Privacy Policy

This Privacy Policy applies to Buy Local Toowoomba, including buylocaltoowoomba.com.au, the business-owner portal, account and claim functions, enquiry features, emails sent on behalf of the platform, and related administration. It does not govern the independent privacy practices of businesses listed in the directory or third-party websites linked from a listing.

Account and identity information

• Name, email address, account identifiers and authentication information.
• Business or organisation memberships, roles and permissions associated with an account.
• Information used to verify or record authority to claim or manage a business listing, including claim and invitation records.

Business listing information

• Business name, trading details, category, address or service area, phone number, business email, website, opening hours, descriptions, social links, images and other listing content.
• Information supplied by a business or its representative, and information sourced from publicly available business sources such as a business website or public business profile.

Enquiries and support

• When you send an enquiry to a listed business: your name, email address, optional phone number, message and the listing from which it was sent.
• Support requests, complaints, correction requests and correspondence with us.

Billing information

• Subscription, plan, payment-status, invoice and transaction-reference information needed to administer paid plans.
• Payment card details are processed by our payment provider (currently Stripe). We do not intend to store full card numbers or card security codes on Buy Local Toowoomba systems.

Technical, security and usage information

• Authentication/session information, logs and security events needed to operate and protect the service.
• For enquiry abuse prevention, we may store one-way hashed values derived from request origin and message content. The raw network address is not stored with the enquiry for this purpose.
• Anonymous or aggregated listing activity such as profile views and clicks on contact actions. These measurements are not intended to identify ordinary visitors.

• Directly from you when you create an account, claim or manage a listing, submit content, contact us, send an enquiry or purchase a paid plan.
• From authorised representatives of a business or organisation.
• From publicly available business sources where we create or maintain an unclaimed business listing or verify a business contact address.
• From service providers that help us operate the platform, including payment, CRM, email, hosting, storage and security providers.

• To operate and publish the local business directory and related search, map and listing features.
• To create, verify, administer and secure user accounts and business ownership permissions.
• To process business claims and listing changes, and to moderate content.
• To deliver an enquiry to the specific business selected by the visitor and help resolve delivery or support issues.
• To provide paid plans, process billing events, administer subscriptions and determine platform entitlements.
• To send service messages, claim invitations, password resets, billing messages and other operational communications.
• To conduct lawful business outreach about an existing Buy Local listing where we have a recorded lawful basis and the communication is permitted by Australian law.
• To prevent fraud, misuse, duplicate submissions, unauthorised access and security incidents.
• To analyse and improve the service using privacy-minimised, aggregate or de-identified information where practical.
• To comply with legal obligations, resolve disputes and protect our legal rights.

Where a listing has an enquiry form, the information you enter is sent to the one business you chose so that business can respond. It is not sold, rented or distributed as a shared lead to other businesses. Sending an enquiry does not subscribe you to Buy Local marketing.

We retain enquiry records so they can be delivered, accessed by an authorised owner, and investigated if delivery or misuse problems arise. Our intended retention period for enquiry records is 24 months. The automated deletion/redaction process for records that pass 24 months is not yet in production; until it is, older enquiry records are removed or redacted manually on request.

A business may receive an initial listing or claim message where a business contact address has been recorded with an appropriate lawful basis for outreach. That basis may include express consent or a business address that has been conspicuously published in circumstances where the communication is relevant to the recipient’s role and there is no statement prohibiting unsolicited commercial messages.

Where the Spam Act 2003 (Cth) applies, our commercial electronic messages will identify the sender, provide current contact details and include a functional way to unsubscribe. We record and honour suppression or unsubscribe requests and do not rely on our CRM provider to grant platform ownership or authority.

• The business you choose to contact, when you submit an enquiry to that business.
• Authorised users of the organisation or business whose records they are permitted to manage.
• Service providers that support hosting, databases, cloud storage, transactional email, CRM and lifecycle automation, analytics, payment processing, security and support.
• Professional advisers, insurers, regulators, courts or law-enforcement bodies where reasonably necessary or legally required.
• A purchaser or successor if all or part of the platform business is reorganised, sold or transferred, subject to appropriate confidentiality and legal requirements.

We do not sell or rent personal information to data brokers or unrelated businesses for their own marketing.

We may use providers such as Stripe for payment processing and GoHighLevel for CRM, outreach and lifecycle automation. Buy Local Toowoomba remains the source of truth for platform ownership, subscriptions and entitlements; a CRM record does not give a person authority to manage a business listing.

Some technology providers may store or process information outside Australia, including in the United States and other countries in which those providers operate. Where Australian privacy law requires us to take steps in relation to an overseas disclosure, we will take reasonable steps appropriate to the circumstances. Provider locations can change, so contact us if you need current information about a particular service provider.

We may use cookies or similar technologies that are necessary for account login, security, preferences and reliable operation of the site. We also measure aggregate listing activity such as profile views and contact-action clicks. Ordinary view and click counts are not intended to reveal the identity of a visitor to a listed business.

We use reasonable administrative, technical and organisational measures designed to protect information from misuse, interference, loss, unauthorised access, modification and disclosure. No internet service can guarantee absolute security. If a data breach occurs, we will assess and respond to it, including under the Notifiable Data Breaches scheme where that scheme applies.

You may ask for access to personal information we hold about you, or ask us to correct information that is inaccurate, out of date, incomplete, irrelevant or misleading. We may need to verify your identity before providing access or making a correction. If access or correction is refused, we will explain the reason where required by law.

We keep information only for as long as reasonably needed for the purposes described in this policy, for security and audit requirements, or to meet legal obligations. Different records have different retention needs. Some claim, billing, consent, suppression and audit records may need to be retained after an account or listing is closed so that we can demonstrate what occurred and protect the integrity of the platform.

If you believe we have mishandled your personal information, contact us with enough detail for us to understand the issue. We will acknowledge and investigate the complaint and aim to provide a substantive response within 30 days where practicable. If the Privacy Act applies and you are not satisfied with our response, you may be able to complain to the Office of the Australian Information Commissioner (OAIC).

We may update this policy when our services, providers or legal obligations change. We will publish the updated version and effective date on the website. If a change materially affects how we use personal information, we will take additional steps to notify affected users where appropriate.

Questions, requests or complaints can be sent to:

• Email: [email protected]
• Website: https://buylocaltoowoomba.com.au
• Operator: Buy Local Exposure Pty Ltd
• ABN: 88 701 388 945
• Registered address: Suite 2, 10 Poitier St, McDowall QLD 4053

This policy has been drafted with reference to the Privacy Act 1988 (Cth), the Australian Privacy Principles, the Notifiable Data Breaches scheme and the Spam Act 2003 (Cth).

Our Terms of Use and Service, Business Listing & Claim Policy and Billing, Cancellation & Refund Policy set out the rules for using the directory and any paid plans.