CtrlOps Privacy Policy

Last updated: 8 October 2025

1. Introduction

This Privacy Policy explains how CtrlOps Pty Ltd ACN 682 981 282 (CtrlOps, we, us, or our) collects, uses, discloses, stores and protects your personal information when you interact with us. This includes use of our website, email and SMS communications, social media platforms, and customer support channels (collectively, the Channels).

We are committed to handling personal information in accordance with the Privacy Act 1988 (Cth) (Privacy Act) and the Australian Privacy Principles (APPs).

This Privacy Policy is subject to change at our discretion, and we will update it from time to time. The current version will always be available on our website at www.ctrlops.com.au/privacy-policy. If we change this Privacy Policy in any material way, we will post a notice on our website (as relevant) along with the updated Privacy Policy.

In this Privacy Policy we use the terms:

• ‘customers’ to refer to individuals who engage us to provide goods and services, and individuals at businesses who engage us to provide goods and services;
• ‘suppliers’ to refer to individuals who provide us with goods or services, and individuals at businesses who provide us with goods or services;
• ’visitors’ to refer to individuals who engage with us on our website, or who enquire about our functions or activities via electronic means (including social media pages or online marketing); and
• ‘applicants’ to refer to individuals who apply for employment or other engagement with us.

In some circumstances, you may belong to more than one of these groups, and multiple sections of this Privacy Policy will then apply to you.

2. Information We Collect

The kinds of Personal Information we collect about you depends on our relationship with you, and we limit the information we collect to what is reasonably necessary for one or more of our functions or activities. This information generally includes your name, commentary or opinion about you, and other information relevant to providing you with the information, goods and services (as applicable) you or someone on your behalf are seeking.

If you are Customer, we will also collect your contact details (email, phone number, delivery and billing address), payment details, information about your order history, marketing and communication preferences, and information related to your interactions with our Channels, including email open rates, link clicks, and browsing behaviour. If applicable, we will also collect your business name and ABN (for sole traders and partnerships).

If you are a visitor, we will also collect your email address, information about your use of our website and the device you are using (including numbers that identify your device, IP address, geographic location of your IP address and device where that is relevant to the services and information we are providing, cookie information, and user preferences). You may choose to enable or disable information you share with us via the website in your browser or device settings. Disabling the sharing of some information may affect your ability to use certain features of the website, and your visitor experience generally.

If you are an applicant, depending on your potential or actual position with us, we will also generally collect your Personal Information contained within an application and CV/resume, employment history, personal information derived from a reference, personal information derived from an interview, personal information derived through testing (including psychometric or aptitude testing, as applicable), licences and other certificates and qualifications, and information included in a passport, birth certificate, visa or other documentation demonstrating your right to work in Australia.

We support your ability to make decisions about the Personal Information you provide to us, however if you choose not to provide us with the information requested, or it’s incomplete or inaccurate, we may not be able to provide you with the information, goods, and services you are seeking. If you are an applicant, refusal to provide Personal Information may mean we are unable to process your application.

3. How we collect your Personal Information

We will generally collect personal information from you directly when you interact with us, such as via our channels, social media, email or phone, when you place an order, create an account, or subscribe to marketing communications.

We may also need to collect Personal Information about you from third parties from time to time where it is necessary for us to do so and it is unreasonable or impractical to collect directly from you, where you have consented to us doing so, or where we are otherwise required to or authorised to by law. Those third parties include:

• if you are a client or supplier: publicly available records such as the Australian Securities Investment Commission, and Australian Business Register;
• if you are a visitor: technology service providers and social media platforms;
• if you are an applicant: referees when they provide references, academic institutions or training and certification providers, providers of licence and background-checking services, recruiters and other service providers who assist in the engagement process, and other publicly available sources such as social media platforms.

Except as otherwise permitted by law, we only collect Sensitive Information about you if you consent to the collection of the information and if it is reasonably necessary for the performance of our functions and activities. Consent may be implied by the circumstances existing at the time of collection. There may also be circumstances under which we may collect Sensitive Information without your consent, as required or authorised by law.

If you provide us with Personal Information about someone else, you must ensure that you are authorised to disclose that information to us and that, without us taking any further steps required by applicable privacy laws, we may collect, store, use and disclose such information for the purposes described in this Privacy Policy. Where we request you to do so, you must assist us with any requests by the individual to access or update the Personal Information you have collected from them and provided to us.

4. Why We Collect, Hold, Use and Disclose Your Information

We will generally collect, hold, use and disclosure use your Personal Information if it is reasonably necessary for or directly related to the performance of our functions and activities. This includes the following purposes:

• to facilitate our business operations, including:
• Transactions and fulfilment – to process and deliver your orders, including providing updates and support and supplying you with goods and services;
• Account management – to manage your account and your relationship with us, updating your Personal Information, including destroying or de-identifying it when it is no longer relevant (to the extent applicable, and maintain your purchase history;
• Requesting your feedback – to contact you and ask for your feedback and testimonial;
• Personalisation – if you are a visitor or client, to tailor content, offers, and recommendations based on your preferences and interactions with our Channels;
• Website optimisation – to conduct market research and monitor use of our goods and services, analyse our performance, track our campaign effectiveness, and improve the quality of our Channels;
• Legal and compliance – to meet legal obligations, respond to lawful requests, and protect the rights and safety of CtrlOps, our customers, and third parties;
• Procurement – if you are a supplier, purchasing goods or services from you, and enquiring about your products and services; and
• Employment Applications – if you are an applicant, considering your application with us.
• Marketing communications – to send you marketing emails, SMS messages, and social media updates if you have provided consent. You may unsubscribe at any time by using the unsubscribe feature on the emails we send, or otherwise by contacting us in writing. We do not use your Sensitive Information for direct marketing purposes.
• De-identification and destruction of your Personal Information – to de-identify and aggregate Personal Information about you and your use of our goods and services to improve the quality of our goods and services, and for research purposes. After we delete Personal Information, we may retain de-identified and anonymised information (that can no longer be associated with you) and may continue to use this de-identified data indefinitely without further notice to you; and
• or any other purpose required or authorised by law or otherwise identified at the time of collection.

5. Who we disclose Personal Information to

We may share your personal information with trusted third parties, including:

• our related entities;
• our employees, contractors, consultants and other parties who require the information to assist us with the purposes for which it was collected, and with establishing, maintaining or terminating our relationship with you;
• third party service providers who assist us in operating our business and supporting our Channels such as Klaviyo (for marketing services and analytics), YotPo (for customer reviews), Gladly (for customer service). We also use logistics and delivery providers to ship orders, payment processors to process transactions securely, IT service providers, insurers, recruitment providers, and professional advisers such as lawyers, accountants and auditors;
• entities who partner with us on joint promotions or campaigns;
• third parties to whom you have agreed we may disclose your information and where the information was collected from you (or from a third party on your behalf) for the purposes of passing it on to the third party; and
• government and regulatory authorities where required by law; and
• any other entity as otherwise required or authorised by law, including regulatory bodies.

Where information is shared with service providers, they are required to use your personal information only for the purpose of providing services to CtrlOps and in accordance with this Policy.

We may expand or reduce our business, and this may involve the sale and/or transfer of control of all or part of our business. Personal Information, where it is relevant to any part of the business for sale and/or transfer, may be disclosed to a proposed new owner or newly controlling entity for their due diligence purposes, and upon completion of a sale or transfer, will be transferred to the new owner or newly controlling party to be used for the purposes for which it was provided.

6. Overseas disclosure

We are assisted by a variety of external service providers to operate our business and to provide you or someone else on your behalf with the information and services sought. Some of these service providers may be located overseas, and while there are too many to name, they include Google, Microsoft, Meta, Klaviyo, Gladly, YotPo and Amazon Web Services located in the USA, and HotJar located in Malta.

We take reasonable steps to ensure these service providers have appropriate security for your Personal Information and use it only for the purposes for which it was collected.

7. Cookies and Tracking

We use cookies, pixels, web beacons and similar technologies (Tracking Technologies), including through the use of third party service providers.

The main purpose of cookies is to identify users to create a personal record of when that user visits our websites and to prepare customised web pages for them so that we may provide our services more effectively. We may also use cookies to monitor the use of our websites and digital services, like the numbers and frequency of visitors to our websites, to help us improve our services and identify any problems that need fixing. If you choose not to accept cookies from our websites, you will not be able to maintain a session-based interaction and will be treated as an anonymous browser.

Our websites also use a number of third party services that utilise Tracking Tools. Use of your personal information by these third parties is also subject to their own privacy policies. For details on how each provider uses information collected through Tracking Tools, please refer to their respective websites. The third party services we use includes:

• Google Analytics and Google Tag Manager, for audience measurement and website optimisation;
• Meta Pixel for advertising analytics and remarketing on Meta platforms such as Facebook and Instagram;
• LinkedIn Insight Tag for advertising analytics and remarketing on LinkedIn;
• HotJar for user experience analytics such as heatmaps and session insights; and
• Microsoft/Bing UET Tag for audience measurement and advertising analytics.

The information that is disclosed to these parties via Tracking Tools is:

• information about your use of our website, your IP address, device and browser type, ISP, and referring/exit pages;
• information about your purchases and items that you add to your cart;
• pseudonymous identifiers such as cookie, browser and session IDs;
• session metrics such as your session start time, duration, pages you view, pages per session and engagement time; and
• user experience metrics such as mouse movements, clicks, taps and scroll behaviour.

You can control cookie settings through your browser, including disabling cookies. You may also adjust your browser settings or use browser extensions to block other Tracking Tools. However, please note that if you do this, you may not be able to use the full functionality of our websites

8. Direct Marketing and Consent

CtrlOps uses email and SMS to share promotions, product updates, and offers with customers who have opted in to receive marketing.

You may withdraw your consent at any time by clicking the unsubscribe link in marketing emails, replying STOP to SMS messages, or contacting us at support@ctrlops.com.au.

Non-marketing communications (such as order confirmations, shipping notifications, or service updates) will continue to be sent where necessary to fulfil your order.

9. Storage and Security

We take reasonable technical and organisational steps to protect personal information from misuse, interference, loss, unauthorised access, modification or disclosure. These measures include:

• All payment transactions are processed using SSL encryption, and CtrlOps does not store full payment card details;
• Personal information is stored securely on servers with restricted access to authorised persons;
• We only provide access to Personal Information once proper identification has been provided; and
• We require our third party providers to have acceptable security measures to keep your Personal Information secure.

In the event of a notifiable data breach, CtrlOps will notify affected individuals and the Office of the Australian Information Commissioner (OAIC) in accordance with the Notifiable Data Breaches scheme.

Despite the reasonable steps we take to secure your Personal Information, if you provide any Personal Information to us via our Channels (including email) or if we provide Personal Information to you by such means, the privacy, security and integrity of your Personal Information cannot be guaranteed during its transmission unless we have indicated beforehand that a particular transaction or transmission of information will be protected (for example, by encryption).

10. Retention of Information

We retain personal information for as long as necessary to provide products and services, comply with legal obligations, and resolve disputes. When information is no longer required for the purpose for which we collect it, we will take reasonable steps to securely delete or de-identify it. However, most of the Personal Information is or will be stored and kept by us for a minimum of seven years (unless legislation requires us to destroy or permanently de-identify it sooner).

11. Access and Correction

You may request access to the personal information we hold about you, or request correction if it is inaccurate, incomplete, or outdated. Requests should be made by contacting support@ctrlops.com.au. We will take reasonable steps to correct the information if we agree that it is incomplete, out of date, or inaccurate. We will strive to respond to any request within 30 days or otherwise within a reasonable time.

There are no charges for requesting access to or the correction of your Personal Information, however we reserve our rights to charge you any reasonable administration fees associated with your request. We will notify you in advance of any applicable fees.

In order to protect the confidentiality of your Personal Information, details of your information will only ever be passed on to you where we are satisfied that the information relates to you. Accordingly, we may request documentation from you which confirms your identity before passing on any Personal Information which relates to you.

12. Complaints

If you believe CtrlOps has breached the Privacy Act or the Australian Privacy Principles, you may lodge a complaint by contacting us at support@ctrlops.com.au. We will investigate and attempt to resolve any complaint in accordance with the Privacy Act. If you are not satisfied with our response, you may refer the matter to the Office of the Australian Information Commissioner, located at http://www.oaic.gov.au/privacy/privacy-complaints, to obtain the relevant complaint forms, or contact the Information Commissioner’s office.