Privacy Policy

Privacy Act

Soh and Soh Art (referred to as “Our business”, “The Business”, “We”, “Us”) is bound by the Privacy Act 1988 (the Act) and the Australian Privacy Principles (APP). Our business is an APP entity as
defined in s 6(1) of the Act.
We collect and hold personal information relating to our clients and to other people and entities associated with our clients as may be provided or disclosed to us in the course of business. Such
personal information may include, but is not limited to, names, addresses, telephone numbers, social media details, email addresses, bank account details, your computer and connection
information, details of products you have purchased from us, any information that you otherwise share with us.
Personal information is collected from our clients in the following ways:
• by providing it to us directly including via email and telephone;
• when you use this website;
• when you purchase any products through this website;
• when you complete an online contact form to contact us;
• by authorising third parties to provide it to us;
• when you subscribe to our newsletters or mailing lists;
• by other parties providing it to us either voluntarily or pursuant to compulsory processes we conduct on our client’s behalf.

IP Addresses and Cookies

This website may also collect Internet Protocol (IP) addresses. IP addresses are assigned to computers on the internet to uniquely identify them within the global network. Our Business collects
and manages IP addresses as part of the service of providing internet session management and for security purposes. We may also collect and use web log, computer and connection information for
security purposes and to help prevent and detect any misuse of, or fraudulent activities involving, this website.

This website may use "cookies" to help personalise your online experience. A cookie is a text file or a packet of information that is placed on your hard disk by a web page server to identify and interact
more effectively with your computer. There are two types of cookies that may be used at this site: a persistent cookie and a session cookie. A persistent cookie is entered by your web browser into the
"Cookies" folder on your computer and remains in that folder after you close your browser and may be used by your browser on subsequent visits to this site. A session cookie is held temporarily in
your computer’s memory and disappears after you close your browser or shut down your computer. Cookies cannot be used to run programs. Cookies are uniquely assigned to you and can only be read
by a web server in the domain that issued the cookie to you. In some cases, cookies may collect and store personal information about you. The Business extends the same privacy protection to your
personal information, whether gathered via cookies or from other sources.

In some cases, third parties may place cookies through this website. For example:
• Google Analytics, one of the most widespread and trusted website analytics solutions, may use cookies de-identified data about how long users spend on this site and the pages that
they visit;
• Google AdSense, one of the most widespread and trusted website advertising solutions, may use cookies to serve more relevant advertisements across the web and limit the number of
times that a particular advertisement is shown to you; and
• third party social media applications (eg, Facebook, Twitter, LinkedIn, Pinterest, YouTube, Instagram, etc) may use cookies in order to facilitate various social media buttons and/or plugins in this site.

How is personal information received and held?

We are committed to maintaining the confidentiality of the information that you provide us, and we will take all reasonable precautions to protect your personal information from unauthorised use or alteration. In our business, personal information may be stored both electronically (on our computer systems and with our website hosting provider) and in hard-copy form. Firewalls, anti-virus software
and email filters, as well as passwords, protect all of our electronic information. Likewise, we take all reasonable measures to ensure the security of hard-copy information.

For what purpose is personal information collected, held, used and disclosed?

 

All data is processed by the Business on a lawful basis. The purposes for which we collect, hold, use and disclose personal information are:
• to offer our products to our clients. In doing so we may disclose personal information to other people or entities involved in the provision of the product. Unless compelled by law, we will
never disclose personal information without the client’s knowledge and consent;
• to assist and process your orders on this website and complete payment;
• to communicate with you and respond to any queries or feedback that you may have;
• to send you marketing communications (where you have consented or as otherwise permitted by law);
• to comply with applicable laws; and
• for any other purpose reasonably considered necessary or desirable by the Business in relation to the operation of said business.

Marketing

 

From time to time, we may email you with news, information and offers relating to our own products or those of selected partners. Your personal information may also be collected so that the Business can promote and market products and services to you. This is to keep you informed of products, services, and special offers we believe you will find valuable and may continue after you cease acquiring products and services from us. If you would prefer not to receive promotional or
other material from us, please let us know and we will respect your request. You can unsubscribe from such communications at any time if you choose.

How can personal information be accessed or corrected?

In most cases, you may have access to personal information that we hold about you. We will handle requests for access to your personal information in accordance with the Australian Privacy Principles.

You may access your personal information and seek correction of it at any time by contacting our Business in writing. We will deal with all requests for access to personal information as quickly as possible.

In some cases, we may refuse to give you access to personal information that we hold about you.
This may include circumstances where giving you access would:
• be unlawful;
• have an unreasonable impact on another person’s privacy; or
• prejudice an investigation of unlawful activity.

We may also refuse access where the personal information relates to existing or anticipated legal proceedings, and the information would not be accessible by the process of discovery in those proceedings.

If we refuse to give you access, we will provide you with reasons for our refusal.

Clients will be formally identified before releasing or amending any personal information.

Is personal information disclosed outside of Australia?

Where necessary we will disclose personal information to recipients located outside of Australia.

What is the complaints process relating to personal information?

If there is a breach of this privacy policy, either of the Act or the Australian Privacy Principles (APP), a
complaint may be made by the client to:
• our customer services team; or
• the Office of the Australian Privacy Commissioner.

Data breaches

All staff are responsible for protecting the confidentiality of client information and business information. Refer any data breaches, or suspected data breaches, to the customer services team as soon as possible.

What is an eligible data breach?

An eligible data breach, defined in s 26WE(2) of the Act, is when:
(a) both of the following conditions are satisfied:
(i) there is unauthorised access to, or unauthorised disclosure of, the information;
(ii) a reasonable person would conclude that the access or disclosure would be likely to
result in serious harm to any of the individuals to whom the information relates; or
(b) the information is lost in circumstances where:
(i) unauthorised access to, or unauthorised disclosure of, the information is likely to occur;
and
(ii) assuming that unauthorised access to, or unauthorised disclosure of, the information
were to occur, a reasonable person would conclude that the access or disclosure would
be likely to result in serious harm to any of the individuals to whom the information
relates;.

If there is a suspicion of a breach

If we suspect that there has been an eligible data breach, a reasonable and expeditious assessment will be conducted within 30 days.
If we believe or have reasonable grounds to believe there has been a breach, then a statement will be prepared setting out:
• the business’s details;
• a description of the breach;
• the kind or kinds of information concerned; and
• recommendations about the steps that we will take in response to it.
If practicable, we will advise the contents of the statement to each of the affected clients who may be at risk from the breach. If this is not practicable, we will publish the statement on our website and
take other reasonable steps to publicise its contents. Communications with individuals will be via their preferred communication method.
The statement will be submitted to the Privacy Commissioner.

Exception to reporting

Mandatory notification requirements are waived if remedial action can be taken that results in a reasonable person concluding that the access or disclosure is not likely to result in serious harm to any of those individuals.

Retention

We will only keep your data for as long as is necessary for the purpose for which it was collected, subject to satisfying any legal, accounting or reporting requirements. At the end of any retention period, your data will either be deleted completely or anonymised (for example, by aggregation with other data so that it can be used in a non-identifiable way for statistical analysis and business planning). In some circumstances, you can ask us to delete your data.

Other Websites

Our website may contain links to other websites that are not operated by us. We are not responsible for the privacy practices of these third-party websites. We encourage you to review the privacy policies of any website you visit.

Changes to this Privacy Policy

From time to time, it may be necessary for us to revise this Privacy Policy. Any changes will be in accordance with any applicable requirements under the Privacy Act and the Australian Privacy
Principles. We may notify you about changes to this Privacy Policy by posting an updated version on this website.