Privacy Policy

Gelato Supplies (“we”, “us”) operates this website. We handle personal information in accordance with the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs). This policy explains what this website collects, why, where it goes and what you can do about it.

This is a business-to-business site. We do not sell to consumers, we do not publish prices, and we do not knowingly collect information from anyone under 18.

Dealing with us anonymously

You can browse this entire website without giving us any personal information, and you are welcome to phone or email us with a general question without identifying yourself or your business.

We cannot send you a gated document anonymously. The enquiry form exists so we know which business asked for a catalogue or a specification sheet, and that is the whole purpose of collecting the details below.

What we collect, and why

When you request a catalogue, a specification sheet or a sample through the form, we collect and store:

• Your name, business name, business email address and phone number — so we can send the document and answer your enquiry.
• Your business type, city and state — so the enquiry reaches the right person and so we can tell where demand is coming from.
• Any message you write — optional, and entirely up to you what goes in it.
• Which document you asked for — so we know what to send and which material is useful.
• Campaign parameters and the referring page — the utm_source, utm_medium and utm_campaign values in the link you arrived through, and the address of the page that linked you. This tells us which channels work. It is not linked to any advertising profile.
• Whether you ticked the marketing consent box — recorded as true or false, and never pre-ticked.

We collect nothing else, and we do not collect any of the categories the Privacy Act treats as sensitive information — no health information, no racial or ethnic origin, no political, religious or philosophical beliefs, no membership details, no sexual orientation, no criminal record and no biometric data.

Information you send us that we did not ask for

The message field is free text, so people occasionally include more than the enquiry needs. Where we receive personal information we did not solicit and could not have collected under APP 3, we destroy or de-identify it as soon as practicable, provided it is lawful and reasonable to do so.

Your IP address

We do not store your IP address, and we do not store a hash of it against your enquiry. The lead record has no IP field populated at all.

Separately from your enquiry, the site keeps a short-lived log of submission attempts to stop automated abuse of the form. Each row in that log holds a salted, one-way hash of the submitting IP address and the outcome of the attempt, and nothing else — no name, no email, nothing that identifies you. The hash cannot be reversed to recover the address, and it is not joined to your enquiry.

How we use it

The primary purpose is to send you what you asked for and to respond to your enquiry. We also use enquiry records for related purposes you would reasonably expect: following up on an enquiry, understanding which products and documents generate interest, and keeping our own business records.

We use your details for marketing only if you ticked the consent box. See Marketing and the Spam Act below.

Who we disclose it to

We do not sell personal information, we do not trade or rent it, and we do not disclose it for anyone else’s marketing.

We disclose it to the service providers who operate this site on our behalf:

• Supabase — the database holding enquiry records, and the private storage the gated documents sit in. Our project runs in Supabase’s Sydney (ap-southeast-2) region, so enquiry records are stored in Australia.
• Brevo — sends the email carrying your download link and the internal notification. Brevo is based in France and processes data in the European Union.
• Vercel — hosts and serves the website. Vercel is based in the United States and operates a global network.
• Google — Google Analytics 4, described below. Google is based in the United States.

We may also disclose personal information where we are required or authorised to by law.

Overseas disclosure

Enquiry records are held in Australia. Sending you an email necessarily discloses your name and email address to our email provider in the European Union. Website hosting and analytics involve providers in the United States, which may process technical and usage data there.

By submitting the form you consent to that disclosure. Where APP 8 applies, we take reasonable steps to ensure overseas recipients handle your information consistently with the APPs, but you should be aware that you may not be able to seek redress under the Privacy Act in respect of an overseas recipient.

Marketing and the Spam Act

Consent is never pre-ticked and never bundled. Submitting the form without ticking the box gets you the document you asked for and nothing else — we record your consent as false and we do not add you to a marketing list.

If you did consent, we may send occasional product and technical updates. Every commercial message will identify us and will carry a working unsubscribe link that we action within five working days, as required by the Spam Act 2003 (Cth). You can also withdraw consent at any time by emailing us. Withdrawing marketing consent does not affect our ability to reply to an enquiry you have made.

Download links

Gated documents are not stored at a public web address. When you submit the form we generate a private, time-limited link that expires 48 hours after it is issued. The link is delivered to you through a short-lived, httpOnly cookie on the thank-you page and by email; it is deliberately never placed in the address bar, because a link in a URL gets copied into messages, recorded in server logs and leaked in the referrer header of the next page you visit. After 48 hours the link stops working and a new request is needed.

Cookies and analytics

This site sets one cookie of its own: a short-lived, httpOnly cookie that carries your download link from the form to the thank-you page. It is not used for tracking and it expires on its own.

We use Google Analytics 4 to understand which pages are useful. It sets its own cookies and collects usage data including pages viewed, approximate location derived from IP address, and device and browser characteristics. We use it to measure the site, not to advertise to you. You can opt out for every site using Google’s browser add-on, or by blocking cookies in your browser — the site works normally either way. Analytics loads only when a measurement ID is configured, so preview and development builds send Google nothing at all.

Embedded videos load only when you click the play button, so no YouTube cookie is set unless you choose to watch.

How we keep it secure

Enquiry records sit in a database with row-level security enabled and no access policies at all, which means the public website key can reach none of it. Only our server-side code, holding a privileged key that is never sent to a browser, can read or write an enquiry. Gated documents live in a private storage bucket that is unreachable without a signed, expiring link. The site is served over HTTPS with a content security policy that prevents the form being repointed at another origin.

No system is perfectly secure. If we ever suffer a data breach likely to result in serious harm, we will assess and notify you and the Office of the Australian Information Commissioner as required by the Notifiable Data Breaches scheme.

How long we keep it

We keep enquiry records while there is an active or prospective commercial relationship, and for as long afterwards as we need them for our business records or are required to keep them by law. When we no longer need a record for any purpose permitted under the APPs, we destroy it or de-identify it.

The anti-abuse log described above is kept only as long as the rate-limiting window needs, and holds nothing that identifies you.

Keeping it accurate

The information we hold is the information you typed, so the fastest way to correct it is to tell us. We take reasonable steps to ensure what we hold is accurate, up to date and complete before we use it.

Access, correction and complaints

You may ask what personal information we hold about you and ask us to correct it. Email hello@gelatosupplies.au. We will respond within a reasonable period, normally 30 days. There is no charge for making a request. If we refuse access or a correction, we will tell you why in writing and how to complain.

If you are unhappy with how we have handled your personal information, complain to us first at the same address and we will investigate and respond in writing. If you are not satisfied with our response, you may complain to the Office of the Australian Information Commissioner — oaic.gov.au, or 1300 363 992.

Changes to this policy

We will post any change to this policy on this page.