Privacy policy

How Bendigo Graphics collects, uses, shares and protects personal information, including in Pulse and for the customers of the businesses we work for.

The short version

  • We collect what we need to quote, make and deliver your work, run your marketing and operate Pulse: your contact and business details, your orders and files, and how you use our website and portal.

  • Card payments are handled by Stripe. We never see or store your full card number.

  • Calls to our business may be recorded and transcribed, and some of our tools use automated and machine-learning processing. A person reviews anything that matters.

  • We never sell your personal information. We share it only with the people who help us do the work, such as our production partners, payment, hosting, email, SMS and advertising providers, some of which are overseas.

  • Where we hold your customers’ information for you (for example leads, callers and review contacts), we handle it on your behalf and you remain responsible for telling your customers.

  • You can ask to see or correct your information, opt out of marketing at any time, and complain to us or to the Office of the Australian Information Commissioner.

This summary is for convenience only. If anything in it differs from the Policy below, the Policy governs. Read our Terms and Conditions

Part A: About this Policy

1. Who we are and how to contact us

1.1 Who we are. This Privacy Policy (Policy) is issued by [TRUSTEE NAME AND ACN] as trustee for the Studio Ecks Family Trust (ABN 49 145 778 164), trading as Bendigo Graphics (Bendigo Graphics, we, us and our).

1.2 Contact. You can contact our Privacy Officer about this Policy, or about any personal information we hold about you, at:

Privacy Officer, Bendigo Graphics

Shop 2, 176 Lyttleton Terrace, Bendigo, Victoria 3550

info@bendigographics.com (subject: Privacy)

(03) 5441 7900

1.3 What this Policy covers. This Policy explains how we collect, hold, use and disclose personal information when you deal with us in any way, including when you visit bendigographics.com (the Website), use Pulse, our client portal at studio.bendigographics.com and its related tools (Pulse), request a quote, place an order, engage us for design, marketing or website services, call, text or email us, attend a content day, or are a customer or lead of one of our clients.

1.4 Our commitment to the Australian Privacy Principles. We may be a small business operator that is exempt from the Privacy Act 1988 (Cth) (the Privacy Act) for some purposes. Regardless of whether that exemption applies to us, we have chosen to handle personal information in accordance with the Australian Privacy Principles (APPs) in the Privacy Act, and this Policy is our APP privacy policy. Where the Privacy Act applies to us, including in relation to any activity for which the exemption is not available, we comply with it.

1.5 How this Policy relates to our Terms. This Policy should be read with our Terms and Conditions at bendigographics.com/terms-and-conditions. If you are our client and we handle your customers’ personal information for you, clause 37 of our Terms and Part D of this Policy also apply.

2. Key terms

2.1 In this Policy:

(a) personal information means information or an opinion about an identified individual, or an individual who is reasonably identifiable, whether true or not and whether recorded in a material form or not, and has the meaning given in the Privacy Act;

(b) sensitive information has the meaning given in the Privacy Act, and includes health information and information about racial or ethnic origin, political opinions or membership of a political association, religious beliefs, sexual orientation and criminal record;

(c) client means a business or person that engages us, and client data means information our clients give us or connect to Pulse, including information about their own customers;

(d) you means the individual whose personal information we handle, whether you are a client, a client’s staff member, a client’s customer, a website visitor, a supplier, a job applicant or anyone else; and

(e) other capitalised words have the meaning given in our Terms and Conditions.

Part B: What we collect and how

3. The kinds of personal information we collect

3.1 Identity and contact information. Your name, business name, job title, email address, phone and mobile numbers, postal, delivery and billing addresses, ABN, and the details of the contacts and team members associated with your account.

3.2 Account and login information. Your Pulse or Website account details, username, encrypted password (we cannot see your password), multi-factor authentication settings, account role, invitations, sign-in history and security logs.

3.3 Order, quote and project information. Quotes, orders, specifications, measurements, garment sizes, delivery and collection details, proofs, approvals, revision requests, proposals, service agreements, signed documents and the typed name, drawn signature, date, time, IP address and device information recorded when you sign or accept something electronically.

3.4 Payment and financial information. Invoices, payments, refunds, account balances, credit terms applications, trade references, credit limits and, if you apply for credit or give a personal guarantee, information relevant to your creditworthiness. Card payments are processed by Stripe. When you pay by card or save a card, your card details are collected and stored by Stripe, not by us. We receive and store only a token, the card brand, the last four digits, the expiry date and the payment outcome. For bank transfers we hold the payer name and reference shown on our bank statement.

3.5 Files, artwork and content. Artwork, logos, photographs, fonts, documents, brand guidelines, copy, product data and other files you upload or send us, designs you create in our design tools, including in guest design sessions, and photographs and video from content days, which may include images of you, your staff or your customers.

3.6 Communications. The content of emails, text messages, social media messages, website chat and form submissions you exchange with us, including enquiry forms and the files attached to them, together with the date, time, sender and recipient details.

3.7 Calls, recordings and transcripts. When you call us or we call you, the phone numbers involved, the date, time and duration of the call, whether it was answered or missed, the recording of the call where recorded, a transcript, an automated summary, and notes our staff make about it. Where you call a tracking number we operate for a client, the same kinds of information are collected for that client (see Part D).

3.8 Marketing and attribution information. How you found us (for example the advertisement, campaign, search, referral source or tracking number), the pages you first visited, campaign codes in links you clicked, your marketing preferences and consents, and your interactions with our emails and text messages (such as opens, clicks and unsubscribes).

3.9 Website and portal usage information. Your IP address, device and browser type, operating system, approximate location derived from your IP address, pages viewed, actions taken, referring pages, the time and duration of visits, and error and performance data. Some of this is collected through cookies and similar technologies (see clause 8).

3.10 Connected account information. If you are our client and connect accounts to Pulse, or give us access to them (such as Google Ads, Google Analytics, Google Business Profile, Meta, Instagram, Facebook, LinkedIn, Mailchimp and similar services), we receive the information those services make available under the permissions you grant, including account and page identifiers, advertising spend, campaign and performance data, analytics, posts, comments, messages, reviews and the public profile information of the people who wrote them, email campaign statistics and audience data, and leads submitted through lead forms.

3.11 Business information from public sources. Information about businesses and the people who run them that is publicly available, including business names, addresses, phone numbers, websites, opening hours, social media profiles, reviews and map listings, collected from sources such as OpenStreetMap, business directories, search engines, websites and social media, which we use to identify businesses that may be interested in our services.

3.12 Information about suppliers, contractors and job applicants. Contact, business, bank and invoicing details of our suppliers and contractors, and the information in applications and resumes from job applicants.

3.13 Sensitive information. We do not ask for sensitive information and do not need it to provide our services. We may incidentally receive sensitive information, for example in artwork, marketing material or reviews for a health or political client, in content day photographs, or in something you choose to tell us. We only collect sensitive information with your consent (which may be implied where you provide it for a purpose) or where otherwise permitted by the Privacy Act, and we handle it only for the purpose for which it was provided.

4. How we collect personal information

4.1 From you. We collect most personal information directly from you, when you fill in a form, request a quote, place an order, create or use an account, sign a document, upload a file, design something online, call, email, text or message us, meet us, attend a content day or apply for credit or a job.

4.2 Automatically. We collect some information automatically when you use the Website and Pulse, open our emails, or click links in them, using cookies, pixels, logs and similar technologies (see clause 8).

4.3 From others. We may collect personal information about you from:

(a) your employer, colleague or business, for example when they add you as a contact or team member, nominate you as an approver, or send us your details for an order;

(b) our clients, when they give us, or connect to Pulse, information about their customers, leads and contacts (see Part D);

(c) third-party services you or our clients connect to Pulse, as described in clause 3.10;

(d) our production partners, carriers and suppliers, for example delivery confirmations;

(e) payment processors and banks, for example payment confirmations and remittance advice;

(f) referees and credit reporting bodies, if you apply for credit terms;

(g) publicly available sources, as described in clause 3.11; and

(h) our previous business systems, which held order and customer history that we have brought into our current systems.

4.4 When we collect from others. Where we collect personal information about you from someone else, we take reasonable steps to make you aware of the matters in this Policy, which may include relying on the party who provided the information to tell you, or on this Policy being publicly available.

4.5 If you do not give us information. If you do not provide the personal information we ask for, we may be unable to quote, fulfil an order, provide a service, give you access to Pulse, or respond to your enquiry.

Part C: How we use and share personal information

5. Why we collect, hold, use and disclose personal information

5.1 Primary purposes. We collect, hold, use and disclose personal information to:

(a) respond to enquiries and prepare quotes, proposals and service agreements;

(b) produce, proof, supply, deliver and support the goods and services you order, including by sending your artwork and delivery details to our production partners and carriers;

(c) provide design, marketing, advertising, social media, review, listings, email, SMS and website services;

(d) provide, maintain, secure and support Pulse and the Website, including connected accounts, reporting, approvals, signed documents and saved payment methods;

(e) verify your identity, manage accounts and access, and prevent fraud, misuse and security incidents;

(f) process payments and refunds, issue invoices and receipts, manage credit terms, and recover overdue amounts;

(g) communicate with you about your quotes, orders, proofs, approvals, account, payments and our terms, including by email, SMS and phone, and send automated reminders and follow-ups;

(h) record, transcribe and summarise calls for quality, training, record-keeping, dispute resolution and to action requests;

(i) keep records of what was approved, signed, agreed and paid, and resolve disputes and complaints;

(j) understand how our Website, Pulse and marketing perform, measure the source of enquiries and orders, and improve our products and services;

(k) send you marketing about our products and services, where permitted (see clause 10);

(l) identify and contact businesses that may be interested in our services, using public business information;

(m) showcase work in our portfolio and case studies, as permitted by our Terms;

(n) manage our relationships with suppliers, contractors and job applicants; and

(o) comply with our legal, tax, accounting and regulatory obligations, and establish, exercise or defend legal claims.

5.2 Other purposes. We may also use or disclose personal information for a purpose related to the purpose for which it was collected (or, for sensitive information, directly related) where you would reasonably expect it, where you have consented, or where required or authorised by law, including to lessen or prevent a serious threat to life, health or safety, to take action on suspected unlawful activity or serious misconduct, or to assist an enforcement body.

5.3 We do not sell personal information. We do not sell, rent or trade personal information, and we do not disclose it to third parties for their own marketing.

6. Calls, messages and recordings

6.1 Call recording. Calls to and from our business phone numbers, including calls our staff take on a computer, may be recorded. We tell callers that calls may be recorded, and this Policy also gives that notice. If you do not want a call recorded, tell us at the start of the call, or contact us by email instead.

6.2 Transcripts and summaries. Recordings may be transcribed and summarised using automated tools, and the summary may be matched to your quote, order or account. Our staff review transcripts and summaries before relying on them for anything that affects you.

6.3 Missed calls. If we miss your call, our system may send you a text message to follow up, to the number you called from.

6.4 Storage of recordings. Call recordings are held by our telephony provider and accessed by our staff through our systems. They are retained in accordance with clause 14.

7. Credit applications and guarantees

7.1 If you apply for credit terms, or give a personal guarantee for a business that does, we collect the information in the application, trade references and information about the business’s payment history with us, and we may obtain a commercial credit report. We use this information to assess the application, set and review a credit limit, manage the account and recover overdue amounts. We handle any credit information about individuals in accordance with Part IIIA of the Privacy Act and the Privacy (Credit Reporting) Code where they apply to us, and we will tell you, when you apply, the name of any credit reporting body we use.

8. Cookies, analytics and similar technologies

8.1 What we use. The Website and Pulse use cookies, local storage, pixels, tags and similar technologies to:

(a) keep you signed in, remember your cart and guest design session, and keep Pulse secure (essential);

(b) remember your preferences and settings (functional);

(c) measure traffic and how the Website and Pulse are used, and diagnose errors (analytics), including through the analytics built into our website platform; and

(d) record where an enquiry or order came from (for example a campaign code, referrer or first page visited) so that we can measure our marketing (attribution), and, where we use advertising pixels, to measure and improve the performance of our advertising on platforms such as Google and Meta.

8.2 Your choices. You can control cookies through your browser settings, delete stored cookies and local storage, and use browser features and extensions that block tracking. If you block essential cookies or local storage, parts of the Website and Pulse (such as the cart, guest designs and sign-in) may not work. You can learn about and adjust how Google and Meta use information for advertising in your account settings with those services.

8.3 Do not track. There is no agreed standard for responding to browser “do not track” signals, and we do not currently respond to them.

9. Automated processing and machine-learning tools

9.1 How we use them. We use automated and machine-learning tools, including the features we call Design Intelligence, to help our staff and clients work faster. They are used to: draft and suggest designs, copy, post captions, email replies and review replies; classify and file incoming emails and identify the records they relate to; transcribe and summarise calls; score and prioritise leads and prospective customers; recommend products; and prepare reports.

9.2 Personal information involved. These tools may process the personal information contained in the material they work on, such as the content of an email, a call transcript, a review and the reviewer’s public name, or the contact details on an enquiry.

9.3 Providers. Some of these tools are provided by third-party model providers, including Anthropic, which process the inputs on our behalf, currently in the United States. Under our arrangements with our providers, inputs and outputs are not used to train their general models, and we do not use your personal information to train models made available to anyone else.

9.4 Decisions. We do not use automated tools to make decisions that have a legal or similarly significant effect on you without human involvement. Decisions about credit terms, suspending supply, declining an order and responding to a complaint are made by our staff. Automated scores and suggestions help our staff decide what to look at first, and are reviewed by a person before we act on them in a way that significantly affects you.

9.5 Your rights. You can ask us for more information about how automated tools were used in relation to you, and ask for a person to review any matter, by contacting our Privacy Officer.

10. Direct marketing

10.1 Our marketing. We may use your contact details to send you information about our products, services, offers and events, by email, SMS, post or phone, where you have consented, where the Spam Act 2003 (Cth) permits consent to be inferred from our existing business relationship, or where otherwise permitted by the Privacy Act.

10.2 Opting out. Every marketing email and SMS we send identifies us and includes a simple way to unsubscribe. You can opt out at any time by clicking unsubscribe, replying STOP to an SMS, or contacting us. We will process your request promptly, and within 5 business days. You will still receive service messages about your orders, account and payments.

10.3 Prospecting. We may contact businesses whose details we have collected from public sources (clause 3.11) about our services, including by phone and email. We comply with the Spam Act 2003 (Cth), the Do Not Call Register Act 2006 (Cth) and the telemarketing industry standard where they apply. If you do not want to hear from us, tell us and we will record your preference and stop.

10.4 Source of information. On request, we will tell you the source of the personal information we used for direct marketing, unless it is impracticable or unreasonable to do so.

10.5 Advertising audiences. We may use hashed contact details or website activity to show our advertisements to, or exclude them from, existing customers and similar audiences on advertising platforms. You can opt out by contacting us.

11. Who we disclose personal information to

11.1 Service providers. We disclose personal information to the service providers that help us run our business, who may only use it to provide services to us. The categories, with key current providers, are:

(a) hosting, database and file storage: Supabase (database and file storage) and Vercel (application hosting);

(b) website hosting, forms and analytics: Framer;

(c) payments and accounting: Stripe (card payments, saved cards, subscriptions and card readers), Xero (accounting) and our bank;

(d) email: Google Workspace (Gmail), Resend (transactional email) and Mailchimp (email campaigns);

(e) SMS and telephony: our texting, calling and call tracking providers (including call recording and transcription);

(f) social publishing, reviews and listings: our social media publishing providers (including our own registered application with Meta) and our business listings provider;

(g) advertising and analytics platforms: Google (including Google Ads, Google Analytics and Google Business Profile) and Meta (Facebook and Instagram), and other platforms you ask us to use;

(h) automated and machine-learning tools: Anthropic;

(i) design assets: Unsplash (stock photographs, when you insert one) and font and icon libraries;

(j) maps and business data: OpenStreetMap and its services;

(k) production partners and suppliers: printers, sign makers, embroiderers, decorators, garment and product wholesalers (such as AS Colour) and print suppliers, who receive the artwork, specifications and, where they deliver directly, the delivery details needed for your order;

(l) carriers and couriers, who receive delivery names, addresses and phone numbers;

(m) legacy systems: our previous customer relationship and order management systems, which held some of our historical customer, marketing and order records, to the extent records remain with them; and

(n) professional advisers and others: our accountants, lawyers, insurers, auditors, debt collectors, credit reporting bodies (if you apply for credit), IT contractors and business advisers.

11.2 Others. We may also disclose personal information:

(a) to your employer or business, and to the team members and approvers on your account, in relation to your account and orders;

(b) to our clients, in relation to their customers and leads (Part D);

(c) to a platform or connected service when we act on your instructions, for example publishing a post or replying to a review;

(d) to a purchaser or prospective purchaser of our business, or a successor trustee, subject to confidentiality obligations;

(e) where required or authorised by law, including to courts, tribunals, regulators and enforcement bodies; and

(f) with your consent.

11.3 Changes to providers. Our providers change from time to time. We will update this Policy when we change a key provider, and a current list is available from our Privacy Officer.

12. Overseas disclosure

12.1 Where information goes. Some of our service providers store or process personal information outside Australia. Based on our providers’ published information, personal information we hold is likely to be stored in or accessed from the following countries:

(a) Japan, where our main database and file storage are hosted;

(b) the United States, for payment processing, email, SMS and telephony, call tracking, advertising and analytics platforms, automated and machine-learning tools, website hosting infrastructure, email marketing, legacy systems and support access by some providers;

(c) Ireland, the Netherlands and other member states of the European Union, and the United Kingdom, for website hosting and analytics, social publishing and some advertising and platform services;

(d) New Zealand, for accounting;

(e) Canada, for stock photography;

(f) India, for listings management; and

(g) Singapore and other countries in which the global cloud infrastructure used by our providers operates.

12.2 Production partners overseas. Where goods for your order are manufactured or supplied by a partner overseas, the artwork and specifications for your order, and occasionally delivery details, may be disclosed to that partner in the country where it operates.

12.3 Our approach. Before disclosing personal information overseas, we take reasonable steps to ensure the recipient handles it in a way that is consistent with the APPs, including by using reputable providers that have published privacy and security commitments and data processing terms. Where we disclose personal information to an overseas recipient, we remain accountable for it to the extent required by APP 8 and section 16C of the Privacy Act.

12.4 Our clients’ instructions. Where a client connects its own accounts to Pulse, or instructs us to use a particular service, information flows to that service under the client’s own arrangements with it.

13. Security

13.1 How we protect information. We take reasonable steps to protect personal information from misuse, interference and loss, and from unauthorised access, modification and disclosure. These steps include: role-based access so staff and client users see only what they need; encryption in transit; encryption at rest of stored integration credentials and tokens; multi-factor authentication for staff access where available; logging of administrative and impersonation actions; signed, expiring links for documents and payments; row-level security in our database so each client can see only its own records; security reviews of our code; and requiring our providers to maintain appropriate security.

13.2 Your part. Please keep your passwords and devices secure, use multi-factor authentication, remove team members who leave your business, and tell us immediately if you think your account has been compromised.

13.3 No guarantee. No method of transmission or storage is completely secure, and we cannot guarantee the security of information you send to us over the internet.

14. Retention and destruction

14.1 How long we keep information. We keep personal information only for as long as we need it for the purposes in this Policy, or as required by law. As a guide:

(a) order, quote, invoice, payment, signed document and proof records: at least 7 years after the end of the financial year to which they relate, to meet tax, accounting and record-keeping obligations and to support reorders and warranty claims;

(b) artwork and print files: while your account is active, to support reorders, and for up to 7 years after your last order, unless you ask us to delete them sooner;

(c) call recordings: up to 2 years, and transcripts and summaries for as long as the related account or record is kept;

(d) enquiries and leads that do not become customers: up to 3 years after our last contact;

(e) public business information used for prospecting: while it is relevant, and removed on request;

(f) Pulse client data after an account ends: in accordance with clause 41 of our Terms, generally deleted or de-identified after a 30-day export period, except business records and backups; and

(g) website and security logs: generally up to 12 months.

14.2 Destruction. When we no longer need personal information and are not required to keep it, we take reasonable steps to destroy it or de-identify it. Information in backups is deleted as the backups are overwritten in the ordinary course.

15. Data breaches

15.1 Our response. If we suspect a data breach, we act promptly to contain it, assess it and reduce any harm. Where a breach is likely to result in serious harm to any individual and the Notifiable Data Breaches scheme in Part IIIC of the Privacy Act applies, we will notify the affected individuals and the Office of the Australian Information Commissioner as required. Where the scheme does not apply to us, we will still notify affected individuals where we consider it reasonable to do so.

15.2 Client data. Where a breach affects personal information we hold for a client, we will notify the client without undue delay and cooperate with it (see clause 16.5).

Part D: Information we handle for our clients

16. Our clients’ customers, leads and contacts

16.1 Our role. When our clients use Pulse or our marketing services, we handle personal information about their customers, leads, callers, email subscribers, reviewers, followers and contacts on their behalf. Examples include: leads submitted through a client’s website or advertising forms; callers to a client’s tracking number, including recordings and transcripts; contacts in a client’s email lists; reviewers and people who comment on or message a client’s pages; and customers to whom review requests or follow-ups are sent.

16.2 The client’s responsibility. In those cases, our client decides why and how the information is collected and used, and is responsible for having its own privacy policy and collection notices, for obtaining any required consent (including consent to receive marketing messages and, where required, to call recording), and for responding to requests from its customers. If you are a customer of one of our clients, please contact that business first about your personal information.

16.3 How we handle it. We handle client data only to provide our services to the client, in accordance with the client’s lawful instructions, our Terms and this Policy. We do not use one client’s customer data for another client, or for our own marketing, and we do not sell it.

16.4 Requests. If we receive a request about client data directly, we will refer it to the relevant client, and assist the client to respond.

16.5 Breaches affecting client data. If we become aware of a data breach affecting client data, we will notify the client without undue delay and cooperate with it in assessing the breach and making any notification required.

16.6 End of the relationship. When a client relationship ends, client data is returned or deleted in accordance with clause 41 of our Terms.

Part E: Your rights and choices

17. Anonymity and pseudonymity

17.1 You may browse the Website, and make a general enquiry, without identifying yourself or by using a pseudonym. Guest design sessions do not require an account. However, it is impracticable for us to quote for, produce, deliver or invoice an order, or give you access to Pulse, without knowing who you are.

18. Accessing and correcting your personal information

18.1 Access. You may ask for access to the personal information we hold about you by contacting our Privacy Officer. We will respond within a reasonable period, and usually within 30 days. We will need to verify your identity. We do not charge for making a request, but may charge a reasonable fee for the cost of retrieving and providing large volumes of information, which we will tell you about first.

18.2 Correction. If you believe personal information we hold about you is inaccurate, out of date, incomplete, irrelevant or misleading, you can correct much of it yourself in Pulse, or ask us to correct it. We will take reasonable steps to correct it, and, if you ask, notify other entities to which we disclosed it.

18.3 Refusal. We may refuse access or correction in the circumstances permitted by the Privacy Act, for example where giving access would unreasonably affect another person’s privacy, or where the information relates to existing or anticipated legal proceedings. If we refuse, we will give you written reasons and tell you how to complain. If we refuse to correct information, you can ask us to attach a statement to it.

18.4 Deletion. You may ask us to delete personal information we hold about you. We will do so unless we need to keep it for the purposes in clause 14, to meet a legal obligation, or to establish or defend a legal claim.

19. Complaints

19.1 Complaining to us. If you have a concern about how we have handled your personal information, please contact our Privacy Officer in writing with the details. We will acknowledge your complaint within 5 business days, investigate it, and give you a written response within 30 days, or tell you if we need more time and why.

19.2 Complaining to the regulator. If you are not satisfied with our response, you may complain to the Office of the Australian Information Commissioner (OAIC):

Website: www.oaic.gov.au

Phone: 1300 363 992

Post: GPO Box 5288, Sydney NSW 2001

20. Children

20.1 Our services are provided to businesses and adults. We do not knowingly collect personal information from children under 16 other than incidentally, for example where a child appears in content day material with the consent of a parent or guardian, or where a parent orders personalised goods bearing a child’s name. If you believe we hold a child’s personal information that should not have been provided to us, please contact our Privacy Officer and we will delete it.

21. Unsolicited information

21.1 If we receive personal information that we did not ask for, and could not have collected under the APPs, we will destroy or de-identify it as soon as practicable, where it is lawful and reasonable to do so.

22. Links and third-party services

22.1 The Website and Pulse link to, and connect with, services operated by others, including social media, advertising and payment platforms. Their privacy practices are governed by their own policies, and we are not responsible for them.

23. If you are outside Australia

23.1 Australian law applies. We are based in Australia and handle personal information in accordance with Australian law. By dealing with us, you understand that your information will be handled in Australia and in the countries listed in clause 12.

23.2 European Union and United Kingdom. If you are in the European Union or the United Kingdom and data protection laws of those places apply to our handling of your personal information, you may have additional rights, including rights to object to processing, to restrict processing, to data portability and to lodge a complaint with your local data protection authority. Where those laws apply, we rely on the performance of our contract with you, our legitimate interests in operating and marketing our business, your consent (for marketing and non-essential cookies), and compliance with legal obligations, as the legal bases for processing. Contact our Privacy Officer to exercise these rights.

23.3 United States. If you are in the United States, we do not sell personal information or share it for cross-context behavioural advertising in exchange for money, and we do not knowingly collect personal information from children under 13. Depending on your state of residence, you may have rights to know, access, correct and delete personal information, and to opt out of targeted advertising, which you can exercise by contacting our Privacy Officer. We will not discriminate against you for exercising your rights.

23.4 Our overseas clients. If you are a customer of one of our clients located outside Australia, that client is responsible for complying with the privacy, marketing, text messaging and call recording laws of its own jurisdiction, and Part D applies.

24. Changes to this Policy

24.1 We may update this Policy from time to time to reflect changes in the law, our services, our providers and our practices. The current version is always available on the Website, with its version number and effective date. If we make a significant change, we will take reasonable steps to let our clients know, for example by email or a notice in Pulse. Previous versions are available from our Privacy Officer on request.

25. Contact us

25.1 For any question, request or complaint about privacy, contact:

Privacy Officer, Bendigo Graphics

Shop 2, 176 Lyttleton Terrace, Bendigo, Victoria 3550

info@bendigographics.com (subject: Privacy)

(03) 5441 7900

Business hours: Monday to Friday, 10.00 am to 4.00 pm, excluding public holidays.