Privacy Policy

Who we are

Owner & Data Controller: Tess Dingle, Paddington, Brisbane, QLD, Australia

Owner contact email: [email protected]

Owner website address: https://www.thirdstonebotanicals.com.au.

---

What personal data we collect and why we collect it

Comments

When visitors leave comments on the site we collect the data shown in the
comments form, and also the visitor’s IP address and browser user agent string
to help spam detection.

An anonymised string created from your email address (also called a hash) may
be provided to the Gravatar service to see if you are using it. The Gravatar
service privacy policy is available here: https://automattic.com/privacy/.
After approval of your comment, your profile picture is visible to the public
in the context of your comment.

Media

If you upload images to the website, you should avoid uploading images with
embedded location data (EXIF GPS) included. Visitors to the website can
download and extract any location data from images on the website.

Cookies

If you leave a comment on our site you may opt-in to saving your name, email
address and website in cookies. These are for your convenience so that you do
not have to fill in your details again when you leave another comment. These
cookies will last for one year.

If you have an account and you log in to this site, we will set a temporary
cookie to determine if your browser accepts cookies. This cookie contains no
personal data and is discarded when you close your browser.

When you log in, we will also set up several cookies to save your login
information and your screen display choices. Login cookies last for two days,
and screen options cookies last for a year. If you select "Remember Me", your
login will persist for two weeks. If you log out of your account, the login
cookies will be removed.

Embedded content from other websites

Articles on this site may include embedded content (e.g. videos, images,
articles, etc.). Embedded content from other websites behaves in the exact same
way as if the visitor has visited the other website.

These websites may collect data about you, use cookies, embed additional
third-party tracking, and monitor your interaction with that embedded content,
including tracking your interaction with the embedded content if you have an
account and are logged in to that website.

How long we retain your data

If you leave a comment, the comment and its metadata are retained indefinitely.
This is so we can recognise and approve any follow-up comments automatically
instead of holding them in a moderation queue.

For users that register on our website (if any), we also store the personal
information they provide in their user profile. All users can see, edit, or
delete their personal information at any time (except they cannot change their
username). Website administrators can also see and edit that information.

---

What rights you have over your data

If you have an account on this site, or have left comments, you can request to
receive an exported file of the personal data we hold about you, including any
data you have provided to us. You can also request that we erase any personal
data we hold about you. This does not include any data we are obliged to keep
for administrative, legal, or security purposes.

---

Where we send your data

This website collects some Personal Data from its Users.

Visitor comments may be checked through an automated spam detection service.

---

Types of Data collected

Among the types of Personal Data that this website collects, by itself or
through third parties, there are: Cookies and Usage Data.

Complete details on each type of Personal Data collected are provided in the
dedicated sections of this privacy policy or by specific explanation texts
displayed prior to the Data collection. Personal Data may be freely provided by
the User, or, in case of Usage Data, collected automatically when using this
Website. Unless specified otherwise, all Data requested by this Website is
mandatory and failure to provide this Data may make it impossible for this
Website to provide its services. In cases where this Website specifically
states that some Data is not mandatory, Users are free not to communicate this
Data without consequences to the availability or the functioning of the
Service. Users who are uncertain about which Personal Data is mandatory are
welcome to contact the Owner. Any use of Cookies – or of other tracking tools –
by this Website or by the owners of third-party services used by this Website
serves the purpose of providing the Service required by the User, in addition
to any other purposes described in the present document and in the Cookie
Policy, if available.

Users are responsible for any third-party Personal Data obtained, published or
shared through this Website and confirm that they have the third party's
consent to provide the Data to the Owner.

---

Mode and place of processing the Data

Methods of processing

The Owner takes appropriate security measures to prevent unauthorised access,
disclosure, modification, or unauthorised destruction of the Data. The Data
processing is carried out using computers and/or IT enabled tools, following
organisational procedures and modes strictly related to the purposes indicated.
In addition to the Owner, in some cases, the Data may be accessible to certain
types of persons in charge, involved with the operation of this Website
(administration, sales, marketing, legal, system administration) or external
parties (such as third-party technical service providers, mail carriers,
hosting providers, IT companies, communications agencies) appointed, if
necessary, as Data Processors by the Owner. The updated list of these parties
may be requested from the Owner at any time.

Legal basis of processing

The Owner may process Personal Data relating to Users if one of the following
applies:

• Users have given their consent for one or more specific purposes. Note:
  Under some legislations the Owner may be allowed to process Personal Data
  until the User objects to such processing (“opt-out”), without having to rely
  on consent or any other of the following legal bases. This, however, does not
  apply, whenever the processing of Personal Data is subject to European data
  protection law;
• provision of Data is necessary for the performance of an agreement with
  the User and/or for any pre-contractual obligations thereof;
• processing is necessary for compliance with a legal obligation to which
  the Owner is subject;
• processing is related to a task that is carried out in the public interest
  or in the exercise of official authority vested in the Owner;
• processing is necessary for the purposes of the legitimate interests
  pursued by the Owner or by a third party.

In any case, the Owner will gladly help to clarify the specific legal basis
that applies to the processing, and in particular whether the provision of
Personal Data is a statutory or contractual requirement, or a requirement
necessary to enter into a contract.

Place

The Data is processed at the Owner's operating offices and in any other places
where the parties involved in the processing are located. Depending on the
User's location, data transfers may involve transferring the User's Data to a
country other than their own. To find out more about the place of processing of
such transferred Data, Users can check the section containing details about the
processing of Personal Data.

Users are also entitled to learn about the legal basis of Data transfers to a
country outside the European Union or to any international organisation
governed by public international law or set up by two or more countries, such
as the UN, and about the security measures taken by the Owner to safeguard
their Data. If any such transfer takes place, Users can find out more by
checking the relevant sections of this document or inquire with the Owner using
the information provided in the contact section.

Retention time

Personal Data shall be processed and stored for as long as required by the
purpose they have been collected for.

Therefore:

• Personal Data collected for purposes related to the performance of a
  contract between the Owner and the User shall be retained until such contract
  has been fully performed.
• Personal Data collected for the purposes of the Owner’s legitimate
  interests shall be retained as long as needed to fulfil such purposes. Users
  may find specific information regarding the legitimate interests pursued by
  the Owner within the relevant sections of this document or by contacting the
  Owner.

The Owner may be allowed to retain Personal Data for a longer period whenever
the User has given consent to such processing, as long as such consent is not
withdrawn. Furthermore, the Owner may be obliged to retain Personal Data for a
longer period whenever required to do so for the performance of a legal
obligation or upon order of an authority. Once the retention period expires,
Personal Data shall be deleted. Therefore, the right to access, the right to
erasure, the right to rectification and the right to data portability cannot be
enforced after expiration of the retention period.

---

The purposes of processing

The Data concerning the User is collected to allow the Owner to provide its
Services, as well as for the following purposes: Website Analytics.

Users can find further detailed information about such purposes of processing
and about the specific Personal Data used for each purpose in the respective
sections of this document.

---

Detailed information on the processing of Personal Data

Personal Data is collected for the following purposes and using the following
services:

Analytics: The services contained in this section enable the Owner to
monitor and analyse web traffic and can be used to keep track of User
behaviour.

Google Analytics (Google LLC)Google Analytics is a web analysis
service provided by Google LLC (“Google”). Google utilises the Data collected
to track and examine the use of this Website, to prepare reports on its
activities and share them with other Google services. Google may use the Data
collected to contextualise and personalise the ads of its own advertising
network. Personal Data collected: Cookies and Usage Data.

Place of processing: United States – Privacy Policy – Opt Out. Privacy Shield participant.

---

The rights of Users

Users may exercise certain rights regarding their Data processed by the Owner.

In particular, Users have the right to do the following:

• Withdraw their consent at any time. Users have the
  right to withdraw consent where they have previously given their consent to
  the processing of their Personal Data.
• Object to processing of their Data. Users have the
  right to object to the processing of their Data if the processing is carried
  out on a legal basis other than consent. Further details are provided in the
  dedicated section below.
• Access their Data. Users have the right to learn if
  Data is being processed by the Owner, obtain disclosure regarding certain
  aspects of the processing and obtain a copy of the Data undergoing
  processing.
• Verify and seek rectification. Users have the right
  to verify the accuracy of their Data and ask for it to be updated or
  corrected.
• Restrict the processing of their Data. Users have
  the right, under certain circumstances, to restrict the processing of their
  Data. In this case, the Owner will not process their Data for any purpose
  other than storing it.
• Have their Personal Data deleted or otherwise
  removed. Users have the right, under certain circumstances, to
  obtain the erasure of their Data from the Owner.
• Receive their Data and have it transferred to another
  controller. Users have the right to receive their Data in a
  structured, commonly used and machine readable format and, if technically
  feasible, to have it transmitted to another controller without any hindrance.
  This provision is applicable provided that the Data is processed by automated
  means and that the processing is based on the User's consent, on a contract
  which the User is part of or on pre-contractual obligations thereof.
• Lodge a complaint. Users have the right to bring a
  claim before their competent data protection authority.

Details about the right to object to processing

Where Personal Data is processed for a public interest, in the exercise of an
official authority vested in the Owner or for the purposes of the legitimate
interests pursued by the Owner, Users may object to such processing by
providing a ground related to their particular situation to justify the
objection.

Users must know that, however, should their Personal Data be processed for
direct marketing purposes, they can object to that processing at any time
without providing any justification. To learn, whether the Owner is processing
Personal Data for direct marketing purposes, Users may refer to the relevant
sections of this document.

How to exercise these rights

Any requests to exercise User rights can be directed to the Owner through the
contact details provided in this document. These requests can be exercised free
of charge and will be addressed by the Owner as early as possible and always
within one month.

---

Additional information about Data collection and processing

Legal action

The User's Personal Data may be used for legal purposes by the Owner in Court
or in the stages leading to possible legal action arising from improper use of
this Website or the related Services. The User declares to be aware that the
Owner may be required to reveal personal data upon request of public
authorities.

Additional information about User's Personal Data

In addition to the information contained in this privacy policy, this Website
may provide the User with additional and contextual information concerning
particular Services or the collection and processing of Personal Data upon
request.

System logs and maintenance

For operation and maintenance purposes, this Website and any third-party
services may collect files that record interaction with this Website (System
logs) use other Personal Data (such as the IP Address) for this purpose.

Information not contained in this policy

More details concerning the collection or processing of Personal Data may be
requested from the Owner at any time. Please see the contact information at the
beginning of this document.

How “Do Not Track” requests are handled

This Website does not support “Do Not Track” requests. To determine whether any
of the third-party services it uses honour the “Do Not Track” requests, please
read their privacy policies.

Changes to this privacy policy

The Owner reserves the right to make changes to this privacy policy at any time
by giving notice to its Users on this page and possibly within this Website
and/or - as far as technically and legally feasible - sending a notice to Users
via any contact information available to the Owner. It is strongly recommended
to check this page often, referring to the date of the last modification listed
at the bottom. Should the changes affect processing activities performed on the
basis of the User’s consent, the Owner shall collect new consent from the User,
where required.

---

Definitions and legal references

Personal Data (or Data)

Any information that directly, indirectly, or in connection with other
information — including a personal identification number — allows for the
identification or identifiability of a natural person.

Usage Data

Information collected automatically through this Website (or third-party
services employed in this Website), which can include: the IP addresses or
domain names of the computers utilized by the Users who use this Website, the
URI addresses (Uniform Resource Identifier), the time of the request, the
method utilized to submit the request to the server, the size of the file
received in response, the numerical code indicating the status of the server's
answer (successful outcome, error, etc.), the country of origin, the features
of the browser and the operating system utilized by the User, the various time
details per visit (e.g., the time spent on each page within the Website) and
the details about the path followed within the Website with special reference
to the sequence of pages visited, and other parameters about the device
operating system and/or the User's IT environment.

User

The individual using this Website who, unless otherwise specified, coincides
with the Data Subject.

Data Subject

The natural person to whom the Personal Data refers.

Data Processor (or Data Supervisor)

The natural or legal person, public authority, agency or other body which
processes Personal Data on behalf of the Controller, as described in this
privacy policy.

Data Controller (or Owner)

The natural or legal person, public authority, agency or other body which,
alone or jointly with others, determines the purposes and means of the
processing of Personal Data, including the security measures concerning the
operation and use of this Website. The Data Controller, unless otherwise
specified, is the Owner of this Website.

This Website

The means by which the Personal Data of the User is collected and processed.

Service

The service provided by this Website as described in the relative terms (if
available) and on this site.

European Union (or EU)

Unless otherwise specified, all references made within this document to the
European Union include all current member states to the European Union and the
European Economic Area.

Cookies

Small sets of data stored in the User's device.

---

Legal information

This privacy statement has been prepared based on provisions of multiple
legislations, including Art. 13/14 of Regulation (EU) 2016/679 (General Data
Protection Regulation).

This privacy policy relates solely to this Website, if not stated otherwise
within this document.

Latest update: January 10, 2019