Privacy Policy

This Privacy Policy explains how Gourmet2Go ("we", "us", "our") collects, uses, stores and discloses your personal information when you use our website (www.gourmet2go.com.au) and services. We are committed to protecting your privacy and complying with the Australian Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs). By using our website or placing an order, you agree to the collection and use of information in accordance with this policy.

We collect the following types of personal information: Account & Order Information • Full name, email address, phone number • Delivery address and suburb • Order history and meal preferences • Subscription plan details Payment Information • Credit or debit card details (processed securely by Stripe — we never store your full card number) • Billing address Technical Information • IP address and browser type • Pages visited and time spent on our website • Device type and operating system • Referring website or link Funded Clients (NDIS & Support at Home) If you sign up for NDIS or Support at Home (SAH) pricing, we also collect sensitive information needed to arrange and invoice your funded meals: • Your NDIS number and plan end date • Your plan management type, and your plan manager's / provider's name and email • Any dietary requirements or allergy notes you give us (which may reveal health information) We only collect this sensitive information with your consent, and only use it to verify your funding, prepare your meals safely, and invoice your plan manager or provider for the funded portion of your orders. To confirm your funding, we email the plan manager or provider you nominate to verify your details before funded pricing is switched on. We collect information directly from you when you create an account, place an order, contact us, or subscribe to our mailing list. We also collect certain information automatically through cookies and analytics tools (see Section 7).

We use your personal information to: • Process and fulfil your orders and deliveries • Communicate with you about your orders, delivery status and account • Send SMS notifications about delivery (via Twilio) • Send transactional emails such as order confirmations and receipts (via Resend) • Manage your subscription and billing • Send marketing emails and promotions where you have opted in • Improve our website, products and services • Personalise your experience on our website • Run targeted advertising on Facebook and Instagram (where you have consented to advertising cookies) • Comply with legal obligations • Respond to your enquiries and support requests

We do not sell your personal information to third parties. We may share your information with trusted service providers who assist us in operating our business: • Stripe — payment processing (stripe.com/au/privacy) • Supabase — secure cloud database hosting • Twilio — SMS delivery notifications • Resend — transactional email delivery • Meta (Facebook/Instagram) — advertising and analytics (where you consent to marketing cookies) • Vercel — website hosting These providers are contractually obligated to keep your information confidential and use it only for the services they provide to us. For NDIS and Support at Home clients, we also share the information necessary to invoice your funded orders with your nominated plan manager or provider, and (where you use accounting/invoicing) with our accounting software provider Xero. Overseas disclosure Some of these providers store or process information outside Australia, so by using our services your information may be handled overseas. In particular, our database provider (Supabase) hosts your data in Singapore, and Stripe, Resend, Twilio, Meta and Vercel may process information in the United States or other countries. We take reasonable steps to ensure these providers protect your information consistently with the Australian Privacy Principles. We may also disclose your information if required by law, a court order, or a government authority.

We will only send you marketing emails and SMS messages if you have opted in to receive them. You can unsubscribe from marketing emails at any time by clicking the "Unsubscribe" link at the bottom of any marketing email, or by contacting us at admin@gourmet2go.com.au. You can opt out of marketing SMS messages by replying "STOP" to any SMS we send. Opting out of marketing communications will not affect your receipt of transactional communications (order confirmations, delivery updates, etc.).

We retain your personal information for as long as your account is active or as needed to provide you with our services. If you delete your account, we will delete or anonymise your personal data within 30 days, except where we are required by law to retain it (such as financial records, which we keep for 7 years as required under Australian law). Proof-of-delivery photos (taken by our drivers to confirm a delivery) are automatically deleted 90 days after delivery. You can request deletion of your account and personal data at any time by contacting admin@gourmet2go.com.au.

Our website uses the following types of cookies: Essential Cookies (always active) These are required for the website to function. They include session cookies, authentication tokens, and shopping cart data. These cannot be disabled. Analytics Cookies (with your consent) We use Google Analytics to understand how visitors use our website. This data is anonymised and aggregated. You can opt out via our cookie banner or by installing the Google Analytics opt-out browser add-on. We also use our own first-party analytics to understand how visitors move through our website (the pages viewed during a visit and where people drop off), using a cookie set by us — no third party is involved. This is linked to your account details only if you sign in, check out, or place an order. We keep this activity data for up to 90 days and do not store your full IP address. It honours the same choice as above: select "Essential Only" in our cookie banner and this tracking is switched off. Advertising Cookies (with your consent) We use the Meta Pixel (Facebook/Instagram) to measure the effectiveness of our advertising campaigns and show you relevant ads. This requires your consent. You can change your cookie preferences at any time by clearing your browser's local storage or using your browser's privacy settings. A new cookie consent prompt will appear on your next visit.

We take reasonable steps to protect your personal information from unauthorised access, loss, misuse, disclosure or alteration. Our website uses HTTPS encryption. Payment details are processed by Stripe using PCI DSS compliant systems — we never see or store your full card number. Despite these measures, no method of transmission over the internet is 100% secure. We cannot guarantee the absolute security of your data.

Under the Australian Privacy Act, you have the right to: • Access the personal information we hold about you • Request correction of inaccurate or out-of-date information • Request deletion of your personal information (subject to legal retention requirements) • Make a complaint about how we handle your personal information To exercise any of these rights, contact us at admin@gourmet2go.com.au. We will respond within 30 days. If you are not satisfied with our response, you can contact the Office of the Australian Information Commissioner (OAIC) at www.oaic.gov.au.

Our services are not directed at children under the age of 16. We do not knowingly collect personal information from children. If you believe we have inadvertently collected information from a child, please contact us and we will delete it promptly.

We may update this Privacy Policy from time to time. The current version will always be available on this page with a "Last updated" date. We will notify you of significant changes by email where we have your contact details. Your continued use of our website after changes are posted constitutes your acceptance of the updated policy.

If you have any questions, concerns or requests relating to this Privacy Policy or how we handle your personal information, please contact us: Email: admin@gourmet2go.com.au Business: Gourmet2Go Location: Melbourne, Victoria, Australia For complaints about privacy, you may also contact the Office of the Australian Information Commissioner (OAIC): Website: www.oaic.gov.au Phone: 1300 363 992