Privacy Policy

Xhale Creative, operated by Legal entity: The Refinery Collective Pty Ltd ABN: 81 676 434 834 (“Xhale Creative”, “we”, “us” or “our”), respects your privacy and is committed to handling personal information responsibly and transparently.

This Privacy Policy explains how we collect, hold, use, disclose and protect personal information when you:

• visit or interact with our website;


• contact us by email, telephone, social media, an online form or another communication channel;


• request a quote, proposal, consultation or discovery session;


• purchase or engage us to provide services;


• participate in a promotion, survey, event or campaign;


• subscribe to our communications;


• apply to work with us as an employee, contractor or supplier; or


• otherwise interact with Xhale Creative.

We aim to manage personal information in accordance with the Privacy Act 1988 (Cth) and the Australian Privacy Principles, where those laws apply to us.

By interacting with Xhale Creative or providing personal information to us, you acknowledge that you have read this Privacy Policy.

Personal information is information or an opinion about an identified individual, or an individual who is reasonably identifiable.

The type of personal information we collect depends on your relationship with Xhale Creative and how you interact with us.

We may collect and hold information including:

Contact and identity information

• your name;


• business or trading name;


• job title or position;


• email address;


• telephone number;


• business address;


• postal address; and


• social media profile or account details.

Business and project information

• information about your business, organisation, products and services;


• brand, marketing and communication requirements;


• project briefs, questionnaires and discovery documents;


• target audiences, competitors and business objectives;


• website, domain, hosting and platform information;


• content, photographs, videos, logos, documents and other project materials;


• social media, advertising or digital platform information you provide to us;


• project feedback, approvals and correspondence; and


• information about your customers or audiences where this is necessary to provide an agreed service.

Transaction and account information

• quotes, proposals, contracts and service agreements;


• purchase and payment history;


• invoices and billing details;


• transaction records;


• subscription or retainer information; and


• information required to manage your client account.

We generally use third-party payment processors and financial institutions to process payments. We do not intentionally retain complete payment-card details unless necessary and appropriately authorised.

Website and technical information

When you visit our website or interact with our digital content, we may collect:

• your Internet Protocol address;


• browser, device and operating-system information;


• approximate location information;


• referring website or campaign;


• pages viewed and actions taken;


• dates, times and duration of visits;


• form interactions;


• advertising identifiers;


• cookie and tracking information; and


• website performance, diagnostic and security information.

Marketing information

We may collect information about:

• your marketing and communication preferences;


• subscriptions and unsubscribe requests;


• email opens and link interactions;


• advertising engagement;


• campaign responses;


• competition or promotional entries; and


• your interests in our services.

Recruitment and contractor information

When you apply to work with us, we may collect:

• your résumé or curriculum vitae;


• employment and education history;


• professional qualifications;


• portfolio and work samples;


• references;


• right-to-work information;


• availability and remuneration expectations; and


• other information relevant to assessing your application.

We will only collect sensitive information where it is reasonably necessary for our activities and you have consented, or where collection is otherwise permitted or required by law.

We may collect personal information directly from you when you:

• submit an enquiry or website form;


• book a consultation or meeting;


• request a proposal or quote;


• complete an onboarding document, questionnaire or project brief;


• engage us to provide services;


• communicate with us by email, telephone, video call or messaging platform;


• interact with our social media accounts;


• subscribe to a mailing list;


• enter a promotion or attend an event;


• provide feedback or a testimonial;


• make a payment; or


• apply for employment or contractor opportunities.

We may also collect personal information from:

• your authorised representatives, employees or colleagues;


• business partners and referral partners;


• publicly available websites, business directories and social media profiles;


• analytics, advertising and technology providers;


• professional advisers and service providers;


• lead-generation or business-information services, where lawful;


• our clients, where information is provided to us as part of a client project; and


• other third parties where you have provided consent or would reasonably expect the information to be provided.

Where practical, we will collect personal information directly from you.

When you provide us with personal information about another person, you confirm that you are authorised to provide that information and that the person has been made aware of this Privacy Policy where reasonably required.

Clients must not provide Xhale Creative with personal information that is unnecessary for the agreed services.

Where we process personal information on behalf of a client, the client remains responsible for ensuring that its collection and disclosure of that information is lawful and appropriately notified.

We may collect, hold and use personal information to:

• respond to enquiries and communicate with you;


• understand your business and service requirements;


• prepare quotes, proposals and recommendations;


• provide branding, graphic design, website development, content, photography, video, social media, advertising, SEO, marketing and related creative services;


• manage client onboarding, projects, approvals and delivery;


• create, manage and optimise websites, campaigns and digital accounts;


• administer contracts, payments, invoices and accounts;


• provide hosting, maintenance, support or ongoing services;


• arrange meetings, consultations and presentations;


• manage client, contractor, supplier and business relationships;


• improve our services, website, systems and customer experience;


• conduct market, audience and competitor research;


• measure website and campaign performance;


• personalise website content and marketing;


• promote our services, subject to applicable laws and your communication preferences;


• prevent fraud, misuse, security incidents and unlawful activity;


• manage complaints and disputes;


• obtain professional advice;


• recruit employees and contractors;


• comply with legal, regulatory, insurance and accounting obligations; and


• protect our rights, property, systems, clients and personnel.

We may use personal information for another purpose where you have consented, where you would reasonably expect that use and it is related to the original purpose, or where the use is authorised or required by law.

Our website may use cookies, pixels, tags, scripts and similar technologies.

These technologies may help us:

• operate and secure our website;


• remember preferences;


• understand how visitors use our website;


• identify technical problems;


• measure the effectiveness of campaigns;


• improve website functionality and content;


• create advertising audiences;


• deliver or personalise advertising; and


• perform analytics and reporting.

The third-party platforms we may use include services provided by organisations such as:

• Google, including Google Analytics, Google Ads and related services;


• Meta, including Facebook and Instagram advertising services;


• LinkedIn;


• email-marketing and customer-relationship-management providers;


• website hosting, content-management and security providers;


• appointment-booking and video-conferencing platforms; and


• other analytics, advertising and marketing providers.

These providers may collect information directly through our website and may combine it with information collected through other websites or services, subject to their own privacy policies.

You can manage or disable cookies through your browser settings. Disabling cookies may affect the operation or functionality of parts of our website.

Where required, we may provide additional cookie controls or request consent before activating particular tracking technologies.

We may use your contact information to send you information about Xhale Creative, our services, insights, events, promotions or opportunities that we believe may be relevant to you.

We may contact you where:

• you have consented;


• you have requested information from us;


• you are an existing or prospective client;


• you would reasonably expect to receive the communication; or


• the communication is otherwise permitted by law.

Marketing communications may be delivered by email, telephone, text message, social media or digital advertising.

You can opt out at any time by:

• using the unsubscribe link included in an email;


• following the opt-out instructions in the communication; or


• contacting us at info@xhale.com.au.

We will process opt-out requests as soon as reasonably practicable. We may still send non-promotional communications relating to active projects, accounts, transactions, legal notices or services you have requested.

We may disclose personal information to:

• our employees, directors and authorised representatives;


• designers, developers, copywriters, photographers, videographers, marketers and other contractors helping us deliver services;


• website hosting, domain, cloud-storage and information-technology providers;


• customer-relationship-management and project-management platforms;


• email, communications, appointment-booking and video-conferencing providers;


• analytics, advertising and social media platforms;


• payment processors, banks and accounting providers;


• printers, manufacturers, couriers and production suppliers;


• professional advisers, including accountants, insurers and legal advisers;


• prospective purchasers, investors or advisers in connection with a business sale, restructure or transaction;


• government bodies, regulators, courts or law-enforcement agencies where required or authorised by law; and


• other parties with your consent or as reasonably necessary to provide the services you have requested.

We do not sell personal information as a standalone commercial product.

Contractors and service providers are only provided with information reasonably required to perform their services.

To deliver services, clients may authorise Xhale Creative to access or manage third-party accounts, including:

• websites and content-management systems;


• hosting and domain accounts;


• social media pages and profiles;


• advertising accounts;


• analytics and reporting platforms;


• email-marketing systems;


• e-commerce platforms;


• file-storage systems; and


• other business or marketing platforms.

Clients are responsible for ensuring they have authority to provide this access.

We will use account access and information for the agreed project or service and may share necessary access with authorised personnel or contractors involved in delivering that service.

Clients should use appropriate access controls, such as delegated user access, where available, rather than sharing primary passwords.

Some services may require us to handle information about a client’s customers, subscribers, leads, employees or website users.

In these circumstances, we generally handle the information on the client’s instructions and solely for the purpose of providing the agreed services.

Clients are responsible for:

• maintaining an appropriate privacy policy;


• obtaining necessary notices, permissions and consents;


• ensuring their collection and use of personal information is lawful;


• providing lawful instructions to Xhale Creative; and


• determining how long their customer information must be retained.

We may suspend an activity where we reasonably believe a client instruction would breach privacy, marketing or other applicable laws.

Some of our employees, contractors, software providers, cloud-storage providers and other service providers may be located outside Australia or may store information using overseas infrastructure.

The locations used by these providers may change from time to time.

Where required by applicable privacy law, we will take reasonable steps before disclosing personal information overseas to ensure the recipient handles the information appropriately, or we will rely on another permitted basis for the disclosure.

By engaging us or using services involving international platforms, you acknowledge that your information may be processed or stored outside Australia.

Personal information may be held electronically or, in limited circumstances, in physical form.

We may store information through:

• secure cloud-storage services;


• project-management and customer-relationship-management systems;


• email and communication platforms;


• accounting and payment systems;


• website and hosting systems;


• password-management and authentication systems; and


• secure devices or business records.

We take reasonable technical and organisational measures designed to protect personal information from misuse, interference, loss and unauthorised access, modification or disclosure.

These measures may include:

• access restrictions and user permissions;


• password controls and multifactor authentication;


• secure hosting and cloud platforms;


• software and security updates;


• secure file-transfer processes;


• backups and recovery procedures;


• contractor confidentiality obligations;


• staff and contractor access controls; and


• review of suspicious activity and security incidents.

No internet transmission or electronic storage system is completely secure. We cannot guarantee the absolute security of information transmitted to or stored by us.

You are responsible for keeping your passwords, account credentials and access links secure.

We maintain processes for responding to suspected loss, unauthorised access or disclosure of personal information.

Where a data breach occurs, we may:

• investigate and contain the incident;


• assess the type of information involved and possible consequences;


• take steps to reduce the likelihood of harm;


• engage relevant service providers or professional advisers;


• notify affected individuals where appropriate; and


• notify the Office of the Australian Information Commissioner or another regulator where required by law.

Clients must promptly notify us if they become aware of an incident affecting information or accounts involved in a project we manage.

We retain personal information only for as long as reasonably necessary for the purposes for which it was collected, including to:

• provide and support services;


• maintain project and business records;


• meet contractual obligations;


• resolve disputes;


• enforce agreements;


• maintain financial, tax and insurance records; and


• comply with legal requirements.

Retention periods will vary depending on the type of information, the service provided and applicable legal requirements.

Where personal information is no longer required, we will take reasonable steps to delete, destroy or de-identify it, unless we are required or authorised to retain it.

Backup copies may remain for a limited period until overwritten or securely deleted through our usual backup processes.

You may interact with us anonymously or using a pseudonym where it is lawful and practical to do so.

We may require your correct identity or business details where necessary to:

• provide a quote or contracted service;


• verify authority or account access;


• process a payment;


• meet legal or accounting obligations;


• protect security; or


• respond meaningfully to your request.

We take reasonable steps to ensure the personal information we use is accurate, current, complete and relevant.

Please notify us when your contact information or other relevant details change.

You may request access to personal information we hold about you by contacting us at info@xhale.com.au.

We may ask you to verify your identity before providing access.

We will respond within a reasonable period. In some circumstances, access may be refused or limited where permitted by law, including where providing access would:

• unreasonably affect another person’s privacy;


• disclose commercially sensitive information;


• prejudice an investigation or legal proceeding;


• be unlawful; or


• create a serious threat to health, safety or security.

Where permitted, we will explain the reason for refusing access and available complaint options.

We generally do not charge for submitting an access request. We may charge a reasonable administrative fee where permitted and where substantial work is required to provide access. We will notify you before incurring that fee.

You may ask us to correct personal information that you believe is inaccurate, out of date, incomplete, irrelevant or misleading.

Please send correction requests to info@xhale.com.au and explain what information should be corrected.

We will take reasonable steps to assess and respond to your request.

Our services and website are primarily directed to businesses and adults.

We do not knowingly seek to collect personal information directly from children without the involvement of a parent, guardian, school, organisation or other authorised adult where appropriate.

Please contact us if you believe a child has provided personal information to us without proper authorisation.

Our website and communications may contain links to third-party websites, social media platforms or external services.

Xhale Creative is not responsible for the privacy, security or content practices of third parties. You should review their privacy policies before providing them with personal information.

Information you post publicly on social media may be visible to others and may be collected, used or shared by the relevant platform and its users.

We may ask for permission to display client names, logos, testimonials, completed work, project information or campaign results in our portfolio, website, proposals, awards submissions or marketing materials.

We will seek appropriate approval where the material contains personal information or confidential client information.

You may withdraw permission for future uses by contacting us, although we may not be able to remove materials that have already been printed, distributed or incorporated into completed publications.

If Xhale Creative undergoes a merger, acquisition, restructure, financing arrangement or sale of all or part of its business, personal information may be disclosed to advisers and relevant parties involved in the transaction.

Where appropriate, we will take reasonable steps to require those parties to keep the information confidential and use it only for purposes connected with the proposed transaction.

Please contact us if you have a concern or complaint about how we have handled your personal information.

Your complaint should include:

• your name and contact details;


• a description of the issue;


• relevant dates and communications; and


• the outcome you are seeking.

Send privacy complaints to:

Privacy Officer

Xhale Creative

Legal entity: The Refinery Collective Pty Ltd ABN: 81 676 434 834

Email: info@xhale.com.au

Website: https://xhalecreative.com.au/

We will acknowledge your complaint within a reasonable period and aim to investigate and provide a response within 30 days.

We may contact you for further information or to discuss a proposed resolution.

If you are not satisfied with our response, you may be entitled to contact the Office of the Australian Information Commissioner or another relevant regulator.

We may update this Privacy Policy to reflect changes to:

• our services and business operations;


• our website and technology;


• our contractors and service providers;


• legal or regulatory requirements; or


• our information-handling practices.

The latest version will be published on our website with the updated date shown at the beginning of the policy.

We encourage you to review this Privacy Policy periodically.

For questions, access requests, correction requests, marketing preferences or privacy complaints, contact:

Privacy Officer

Xhale Creative

Legal entity: The Refinery Collective Pty Ltd ABN: 81 676 434 834

Email: info@xhale.com.au

Website: https://xhalecreative.com.au/