Privacy policy

PRIVACY POLICY OF EMPRESS ATHLETICUS GROUP

Last updated 25 September 2026

1. INTRODUCTION

1.1 About this policy

This Privacy Policy (“this policy”) is the official privacy policy of EMPRESS ATHLETICUS PTY LTD ACN 647 499 447 and any of its wholly owned subsidiaries (hereafter collectively referred to as the “EMPRESS ATHLETICUS Group” or “we”, “us”, or “our”) as required by the Privacy Act 1988 (the “Act”) and the Australian Privacy Principles (the “APPs”) and it applies to all personal information about individuals collected by the EMPRESS ATHLETICUS Group.

1.2 What this policy provides

(a) In this policy we explain how and why we collect personal information about individuals, how we use such information within the EMPRESS ATHLETICUS Group, and what controls individuals have over our collection and use of information about them.

(b) This policy is relevant to individuals who are current and former customers, as well as other individuals that the EMPRESS ATHLETICUS Group deals with in connection with the goods and services we provide or information we collect from customers and other persons.

1.3 Our commitment

The EMPRESS ATHLETICUS Group is committed to complying with Commonwealth legislation (the Act and the APPs) that deals with how businesses may collect, hold and use personal information about individuals and to protecting and safeguarding the privacy of individuals when they deal with us.

2. COLLECTION OF INFORMATION

2.1 Type of information collected

(a) Some information provided to us by customers and other parties might be considered private or personal. However, without such information we would not be able to carry on our business activities and provide our services. We will only collect such personal information if it is necessary for one of our functions or activities.

(b) The kinds of personal information that the EMPRESS ATHLETICUS Group may collect and hold in respect of individuals may include:

(i) names;

(ii) contact details, delivery addresses and identification information;

(iii) information about your orders, returns, rewards and your purchase history with the EMPRESS ATHLETICUS Group;

(iv) messages you send us, reviews you write and photos you share with us;

(v) the measurements, height and fit preference you enter into our Find My Perfect Fit tool;

(vi) information about how you use our websites and emails (see section 6.3); and

(vii) if we open trade or credit accounts in future, information about credit history.

(c) Credit Information (as defined in the Act) is the subject of our additional Credit Reporting Privacy Policy, which may be found here: Credit Reporting Privacy Policy.

2.2 Situations where information is collected

Personal information may be collected in the following situations by the EMPRESS ATHLETICUS Group:

(a) if an individual contacts the EMPRESS ATHLETICUS Group, we may keep a record of that communication or correspondence;

(b) if an individual submits an application, curriculum vitae or another form required to enable and/or facilitate services and/or employment to be provided by the EMPRESS ATHLETICUS Group;

(d) when conducting transactions such as purchases or refunds. Card payments are processed by our payment providers (such as Shopify Payments, Afterpay and PayPal). We do not see or store your full card number;

(e) when an individual submits their contact details to be included on our email or SMS lists, or enters a giveaway or competition;

(f) when an order is placed with us, we require contact information including name, delivery address, telephone number and email address to process and deliver that order;

(g) when an individual uses our Find My Perfect Fit tool, joins our rewards program, writes a review or starts a return; and

(h) when CCTV footage is recorded at our premises.

2.3 Manner of collection

(a) At or before the time the personal information about an individual is collected by us, we will take reasonable steps to ensure that the individual is made aware of who we are, the fact that the individual is able to gain access to the information held about the individual, the purpose of the collection, the type(s) of organisations to which we may usually disclose the information collected about the individual, any laws requiring the collection of the information and the main consequences if all or part of the information is not collected.

(b) We usually collect personal information about individuals directly from the individual. However, sometimes we may need to collect personal information about individuals from third parties for the purposes described in this policy. For example, where we need information from a third party to assist us to process an order (such as to verify information an individual has provided) or to assist us to locate or communicate with the individual.

2.4 How information may be held

(a) A company within the EMPRESS ATHLETICUS Group may hold personal information about an individual in physical form or in electronic form on our systems or the systems of our service providers.

(b) The personal information that a company within the EMPRESS ATHLETICUS Group holds about individuals is protected by physical, electronic and procedural safeguards, and the EMPRESS ATHLETICUS Group requires its service providers that hold and process such information on our behalf to follow appropriate standards of security and confidentiality.

(c) The EMPRESS ATHLETICUS Group trains its staff and others who work for it on how to handle personal information appropriately and restricts access to what is necessary for specific job functions.

2.5 Period of retention of information

(a) The EMPRESS ATHLETICUS Group may retain personal information collected or provided to us including:

(i) recordings of calls to our phone lines. We do not currently record calls. If we start, we will tell you at the start of any recorded call;

(ii) CCTV security footage from our business premises; and

(iii) customer files including individuals’ personal information, contact information, financial and transactional information, to enable us to verify transactions and customer details and to retain adequate records for legal and accounting purposes.

(b) The EMPRESS ATHLETICUS Group will retain personal information for any minimum or maximum periods required by law depending on the type of information collected. Apart from those periods, we will safely destroy or de-identify personal information once it is no longer required.

3. USE AND DISCLOSURE OF PERSONAL INFORMATION

3.1 Purposes of collection

(a) A company within the EMPRESS ATHLETICUS Group may, as permitted by law, use or disclose personal information held about an individual for the business purposes for which it is collected (e.g. provision of our services, including administration of our services, notifications about changes to our services, record-keeping and technical maintenance), that is, to carry on our business activities and provide services to our customers.

(b) We may also use such information about individuals for a purpose related to the primary purpose of collection and where the individual would reasonably expect that we would use the information in such a way. This information is only disclosed to persons outside our business in the circumstances set out in this policy or as otherwise notified at the time of collection of the information.

(c) The EMPRESS ATHLETICUS Group’s business purposes for which personal information is collected, used and disclosed may include:

(i) processing and delivering an order or service request (including verifying a person's identity for these purposes);

(ii) managing our products and services or other relationships and arrangements, including processing receipts, payments, refunds, returns and invoices;

(iii) if we offer trade or credit accounts in future, assessing and monitoring credit worthiness;

(iv) detecting and preventing fraud and other risks to us and our customers;

(v) responding to inquiries about orders, accounts or other products, services or arrangements;

(vi) understanding our customers' needs and developing and offering products and services to meet those needs;

(vii) researching and developing our products and services and maintaining and developing our systems and infrastructure (including undertaking testing);

(viii) sending you marketing by email or SMS where you have agreed to receive it, and measuring and personalising our advertising (see sections 4 and 6.3);

(ix) running our rewards program, giveaways and competitions;

(x) ensuring workplace health and safety and productivity of employees at the EMPRESS ATHLETICUS Group’s workplace premises;

(xi) dealing with complaints;

(xii) meeting legal and regulatory requirements, for example various Australian laws may expressly require us to collect and/or disclose personal information about individuals, or we may need to do so in order to comply with other obligations under those laws;

(xiii) enforcing our rights, including undertaking debt collection activities and legal proceedings; and

(xiv) Fit tool. If you use our Find My Perfect Fit tool, we store the measurements, height and fit preference you enter so we can improve our sizing. If you are logged in, we link your result to your account so we can show your size when you shop and help you faster if you contact us. You can ask us to delete it at any time by emailing hello@empressathleticus.com.au.

3.2 Additional disclosure situations

In addition to the above, we are permitted to use or disclose personal information held about individuals:

(a) where the individual has consented to the use or disclosure;

(b) where we reasonably believe that the use or disclosure is necessary to lessen or prevent a serious threat to someone's life, health or safety or to public health or safety;

(c) where we reasonably suspect that unlawful activity has been, is being or may be engaged in and the use or disclosure is a necessary part of our investigation or in reporting the matter to the relevant authorities;

(d) where such use or disclosure is required under or authorised by law (for example, to comply with a subpoena, a warrant or other order of a court or legal process);

(e) where we reasonably believe that the use or disclosure is necessary for the prevention, investigation, prosecution and punishment of crimes or wrongdoings or the preparation for and conduct of proceedings before any court or tribunal or the implementation of the orders of a court or tribunal by or on behalf of an enforcement body; and

(f) where a customer has requested a service to be provided by us and we are required to disclose the information to a third party in order to provide the service. In most, if not all cases, any such disclosure will be with the consent of the individual.

3.3 Third parties to whom information may be disclosed

Third parties to whom we may disclose personal information about individuals in accordance with the business purposes set out above may include:

(a) our online store platform and IT service providers;

(b) delivery and returns providers, such as Australia Post and our returns portal;

(d) email, SMS, customer service, rewards and reviews providers;

(e) analytics and advertising platforms (see section 6.3);

(f) AI service providers (see section 7);

(g) cloud information storage providers;

(h) our legal and financial advisors;

(i) regulatory bodies in Australia;

(j) if we offer trade or credit accounts in future, guarantors, security providers and debt collectors; and

(k) other trade suppliers.

4. DIRECT MARKETING

4.1 We may carry out direct marketing

As part of our business activities, a company within the EMPRESS ATHLETICUS Group may use personal information that individuals have provided to us for direct marketing. Direct marketing includes, but is not limited to, sending emails and SMS messages about our products, launches, pre-sales and promotions.

4.2 Opting out of direct marketing

(a) You can opt out at any time by using the unsubscribe link in any email, by replying STOP to any SMS, or by emailing us at the address in the ‘Contacting us’ section of this policy.

(b) Every direct marketing message we send includes a way to opt out.

5. ANONYMITY AND PSEUDONYMITY

Individuals generally have the option of dealing with a company within the EMPRESS ATHLETICUS Group anonymously or under a pseudonym, where it is practicable. For example, individuals making general enquiries may do so anonymously. However, if we are supplying goods and services or entering into a contract with an individual, it is impractical for that individual to deal with us anonymously or under a pseudonym.

6. WEBSITES AND LINKS

6.1 EMPRESS ATHLETICUS Group websites

The EMPRESS ATHLETICUS Group carries on business through a number of websites, including:

www.empressathleticus.com.au
www.zashaboutique.com

and any other website that contains a link to this policy.

6.2 Website terms and conditions

(a) Each website of the EMPRESS ATHLETICUS Group collects personal information under this policy except as otherwise stated on the website.

(b) A website may display additional terms and conditions for access and use of the website which apply in addition to this policy.

6.3 Cookies and tracking

(a) We and our partners use cookies, pixels and similar tools on our websites and in our emails. They keep the site working (like remembering your cart), show us how the site is used, and help us measure and personalise our ads on platforms such as Meta, Google and Pinterest.

(b) These tools may collect your IP address, device and browser type, the pages you view, the website you came from, and whether you open or click our emails.

(d) We may share hashed (scrambled) contact details with advertising platforms to measure our results and show relevant ads.

(e) You can turn off cookies in your browser settings and manage ad preferences in your Meta and Google account settings. Some parts of our websites may not work properly without cookies.

6.4 Third party links

Our websites may contain links to other websites and those third party websites may collect personal information about individuals. We are not responsible for the privacy practices of other businesses or the content of websites that are linked to our websites. We encourage users to read the privacy statements of each website they visit.

7. USE OF AI

7.1 We use artificial intelligence (AI) tools to help run our business, including tools that:

(a) help us reply to your emails and chat messages;

(b) help our team analyse sales, stock, sizing and website data so we can plan products and improve our service; and

7.2 These include tools provided by Gorgias, Shopify, Slack, OpenAI, Anthropic and Viktor. We may change the tools we use over time.

7.3 We only give AI tools the personal information they need for the task. We use business versions of these tools that do not use your information to train their AI models, and they are subject to the same security standards as the rest of this policy.

7.4 You can always ask to speak with a person. Reply to any message or email hello@empressathleticus.com.au.

7.5 Our Find My Perfect Fit tool uses fixed sizing rules written by our team. It is not AI, and its result is a suggestion only.

7.6 Automated decisions. Some automated systems, such as fraud checks at checkout run by us or our payment providers, may flag, hold or cancel an order. If this happens to you, contact us and a team member will review it.

8. SECURITY AND STORAGE OF INFORMATION

8.1 Our commitment

The EMPRESS ATHLETICUS Group places great importance on the security of all information associated with our customers and others who deal with us. We have security measures in place to reasonably protect against the loss, misuse, unauthorised access and alteration of personal information and other data under our control.

8.2 Security and storage methods

(a) All personal information and other data we hold is kept securely, and information held electronically is held on secure servers.

(b) Information stored within our computer systems or by our service providers can only be accessed by people with authority and appropriate password protection.

(c) We work with our IT service providers to implement reasonable firewall, malware detection and data security procedures.

8.3 Electronic transmissions

No data transmission over the internet can be guaranteed to be absolutely secure. As a result, whilst we strive to protect users' personal information, the EMPRESS ATHLETICUS Group cannot ensure or warrant the security of any information transmitted to it or from its online products or services, and users do so at their own risk. Once we receive a transmission, we make every effort to ensure its security on our systems.

8.4 Banking information and payment requests

(a) We will never email you or telephone you requesting your credit card or bank account details except in connection with a purchase that you are making by email or telephone.

(b) If you receive a communication claiming to be from us requesting payment or banking information, we recommend that you contact us separately using our publicly available phone number to check it is genuine.

8.5 Data breach and response

(a) The EMPRESS ATHLETICUS Group has a data breach response plan to comply with the mandatory notification requirements of Part IIIC of the Act.

(b) As part of this plan, the EMPRESS ATHLETICUS Group will:

(i) within 30 days of becoming aware of a suspected data breach, assess whether it is a breach that must be notified; and

(ii) take any immediate remedial action as is reasonable to contain the breach or stop it continuing.

(i) provide a statement about the breach to the Office of the Australian Information Commissioner;

(ii) if it is practical to notify affected individuals directly, notify them and provide a copy of our statement; or

(iii) if it is impractical to notify affected individuals directly, publish the statement on our websites and otherwise act in accordance with the requirements of the Act.

9. TRANSFER OF INFORMATION OVERSEAS

9.1 Some of our service providers store or process personal information outside Australia. These include our online store platform and our email, SMS, customer service, rewards, reviews, returns, analytics, advertising and AI providers.

9.2 The countries where your information may be stored or processed include the United States, Canada, the United Kingdom and countries in the European Union. The locations may change as our providers change.

9.3 We take reasonable steps to make sure overseas providers handle personal information in line with the APPs.

10. ACCESS TO AND CORRECTION OF PERSONAL INFORMATION

10.1 Our commitment

The EMPRESS ATHLETICUS Group takes all reasonable steps to keep the personal information we hold about our customers and website users accurate, up to date, complete and relevant.

10.2 Access to information

(a) Any individual may request access to personal information about them held by the EMPRESS ATHLETICUS Group. Requests are to be made to our Privacy Officer, whose details are set out below.

(b) We will respond to any requests for access or correction within a reasonable time, and no later than 30 days after the request is received.

(c) As part of any request for access, we will ask the individual to verify their identity so we can be satisfied the request is being made by the individual concerned.

(d) The EMPRESS ATHLETICUS Group is not required to give an individual access to personal information in circumstances where:

(i) we reasonably believe that giving access would pose a serious threat to the life, health or safety of any individual, or to public health or public safety;

(ii) giving access would have an unreasonable impact on the privacy of other individuals;

(iii) the request for access is frivolous or vexatious;

(iv) the information relates to existing or anticipated legal proceedings between the EMPRESS ATHLETICUS Group and the individual, and would not be accessible by the process of discovery in those proceedings;

(v) giving access would reveal our intentions in relation to negotiations with the individual in a way that would prejudice those negotiations;

(vi) giving access would be unlawful;

(vii) denying access is required or authorised by or under an Australian law or a court or tribunal order;

(viii) both of the following apply:

(A) we have reason to suspect that unlawful activity, or misconduct of a serious nature, that relates to our functions or activities has been, is being or may be engaged in; and

(B) giving access would be likely to prejudice the taking of appropriate action in relation to the matter;

(ix) giving access would be likely to prejudice one or more enforcement related activities conducted by, or on behalf of, an enforcement body; or

(x) giving access would reveal evaluative information generated within the EMPRESS ATHLETICUS Group in connection with a commercially sensitive decision-making process.

(e) If we refuse to provide an individual with access to, or to correct, their personal information, we will give written reasons, the ways they can complain about the refusal and any other matters required by the Act.

10.3 Correction of information

(a) Inaccurate information will be corrected once we are told about it. To protect confidentiality, we will only pass on details of an individual’s personal information to that individual once we are satisfied the information relates to them.

(b) From time to time, and having regard to the purpose of collection, we may contact individuals to confirm that the personal information they provided is accurate, up to date and complete.

10.4 Customers in the European Union and United Kingdom

If you are in the European Union or United Kingdom, you may also have the right to ask us to delete your personal information, to limit or object to how we use it, and to receive a copy of it in a common format. We process your information to fulfil your orders, where you have consented (such as marketing), and for our legitimate business interests described in this policy. To make a request, contact our Privacy Officer. You can also complain to the data protection authority in your country.

11. COMPLAINTS

11.1 Making a complaint

If an individual has a complaint about this policy or about how the EMPRESS ATHLETICUS Group collects, uses, discloses or destroys their personal information, the complaint should be directed in the first instance to our Privacy Officer at the contact details set out in the ‘Contacting us’ section of this policy.

11.2 Investigation and resolution procedure

(a) Within 7 days of receiving a complaint, we will give the complainant written notice acknowledging receipt and setting out how we will deal with it.

(b) Unless a longer time is agreed by the complainant, we will investigate the complaint, make a decision within 30 days of receipt and communicate the decision to the complainant.

(c) If we cannot resolve a complaint within 30 days, we will tell the complainant why, give a date when we expect to make a decision, and seek the complainant’s agreement to extend the 30-day period. If the complainant does not agree, we may not be able to resolve the complaint.

(d) It may be necessary (and it may be required by the Act), in order to deal with a complaint, to consult with a third party. If, while a complaint remains unresolved, we are disclosing information subject to the complaint to a third party, we may be required to advise the third party about the complaint.

(e) If we find a complaint is justified we will resolve it and do what is required to rectify any breach. The EMPRESS ATHLETICUS Group is committed to fulfilling its obligations as an APP entity and, if we offer credit in future, as a credit provider under the Act.

(f) If a complainant is not satisfied with the outcome of our internal complaints procedure, they may refer their complaint to the Office of the Australian Information Commissioner (“OAIC”) at www.oaic.gov.au. Customers in New Zealand may contact the Office of the Privacy Commissioner at www.privacy.org.nz.

11.3 Complaints handling policy

The EMPRESS ATHLETICUS Group has a broader complaints handling policy which may be viewed here: Complaints Policy.

12. CHANGES TO THIS POLICY

If we decide to or are required to change this policy, we will post the updated policy on this page and update the date at the top, so users are always aware of what information we collect, how it is used and how it may be disclosed. Please check back regularly for any changes.

13. CONTACTING US

For concerns, complaints or further information about this policy or our privacy and data security practices, please contact:

The Privacy Officer, EMPRESS ATHLETICUS Group

Address for postage: Empress Athleticus

35 Access Crescent

Coolum Beach QLD 4573

Telephone: 07 5446 1846

Email: hello@empressathleticus.com.au

We will respond to your enquiry as soon as possible.

Contacting the OAIC

If you are not satisfied with our response to your enquiry, or for more information on privacy law, please visit the website of the Office of the Australian Information Commissioner at www.oaic.gov.au.