PRIVACY POLICY

1. Who we are

1.1 JLR EXPERT IMPORTERS Pty Ltd (ABN 35 656 848 476) (JLR, we, us or our) is a wholesale importer and distributor. This Policy explains how we manage personal information in connection with prospective, current and former wholesale accounts, our wholesale website and portal, orders, deliveries, trade enquiries and related business activities.

1.2 This Policy applies to sole traders and to individuals associated with a business customer, including proprietors, directors, officers, beneficial owners, guarantors, authorised buyers, finance personnel, employees, delivery contacts, trade referees and other representatives. Information about a company is not personal information unless it identifies, or is reasonably linked to, an individual.

1.3 Personal information has the meaning given in the Privacy Act 1988 (Cth) — broadly, information or an opinion about an identified individual, or an individual who is reasonably identifiable, whether or not it is recorded in a material form.

2. Personal information we collect

We collect only information that is reasonably necessary for our functions or activities, or otherwise permitted by law. Depending on your dealings with JLR, this may include:

• name, business role, signature, date of birth where reasonably required, telephone number, email address, and evidence of identity or authority;
• business-account information linked to an individual, including business name, ABN or ACN, ownership or directorship, trading, billing and delivery addresses, authorised users and login details;
• trade-account information, including requested payment terms or credit limit, trade references, guarantees, payment history, overdue-account communications and publicly available insolvency or business-register information;
• quotations, purchase orders, products, carton or pallet quantities, invoices, account statements, payment status, returns, refunds, account credits, credit notes and communications;
• payment method, transaction reference and limited payment information supplied to JLR by a bank or payment provider. JLR does not require complete card numbers or card security codes to be sent by ordinary email;
• website and device data, including IP address, browser and device type, login and security events, pages viewed, searches, cart activity, referring pages, approximate location and cookie or similar identifiers;
• marketing preferences, survey responses, promotion entries, feedback and interactions with wholesale communications;
• delivery, complaint, food-safety and recall information, including photographs, proof of delivery, batch or lot codes and temperature information; and
• security records, including access logs and CCTV images at premises where surveillance notices are displayed.

2.1 Sensitive information. We do not generally seek sensitive information. We will collect it only where reasonably necessary and with consent, or where another legal exception applies. Please do not provide sensitive information unless JLR requests it or it is necessary to resolve a matter.

3. How we collect personal information

3.1 We usually collect information directly from you through wholesale account or trade-credit applications, identification and authority documents, our website or portal, telephone calls, emails, quotations, purchase orders, claims, promotions and in-person dealings.

3.2 We may also collect information from the wholesale customer and its personnel or advisers, an authorised guarantor or trade referee, banks and payment providers, couriers and freight providers, publicly available ABR or ASIC records, social-media platforms, website and IT providers, or another source where collection is lawful and reasonably necessary.

3.3 If you give JLR personal information about another person, you must be authorised to do so and, where reasonably practicable, make that person aware of this Policy and any relevant collection notice.

3.4 Anonymity and pseudonyms. You may make a general enquiry anonymously or under a pseudonym where lawful and practicable. We normally need verified identity, business authority, payment and delivery information to approve or operate a wholesale account, supply account pricing, provide credit, deliver goods, administer claims or conduct a recall.

3.5 Collection notices. Where required, JLR will provide a collection notice at or before collection, or as soon as practicable afterwards. A collection notice may give details specific to a form or transaction, including required information, consequences of non-provision, usual disclosures and likely overseas recipients.

4. Why we handle personal information

• respond to wholesale enquiries and provide product, price, availability and quotation information;
• assess, verify, approve, administer and secure wholesale accounts, payment terms and authorised users;
• process purchase orders, allocate stock, issue tax invoices and statements, receive payments, deliver or release goods and recover overdue amounts;
• manage cancellations, returns, replacements, refunds, credits, credit notes, complaints and disputes;
• perform product traceability, safety, withdrawal and recall activities;
• operate, secure, troubleshoot and improve our wholesale website, catalogue and services;
• send direct marketing where permitted and manage preferences and opt-outs;
• meet legal, taxation, accounting, food-safety, insurance, audit and record-keeping obligations; and
• prevent fraud and establish, exercise or defend legal rights.

4.1 We will not use or disclose personal information for a secondary purpose unless the individual has consented or the use or disclosure is otherwise authorised or required by law. If required information is not provided, JLR may be unable to verify authority, approve or maintain an account, provide credit or account pricing, accept an order, deliver goods or resolve a claim.

5. Disclosures

Where reasonably necessary and lawful, we may disclose personal information to:

• JLR personnel, contractors and professional advisers who need the information for their work;
• website hosting, ecommerce, customer-management, cloud, email, communications, analytics, IT-support, cybersecurity and document-management providers;
• banks, payment processors, fraud-prevention providers, accountants, insurers, lawyers, authorised trade referees and debt-recovery providers;
• warehouses, couriers, freight forwarders, cold-chain providers and delivery contractors;
• manufacturers, importers, suppliers, insurers or regulators for quality, traceability, safety, withdrawal or recall matters;
• government agencies, courts, law-enforcement bodies or regulators where authorised or required by law; and
• a prospective purchaser and its advisers in a proposed sale, restructure or transfer of JLR, subject to appropriate confidentiality and legal safeguards.

5.1 JLR does not sell personal information as a product. Service providers may use it only to provide services to JLR or as otherwise lawfully permitted under their own disclosed obligations.

6. Trade credit and credit reporting

6.1 JLR may use information supplied in a trade-account application, payment history, authorised trade references and public business records to assess or administer commercial payment terms. JLR will not obtain an individual’s consumer credit report for a commercial-credit or guarantee assessment unless legally permitted and the required consent and notices have been provided.

6.2 If JLR begins obtaining or disclosing credit-reporting information regulated by Part IIIA of the Privacy Act, it will first implement the notices, consents, access, correction and complaint arrangements required by law and publish a compliant credit-reporting policy where required. Unless JLR gives you a specific credit-reporting notice, this Policy does not represent that JLR reports payment defaults to a credit reporting body.

7. Overseas access, storage and disclosure

7.1 Some of JLR’s service providers may store or process personal information outside Australia, or may permit overseas support access to systems that hold personal information.

[TO CONFIRM BEFORE PUBLISHING] List here the countries where JLR’s current IT, hosting, payment or logistics providers are likely to store or access personal information (e.g. specific cloud or SaaS providers), or state that JLR does not currently disclose personal information overseas. This section must reflect JLR’s actual providers at the time of publishing, and should be reviewed whenever a provider changes.

7.2 Where Australian Privacy Principle 8 applies to an overseas disclosure, JLR will take the reasonable steps required by law and may remain accountable for the overseas recipient’s handling of the information, subject to statutory exceptions. Overseas privacy protections and enforcement rights may differ from those in Australia.

8. Cookies and online technologies

8.1 Our wholesale website and portal may use cookies, local storage, pixels, tags, server logs and similar technologies. Essential technologies support security, login, account pricing, carts, checkout and core functionality. With any consent required by law, non-essential technologies may remember preferences, measure performance, analyse usage or support advertising.

8.2 JLR maintains a cookie notice or preference tool on its website identifying the categories and material third-party analytics or advertising tools in current use. You may use that tool or your browser settings to block or delete cookies, although disabling essential technologies may prevent parts of the wholesale portal from working.

9. Automated decisions

9.1 JLR reviews and documents any computer program it uses that makes, or materially contributes to making, a decision that could reasonably be expected to significantly affect an individual’s rights or interests (for example, automated credit-limit or account-approval decisions).

[TO CONFIRM BEFORE PUBLISHING] Confirm current position and state it plainly, for example: ‘JLR does not currently use a computer program to make decisions that significantly affect an individual’s rights or interests without human review’ or, if one is used, name the system and describe the kinds of personal information used and the kinds of decisions involved, as required by law.

10. Direct marketing

10.1 JLR may send wholesale product news, stock updates, offers and trade promotions where the individual has consented or the communication is otherwise permitted by the Privacy Act, Spam Act and other applicable law. Marketing consent is separate from acceptance of JLR’s Wholesale Terms and is not a condition of opening an account or placing an order unless lawful and genuinely necessary.

10.2 Commercial electronic messages will identify JLR, include accurate sender contact details and provide a functional unsubscribe facility. We will honour a valid electronic unsubscribe request within five business days. You may also opt out by contacting us. Opting out does not stop operational communications about account administration, requested quotations, orders, invoices, deliveries, payments, product safety or recalls.

11. Security and data breaches

11.1 JLR takes reasonable administrative, technical and physical steps to protect personal information from misuse, interference, loss and unauthorised access, modification or disclosure. Controls are selected having regard to the nature of the information and may include role-based access, authentication, staff procedures, supplier controls, backups, monitoring, physical security and secure disposal.

11.2 Wholesale users must use strong, unique passwords, protect account credentials, restrict access to authorised staff and promptly tell JLR if a user leaves the business, authority changes or unauthorised activity is suspected.

11.3 JLR maintains a data-breach response process. If the Notifiable Data Breaches scheme applies, JLR will promptly assess a suspected eligible data breach and notify the OAIC and affected individuals where required because the breach is likely to result in serious harm and no exception applies.

12. Retention and disposal

12.1 JLR retains personal information only while reasonably necessary for the purposes described in this Policy and applicable legal, taxation, accounting, credit, food-traceability, insurance, guarantee, debt-recovery and dispute requirements. Retention depends on the record — for example, tax invoices and payment records are generally kept for at least five years to meet Australian Taxation Office requirements, corporate and account records are generally kept for at least seven years, and food-traceability and claim records are kept for as long as the applicable product, regulatory, insurance or limitation period requires.

12.2 JLR will maintain an internal retention schedule that identifies record categories, legal bases, minimum periods and secure disposal methods. When information is no longer required and JLR is not legally permitted or required to retain it, JLR will take reasonable steps to destroy or de-identify it. Backup copies will be protected and removed through the normal backup cycle where immediate deletion is not technically practicable.

13. Access and correction

13.1 An individual may ask for access to personal information JLR holds about them or request correction of information that is inaccurate, out of date, incomplete, irrelevant or misleading. Contact us using section 17 and provide enough information to verify identity and locate the records. A business representative cannot obtain another individual’s personal information without authority.

13.2 JLR will respond within a reasonable period. We may refuse or limit a request only where permitted by law and will generally give written reasons and available complaint options. There is no charge to make a request. If the law permits a reasonable access charge, JLR will explain it before incurring the cost. Where required following a correction, JLR will take reasonable steps to notify relevant third parties.

14. Complaints

14.1 Send a privacy complaint to the contact in section 17, identifying the issue and outcome sought. JLR aims to acknowledge a complaint within five business days and provide an outcome within 30 calendar days. If more time is reasonably needed, JLR will explain why and provide a revised timeframe.

14.2 If you remain dissatisfied and the Privacy Act applies, you may complain to the Office of the Australian Information Commissioner at oaic.gov.au. The OAIC generally expects you to first give JLR an opportunity to resolve the complaint. You may also seek independent legal advice.

15. Account representatives, links and policy changes

15.1 The wholesale customer must keep authorised-user information current and promptly ask JLR to remove or amend access when a person changes role, leaves the business or no longer has authority. A change in ownership or control may require a new application or verification. Login credentials and personal information must not be transferred informally to a new owner or unrelated business.

15.2 External websites are governed by their own privacy practices. JLR is not responsible for them except to the extent required by law.

15.3 JLR may update this Policy when its practices, providers, website tools or legal obligations change. The current version and effective date will be available free of charge on our website. Material changes will be notified by an appropriate method before or when they take effect, where reasonably practicable.

16. How this Policy relates to the Returns, Refunds and Cancellations Policy

16.1 Personal information and evidence collected under JLR’s Returns, Refunds and Cancellations Policy (such as claim details, photographs and delivery records) is handled in accordance with this Privacy Policy.

17. Contact us

17.1 Business: JLR EXPERT IMPORTERS Pty Ltd | ABN 35 656 848 476

17.2 Address: 3/85-91 Broun Avenue, Morley WA 6062

17.3 Email:admin@jlrexpertimporters.com.au

17.4 Telephone: 0410 028 713

17.5 Mark correspondence ‘Privacy Request’ and include your name, wholesale business name, role, contact details and enough information for JLR to verify identity and respond.