This Privacy Policy sets out how Cignall Pty Ltd ACN 111 443 933 and its related and associated entities (“Cignall”, “we”, “us” or “our”) uses and discloses personal information in connection with our business, including in connection with the Club Cignall loyalty and membership program (Club Cignall) and this website. Cignall is committed to ensuring that your privacy is protected. Should we ask you to provide certain information by which you can be identified when using this website, then you can be assured that it will only be used in accordance with this Privacy Policy.
This Privacy Policy is prepared in accordance with the Privacy Act 1988 (Cth) (Privacy Act), including the Australian Privacy Principles set out in Schedule 1 to the Privacy Act (the APPs). This Privacy Policy is intended to provide a general overview of our policies in respect of the collection, handling and management of your personal information. Your personal information is any information or opinion about you that can identify you. Other policies may override this Privacy Policy in certain circumstances. For example, when we collect personal information from you, we may advise a specific purpose for collecting that personal information, in which case we will handle your personal information in accordance with that stated purpose. This Policy is intended to cover most personal information handled by us (and our authorised agents who collect personal information on our behalf) but is not exhaustive. If you have any queries about our management of your personal information, you are encouraged to contact us for further information (see section 11 below). You are agreeing to be bound by this Privacy Policy by voluntarily providing us with your personal information.
We may collect your personal information directly from you, or where this is unreasonable or impracticable, from third parties (such as market research companies acting on our behalf) that have collected it from you. Where we collect personal information from third parties, we will take reasonable steps to notify you or otherwise ensure you know we are collecting that information and the circumstances of its collection. We limit the personal information we collect to that which is reasonably necessary for one or more of our functions or activities. When collecting personal information, we will take reasonable steps to make you aware of the purposes for which the information is being collected by us, the organisations to which we would usually disclose your information, the main consequences for you if you fail to provide any information that is requested by us, and whether we are likely to disclose your information to overseas recipients as well as the countries any such recipients are located in. This Privacy Policy provides these details as they typically apply in most cases, however different details may apply depending on our specific interaction with you. If we do not notify you of such other details, the information in this Privacy Policy applies. There may be a range of consequences if you fail to provide information requested by us, for example we may be unable to process or respond to your request for products or services. There will not usually be Australian laws or court/tribunal orders which require or authorise us to collect your personal information. However, if such laws or orders do apply, we will take reasonable steps to notify you of them. Further information about the overseas recipients to whom we are likely to disclose personal information, and the countries in which they are located, is set out in section 2.4 and section 5.5 below.
We take technical and organisational measures designed to ensure that your personal information is protected from misuse, loss, unauthorised access and modification of disclosure. Specific security measures we employ include authorised user-only access to computer records (including password protection), internal procedures to protect physical documents, encryption of personal information held in electronic form where appropriate, and monitoring of our practices and systems to ensure the effectiveness of our security policies. We will endeavour to destroy or de-identify your personal information as soon as it is no longer required by us (as permitted by law).
We may need to keep your information for longer periods. This could be because of the following reasons:
a) to potentially establish, bring or defend legal proceedings or to comply with a legal or regulatory requirement;
b) to be able to deal with external or internal audits.
We will generally only use your personal information for the purpose for which we collected it, and for related purposes we consider will be within your reasonable expectations, or otherwise with your consent. We generally collect, hold and use your personal information to: Provide the service requested, respond to your enquiries, send you information that you request, or otherwise achieve the purpose for which the information was submitted to us; Contact you to ask about your experiences with, or impressions of, our products or services Contact you from time to time to advise you of new products, promotional offers, or services offered by us or our dealers that we consider may interest you; Conduct market research or monitor product demand (although where possible we will use “de-identified” information that does not refer to particular individuals when conducting these activities); Contact you about other matters relating to products or services that you have acquired from us; Streamline and personalise your experience within our web site, or tailor our information, services or products; Create aggregate data about our web site visitors and other statistics to allow for more efficient operation of our web site; Engage in other activities where required or permitted by law; and Undertake any purpose related to any of the above. We may use personal information to contact you for marketing and promotional purposes. You may request not to receive these communications by contacting us using the details set out in section 11 below, or by using the opt out function provided for in those communications. If you do not opt out in either of these ways you will be taken to have consented to receiving such communications from us. There are no consequences for opting out of receiving our marketing and promotional communications except that you will no longer receive them, and you may elect to rejoin our marketing list at a later stage if you wish. Where we propose to use your personal information for another purpose other than as outlined above, we will seek your consent prior to using your personal information for that purpose (unless we are required or permitted by law to do so without seeking your permission).
We will generally only disclose your personal information for the purpose for which we collected it, and for related purposes we consider will be within your reasonable expectations, or otherwise with your consent. We may disclose your personal information to: Our authorised agents, contractors or subcontractors that provide administrative or promotional services (for example, mail processing businesses, printers, or market research companies or other service providers). We typically enter into contractual agreements with these organisations to ensure that information we disclose is used only for the limited purposes for which we have provided it; and Our related bodies corporate. Where we propose to disclose your personal information for another purpose other than as outlined above, we will seek your consent prior to disclosing your personal information for that purpose (unless we are required or permitted by law to do so without seeking your permission). An example is where personal information must be disclosed for certain law enforcement purposes. We may also disclose personal information to overseas recipients for the purposes described in section 5.5 below. Where we disclose personal information to an overseas recipient, we will take reasonable steps to ensure that recipient does not breach the APPs in relation to that information, except where an exception under the Privacy Act applies.
Where we rely on your consent to collect, use or disclose your personal information, we will obtain that consent either expressly, for example, by way of a consent checkbox or acknowledgement when you join Club Cignall, complete a form, or otherwise submit your details to us, or by your conduct, where it is reasonable to infer your consent from the circumstances in which you provide your personal information to us. You may withdraw your consent at any time by contacting us using the details in section 11 below or, in relation to direct marketing, by using the opt-out mechanism described in section 2.3. Withdrawing your consent will not affect the lawfulness of anything we did in reliance on that consent before you withdrew it, but may affect our ability to provide you with certain products, services or communications going forward.
Where it is lawful and practicable to do so, you have the option of not identifying yourself, or of using a pseudonym, when dealing with us, for example, general enquiries about our products or services. It will not be practicable for us to deal with you anonymously or under a pseudonym where we are required or authorised by law to deal with identified individuals, or where it is impracticable for us to provide the product, service or information you have requested without knowing your identity, including age-verification for age-restricted products or Club Cignall membership.
If we receive personal information that we did not solicit, we will assess within a reasonable period whether we could have collected that information under section 2.1 above had we solicited it. If we could not have done so, and provided it is lawful and reasonable for us to do so, we will destroy that information or ensure it is de-identified as soon as practicable.
We will not adopt a government related identifier that you provide to us (such as a Medicare number, driver licence number or passport number) as our own identifier for you, and we will only use or disclose a government related identifier where a Privacy Act exception applies, for example, where necessary to verify your identity or age for the sale of an age-restricted product (see also section 2.6 and section 4 above).
We take reasonable steps to ensure that the personal information we collect, use and disclose is accurate, up-to-date and complete, having regard to the purpose for which it is collected, used or disclosed.
You may contact Cignall to request access to or correction of your personal information held by us. Contact details are set out in section 11 below. You will be required to verify your identity before we will allow you to access your personal information, for the protection of your privacy and the privacy of other individuals whose personal information we hold. We may refuse to allow you to access or to correct your personal information if we are legally required or entitled to do so. If we do so, we will provide you with written reasons for the refusal (unless it is unreasonable to do so) and the options available to complain about the refusal. We will endeavour to respond to your request for access or correction within 30 days from receiving your request. We may require you to pay a fee in order to access your personal information held by us. We will advise the amount of the fee payable (if any) once we have assessed your application for access. This fee is based on the cost of providing you with access to your personal information (for example, photocopying costs). It is not a fee for lodging a request for access to or correction of your personal information. If you lodge a request for access, we may provide you with access to your personal information in any of a number of ways (including, for example, supplying you with a copy or providing you with the opportunity to inspect our records). We will take reasonable steps to ensure that the personal information that we collect, use and disclose is accurate, up-to-date and complete. If we are satisfied that any personal information, we hold about you is inaccurate, out-of-date, incomplete, irrelevant or misleading, we will amend our records accordingly.
The personal information about you we may collect, and hold includes but is not limited to your name and address, contact telephone number(s) and/or email address(es). We may also hold information about any products or services you acquire from us or our dealers, any warranty claims made in connection with those products or services, and any other personal information that you volunteer to us (if that information is reasonably necessary for, or directly related to, one or more of our functions or activities). Where we are required to verify your age before selling age-restricted products (such as tobacco or vaping products), we may collect limited identity or age-verification information for that purpose. Other than this, we do not generally collect (or, if it is provided by you to us, retain) any sensitive information about you.
This part of our Privacy Policy sets out the manner in which we handle your personal information in respect of online services provided to you by us. “Online services” includes any services provided by us via the Internet (including email and web pages).
Our web site server automatically collects various items of information when you use our web site. For example, we may collect information about your computer’s operating system, Internet Protocol (IP) address, access times, browser type and language, and the web site that referred you to us. We also collect information about your usage and activity on our web site. When you visit our web site it may store “cookies” on your computer. The purpose of “cookies” is to avoid the need for you to re-enter certain information when you next visit our web site. The settings in your Internet browser software can be adjusted to prevent cookies being stored on your computer, if required. However, some of the features of our web site may then be lost. Although, in some circumstances, it may be possible to identify you from the information we collect as described in this section 5.1, we do not attempt to do so, and only use this information for statistical analysis, system administration, and similar related purposes.
We may collect personal information from you (such as your name, address, telephone number and email address, and any other personal information you volunteer) if you send us an email or if you submit information to us using a message form, brochure request form or feedback form. We will use this personal information to contact you to respond to your message, to send you information that you request, and for other related purposes we consider are within your reasonable expectations. We will not use or disclose any such information for any other purpose without your consent, except where required by law.
If you provide any personal information to us via our online services (including email) or if we provide such information to you by such means, the privacy, security and integrity of this information cannot be guaranteed during its transmission unless we have indicated beforehand that a particular transaction or transmission of information will be protected (for example, by encryption). If we receive your personal information, we will take reasonable steps to store it such that unauthorised access, modification, disclosure, misuse and loss are prevented.
If any of our online services (including any email messages we send to you) contain links to other online services that are not maintained by us (other services), or if other services link to our online services, we are not responsible for the privacy practices of the organisations that operate those other services, and by providing such links we do not endorse or approve the other services. This Privacy Policy applies only in respect of our online services.
We may allow third parties to use cookies or other tracking technologies to collect non-personal information about your use of our web site, including your IP address, pages viewed and conversion information. This information may be used, among other purposes, to deliver advertising targeted to your interests and to better understand the usage and visitation of our web site and other web sites tracked by these third parties. We may at times use “Remarketing” (https://www.google.com.au/ads/innovations/remarketing.html) to advertise online. Third-party vendors, including Google, may show our ads on sites across the Internet. Where this involves the disclosure of personal information to Google or other third-party vendors located overseas, section 2.4 above sets out further detail about that overseas disclosure. This Privacy Policy does not otherwise apply to, and we are not responsible for, third party cookies or other tracking technologies. We encourage you to check the privacy policies of advertisers and/or ad services to learn more about their privacy practices. If you would like more information about third party advertising or to opt out of having your information used in this way please visit the Ads Settings.
We may use computer programs to make, or to substantially assist in making, decisions that could reasonably be expected to significantly affect your rights or interests. This may include decisions relating to Club Cignall membership tier and associated benefits, eligibility for promotional or loyalty offers, and personalised marketing content. These decisions are made using personal information such as your purchase history, membership activity, and contact and demographic details, and are generated by [a rules-based system that applies set criteria to that information]. If you have questions about a decision affecting you that has been made in this way, you can contact us using the details set out in section 11 below.
We have processes in place to identify, assess, contain and respond to data breaches. If we experience a data breach involving your personal information that we reasonably believe is likely to result in serious harm to you (an eligible data breach), we will notify you and the Office of the Australian Information Commissioner in accordance with the Notifiable Data Breaches scheme in Part IIIC of the Privacy Act. You can contact us using the details in section 11 below if you have any concerns about the security of your personal information.
We reserve the right to amend this Privacy Policy at any time. We will notify you of amendments to this Privacy Policy by uploading the updated Privacy Policy to our website. You may also obtain a copy of the current version of our Privacy Policy by contacting us.
If you believe that a breach of your privacy has occurred or you otherwise have a complaint about our use or management of your personal information, we encourage you to contact Cignall to discuss your concerns. Contact details can be found in section 11 below. Your complaint will be considered and dealt with by our Privacy Officer. If the breach is deemed to be serious, the Privacy Officer may escalate the complaint internally within our company. Please allow us a reasonable time to respond to any complaint. If you are not satisfied with our resolution, you may make a complaint to the Office of the Australian Information Commissioner whose contact details can be found at https://www.oaic.gov.au/
You may contact Cignall Head Office if you require further information about the ways we manage your personal information.
Privacy Officer: Gary Chew
Email: garychew@cignall.com.au
Last updated: September 2026