Privacy and Cookie Policy
The website located at saveteatree.com (the "Website") is operated by ATTIA Ltd ("ATTIA", "we", "us", or "our"). ATTIA Ltd is registered, based, and operated in Australia.
This Privacy and Cookie Policy explains how we collect, use, disclose, store, and protect personal information collected through this Website, including from people who choose to support, follow, or engage with our advocacy activities from Australia, the European Union, the United Kingdom, and other locations.
We aim to process personal information in a transparent, lawful, fair, and secure manner. Where applicable, this policy is intended to address requirements under the Australian Privacy Act 1988, the EU General Data Protection Regulation ("EU GDPR"), the UK GDPR, and related cookie and electronic communications rules.
1. Data Controller and Contact Information
For the purposes of applicable privacy laws, including the EU GDPR and UK GDPR where they apply, the data controller responsible for your personal information is:
Postal Address: PO Box 903, Casino, NSW 2470, Australia
Contact Email: [email protected]
You can contact us at the email address above if you have questions about this policy, wish to exercise your privacy rights, or want further information about how we handle personal information.
EU and UK Representative Status
ATTIA Ltd is established and operates from Australia and does not have an office, branch, or establishment in the European Union or the United Kingdom.
We may receive personal information from people located in the EU or UK where they voluntarily choose to interact with this Website, sign up for updates, participate in campaign activity, or make a donation. We keep our EU/UK-related processing under review. If our activities require us to appoint an EU or UK representative under applicable data protection law, we will update this policy with the representative’s contact details.
2. Personal Information We Collect
We collect only the personal information reasonably necessary for our advocacy, communication, donation administration, website operation, and legal compliance purposes.
- Identity Data: first name and last name.
- Contact Data: email address.
- Geographic Data: country of residence or location information you choose to provide.
- Campaign Participation Data: information connected with campaign engagement actions, supporter messages, advocacy preferences, or other actions you choose to take through the Website.
- Donation and Transaction Data: if you make a donation through PayPal, we do not collect or store your credit card or bank account details. PayPal may provide us with transaction details needed for administration, reconciliation, fraud prevention, and record keeping. This may include your name, email address, billing address, donation amount, transaction date, and transaction reference.
- Technical and Usage Data: IP address, browser type and version, time zone setting, device information, operating system, referring URLs, pages visited, interaction data, and analytics information about how visitors use the Website.
- Cookie and Tracking Data: information collected through cookies, pixels, analytics tags, and similar technologies, where these technologies are enabled.
3. How We Collect Personal Information
We may collect personal information when you:
- subscribe to campaign updates or newsletters;
- register your name to support our digital advocacy campaign;
- contact us by email or through the Website;
- make a donation through PayPal;
- interact with our Website, cookie banner, forms, or campaign content; or
- engage with our campaign through third-party platforms, including social media platforms.
4. Purposes and Lawful Bases for Processing
Where the EU GDPR or UK GDPR applies, we rely on the lawful bases set out below.
| Data Category | Purpose of Processing | Lawful Basis |
|---|---|---|
| Identity, Contact, and Country Data | Sending campaign updates, newsletters, regulatory alerts, and advocacy communications. | Consent. You choose to opt in to receive these communications by submitting your details. You can withdraw consent at any time by using the unsubscribe link in our emails or contacting us. |
| Identity, Contact, Country, and Campaign Participation Data | Administering our internal supporter registry, evaluating campaign milestones, and identifying geographic engagement. | Legitimate interests. We have a legitimate interest in operating, verifying, and measuring aggregate engagement for our advocacy campaign. We balance this interest against your rights and freedoms. |
| Identity, Contact, Donation, Billing, and Transaction Data | Processing, validating, recording, reconciling, and administering donations through PayPal. | Legitimate interests in administering donations and preventing fraud, and legal obligation where we must keep accounting, taxation, or corporate records. |
| Technical, Usage, Cookie, and Tracking Data | Website operation, security, analytics, campaign measurement, and optimisation. | Consent for non-essential analytics, advertising, retargeting, and tracking technologies. Legitimate interests may apply to strictly necessary technical, security, and website functionality processing. |
| Contact and Correspondence Data | Responding to questions, complaints, requests, or rights enquiries. | Legitimate interests in responding to communications and managing our relationship with supporters, and legal obligation where a privacy law requires us to respond. |
5. Legitimate Interests
Where we rely on legitimate interests, our interests may include:
- operating and promoting our advocacy campaign;
- communicating with supporters who have engaged with the campaign;
- recording and verifying overall campaign support;
- administering donations and preventing fraud;
- maintaining website security and functionality;
- keeping appropriate business, financial, and compliance records; and
- responding to enquiries, complaints, or rights requests.
Where applicable, you have the right to object to processing based on legitimate interests. You can do this by contacting us at [email protected].
6. Cookies and Similar Technologies
Our Website may use cookies, pixels, analytics tags, and similar technologies to operate the Website, understand how visitors use it, measure campaign effectiveness, and, where enabled, support targeted campaign outreach.
Non-essential cookies and tracking technologies are disabled by default and will only be activated where you provide consent through our cookie banner or preference tool. You can change or withdraw your cookie preferences at any time by selecting the "Cookie Settings" link in the Website footer, where available, or by adjusting your browser settings.
Types of Cookies and Tracking Technologies
| Category | Purpose | Consent Required? |
|---|---|---|
| Strictly Necessary Cookies | Enable core Website functions, security, consent preference storage, and form operation. | No, where they are strictly necessary. |
| Analytics Cookies | Help us understand Website traffic, pages visited, and how people interact with campaign content. | Yes, where required by applicable law. |
| Campaign Measurement and Advertising Pixels | Measure the effectiveness of campaign outreach and social media advocacy activity. | Yes. |
| Preference Cookies | Remember your cookie choices or Website preferences. | Consent may not be required where used only to remember your requested preferences. |
Third-Party Technologies
We may use the following third-party technologies, subject to your cookie choices:
- Google Analytics: used to understand Website traffic and user interaction patterns. Google may process information such as device information, browser information, approximate location, pages visited, and interaction data. Google Analytics cookies are configured with a rolling expiration lifetime of up to 14 months.
- Meta Pixel: used to measure the performance of social media campaign activity and, where enabled, support campaign audience measurement or outreach on Meta platforms. Meta tracking cookies possess a data retention lifetime of up to 180 days.
- PayPal: used to process donations. PayPal processes payment information according to its own privacy terms and may provide transaction confirmation information to us.
We will maintain a separate cookie list or cookie preference panel identifying, where practical, the cookies and similar technologies used on the Website, their provider, purpose, category, and duration.
7. Disclosures and Recipients of Personal Information
We may disclose personal information to the following categories of recipients where necessary for the purposes described in this policy:
- payment processors, including PayPal;
- website hosting, security, maintenance, and IT service providers;
- email, newsletter, or campaign communication service providers;
- analytics and campaign measurement providers, including Google and Meta where enabled;
- professional advisers, including accountants, auditors, lawyers, and insurers;
- regulators, government authorities, law enforcement bodies, or courts where required or permitted by law;
- campaign partners or advocacy recipients, but only where this is reasonably necessary for the campaign activity you have chosen to support or where you have been explicitly informed of the disclosure and provided necessary authorization beforehand.
We do not sell your personal information.
8. International Data Transfers
ATTIA Ltd is based in Australia. If you are located outside Australia, including in the European Economic Area or the United Kingdom, your personal information may be transferred to, stored in, or accessed from Australia and other countries where our service providers operate.
Where the EU GDPR or UK GDPR applies and personal information is transferred internationally, we will take steps designed to protect that information in accordance with applicable law. These steps may include using Standard Contractual Clauses, UK international data transfer arrangements or addenda, transfer risk assessments, and contractual, technical, and organisational safeguards where required.
Some third-party providers, including analytics, campaign measurement, email, hosting, or payment providers, may process information in countries outside your location. Their handling of personal information may also be governed by their own privacy policies.
9. Data Retention
We retain personal information only for as long as reasonably necessary for the purposes for which it was collected, including to meet legal, accounting, reporting, campaign, and compliance requirements.
- Campaign Subscription Data: retained until you unsubscribe, withdraw consent, ask us to delete it, or until the campaign or related communications are no longer active, unless we need to retain limited information for legal or suppression-list purposes.
- Campaign Participation and Supporter Data: retained for as long as reasonably necessary to administer, evidence, and evaluate internal campaign analytics, unless a longer or shorter period is required by law or you successfully exercise an applicable deletion right.
- Donation and Transaction Data: retained for up to 7 years after the transaction, or longer if required by applicable taxation, accounting, corporate, audit, or legal requirements.
- Analytics and Technical Log Data: retained for a rolling period of up to 14 months, unless a shorter or longer period is reasonably required for security, legal, or technical reasons.
- Correspondence and Rights Requests: retained for as long as necessary to respond to the request and maintain appropriate records of our response.
10. Your Privacy Rights
Depending on your location and the privacy laws that apply to you, you may have rights in relation to your personal information, including:
- Access: to request a copy of personal information we hold about you.
- Correction: to request correction of inaccurate or incomplete information.
- Deletion ("Right to be Forgotten"): to request deletion of your personal information in certain circumstances.
- Restriction: to request that we restrict certain processing activities.
- Objection: to object to processing based on legitimate interests or direct marketing.
- Portability: to request transfer of certain information in a structured, commonly used, machine-readable format.
- Withdraw Consent: to withdraw consent where processing is based on consent, including for email marketing or non-essential cookies.
- Complain: to complain to a privacy or data protection regulator.
To exercise your rights, contact us at [email protected]. We may need to verify your identity before responding. We aim to respond within one calendar month where the EU GDPR or UK GDPR applies, unless an extension is permitted by law.
You can unsubscribe from campaign emails at any time by using the unsubscribe link included in our emails or by contacting us.
11. Complaints
If you are concerned about how we handle your personal information, please contact us first so we can try to resolve the issue.
You may also have the right to complain to a privacy or data protection authority, including:
- Australia: Office of the Australian Information Commissioner (OAIC).
- European Union: the data protection authority in your EU member state.
- United Kingdom: Information Commissioner’s Office (ICO).
12. Data Security
We use reasonable technical, organisational, and administrative safeguards designed to protect personal information against unauthorised access, disclosure, alteration, loss, misuse, or destruction.
These safeguards may include access controls, secure website connections using HTTPS, restricted administrative access, service provider due diligence, and reasonable internal handling controls. However, no method of transmission or storage is completely secure, and we cannot guarantee absolute security.
13. Children
This Website is not directed to children, and we do not knowingly collect personal information from children under the age at which parental consent is required under applicable law. If you believe a child has provided us with personal information, please contact us so we can take appropriate steps.
14. Third-Party Links
The Website may contain links to third-party websites, platforms, or services. We are not responsible for the privacy practices, content, or security of those third parties. You should review their privacy policies before providing personal information to them.
15. Changes to This Policy
We may update this Privacy and Cookie Policy from time to time to reflect changes in our practices, technologies, legal obligations, or campaign activities. The "Last Updated" date at the top of this policy shows when it was last revised.