CavallaroMedia Pty Ltd Privacy Policy

Last updated: Wednesday, 13 May 2026

Effective from: Wednesday, 13 May 2026

Next scheduled review: Thursday, 13 May 2027

1. About This Policy

CavallaroMedia Pty Ltd ABN 85 689 897 970 ("we", "us", "our") is committed to protecting the privacy of personal information we collect, hold, use, and disclose. This Privacy Policy explains how we handle personal information in accordance with the Privacy Act 1988 (Cth), the Australian Privacy Principles (APPs), and the Spam Act 2003 (Cth), including the transparency obligations introduced under APP 1.7 to 1.9 that take effect on 10 December 2026.

By providing personal information to us, or by using our website, services, or marketing channels, you agree to the collection, use, and disclosure of that information as described in this Privacy Policy.

2. What Personal Information We Collect

We may collect the following kinds of personal information about you:

• Contact and identification information, including your full name, email address, mobile and landline phone numbers, postal address, and date of birth where required for verification.

• Transactional information, including details of products and services you have enquired about, purchased, or expressed interest in, and any communications between us.

• Technical and behavioural information, including your IP address, device identifiers, browser type, operating system, the pages you visit on our website, the time and duration of your visits, the source you arrived from (including referring website or advertising platform), and the actions you take on our website such as form submissions, clicks, scrolls, and content interactions.

• Marketing engagement information, including whether you opened, clicked, replied to, or unsubscribed from emails or SMS messages we have sent, and how you interacted with our advertising on third-party platforms.

• Information from third parties, including information advertising platforms (such as Meta and LinkedIn) and analytics providers share with us about how you interacted with our advertising or website.

We do not knowingly collect sensitive information (as defined under the Privacy Act) unless it is necessary for a service we are providing and you have given us your consent.

3. How We Collect Personal Information

We collect personal information directly from you when you contact us, submit an enquiry, request a quote, sign up to our mailing list, purchase from us, or interact with our advertising.

We also collect personal information indirectly through:

• Website tracking technologies, including cookies, pixels, and similar identifiers placed by us or by third-party services on our behalf, including the Meta Pixel, LinkedIn Insight Tag, Google Analytics, and Google Ads conversion tracking.

• Advertising platforms, including Meta (Facebook and Instagram) and LinkedIn, which may share with us aggregated and individual-level data about how you interacted with our advertising.

• Server-side tracking, which means certain information about your activity is sent directly from our servers to advertising and analytics platforms (including via Meta's Conversions API and equivalent server-to-server integrations) rather than only from your browser.

4. Why We Collect, Use, and Disclose Personal Information

We use your personal information to provide our services, respond to your enquiries, fulfil orders and bookings, send transactional communications, market our products and services to you (where permitted), measure and optimise the performance of our advertising, comply with our legal obligations, and protect our business and customers from fraud and misuse.

We may disclose your personal information to:

• Service providers that help us operate our business, including hosting providers, CRM platforms, email and SMS service providers, payment processors, accountants, and professional advisers.

• Advertising and analytics platforms, including Meta, LinkedIn, Google, and any other advertising platforms we use from time to time, for the purposes of measuring advertising performance and optimising future campaigns.

• Government and regulatory bodies where required by law.

• Any successor entity if our business is sold, merged, or restructured.

5. Cross-Border Disclosures

Some of the service providers and platforms we use store and process data outside Australia, including in the United States, the European Union, and other countries. By providing your personal information to us, you consent to this cross-border transfer. We take reasonable steps to ensure that overseas recipients handle your personal information in a manner consistent with the Australian Privacy Principles.

6. Automated Decision-Making and AI Disclosure (APP 1.7 to 1.9)

This section discloses the use of computer programs, including artificial intelligence and machine learning systems, that make or substantially assist in making decisions about you using your personal information, in accordance with APP 1.7 to 1.9 of the Privacy Act 1988 (Cth).

6.1 Meta advertising platforms (Facebook and Instagram)

We run advertising campaigns on Meta's platforms (Facebook and Instagram) using Meta's automated advertising products, including but not limited to Advantage+ campaigns, Advantage+ audience targeting, Advantage+ creative optimisation, automatic placements, and automated bidding.

The kinds of personal information used in the operation of these automated systems include: your email address, phone number, and other identifiers we may share with Meta in hashed format through Meta's Customer Match, Custom Audiences, or Conversions API integrations; your interactions with our website and advertising as tracked by the Meta Pixel and our server-side integration; demographic, interest, and behavioural data Meta holds about you as a Meta user; and inferences Meta draws about your likelihood to engage with or convert from our advertising.

The kinds of decisions made or substantially assisted by these systems include: whether you are shown our advertising, which version of our advertising you are shown, at what time and on which placement (feed, Stories, Reels, Audience Network, etc.) you are shown our advertising, how much we bid to reach you, and whether you are included in or excluded from audiences such as lookalike audiences or retargeting audiences.

These decisions could reasonably be expected to affect your rights or interests by determining whether you receive marketing communications from us, the nature of those communications, and the offers or pricing you may be exposed to.

We do not have direct control over the algorithms Meta uses or full visibility into the specific signals that determine outcomes for any individual user. Meta's own privacy policies and tools (available at https://www.facebook.com/privacy/policy and https://www.facebook.com/adpreferences) provide further information about how Meta uses personal information and allow you to control your advertising experience on Meta's platforms.

6.2 LinkedIn advertising

We run advertising campaigns on LinkedIn using LinkedIn's advertising products, which may include automated audience expansion, automated bidding, and predictive audience tools.

The kinds of personal information used include: identifiers you have shared with LinkedIn (including your professional profile data), interactions with our website as tracked by the LinkedIn Insight Tag, and audience data LinkedIn derives about your professional attributes such as job title, industry, seniority, and company.

The kinds of decisions made or substantially assisted by these systems include whether you are shown our advertising, which version is shown, at what frequency, and how much we bid to reach you.

These decisions may affect your rights or interests by determining whether you receive marketing communications from us through LinkedIn and what offers you are exposed to. LinkedIn's privacy policy and ad settings are available at https://www.linkedin.com/legal/privacy-policy.

6.3 Google advertising platforms (where used)

Where we run advertising through Google Ads or related Google advertising products, this may include the use of Google's automated advertising products such as Performance Max, Smart Bidding, automated audience targeting, and machine learning-driven creative optimisation.

The kinds of personal information used in the operation of these systems include: identifiers you have shared with us that we may share with Google in hashed format through Customer Match or Enhanced Conversions; your interactions with our website as tracked by Google Analytics, Google Ads conversion tracking, and any server-side integration we use; and data Google holds about you as a Google user, including search, browsing, and demographic signals.

The kinds of decisions made or substantially assisted by these systems include: whether you are shown our advertising across Google's network (Search, YouTube, Display, Discover, Gmail, Maps), which creative you are shown, the bid we place to reach you, and whether you are included in audiences such as lookalikes or retargeting.

These decisions could reasonably be expected to affect your rights or interests by determining whether and how you receive marketing communications from us and the offers you are exposed to. Google's privacy policy is available at https://policies.google.com/privacy, and you can control your Google ad experience at https://adssettings.google.com.

6.4 Email and SMS marketing automation (where used)

Where we use email and SMS marketing platforms with automation capabilities, including segmentation, behavioural triggers, send-time optimisation, predictive analytics, and AI-generated or AI-personalised content, the following disclosures apply.

The kinds of personal information used include: your contact details, your engagement history with our previous messages, your purchase or enquiry history, your website behaviour as captured by tracking technologies, and any preferences or information you have provided to us directly.

The kinds of decisions made or substantially assisted by these systems include: which messages you receive, when those messages are sent, the content or offers shown to you, the segments you are included in, and whether you are flagged as a high-value or engaged contact for follow-up.

These decisions may affect your rights or interests by determining the marketing communications you receive, the offers you are made, and how we prioritise contact with you. You may opt out of marketing communications at any time using the unsubscribe link in any email or by replying STOP to any SMS.

6.5 AI-powered website chatbots and conversational assistants (where used)

Where we use an AI-powered chatbot, virtual assistant, or conversational interface on our website or messaging platforms (including WhatsApp, SMS, Messenger, or Instagram DM), the following disclosures apply.

These systems use artificial intelligence and large language models, which may be provided by third parties including but not limited to OpenAI, Anthropic, or Google, to generate responses to your enquiries.

The kinds of personal information used include: the content of your conversation, any identifying information you provide during the conversation (such as your name, email, phone number, or enquiry details), and your prior interaction history with us where available.

The kinds of decisions made or substantially assisted by these systems include: the response generated to your enquiry, whether your enquiry is escalated to a human team member, how your enquiry is categorised or prioritised, and what follow-up communications you may receive.

These decisions could reasonably be expected to affect your rights or interests by determining the quality and accuracy of information you receive, the speed of response, whether you receive a quote, booking, or service, and how you are followed up with. You may at any time request to speak with a human team member by emailing [email protected].

6.6 Lead scoring and qualification (where used)

Where we use automated systems to score, qualify, or prioritise leads, the following disclosures apply.

The kinds of personal information used include: your contact details, your enquiry content, your website behaviour, your engagement with our marketing, your geographic location, and any information you provided in forms or conversations.

The kinds of decisions made or substantially assisted by these systems include: whether your enquiry is treated as a high, medium, or low priority lead, how quickly you are contacted, whether you are contacted by phone, email, or SMS, and what offers or services you are presented with.

These decisions may affect your rights or interests by determining the level of service and attention you receive. You may request a human review of any automated decision affecting you by contacting us using the details in section 11.

6.7 Your rights in relation to automated decisions

If you believe an automated decision has significantly affected you and you would like a human to review that decision, or you would like further information about how an automated system has used your personal information, you may contact us using the details in section 11. We will respond within 30 days.

7. Cookies and Tracking Technologies

Our website uses cookies and similar tracking technologies. These technologies allow us and our third-party service providers to recognise you, remember your preferences, measure how you use our website, and serve advertising relevant to you.

The categories of cookies and tracking we use include:

• Strictly necessary cookies, which are required for the website to function.

• Analytics cookies, including those set by Google Analytics, which help us understand how visitors use our website.

• Advertising cookies and pixels, including the Meta Pixel and LinkedIn Insight Tag, which help us measure and optimise our advertising.

• Server-side tracking integrations, which transmit some of the same data directly from our servers to advertising platforms.

You may control cookies through your browser settings and through the consent banner on our website where applicable.

8. Data Security

We take reasonable steps to protect your personal information from misuse, interference, loss, unauthorised access, modification, and disclosure, including through the use of secure hosting, encrypted data transmission, access controls, and staff training. However, no method of transmission or storage is completely secure, and we cannot guarantee absolute security.

9. Data Retention

We retain personal information for as long as necessary to fulfil the purposes for which it was collected, comply with our legal obligations, resolve disputes, and enforce our agreements. When personal information is no longer required, we take reasonable steps to destroy or de-identify it.

10. Accessing and Correcting Your Information

You have the right to access the personal information we hold about you and to request that we correct any inaccurate or out-of-date information. To make such a request, contact us using the details in section 11. We will respond within 30 days.

11. Contact and Complaints

If you have any questions about this Privacy Policy, would like to access or correct your personal information, would like a human review of an automated decision, or wish to make a complaint about our handling of your personal information, contact us at:

CavallaroMedia Pty Ltd

Attention: Jason Cavallaro

Email: [email protected]

Phone: +61 489 070 000

Postal address: Level 5/61 Market St, Sydney NSW, Australia 2000

If you are not satisfied with our response, you may lodge a complaint with the Office of the Australian Information Commissioner (OAIC) at www.oaic.gov.au or by calling 1300 363 992.

12. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, the systems we use, or the law. The "Last updated" date at the top of this policy will indicate when the most recent changes were made. We encourage you to review this policy periodically.