Draft for legal review. Prepared 17 October 2026; updated 18 October 2026 to match the site code (date of birth not kept, pool places, links). Bracketed items are undecided. Remove this box before publishing.

Drafting notes for the lawyer:

• Written as if Pulldog is bound by the Australian Privacy Principles (APPs). Two reasons: the small business exemption is doubtful because hashed customer data goes to Meta (Privacy Act s 6D(4)(c), consent exception s 6D(7)), and turnover is not yet known.
• The "OAIC July 2026 position" the founder cited is, on our search, the OAIC release of 24 June 2026 (determinations Monash IVF [2026] AICmr 40 and Medmate Australia [2026] AICmr 41, dated 11 June 2026, and the report "Your life, pixelated"), which law firms covered in July 2026. Its relevant points:
  • hashed identifiers sent to platforms are still personal information;
  • a privacy policy alone does not satisfy APP 5 notice;
  • organisations should offer a simple opt-out of pixel-based ad targeting.
• The automated-decision section applies from 10 December 2026 (APP 1.7 to 1.9).
• Sources: LEGAL-REPORT.md section 13 [28], and:
  • https://www.oaic.gov.au/news/media-centre/privacy-commissioner-finds-privacy-breaches-in-third-party-tracking-pixel-investigation
  • https://www.oaic.gov.au/privacy/privacy-guidance-for-organisations-and-government-agencies/organisations/tracking-pixels-and-privacy-obligations
  • https://www.oaic.gov.au/__data/assets/pdf_file/0021/269013/APP-1.7-1.9-Transparency-Obligation-Fact-Sheet.PDF

Privacy Policy

Last updated: [date]

This policy explains how Studio Slate Pty Ltd, ACN [ACN], ABN 60 695 372 993 ("Pulldog", "we", "us") handles personal information. We follow the Australian Privacy Principles in the Privacy Act 1988 (Cth).

Contact: hello@pulldog.com.au, or [postal address].

1. What we collect

When you buy: your name, email address, phone number, delivery address, order history, and messages you send us. Payments are processed by Stripe. We receive the payment result, the card type and its last four digits, but never your full card number.

When you enter a promotion: your state of residence, residential postcode and eligibility declaration. We also ask for your date of birth to check that you are 18 or over before you pay. We do not keep it.

If you win a prize: a copy of your government-issued photo ID, to confirm your identity, age and address. We delete the copy once we have checked it and keep only a record that it was checked, by whom and when.

When you use our site: your IP address, device and browser type, pages viewed, items added to cart, purchases, and identifiers stored in cookies. Some of this comes from the Meta Pixel and Meta Conversions API (section 4).

When you contact us: what you tell us.

We do not ask for sensitive information, such as health information. Please do not send it to us.

2. How we collect it

• Directly from you: through our checkout, entry forms and emails.
• Through cookies and similar tools on our site, including the Meta Pixel.
• From service providers: for example, Stripe tells us whether a payment succeeded and flags suspected fraud.

3. Why we use it

We use personal information to:

• process, ship and support your orders;
• run promotions: check eligibility (age, state, entry limits), allocate entries, contact and verify winners, deliver prizes, and publish winners as the promotion terms describe;
• prevent and investigate fraud, chargebacks and abuse;
• measure and improve our advertising, including showing ads to people likely to be interested and measuring which ads lead to purchases (section 4);
• send marketing emails or texts, only if you opt in;
• meet our legal obligations, such as tax records and promotion records that state regulators require us to keep.

If you do not give us the information an order or entry needs, we cannot complete the order or give you an entry.

4. Advertising, the Meta Pixel and the Conversions API

We advertise on Facebook and Instagram, which are run by Meta. To measure and target those ads we use two Meta tools.

• The Meta Pixel is code on our site. It sends Meta your IP address, browser details, the pages you view, and events such as "added to cart" and "purchase", linked to Meta cookies.
• The Conversions API sends similar event details from our server to Meta. It includes your email address and phone number in hashed (scrambled) form, and your order value.

Meta uses this to match the events to Meta accounts. Hashed details can still identify you once Meta matches them, so we treat them as personal information. We do not send Meta your date of birth, ID documents, or details of promotion results.

Your choices:

• When you first visit our site, a banner lets you turn advertising tracking off. You can change your choice at any time using the "Privacy choices" link in our footer. If you turn it off, we do not load the Meta Pixel and do not send your details through the Conversions API.
• You can also manage ad preferences in your Facebook and Instagram settings, and block cookies in your browser.

Meta's own use of this information is governed by Meta's privacy policy.

5. Who we share it with

We share personal information only as needed with:

• Stripe (payments and fraud screening);
• [delivery carrier] (delivery);
• [email provider] (order and, if you opt in, marketing emails);
• [hosting and database providers] (running our site);
• Meta (advertising measurement, as described in section 4);
• [ID check provider, if used] (winner verification);
• the independent person who supervises our promotion draws;
• our professional advisers; and
• regulators, police or courts, when the law requires it.

We do not sell personal information.

6. Overseas disclosure

Some of these providers store or process information outside Australia, including in [the United States, Ireland and other countries where Meta and Stripe operate]. Before we use an overseas provider, we take reasonable steps to make sure it handles your information in line with the Australian Privacy Principles. [Lawyer to confirm vendor locations and the APP 8 approach.]

7. Marketing

We only send marketing emails or texts if you tick the opt-in box. Buying from us does not by itself sign you up. Every marketing message identifies us and has an unsubscribe link, and we act on it within 5 working days. Order and delivery emails are service messages and do not contain marketing.

8. Decisions made by computer programs

Some decisions about you are made, or substantially made, by computer programs using your personal information.

• Promotion eligibility. We use your date of birth, state of residence and postcode to decide automatically whether a pack receives a promotion entry. Under-18s and residents of excluded states receive no entry.
• Entry limits. We use your email address, payment card and delivery address to apply the daily entry limit.
• Promotion results. Each entry takes the next place in its Series' prize pool, in the order payments are confirmed. That place decides whether the pack wins, by matching it against winning places fixed before the promotion. Prize draws pick entries at random. Neither uses any personal information beyond your order record.
• Fraud screening. Stripe's fraud tools use your payment, device and order details to decide whether to block a payment or flag it for review. We may also decline orders that match patterns of abuse.

If you think a decision about you is wrong, contact us and a person will review it.

9. Security and retention

We store personal information with providers that use encryption and access controls. Only staff who need it can see it.

We keep:

• order and tax records for 5 years;
• promotion records (entries, winners, prize delivery) for 3 years after each promotion;
• winner ID copies only until verification is complete.

When we no longer need information, we delete it or de-identify it.

10. Children

Our promotions are for people aged 18 and over, and our ads are targeted only at adults. We do not knowingly collect promotion details from anyone under 18. If you think a child has given us personal information, contact us and we will delete it.

11. Access and correction

You can ask for a copy of the personal information we hold about you, or ask us to correct it, by emailing hello@pulldog.com. We will respond within 30 days. We do not charge for corrections. If we refuse a request, we will explain why in writing.

12. Complaints

If you have a privacy concern, email hello@pulldog.com. We will acknowledge it within 5 business days and aim to resolve it within 30 days.

If you are not satisfied, you can complain to the Office of the Australian Information Commissioner at www.oaic.gov.au or on 1300 363 992.

13. Changes

We may update this policy. The current version is always at pulldog.com.au/legal/privacy-policy, with the date it was last updated.