This Privacy Policy explains how WebKreativo (“we”, “us”, “our”) collects, holds, uses, discloses and protects the personal information of our clients, prospective clients, website visitors and other individuals we deal with in the course of our business.
It applies to personal information we handle through our website, our enquiry and quotation forms, our advertising and the services we provide. We handle that information in accordance with the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs). This policy should be read together with our Terms and Conditions.
Effective date: 16 August 2026
Under APP 3, we collect only the personal information that is reasonably necessary for our business functions and activities. We may collect the following types of personal information:
(a) Identity information: full name, business name and ABN (if applicable).
(b) Contact information: email address, phone number and business address.
(c) Financial information: billing details, invoice history and payment method details. Card payments are processed securely through Stripe and we do not store full card details.
(d) Marketing and campaign data: information about your business, target audience, products, services, campaign performance and advertising account data, including data from the Meta Ads and Google Ads platforms.
(e) Website usage data: IP address, browser type, device type, pages visited, time on site and referring website, collected through cookies and tracking tools as described in section 6.
(f) Communications: the content of emails, messages, meeting notes and other correspondence you have with us.
Sensitive information. We do not seek out sensitive information, which includes information about health, racial or ethnic origin, political opinions, religious or philosophical beliefs, sexual orientation and criminal record. Under APP 3.3, we will collect sensitive information only with your consent and where it is reasonably necessary for our functions or activities, or where the collection is required or authorised by law.
We collect personal information in the following ways:
(a) Directly from you, when you contact us, request a quotation, sign a service agreement or communicate with us by any means.
(b) Through your use of our website, by means of cookies, web analytics and embedded tracking tools (see section 6).
(c) Through access you grant us to your advertising accounts, such as Meta Business Manager or Google Ads. We access data in those accounts solely to perform the agreed services.
(d) From publicly available sources, where relevant to providing our services.
Under APP 3.6, we will collect personal information directly from you wherever it is reasonable and practicable to do so. Where we collect personal information about you from a third party, APP 5 requires us to take reasonable steps to notify you of that collection.
Dealing with us anonymously. Under APP 2, you have the option of dealing with us anonymously or under a pseudonym. We can answer general questions about our services on that basis. We cannot prepare a quotation, enter into a service agreement or deliver a project without your contact details, as it is not practicable to do so.
Information about other people. If you provide us with personal information about another person, such as a colleague, a member of your staff or a customer of your business, you must be authorised to do so. Where it is required, you must also make that person aware that their information may be handled in accordance with this policy.
Under APP 6, we use personal information for the purpose for which it was collected, known as the primary purpose. We may use it for a related secondary purpose only where you would reasonably expect us to do so, where you have consented, or where the use is required or authorised by law.
The purposes for which we collect, hold, use and disclose personal information are:
(a) To provide, manage and improve our digital marketing and web services;
(b) To communicate with you about your service agreement, campaigns, invoices and support requests;
(c) To process payments and manage our accounts and billing records;
(d) To send you relevant business updates, service information or marketing materials, which you may opt out of at any time (see section 7);
(e) To comply with our legal obligations, including tax and record-keeping requirements;
(f) To improve the quality of our website and services through analytics;
(g) To protect our systems and accounts, and to prevent, detect and investigate fraud, misuse and unlawful activity; and
(h) To establish, exercise or defend a legal claim, including the recovery of amounts owed to us.
We may disclose personal information to:
(a) Our service providers, including Stripe (payment processing), Google (Google Analytics, Google Ads), Meta (Facebook and Instagram Ads), website hosting and domain registration providers, and cloud storage and communication tools. These providers may use the information only for the purpose for which we engaged them, are bound by confidentiality obligations, and may process data outside Australia (see section 5).
(b) Professional advisers, including accountants and legal advisers, under obligations of confidentiality.
(c) Regulatory authorities or law enforcement agencies, where required or authorised by law, and to a court or tribunal in connection with a legal claim.
(d) A purchaser or investor, in connection with a genuine sale, restructure or financing of our business, subject to appropriate confidentiality arrangements.
(e) Any other recipient, with your consent or at your direction.
We do not sell, rent or trade personal information.
In the course of providing our services, we handle personal information that belongs to our clients and is controlled by them. This may include customer records held in a website, online store, customer relationship system or email marketing platform, enquiry and order form submissions, advertising audiences, and analytics data.
Where we handle personal information on behalf of a client:
(a) The client remains responsible for that information, including for having lawful authority to collect it, for its own privacy policy and collection notices, and for the instructions it gives us;
(b) We handle the information only to perform the services agreed with that client, and in accordance with their lawful instructions;
(c) We do not use client-controlled information for our own purposes, and we do not disclose it except as required to perform the services or where required or authorised by law;
(d) We may use the service providers listed in section 4 where reasonably required to perform the services; and
(e) At the end of an engagement, we return, transfer or delete client-controlled information in accordance with the service agreement, subject to any lawful backups and to records we are required to retain.
If you are an individual whose personal information is held in a system we manage for one of our clients, your request for access, correction or deletion should be directed to that client in the first instance, as they control the information. If you contact us instead, we will pass your request on to them.
Some of the third-party tools and providers we use, including Google Analytics, Meta Pixel and Stripe, may store or process personal information on servers located outside Australia. Based on the providers we currently engage, the countries in which your personal information is likely to be stored or processed are the United States, Ireland and other member states of the European Union.
Under APP 8, before we disclose personal information to an overseas recipient we take reasonable steps to ensure that the recipient does not handle that information in a way that would breach the Australian Privacy Principles. These steps include reviewing the privacy and security commitments published by the provider and relying on contractual protections where they are offered.
Overseas recipients may be subject to laws that differ from Australian privacy law, including laws that permit government authorities to access information.
Our website uses cookies and similar tracking technologies to enable core functions, understand how visitors use our site, measure the performance of our advertising and improve our services. These include:
(a) Analytics cookies: we use Google Analytics to understand website traffic and visitor behaviour. This involves collecting technical information such as your IP address, device type and the pages you view. The information is reported to us in aggregate and we do not use it to identify you personally.
(b) Advertising pixels: we use the Meta Pixel to measure the effectiveness of our own advertising, to understand how visitors interact with our website, and to show our ads to people who have previously visited our site.
(c) Functional cookies: essential cookies that enable basic website functions, such as form submissions.
You can control or disable cookies through your browser settings. Disabling certain cookies may affect the functionality of parts of our website.
You can also opt out of Google Analytics using the browser add-on available at tools.google.com/dlpage/gaoptout, and manage personalised advertising through your Google and Meta account settings.
Where you have consented or would reasonably expect us to do so, we may use your contact details to send you information about our services, promotions or industry news that may be of interest to you. Under APP 7, every direct marketing message we send includes a simple means of opting out.
You may opt out of direct marketing at any time by:
(a) Clicking the “unsubscribe” link in any marketing email we send; or
(b) Contacting us directly at hello@webkreativo.com.au with the subject line “Unsubscribe”.
We will action your request within five business days and at no cost to you, in accordance with the Spam Act 2003 (Cth). After that, we will not send you further direct marketing communications, although we may still send transactional or service-related messages about a current engagement.
Under APP 11, we take reasonable steps to protect the personal information we hold from misuse, interference and loss, and from unauthorised access, modification and disclosure. Our security measures include:
(a) Password-protected systems and accounts;
(b) Use of encrypted and reputable third-party platforms, including Stripe and Google Workspace;
(c) Limiting access to personal information to those who need it to perform their role; and
(d) Keeping the systems and software we control up to date.
While we take reasonable precautions, no method of transmission over the internet and no method of electronic storage is completely secure, and we cannot guarantee the absolute security of personal information.
We recommend that you do not send sensitive or security-critical information, such as passwords or financial details, through ordinary email or a website form unless we have provided you with a secure method for doing so.
We retain personal information only for as long as it is needed for the purposes described in this policy, or for as long as we are required to retain it by law. In general:
(a) Client records, including service agreements, invoices and campaign data, are retained for at least five years after the end of the client relationship, in line with our record-keeping obligations under Australian taxation law. Some records, such as those relating to capital assets, may need to be kept for longer.
(b) Enquiries that do not proceed to an engagement are retained for no longer than 24 months and are then deleted.
(c) Marketing contact details are retained until you opt out, after which we keep only the minimum record needed to ensure we do not contact you again.
(d) Website analytics data is retained in accordance with the retention period configured in Google Analytics.
Under APP 11.2, when personal information is no longer needed for any purpose for which it may be used or disclosed, and we are not required by law to retain it, we take reasonable steps to destroy it securely or to ensure that it is de-identified. This is subject to information held in routine backups and archives, which is deleted in the ordinary course of those systems.
Under APP 12, you may request access to the personal information we hold about you. Under APP 13, you may request correction of any information that is inaccurate, out of date, incomplete, irrelevant or misleading.
You may also ask us to delete personal information we hold about you. We will do so unless we are required by law to retain it, or it remains necessary in connection with a current engagement or an existing or anticipated legal claim.
To make a request, please contact us at hello@webkreativo.com.au. A request may be made by you, by a person you have authorised in writing to act on your behalf, or by your legal representative. Where a request concerns a person under the age of 18, it must be made by a parent or guardian. We may need to verify your identity before we act on a request.
We will respond within a reasonable period, and in most cases within 30 days. We do not charge a fee for making a request, although we may charge a reasonable fee for providing access where the law permits and the request is substantial. We will tell you the amount before proceeding.
We may decline to give access or to make a correction in the limited circumstances permitted by law. If we decline, we will provide written reasons and explain how you may complain about the decision. Where we decline to make a correction, you may ask us to associate a statement with the information noting that you consider it to be inaccurate, out of date, incomplete, irrelevant or misleading.
If your request concerns personal information held in a system we manage for one of our clients, see section 5.
Where we suspect that a data breach involving personal information may have occurred, we will take immediate steps to contain it and limit any resulting harm, and we will carry out a prompt assessment to determine whether the breach is likely to result in serious harm to any individual.
Where a breach is likely to result in serious harm, we will notify the affected individuals and the Office of the Australian Information Commissioner (OAIC) in accordance with the Notifiable Data Breaches scheme in Part IIIC of the Privacy Act 1988 (Cth). Our notification will describe the breach, the kinds of information involved and the steps we recommend individuals take in response.
Where a breach affects personal information held in a system we manage for a client, we will notify that client without undue delay and work with them to meet their notification obligations.
If you have a complaint about how we have handled your personal information, please contact our Privacy Officer:
Email: hello@webkreativo.com.au (subject line: Privacy Complaint)
Phone: +61 494 096 833
Address: Melbourne, Victoria, Australia
Where possible, please put your complaint in writing and include enough detail for us to understand and investigate it. We will acknowledge your complaint within five business days, investigate it fairly and aim to provide a written response within 30 days. If we need more time, we will explain why and agree a revised timeframe with you.
If you are not satisfied with our response, or if we do not respond within 30 days, you may lodge a complaint with the Office of the Australian Information Commissioner (OAIC):
Website: oaic.gov.au
Phone: 1300 363 992
Email: enquiries@oaic.gov.au
We may update this Privacy Policy from time to time to reflect changes to our practices, our services or applicable law. We will publish any updated version on our website, and it applies from the effective date shown at the top of this policy.
Where a change is significant, we will take reasonable steps to notify current clients directly. We encourage you to review this policy periodically.
Fill in your details and we'll be in touch