iTao (itao.com.au and the iTao app) is an Australian online marketplace operated by iSun Investment (“iTao”, “we”, “us”, “our”). This policy explains how we collect, use, share and protect your personal information, and how you can access or correct it. We handle personal information in line with the Privacy Act 1988 (Cth) and the Australian Privacy Principles.
1. Information we collect
Information you give us
Account details: your name, email address, mobile number and password. If you sign in with a social account (such as Facebook), we receive your name and email address from that service.
Order details: billing and delivery addresses, phone number, the products you buy, order notes and order history.
Messages: what you send us or a seller through contact forms, support tickets, in-app chat and email.
Reviews and wishlists: product and shop reviews you write, and items you save.
Sellers: business name and address, ABN or company registration and identity documents for verification, shop details, and the Stripe account you connect for payouts.
Information collected automatically
Device and browser details, IP address, pages viewed, items added to your cart, and how you arrived at our site.
Cookies and similar technologies that keep you signed in, remember your cart and preferences, and help us measure and improve the site. Section 6 has more detail.
Payment card details are entered into Stripe’s secure payment form. They go directly to Stripe, and iTao never sees or stores your full card number.
You can browse iTao without an account. If you choose not to give us certain information, we may not be able to process an order or provide a service.
2. How we use your information
To create and manage your account, including verifying your mobile number with a one-time code.
To process orders and payments, arrange delivery, and handle returns, refunds and disputes.
To send you order confirmations, shipping updates and account messages.
To answer your questions and provide customer support.
To verify sellers and keep the marketplace safe: preventing fraud, spam, fake accounts and misuse.
To improve the site, the app and our product range.
To send you newsletters, offers and push notifications, but only when you have opted in. You can unsubscribe or turn notifications off at any time.
To meet our legal obligations, such as keeping financial records.
3. Who we share it with
We do not sell your personal information. We share it only as needed to run the marketplace:
Sellers on iTao: when you buy from a seller, they receive your name, delivery address, phone number, email address and order details, so that they can fulfil and support your order. Sellers must use this information only for your order, as our Seller Terms require.
Payment processing: Stripe processes card, Apple Pay and Google Pay payments, and holds sellers’ payout details.
Delivery: carriers such as Australia Post, and our fulfilment partners for products sold by iTao, receive your delivery details.
Service providers that help us run iTao:
Hosting and security: our Australian web host, Cloudflare and Akismet.
Account sign-in and SMS verification: Digits and Google Firebase.
Spam protection: Google reCAPTCHA.
Email newsletters: Mailchimp.
Push notifications: OneSignal.
Website analytics: Google Analytics and Jetpack.
Our Facebook and Instagram shop and advertising: Meta.
These providers may use the information only to provide their service to us.
Legal reasons: when the law requires it, to respond to a lawful request from a government or law enforcement agency, or to protect the rights, property or safety of our customers, sellers or iTao.
Business changes: if iTao’s business is sold or restructured, information may pass to the new owner, who must handle it under this policy.
4. Information stored or processed overseas
Some of the providers above store or process information outside Australia, mainly in the United States and the European Union, and some of our fulfilment partners for products sold by iTao are located overseas (including China). We take reasonable steps to make sure these providers protect your information in a way that is consistent with the Australian Privacy Principles.
5. How we protect your information
Our site uses encrypted (HTTPS) connections. Access to personal information is limited to people who need it to do their job.
Card payments are handled by Stripe, a PCI DSS Level 1 certified provider.
Keep your password private, use one that you don’t use elsewhere, and tell us straight away at [email protected] if you think someone has used your account.
If a data breach is likely to cause you serious harm, we will notify you and the Office of the Australian Information Commissioner (OAIC) as the Notifiable Data Breaches scheme requires.
6. Cookies, analytics and marketing
Essential cookies keep you signed in, hold your cart and protect forms from spam. The site doesn’t work properly without them.
Analytics cookies (Google Analytics, Jetpack) tell us how the site is used, in aggregate.
Newsletter: if you join our newsletter, Mailchimp holds your email address so that we can send it to you. Every email has an unsubscribe link.
Meta: our product catalogue is shared with Meta for our Facebook and Instagram shop. Meta may use cookies to measure our ads and show you relevant ads, under its own privacy policy.
Push notifications are sent only if you allow them in your browser or the app, and you can turn them off in your browser or phone settings.
You can block or delete cookies in your browser settings, but some parts of the site may stop working.
7. How long we keep it
We keep your information while your account is active and for as long as we need it for the purposes above. Order, payment and tax records are kept for as long as Australian tax and financial reporting laws require (generally 5 to 7 years). When we no longer need information, we delete it or make it anonymous. You can ask us to delete your account at any time; see our Data Deletion page.
8. Your choices and rights
Access and correction: you can view and update most of your details under My Account. You can also ask us for a copy of the personal information we hold about you, or ask us to correct it. We will respond within 30 days.
Deletion: you can delete your account in the iTao app or request deletion on our Data Deletion page.
Marketing: you can unsubscribe from emails and turn off notifications at any time.
We may need to confirm your identity before acting on a request. We may refuse a request where the law allows it, and if we do, we will tell you why.
9. Children
iTao is intended for adults. You must be 18 or older, or use iTao with the involvement of a parent or guardian, to place an order. We do not knowingly collect personal information from children under 16. If you believe a child has given us their information, please contact us and we will delete it.
10. Links to other sites
Our site may link to other websites, such as a brand’s website or a payment provider. Their privacy practices are their own, so please read their privacy policies.
11. Changes to this policy
We may update this policy from time to time. The “Last updated” date at the top shows when it last changed. If we make a significant change, we will let you know on the site or by email.
12. Contact us and complaints
For privacy questions, requests or complaints, email [email protected] or use our contact page. We will acknowledge your message and aim to resolve it within 30 days.
If you are not satisfied with our response, you can contact the Office of the Australian Information Commissioner (OAIC) at www.oaic.gov.au or on 1300 363 992.
