Cfresco Privacy Policy

1. What we collect

Depending on how you interact with Cfresco, we may collect:

• Identity and contact details: your name, email address, telephone number, postcode, suburb, delivery or installation address, and preferred contact method and time.
• Kitchen and project details: designs and saved design versions, selected products and finishes, measurements, plans, photographs or notes you provide, property and site information, installation requirements, project timing and questions.
• Account information: your account identifier, login email, authentication and account-activity records. Passwords are handled through our authentication provider; we do not ask you to send us a password by email.
• Enquiry and transaction records: your messages to us, consultation and quote requests, quotes, orders, invoices, payments and transaction references, delivery and installation communications, warranty or service requests, and our records of follow-up.
• Website and device information: IP address, approximate location derived from it, browser and device details, pages visited, referral source, campaign tags, and technical logs. Our site may use cookies or browser storage to support sign-in, remember a draft design, maintain security and understand how the site is used. See section 5.
• Marketing preferences: whether, when and how you agreed to receive optional product updates, and any later unsubscribe request.

Please do not provide sensitive personal information unless we request it for a specific purpose and explain why it is needed. If you provide details about someone else, please make sure they know you have shared those details with us.

2. How we collect information

We collect information directly from you when you use our website or configurator, complete a form, create an account, contact us, meet with us, provide site details, or purchase a product or service. We also collect technical information automatically when you use the site.

Sometimes information comes from another person involved in your project, such as a joint customer, designer, builder, installer or referring partner. Where practicable, we will make clear how we obtained it. You may be able to browse public pages without identifying yourself, although some website functions may involve cookies or other technical identifiers. We need some contact and project details to respond to an enquiry, save an account-based design, prepare a quote or fulfil an order. If required details are not provided, we may not be able to do those things.

3. Why we use it

We use personal information to:

• operate the website and kitchen configurator; create and secure accounts; and save, retrieve or share a design at your request;
• answer enquiries, arrange consultations or site measures, assess your project, prepare and revise quotes, and communicate about the products and services you request;
• manage orders, payments, supply, delivery, installation, warranties, repairs, customer service and disputes;
• coordinate with the manufacturers, suppliers, installers and other trades needed for your project;
• maintain business records, prevent fraud or misuse, secure our systems, troubleshoot problems, and meet legal and regulatory obligations; and
• where required, with your consent or another applicable lawful basis, send occasional Cfresco product news or offers. An enquiry or account registration is not, by itself, consent to receive marketing.

We may analyse website use and enquiry sources to improve the site and our services. We do not sell customer contact lists or personal information.

The configurator helps you explore a design. Any automated layout, compatibility information or indicative pricing does not replace our review of the details and a firm written quote.

4. Who we share it with

We may share information reasonably needed for a particular task with:

• our staff and authorised contractors who handle sales, customer support, administration and operations;
• kitchen and appliance manufacturers, suppliers, delivery providers, check-measurers, installers and licensed trades involved in your project;
• providers of website hosting, databases, account authentication, cloud storage, email delivery, communications, analytics, payment or business-management services that we use; and
• professional advisers, insurers, regulators or other parties where required or authorised by law, or reasonably necessary to protect our rights or resolve a dispute.

An installer or supplier may need your name, contact details, address and relevant project specifications. Access will depend on the task and the systems used. We do not share your details with unrelated businesses for their own marketing unless we have an appropriate legal basis and, where required, your consent.

5. Cookies, browser storage and analytics

Our site may use cookies and similar browser storage for essential functions such as authentication, security and remembering a design while you work. A locally stored draft may remain on your device until it is cleared by you, overwritten or removed by the browser. A saved design associated with your account may also be stored in our systems.

We may use Google Analytics 4 to collect aggregated information about website use, including pages viewed, approximate location, device and browser information, referral source and interactions with the site. Google Analytics may use cookies and similar technologies. We intend to configure it to reduce the collection of directly identifying information and not to send Google Analytics your name, email address, postal address or payment details. Google may process information in countries outside Australia, including the United States.

We may use Google Ads conversion tracking or Google Ads remarketing where enabled on the site. These tools may use cookies or similar technologies to measure advertising performance and, where applicable, show Cfresco advertising to people who have previously visited the site. They may collect information about visits, interactions, campaign referrals and browser or device identifiers. We do not intend to upload customer contact lists to advertising platforms unless we first obtain any consent required by law and provide the relevant notice.

Where required by law, we ask for consent before activating non-essential analytics or advertising technologies. The technologies currently enabled and your available choices are described in our cookie settings tool. Essential cookies and storage may remain active because they are required for sign-in, security and core configurator functions. You can also control or delete cookies and local storage through your browser settings. Blocking essential storage may prevent sign-in or design-saving features from working.

6. Marketing messages

If you choose to receive product updates, we may contact you using the channels you agreed to. Marketing is separate from messages needed to respond to your enquiry or fulfil a contract. You can withdraw marketing consent at any time through an unsubscribe link or by contacting us. We will process unsubscribe requests in accordance with applicable law and our systems’ processing times. Withdrawing marketing consent does not stop necessary messages about an active quote, order, installation or service request.

7. Overseas handling

Some technology or communication providers may store, process or permit support access to personal information outside Australia. Google Analytics 4 and Google Ads may process information in the United States and other countries in which Google or its service providers operate. Payment providers, manufacturers, suppliers and other project providers may also process information in the countries where they operate.

We assess overseas disclosures and provider arrangements as part of our privacy and vendor-management processes and take steps required by applicable law. We do not intentionally transfer personal information overseas except through providers and project participants reasonably required to operate our business or provide requested products and services.

8. Security and retention

We use administrative, technical and organisational safeguards appropriate to the nature of the information and the risks involved. The safeguards used may vary between systems and providers. No online service is completely secure; please contact us promptly if you suspect unauthorised access to your account.

We retain personal information for as long as reasonably necessary for the purposes described in this policy, including to manage enquiries, accounts, designs, orders, warranties, services, complaints, disputes, legal claims, regulatory obligations, taxation, insurance and business records.

Marketing consent and unsubscribe records may be retained for as long as reasonably necessary to demonstrate compliance and suppress further marketing.

When information is no longer needed, we delete it from active systems or de-identify it where practicable. Deleted information may remain in encrypted backup copies until those backups expire through the normal rotation cycle. Backups are not ordinarily restored for access except where needed for disaster recovery or investigation. Where a legal hold, dispute, investigation or regulatory requirement applies, deletion may be delayed until that matter is resolved.

If we identify a data breach, we will assess the circumstances and take steps required by applicable law, which may include investigation, containment and notification.

9. Access, correction and account requests

You may ask what personal information we hold about you, request access or correction, or ask us to close an account or delete information that we no longer need to retain. Contact us using the details below. We may need to verify your identity before acting. We will explain if we cannot fulfil a request because of a legal obligation, a current transaction or another applicable reason. Closing an account may not erase records that we must keep for orders, warranties or legal purposes.

10. Questions and complaints

For a privacy question, access or correction request, or complaint, contact:

Please describe your concern and provide a safe way to contact you. We will process privacy enquiries and complaints in accordance with applicable law and our internal procedures. If the Australian Privacy Principles apply to our business and you remain dissatisfied after contacting us, you may be able to complain to the Office of the Australian Information Commissioner at oaic.gov.au.

11. Changes to this policy

We may update this policy as our services or information-handling practices change. We will publish the current version on this page with its effective date. If a change materially affects how we use information already collected, we will take any additional steps required by applicable law.

The policy will be reviewed, versioned, dated and published in accordance with Cfresco’s privacy-management processes.