Privacy notice

This notice explains how TreatFolio (“we”, “the desk”) handles personal information collected through treatfolio.com. We handle personal information in accordance with the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs) set out in that Act.

Who is responsible

TreatFolio is an independent editorial project based in South Australia, Australia. Questions about this notice, or about the information we hold, can be sent to info@treatfolio.com. We answer privacy enquiries within five business days wherever we can, and within thirty days in every case.

What we collect

• Information you give us. If you use the subscription form, we receive the e-mail address you enter, the name you enter (optional) and the fact that you ticked the consent box. There is no telephone field on this site and we do not ask for one.
• Notification identifiers. If you allow browser notifications, our push provider creates a subscription identifier for that browser and records the browser type, operating system, approximate region derived from the IP address, and your permission state.
• Technical records. Our hosting and content delivery provider records ordinary server data when a page is requested: IP address, date and time, requested address, referring address and user-agent string. These records exist for security and reliability.
• Your consent choice. The Accept or Decline decision you make on the consent strip is stored in your browser under the key userConsent. It never leaves your device.

We do not run analytics, advertising or profiling services on this site, and we do not collect payment details anywhere. The Plus membership described on the home page is not yet active and takes no payment.

Why we collect it, and on what basis

• To send you the seasonal message about a new folio — on the basis of the consent you give when you tick the box on the form.
• To deliver browser notifications you have asked for — on the basis of the same consent, together with the permission your browser records.
• To keep the site available and to identify abuse — on the basis of our legitimate interest in operating the site securely.
• To answer an e-mail you send us — on the basis of your request.

Marketing messages and push messages are sent in line with the Spam Act 2003 (Cth): we send them only with your consent, we identify TreatFolio as the sender in every message, and every message carries a working way to stop receiving them.

Who else handles the data

• OneSignal operates the notification and mailing-list infrastructure as our service provider. It processes your e-mail address, the tags we attach (the domain name, the name you supplied and the source of the sign-up) and the browser subscription identifier, and it may store data outside Australia, including in the United States.
• Our hosting and content delivery provider processes server log data in order to serve the pages.
• Google Play is not sent your data by us. Following a store link from this site takes you to Google, whose own privacy terms then apply.

Where information is disclosed to an overseas recipient, we take reasonable steps under APP 8 to ensure it is handled consistently with the Australian Privacy Principles. We do not sell personal information, and we do not disclose it for anyone else’s marketing.

How long we keep it

Mailing-list and notification data is kept until you unsubscribe, revoke browser permission, or ask us to delete it — and is then removed within thirty days. Server log data is kept for up to twelve months. E-mail correspondence is kept for up to twenty-four months so that we can follow up on what was said.

Your rights

Under the Australian Privacy Principles you may ask us for access to the personal information we hold about you, ask us to correct it if it is wrong or out of date, revoke your consent at any time, and ask us to delete what we hold. Write to info@treatfolio.com and we will verify the request and act on it.

If you are not satisfied with our response, you may complain to the Office of the Australian Information Commissioner (OAIC) at oaic.gov.au, which oversees compliance with the Privacy Act 1988 (Cth). We would appreciate the chance to resolve the matter first.

Children

This site is written for adults and is not intended for anyone under 15 years of age. We do not knowingly collect personal information from a person under 15. If you believe a child has given us their details, write to us and we will delete the record.

Security

Pages are served over an encrypted connection. Access to the mailing-list console is limited to the people who run the desk and is protected by two-factor authentication. No system is perfect, so if a data breach occurs that is likely to cause serious harm we will notify affected people and the OAIC as required by the Notifiable Data Breaches scheme.

Changes to this notice

If this notice changes, the revised version appears on this page with a new date at the top. Material changes affecting people on the mailing list will also be sent by e-mail before they take effect.