Privacy Policy

Privacy Policy

ABOUT THIS PRIVACY POLICY

Components Only Pty Ltd ACN 602 730 898 ("ComponentsONLY") is committed to safeguarding the privacy of our customers and website visitors.

We are bound by the Privacy Act 1988 (Cth) (Act) and the Australian Privacy Principles set out in the Act. This policy sets out how we collect and treat your personal information and applies to all your dealings with us, whether on our website, in person, or via telephone, email, or correspondence.

This policy also explains how we process 'personal data' about people in the European Union (EU), as required under the General Data Protection Regulation (GDPR). Under the Act 'personal information' means information or an opinion about an identified individual, or an individual who is reasonably identifiable , whether the information or opinion is true or not, and whether the information or opinion is recorded in a material form or not.

The purpose of this policy is to:

• give you a better and more complete understanding of the kinds of personal information we collect and hold;
• clearly and concisely communicate how and when we collect, disclose, use, store and otherwise handle personal information;
• inform you about the purposes for which we collect, hold, use and disclose personal information;
• provide you with information about how you may access your personal information, and seek correction of your personal information;
• provide you with information about how you may make a complaint, and how we will deal with any such complaint;
• advise you of the circumstances in which we are likely to disclose personal information to overseas recipients; and
• enhance the transparency of our operations.

COLLECTION OF PERSONAL INFORMATION

ComponentsONLY may collect personal information about you in order to provide our products, services and customer support to you. We do not collect personal information unless it is reasonably necessary for, or directly related to, one or more of the goods or services we provide or functions we carry out.

Our products, services, and customer support are provided through numerous platforms including but not limited to websites, mobile applications, email, and telephone. The specific platform and product, service, or support you interact with may affect the personal data we collect.

Whenever prospective, current or former employees or contractors deal with ComponentsONLY, we will collect personal information in order to assess job applications, process payments of fees, salary and superannuation, take out appropriate insurance, and otherwise administer the employer/employee or principal/contractor relationship.

Not all information requested, collected, and processed by us is personal information as it does not identify you as a specific natural person. This will include majority of "User Generated Content" that you provide us with the intention of sharing with others. Such "Non-Personal Information" is not covered by this privacy policy. However, as non-personal information may be used in aggregate or be linked with existing personal information, when in this form it will be treated as personal information. As such, this privacy policy will list both types of information for the sake of transparency.

In some situations we may be provided with personal information without us asking for it, or through means not intended for the collection of particular types of information. Whilst we may take reasonable steps to protect this data, the user will have bypassed our systems, processes, and control and thus the information provided will not be governed by this privacy policy.

In some situations we may also be provided personal information over platforms that are outside our control; for example through social media or messaging service. Whilst any information collected by us is governed by this privacy policy, the platform by which it was communicated will be governed by its own privacy policy.

SENSITIVE INFORMATION

‘Sensitive information’ means information or an opinion about an individual’s racial or ethnic origin, political opinions, membership of a political association, religious beliefs or affiliations, philosophical beliefs, membership of a professional or trade association, membership of a trade union, sexual orientation or practices, or criminal record, that is also personal information, or health information about an individual or genetic information about an individual that is not otherwise health information, biometric information that is to be used for the purpose of automated biometric verification or biometric identification or biometric templates.

We will not ask prospective, current and former clients and customers to provide sensitive information.

We may collect sensitive information from prospective and current employees and contractors for the limited purposes of administering the employer/employee or principal/contractor relationship, insurance claims, and ensuring health and safety. We will only collect sensitive information in circumstances where:

• it is reasonably necessary for one or more of the goods or services we provide or functions we carry out; and
• you consent to the collection of the information; or
• we are required or authorised by law to collect the sensitive information.

Some of the information we may ask employees or contractors to provide may be identified as mandatory. If you do not provide the mandatory data, we may be unable to offer you employment or engage your services.

HOW WE COLLECT PERSONAL INFORMATION

While you use our products and services you may be asked to provide certain types of personal information. This might happen through our website, mobile applications, online chat systems, telephone, paper forms, or in-person meetings. We will give you a Collection Notice at the time, to explain how we will use the personal information we are asking for. The notice may be written or verbal.

• The personal information we may request, collect, or process, includes but is not limited to: Account Details - username, password
• Contact Details - email address, phone number.
• Location Details - physical address, billing address, timezone.
• Identity Details - full name
• Financial Information - credit card details, wire transfer details, payment processor details (e.g. skrill, paypal), tax numbers.
• User Generated Content - component/part lists and company profiles.
• Metadata - IP address, computer and connection information, referring web page, standard web log information, language settings, timezone, etc.
• Device information - device identifier, device type, device plugins, hardware capabilities, etc.
• Actions - pages viewed, buttons clicked, time spent viewing, search keywords, etc.

We maintain records of the interactions we have with our customers, including the products, services and customer support we have provided. This includes the interactions our customers have with our platform such as when a customer has viewed a page or clicked a button.

When we are contacted we may collect personal information that is intrinsic to the communication. For example, if we are contacted via email, we will collect the email address used.

Like many websites, we may utilise "cookies" which automatically collect information to help us recognise you and customise your experience. For example, when visiting our website, we may automatically record information that your browser sends such as the web address you came from or are going to, your device model, operating system, browser type, unique device identifier, IP address, mobile network carrier, time zone and location. Likewise, our third part service providers may help us to track activity within our website and may also use “cookies” as a tracking technology. A cookie does not identify you personally but may identify your internet service provider or consumer. You can set your browser to notify you when you receive a cookie, and this will provide you with an opportunity to either accept or reject it in each instance.

On our website, you will encounter links to third party websites. These links may be from us, or they may appear as content generated by other users. These linked sites are not under our control and thus we are not responsible for their actions. Before providing your personal information via any other website, we advise you to examine the terms and conditions of using that website and its privacy policy.

HOW WE USE PERSONAL INFORMATION

The information we request, collect, and process is primarily used to provide customers with the product or service they have requested. More specifically, we may use your personal information for the following purposes:

• to provide the service or product you have requested;
• to provide technical or other support to you;
• to answer enquiries about our services, or to respond to a complaint;
• to promote our other programs, products or services which may be of interest to you (unless you have opted out from such communications);
• to allow for debugging, testing and otherwise operate our platforms;
• to conduct data analysis, research and otherwise build and improve our platforms;
• to comply with legal and regulatory obligations;
• if otherwise permitted or required by law; or
• for other purposes with your consent, unless you withdraw your consent for these purposes.

The 'lawful processing' grounds on which we will use personal information about our users are (but are not limited to):

• when a customer has given consent;
• when necessary for the performance of a sales contract to which the customer is party;
• processing is necessary for compliance with our legal obligations;
• processing is necessary in order to protect the vital interests of our users or of another natural person.
• processing is done in pursuing our legitimate interests, where these interests do not infringe on the rights of our users.

WHEN WE DISCLOSE PERSONAL INFORMATION

The personal information of users may be held or processed on our behalf outside Australia, including 'in the cloud', by our third party service providers. Our third party service providers are bound by contract to only use your personal information on our behalf, under our instructions.

Our third party service providers include:

• Cloud hosting, storage, networking and related providers
• Payment, banking and credit rating providers
• Marketing and analytics providers
• Security providers

We may also disclose your personal information to third parties for the following purposes:

• if necessary to provide the service or product you have requested;
• we receive court orders, subpoenas or other requests for information by law enforcement;
• if otherwise permitted or required by law; or
• for other purposes with your consent.

As we are a global company, with representatives around the world, your personal information may be processed by staff in any of our locations. ComponentsONLY currently has representatives in Australia, Mongolia, The United States of America, South Africa, Canada, and Chile.

STORAGE

Your personal information may be stored in hard copy documents or electronically. ComponentsONLY is committed to keeping your personal information secure and safe. Some of the ways we do this are:

• Requiring employees and contractors to enter into confidentiality agreements.
• Secure hard copy document storage (i.e. storing hard copy documents in locked filing cabinets).
• Security measures for access to our computer systems.
• Providing a discreet environment for confidential discussions.
• Access control for our buildings.
• Security measures for our websites (see the Your Privacy on the Internet section for more information).

We will review and update our security measures from time to time.

In addition, we will review the personal information and sensitive information held by us from time to time, ensuring that information which is no longer needed for a purpose for which it was initially collected is destroyed or de-identified.

ComponentsONLY takes care to ensure that the information you provide to us via our website is protected. For example, our website has electronic security systems in place, including data encryption.

You may be able to access external websites by clicking on links we have provided. Those other websites are not subject to our privacy standards, policies and procedures. You will need to contact or review those websites directly to ascertain their privacy standards, policies and procedures.

ACCESSING, CORRECTING, OR DOWNLOADING YOUR PERSONAL INFORMATION

You may request access to the personal information ComponentsONLY holds about you (please see the ‘Contacting Us’ section below for more information).

We will acknowledge your request within 5 business days of the request being made. Access will usually be granted within 10 business days of our acknowledgment or, if the request involves complex considerations or voluminous photocopying or scanning, within 15 business days. We will let you know which timeframe applies to your request and if any delays are anticipated.

You will need to verify your identity before access to your personal information is granted.

While we cannot and do not charge an “application fee” for you applying to access your personal information, we may charge a fee for actually giving you access to your personal information in your preferred format (where reasonable and possible), which will cover our costs involved in locating and collating information as well as reproduction costs.

If you are aware that we hold personal information about you that is no longer accurate, complete or up-to-date, please contact us (see the Contacting Us section for more information).

If you request access to your personal information, or if you request that we correct your personal information, we will allow access or make the correction unless we consider that there is a sound reason to withhold the information, or not make the correction.

Under the Act, we may refuse to grant access to personal information if:

• We believe that granting access would pose a serious threat to the life, health or safety of any individual, or to public health or public safety.
• Granting access would have an unreasonable impact upon the privacy of other individuals.
• Denial of access is required or authorised by law or by a Court or Tribunal order.
• Giving access would be unlawful.
• The request for access is frivolous or vexatious.
• Legal proceedings are underway or anticipated and the information would not be accessible by way of the discovery process in those proceedings.
• Giving access would reveal our intentions in relation to negotiations between us and you in such a way as to prejudice those negotiations.
• Giving access is likely to prejudice enforcement related activities conducted by, or on behalf of, an enforcement body.
• Giving access is likely to prejudice action being taken or to be taken with respect to suspected unlawful activity or serious misconduct relating to our functions or activities.
• Giving access would reveal information in connection with a commercially sensitive decision making process.

If we do not agree to make a correction to your personal information, you may provide a statement about the requested corrections, and we will ensure that the statement is apparent to any customers of the relevant personal information.

EXERCISING YOUR OTHER RIGHTS

You have a number of other rights in relation to the personal data ComponentsONLY holds about you, however, there may be some limits (where permitted by the Act) on how you may exercise these rights. This is largely due to the nature of the products and services we provide. Much of the data we collect is in order to facilitate product/service enquiries, facilitate payments, and provide protection for the legitimate customers of ComponentsONLY and users of our website - these data uses are protected against the below rights.

You have the right to:

• opt-out of direct marketing, and profiling for marketing
• erasure; and
• temporary restriction of processing.

Users can control what emails they receive through their settings page.

Most personal information and user generated content cannot be deleted as they are used to support sales contracts, document financial transactions, and are used in providing protecting other legitimate users of our website and services. In the case of non-personal data that can be linked with personal data, it will either be erased or otherwise anonymised from the personal data.

Under certain circumstances you may exercise this right, in particular if you believe that the personal data we have is not accurate, or you believe that we do not have legitimate grounds for processing your information. In either case you may exercise this right by contacting our privacy officer.

Unless stated above, you may exercise any of the above rights by contacting our Privacy Officer.

CONTACTING US

If you have an enquiry or a complaint about the way we handle your personal information, or to exercise your privacy rights, you may contact our Privacy Officer as follows:

privacy@componentsonly.com

For the purposes of the GDPR, our Privacy Officer is also our Data Protection Officer (DPO).

We will acknowledge receipt of a complaint within 2 business days.

We will investigate the complaint and attempt to resolve it within 20 business days after the complaint was received. Where it is anticipated that this timeframe is not achievable, we will contact you to provide an estimate of how long it will take to investigate and respond to the complaint.

COMPLAINTS

If you consider we have not adequately resolved your privacy complaint, you may lodge a complaint with the Office of the Australian Information Commissioner (OAIC) by calling them on 1300 363 992, making a complaint online at www.oaic.gov.au, or writing to them at:

enquiries@oaic.gov.au

If you are in the European Union, you can choose to instead lodge a complaint with your local Data Protection Authority (DPA). The list of DPAs is at:

https://www.edpb.europa.eu/about-edpb/about-edpb/members_en

Last updated: 19 February 2025