Privacy Policy

Effective Date: February 21, 2026

Last Updated: February 21, 2026

Probioform Australia Pty Ltd (ABN 93630997554), located at 89 Stirling Street, Perth WA 6000, Australia ("we", "us", "our", or "the Company"), is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, store, and protect your personal information in accordance with the Privacy Act 1988 (Cth) (including the Australian Privacy Principles or "APPs"), the Spam Act 2003 (Cth), and other applicable Australian laws.

We are an Australian-incorporated entity and handle personal information primarily within Australia, though some processing occurs through third-party service providers located overseas. If you have any questions about this Privacy Policy or our privacy practices, please contact our Data Protection Officer:

- Name: Robert Dennis Crnalic  
- Email: customerservice@probioform.com.au  
- Address: 89 Stirling Street, Perth WA 6000, Australia  

By providing your personal information to us, using our website, signing up for our services, or otherwise interacting with us, you agree to the terms of this Privacy Policy.

1. Types of Personal Information We Collect

We collect personal information that is reasonably necessary for our business functions and activities. This may include:

- Contact details: Name, email address, phone number, postal address.  
- Marketing preferences: Your opt-in choices for email and/or SMS marketing.  
- Transaction details: Purchase history, payment information (processed securely via third-party providers).  
- Device and usage data: IP address, browser type, pages visited on our website (via cookies or similar technologies—see Section 8 for details).  
- Other information: Any additional details you provide, such as inquiries or feedback.

We do not collect sensitive information (e.g., health data) unless it is directly relevant to your purchase and you provide it voluntarily.

2. How We Collect Your Personal Information

We collect personal information directly from you when you:

- Sign up for our email or SMS marketing subscriptions (via opt-in checkboxes).  
- Make a purchase or create an account on our e-commerce store.  
- Contact us via email, phone, or our website.  
- Interact with our website or marketing communications.  

We may also collect information indirectly, such as through cookies or from third-party service providers (e.g., analytics tools), but only with your consent where required.

At the time of collection, we will notify you of the purposes for which we are collecting the information, as required by APP 5.

3. Purposes for Collecting, Using, and Disclosing Your Personal Information

We collect, use, and disclose your personal information for the following primary purposes:

- To process and fulfill your orders, provide customer service, and manage your account.  
- To send you marketing communications via email or SMS, but only if you have expressly opted in (see Section 4 for details).  
- To improve our products, services, and website (e.g., via analytics).  
- To comply with legal obligations, such as tax or consumer protection laws.  
- For internal business operations, such as auditing, research, or fraud prevention.  

We will only use or disclose your personal information for secondary purposes if:

- You have consented;  
- You would reasonably expect us to do so, and the purpose is related (or directly related for sensitive information) to the primary purpose; or  
- It is required or authorized by law, or another APP exception applies (e.g., to prevent a serious threat to health or safety).  

4. Direct Marketing and Consents (Compliance with Spam Act 2003 and APP 7)

We offer opt-in subscriptions for email and SMS marketing about our products, promotions, and updates related to health, nutrition, and wellness.

- Opt-In Process: You can choose to subscribe to email, SMS, or both via separate, unchecked checkboxes during sign-up, checkout, or on our website, including through pop-up forms or other forms on our website. Consent is express, voluntary, and specific. We do not use pre-ticked boxes or bundle marketing consent with other terms.  
- What You Consent To: By opting in, you consent to receive commercial electronic messages from us (as the authorizing sender) about our products and services. You also consent that, in the event of a business sale, merger, acquisition, or asset transfer (including our customer database), your contact details and marketing preferences may be transferred to the buyer or successor entity. The buyer may continue sending marketing communications:  
  - Under our brand or integrated into theirs, for similar health and wellness products; or  
  - For their own products in the health, nutritional, sports supplements, or health services sectors, even if unrelated to our specific brand.  
- Inferred Consent: In limited cases, we may infer consent from an existing business relationship (e.g., recent purchases), but we prefer and prioritize express consent for compliance.  
- Opt-Out and Unsubscribe: Every marketing email or SMS will include a clear, functional unsubscribe mechanism (e.g., "Reply STOP" for SMS or a link for email). We will process opt-outs within 5 business days, free of charge. You can also withdraw consent at any time by contacting our Data Protection Officer. If you opt out, we will stop sending marketing but may retain your information for other purposes (e.g., order fulfillment).  
- Records: We maintain records of your consents, including timestamps and details, for at least 5 years to demonstrate compliance.  

Under the Spam Act 2003, all messages will clearly identify us as the sender and include our contact details. We do not send messages without consent, and penalties for non-compliance can be significant.

5. Disclosure of Your Personal Information

We may disclose your personal information to:

- Service providers: Such as email/SMS platforms (e.g., Klaviyo), e-commerce platforms (e.g., Shopify), subscription management services (e.g., Loop Subscriptions), payment processors, or logistics partners, who are bound by confidentiality and privacy obligations.  
- Related entities: For internal operations, where permitted under the Privacy Act.  
- Third parties in corporate transactions: In connection with a merger, acquisition, reorganization, sale of the business (share sale), or sale of assets (including our brand and/or customer database). This may include transferring your personal information to a buyer or successor entity, who will be required to handle it in accordance with the Privacy Act, Spam Act, and a privacy policy substantially similar to this one. The buyer may use your information for their direct marketing purposes, as described in Section 4, including for products in the health, nutritional, sports supplements, or health services sectors.  
- Other third parties: We may sell or transfer our customer database (without the brand) to entities in the health, nutritional, sports supplements, or health services sectors for their direct marketing, subject to your existing consents. In such cases, the recipient must comply with applicable laws, including providing opt-out options.  
- Legal requirements: To government authorities, law enforcement, or as required by law (e.g., subpoenas).  

We will only disclose the minimum information necessary. For any transfer in a sale, we aim to ensure continuity of your consents where possible, but the buyer may need to confirm or refresh consents to comply with the Spam Act (e.g., if they are a new sender).

If we are a small business exempt from the Privacy Act, a sale involving personal information may trigger coverage, and we will comply accordingly.

6. Cross-Border Data Transfers

Your personal information may be stored and processed in Australia and transferred to other countries, including the United States and Canada, where our service providers (such as Shopify, Klaviyo, and Loop Subscriptions) operate and store data. For example, Shopify processes data through entities in Canada and Ireland, with storage potentially in the US or other regions; Klaviyo stores data in the US; and Loop Subscriptions, as a US-based service, likely processes data in the US.

We take reasonable steps to ensure that overseas recipients provide a level of data protection comparable to the Australian Privacy Principles, such as through binding contractual clauses, standard data protection clauses, or other appropriate safeguards in accordance with APP 8. If a recipient is in a country without laws substantially similar to Australia's privacy laws, we require them to comply with equivalent standards.

7. Data Security and Retention

We take reasonable steps to protect your personal information from misuse, loss, unauthorized access, modification, or disclosure, including encryption, access controls, and secure servers (APP 11).

We retain personal information only as long as necessary for the purposes outlined (e.g., 7 years for tax records) or as required by law. After that, we securely destroy or de-identify it.

8. Cookies and Tracking Technologies

Our website uses cookies for functionality, analytics, and marketing. You can manage preferences via your browser settings. For details, see our Cookie Policy (if separate) or contact us.

9. Your Rights: Access, Correction, and Complaints

Under the Privacy Act:

- Access and Correction: You can request access to or correction of your personal information. We will respond within 30 days, free of charge unless unreasonable. Contact our Data Protection Officer.  
- Complaints: If you believe we have breached your privacy, contact us first. If unsatisfied, you can complain to the Office of the Australian Information Commissioner (OAIC) at www.oaic.gov.au or 1300 363 992.  

10. Changes to This Privacy Policy

We may update this policy from time to time. Changes will be posted on our website with the updated date. For material changes affecting your personal information, we will notify you via email or SMS (if subscribed). Continued use of our services after changes constitutes acceptance.

This Privacy Policy ensures full compliance with Australian laws while facilitating business flexibility, such as data transfers in sales. However, this is a draft—consult a legal professional to customize and verify it for your specific circumstances.