What we collect
Depending on how you interact with us, we may collect:
Identity & contact: name, role/title, business name, ABN/ACN, email, phone, postal/billing address.
Engagement & billing: invoices, payment details (processed via PCI-compliant providers), project notes, approvals, support tickets.
Website & analytics: device and browser type, pages viewed, timestamps, referral source, approximate location, and cookie identifiers (e.g., GA4, ad pixels).
Marketing preferences: newsletter/eDM subscriptions, campaign interactions (opens/clicks).
Client-provided data (when we act for clients): lists or data sets you lawfully supply to us for agreed services (e.g., eDM dispatch). You must ensure you have the required notices/consents.
We avoid collecting sensitive information. If a project unavoidably involves such information (e.g., a medical practice’s website content), we will discuss scope and safeguards with you first.
2. How we collect
Directly from you: website forms, emails, phone calls, meetings, e-sign, support requests.
Automatically: cookies and similar technologies on our site and campaign landing pages.
From clients: where you provide data to us for agreed services and instruct us how to process it.
From providers: domain/hosting registrars, analytics or advertising platforms, payment processors.
3. Why we collect and how we use personal information
We use personal information to:
Provide and improve services: consulting, creative, web, Google Ads, SEO, social, hosting, domains, email services, analytics, and support.
Operate our website and analytics: measure performance, diagnose issues, improve content.
Communicate: proposals, onboarding, updates, invoices, service notices.
Direct marketing: where permitted, send news and offers with an easy unsubscribe.
Security and compliance: prevent misuse, manage fraud/abuse risks, meet legal obligations.
Perform services on your instructions (when we act for clients with their data).
We only use or disclose personal information for the primary purpose it was collected, related purposes you would reasonably expect, with your consent, or as required or authorised by law.
4. eDM and direct marketing (Spam Act)
We send marketing only with consent, clearly identify ourselves, and include a functional unsubscribe in each message. You can opt out at any time, and we will action unsubscribe requests promptly.
When you supply contact lists to us (e.g., for eDM), you warrant the list has valid consent and is otherwise compliant.
5. Cookies, tracking and analytics
We use cookies and similar technologies for site functionality, analytics (e.g., Google Analytics 4) and to measure campaign effectiveness. You can adjust your browser settings to refuse or delete cookies—this may impact site features. Platform privacy controls (e.g., Google/Meta ad settings) may provide additional choices.
6. Disclosing personal information
We may disclose personal information to:
Service providers we trust (hosting, domains/DNS, email services, eDM platforms, analytics, payment processing, security, backups, professional advisers).
Third-party platforms you ask us to connect (e.g., Google, Meta) to deliver agreed services.
Authorities where required or authorised by law, or to manage suspected fraud, security or abuse.
We take reasonable steps to ensure providers handle personal information consistently with the APPs and our instructions.
7. Overseas disclosures
Some processing may occur overseas. We currently use team members and/or service providers located in India, and Brazil may be used from time to time. Where we disclose personal information overseas, we take reasonable steps so recipients handle it in a manner consistent with the APPs (APP 8), including contractual and technical controls.
If you are a client and need more detail about our current providers and locations, please contact us.
8. Security
We apply reasonable administrative, technical and physical safeguards, such as role-based access, MFA for admin systems where available, encryption in transit, backups, and provider due diligence. No method is 100% secure; we cannot guarantee absolute security.
9. Data retention
Client/project files: generally retained for 2 years after project completion, unless we need to keep them longer (e.g., to meet legal, tax or insurance requirements).
Billing records: generally retained for 7 years.
Support logs/analytics: typically 12–24 months.
We may de-identify data for analytics or service improvement. When data is no longer required, we take reasonable steps to delete or de-identify it.
10. Access and correction
You can request access to, or correction of, your personal information by contacting us (see Section 14). We will respond within a reasonable time (usually within 30 days). If we decline a request (e.g., because an exception applies), we’ll tell you why and how to complain if you’re not satisfied.
When we process personal information on behalf of a client, we may refer you to that client first so they can address your request under their own privacy obligations.
11. Notifiable Data Breaches (NDB) scheme
If a data breach occurs, we will promptly assess whether it is likely to result in serious harm to affected individuals. If so, we will notify those individuals and the Office of the Australian Information Commissioner (OAIC) in line with the NDB scheme.
12. Third-party links
Our website and communications may link to third-party sites or services that have their own privacy practices. We are not responsible for those practices. We recommend you review their privacy policies.
13. Children
Our services and website are directed to businesses and adults. We do not knowingly collect personal information from children.
14. Contact us
For privacy questions, access/correction requests or complaints, contact our Privacy Officer:
Gravy Makers Marketing
Email: hello@gravymakers.com
Phone: 07 3264 5556
Postal: Unit 3, 22-24 Strathwyn St, Brendale QLD 4500
We will acknowledge complaints and aim to resolve them promptly. If you are not satisfied, you can contact the Office of the Australian Information Commissioner (OAIC): www.oaic.gov.au
15. Changes to this Policy
We may update this Policy from time to time. The “Last updated” date above tells you when we last made changes. Significant changes will be highlighted on this page; for client services, updates and notices are handled under our Terms of Business.
Note: This Policy is intended to be clear and practical. It does not limit rights and obligations under the Privacy Act 1988 (Cth).