Cup & Carry respects the privacy of your personal information and data in our care; and we are committed to maintaining the security of all such information provided to Cup & Carry in accordance with the Privacy Act 1988 (as amended), the Australian Privacy Principles and any other applicable laws or regulations governing privacy, personal information or data and its collection, acquisition, management, storage, use, transfer, exchange or destruction. To the extent that the European Union General Data Protection Regulation (GDPR) applies, Cup & Carry will comply with the GDPR in management and treatment of data.
- What information is collected and why
- Ways we collect your information
- Website Analytics
- How information is stored, managed and protected
- Information disclosure
- International Data Transfer
- Data Protection Officer
- Your Data Protection Rights
- Exercise of your rights
- How to contact us
What information is collected and why
Personal information is collected by Cup & Carry from individuals for business purposes and may be collected from customers, potential customers, suppliers and their representatives, contractors and job applicants.
Business purposes may include the processing of payments, delivering orders, managing promotions, providing refunds, verifying your identity, communicating with you, conducting market and product research, dealing with enquiries from you, working with our service providers and other Cup & Carry companies and providing, administering and improving our products and services.
The types of personal information which may be collected from you via our contact forms, enquiry forms, quote lists, surveys includes: name, title, email address, street address, mailing address, delivery details, telephone numbers, business details, payment details, order history, product preferences, credit card details and financial information.
Job applicant information collected may include other information, see below under ‘Job Applications/Expression of Interests’.
Cup & Carry may in the course of its business use personal information for direct marketing of its products and services. You may opt out of receiving future marketing communications from Cup & Carry by contacting us directly at any time.
If you are resident or present in a country in the European Union, then unless you have previously given your consent to receive marketing communications, you will need to positively consent and “opt in” to receiving such marketing communications.
Ways we collect your information
We collect your personal information in a number of ways; written forms (including order forms, enquiry forms, credit applications and job applications), via email, letter, fax or telephone contact, your mobile or other messaging technology, via the internet including websites and social media, via our websites, in person either directly from you, from publicly available sources of information or from other persons or organisations.
Job Applications / Expressions of Interest
We collect your personal information when you apply for a job by submitting an Expression of Interest for a role with us, or during the recruitment process. This personal information may include; your name, email address, street address, mailing address, telephone number, legal employment eligibility, employment history, skills, qualifications, licences, referee details, medical, background checks and video interviews. Other information may be requested such as the type of role you are interested in and what other career interests you may have. Other questions may be asked that are relevant to the role advertised and to working with Cup & Carry.
Your personal information obtained via a job application will be used to assist us throughout the recruitment process including; verification of identity, verification of legal employment rights, background checks, contacting referees, skills and psychometric tests and we may also contact you regarding other employment opportunities within Cup & Carry.
Cup & Carry will not share, trade or sell personal information for marketing purposes.
Cup & Carry websites uses ‘cookies’. A cookie is a piece of data that is stored on a computer or device which allows us to enhance your online experience with us.
When one of our websites is visited, records of visits are logged for statistical, maintenance and improvement purposes. The service or internet provider address is collected and cannot be traced to an individual user. We do not identify the browsing history of our website users and visitors. The only exception to this is where a law enforcement agency lawfully requires us to, or we are required to do so under local law.
If you do not wish to accept cookies, you can set your browser to refuse them.
Some of our websites use Google Analytics which captures data about the traffic to our websites. This data does not identify individual users and we use this data to help us understand how our websites are used.
How information is stored, managed and protected
Personal Information is either stored in facilities that Cup & Carry owns and manages or those that are owned and operated by our service providers.
Cup & Carry takes reasonable steps to maintain the security and protect all personal information in our care. These include; restricting electronic and physical access to personal information; having in place information back up and standby systems to deal with major business interruptions; maintaining technology security products; requiring any third party providers to have acceptable security measures to keep information secure, including confidentiality arrangements; destroying or de-identifying personal information pursuant to the appropriate laws.
Cup & Carry may provide personal information to relevant Cup & Carry employees, sub-contractors, distributors and third party advisors who require this information as a part of the work they perform on behalf of Cup & Carry.
Personal information related to job applications/Expressions of Interest may be disclosed to those people in Cup & Carry involved in the recruitment process, hiring managers and any recruitment advisors for the purposes of consideration for employment within Cup & Carry.
International data transfer
Cup & Carry operates businesses in multiple jurisdictions, some of which are not located in the European Union or European Economic Area (EEA). While countries outside the EEA do not always have strong data protection laws, we require all service providers which process your information to do so in a secure manner and in accordance with Australian privacy laws and EU laws on data protection. We use standard means under EU law to legitimise data transfers outside the EEA.
Data Protection Officer
We have appointed a Data Protection Officer (“DPO”) (or privacy officer) to oversee compliance with this policy.
You have the right to make a complaint at any time to a supervisory authority. The data protection supervisory authority for you depends upon the country or geographical area in which you are located.
Your data protection rights
Under certain circumstances, by law you have the right to:
- Request information about whether we hold personal information about you, and, if so, what that information is and why we are holding/using it.
- Request access to your personal information (commonly known as a "data subject access request"). This enables you to receive a copy of the personal information we hold about you and to check that we are lawfully processing it.
- Request correction of the personal information that we hold about you. This enables you to have any incomplete or inaccurate information we hold about you corrected.
- Request erasure of your personal information. This enables you to ask us to delete or remove personal information where there is no good reason for us continuing to process it. You also have the right to ask us to delete or remove your personal information where you have exercised your right to object to processing (see 5. below).
- Object to processing of your personal information where we are relying on a legitimate interest (or those of a third party) and there is something about your particular situation which makes you want to object to processing on this ground. You also have the right to object where we are processing your personal information for direct marketing purposes.
- Object to automated decision-making including profiling, that is not to be subject of any automated decision-making by us using your personal information or profiling of you.
- Request the restriction of processing of your personal information. This enables you to ask us to suspend the processing of personal information about you, for example if you want us to establish its accuracy or the reason for processing it.
- Request transfer of your personal information in an electronic and structured form to you or to another party (commonly known as a right to “data portability”). This enables you to take your data from us in an electronically useable format and to be able to transfer your data to another party in an electronically useable format.
- Withdraw consent. In the limited circumstances where you may have provided your consent to the collection, processing and transfer of your personal information for a specific purpose, you have the right to withdraw your consent for that specific processing at any time. Once we have received notification that you have withdrawn your consent, we will no longer process your information for the purpose or purposes to which you originally agreed, unless we have another proper and legitimate basis for doing so.
Exercise of your rights
If you want to exercise any of these rights, then please contact our DPO at the email address below.
You will not have to pay a fee to access your personal information (or to exercise any of the other rights). However, we may charge a reasonable fee if your request for access is clearly completely unfounded or excessive. Alternatively, we may refuse to comply with the request in such circumstances.
We may need to request specific information from you to help us confirm your identity and ensure your right to access the information (or to exercise any of your other rights). This is another appropriate security measure to ensure that personal data is not disclosed to any person who has no right to receive it. If you have any complaints in respect of our handling of your personal information, we require that you contact us by email. Please provide as much detail as you can about the particular information you have a question or concern about. Cup & Carry will within 7 days of receiving any complaint, provide you with a written response acknowledging receipt of the complaint and set out how we propose to deal with it. We will then investigate the complaint and within 30 days of the date of your complaint or such longer period as agreed by you in writing, provide you with the outcome of our investigation in writing.
How to contact us
You can contact us in writing via email to firstname.lastname@example.org. Please write ‘To the Data Protection Officer’ in the subject line of your email.