your full name, delivery address, billing address, email address, and phone number.

●      Payment Data: Transaction details, order history, and partial billing data. Payment processing is handled by PCI-DSS compliant third-party gateways; we do not store credit card numbers on our servers.

●      Charity Selection & Impact Preferences: The specific partner charity or cause you nominate during checkout or campaign participation.

●      Device & Interaction Data: IP addresses, browser types, time zones, device identifiers, and browsing activity collected automatically through cookies and tracking pixels.

●      Communications: Feedback, direct inquiries, or survey responses submitted to our team.

●      Sensitive Information: We do not deliberately solicit sensitive information. If voluntarily provided, it will be handled strictly with your express consent in compliance with the APPs.

3. Unsolicited Personal Information

If we receive personal information that we did not solicit, we will assess within a reasonable period whether we could have lawfully collected it under Australian privacy law. If not, and where lawful and practicable, we will securely destroy or permanently de-identify the information.

 

4. How We Use Personal Information

We use your personal information for purposes directly related to our primary charitable and commercial functions:

●      Processing, packaging, dispatching, and tracking product orders.

●      Processing payments, issuing order confirmations, and providing tax invoices.

●      Attributing and reporting impact data to our designated charity partners.

●      Protecting our website, systems, and community against fraud, cybersecurity threats, or unauthorised transactions.

●      Delivering customer support and operational notifications.

●      Conducting analytics to evaluate website performance and campaign effectiveness.

●      Sending promotional communications and social impact updates in accordance with the Spam Act 2003 (Cth) (which you can opt out of at any time).

5. Automated Decision-Making (ADM)

We utilise automated fraud-screening tools provided by our e-commerce platform (Shopify) to assess transaction risk signals (such as repeated failed payment attempts or high-risk IP addresses). These automated mechanisms operate solely to prevent fraudulent transactions. If an order is flagged or blocked automatically and you believe this was an error, you may contact our Privacy Officer to request human review.

6. Disclosure of Personal Information

We do not sell, rent, or trade your personal information. We disclose data only to trusted entities to facilitate our operations:

●      Nominated Charity Partners: When you select a specific charity partner at checkout, we share transaction-related analytical and attribution data (such as order totals, campaign referral source, general geographic region, and associated contribution values) with that nominated charity partner. This enables our partner charities to evaluate campaign reach, assess marketing performance, and verify impact distributions. We only share analytical attribution data with the specific partner you select, and we never share credit card details or full billing records with charity partners.

●      E-Commerce & Technology Providers: Shopify Inc., hosting infrastructure partners, and IT database managers.

●      Freight & Logistics: Couriers, warehouse fulfillment providers, and postal delivery networks.

●      Analytics & Marketing Partners: Analytics and advertising networks (such as Google Analytics and Meta Platforms) to track traffic and deliver relevant communications.

●      Legal Compliance: Regulators, courts, or law enforcement authorities where required by Australian law.

Cross-Border Disclosures (APP 8): Our platform infrastructure and service providers operate globally. Your personal information may be disclosed to and stored on secure cloud servers situated in Canada, the United States of America, Ireland, and Singapore where Shopify and its technical infrastructure providers maintain operations.

7. Storage, Security, and Notifiable Data Breaches

We apply physical, technical, and administrative safeguards—including SSL/TLS data encryption and restricted user access—to protect your personal information from misuse, interference, loss, and unauthorised access or disclosure.

●      Data Retention: We retain transaction and contact information only as long as necessary to satisfy operational, accounting, and legal requirements, after which it is securely deleted or de-identified.

●      Data Breach Notification: In the event of an eligible data breach that involves a likely risk of serious harm, we will contain and evaluate the incident, notify affected individuals, and notify the Office of the Australian Information Commissioner (OAIC) in accordance with the Notifiable Data Breaches (NDB) scheme under the Privacy Act 1988 (Cth).

8. Cookies and Tracking Technologies

Our website utilizes cookies and similar tracking tags to manage sessions, remember your preferences, and track visitor interactions.

●      Cookie Management: You can disable or delete cookies via your browser settings. Note that disabling essential cookies may impact cart functionality and checkout processing.

●      Opt-Out Portals: You may opt out of digital behavioral tracking via:

○      Google Analytics Opt-Out: [tools.google.com/dlpage/gaoptout](https://tools.google.com/dlpage/gaoptout)

○      Digital Advertising Alliance Portal: optout.aboutads.info

9. Your Rights: Access, Correction, and Opt-Out

Under the APPs, you have the right to:

●      Access: Request a copy of the personal information we hold about you.

●      Correction: Request that inaccurate, outdated, or incomplete information be updated.

●      Marketing Opt-Out: Unsubscribe from promotional materials at any time by clicking the "unsubscribe" link in our emails or contacting us directly.

10. Contact Us & Complaints

For access or correction requests, inquiries regarding this policy, or privacy complaints, contact our Privacy Officer:

●      Entity: 100% Collective Foundation Ltd

●      Email: gday@100pc.org.au

We investigate and respond to privacy inquiries in writing within thirty (30) days. If you are not satisfied with our response, you have the right to escalate your complaint to the Office of the Australian Information Commissioner (OAIC):

●      Website: www.oaic.gov.au

●      Phone: 1300 363 992