Privacy Policy

Last updated: 12 August 2026

1. Who we are

This Privacy Policy explains how Toby Bros collects, holds, uses and discloses personal information through its website and grocery pickup and delivery service. Contact us at admin@tobybros.com.au.

2. Information we collect

Depending on how you use the service, we may collect:

• identity and contact details, including name, email address and phone number;
• account and authentication information, including username and protected password credentials;
• billing, delivery and safe-drop details, including addresses, postcode, instructions and preferred order method;
• order, basket, saved-basket, product, substitution, payment-status, refund and transaction-reference information;
• customer-service communications, internal fulfilment notes, contact attempts, complaints and return requests;
• delivery-run information, including assigned stops, navigation addresses, delivery outcomes and issue notes;
• website and device information such as IP address, browser type, essential cookie identifiers, security events and server logs; and
• any other information you choose to provide when contacting us.

We do not need sensitive information for ordinary grocery orders. Please avoid including health or other sensitive details in delivery instructions or notes unless they are reasonably necessary.

3. How we collect information

We usually collect information directly from you when you create an account, update My Account, save a basket, place an order, choose preferences, request support or communicate with staff. We also receive transaction status from eWAY and operational information created by authorised staff while fulfilling and delivering orders.

The homepage postcode checker is informational. It checks the entered postcode against the approved delivery list in the browser and does not intentionally save that postcode to your profile or order preferences. Ordinary website security and server logs may still record technical information about the visit.

4. Why we use information

We use personal information to:

• create and secure customer accounts;
• operate baskets, checkout, payments, pickup, delivery and saved preferences;
• pick, pack, check, route and complete orders;
• send account, order, payment, pickup, delivery, cancellation and refund messages;
• respond to questions, complaints, returns and privacy requests;
• prevent fraud, misuse and security incidents;
• maintain, troubleshoot and improve the website and operations; and
• meet accounting, tax, legal, insurance and record-keeping obligations.

If you do not provide required account, contact, address or payment information, we may be unable to create an account, accept an order or provide the requested pickup or delivery service.

5. Cookies and similar technology

The website uses cookies and local browser storage that are reasonably necessary for functions such as account sign-in, basket contents, checkout, preferences, security and remembering a session. You can restrict cookies in your browser, but essential store functions may stop working correctly.

6. When we disclose information

We disclose only the information reasonably needed for the service, including to:

• eWAY and relevant financial institutions to authorise, process, secure and reconcile payments and refunds. We receive payment status and transaction references and do not intentionally store a reusable copy of full card details in WooCommerce;
• email delivery and hosting providers to send transactional emails and operate the website;
• authorised Toby Bros staff, delivery personnel and contractors who need information to prepare, deliver or support an order;
• Google Maps when an authorised delivery user opens a route or navigation link containing store and customer delivery addresses;
• technical, professional, insurance and security advisers where reasonably necessary to operate or protect the business; and
• government, regulators, courts or law-enforcement bodies where required or authorised by law.

Service providers handle information under their own terms and privacy practices as well as their arrangements with us. We do not sell customer personal information.

7. Overseas handling

Some technology, payment, email or navigation providers may store or process information using systems or support teams outside Australia. The countries can change with provider infrastructure and are not always known to us. Where Australian privacy law applies, we take reasonable steps appropriate to the service and disclosure. You may contact us for current information about the providers configured for the website.

8. Storage, security and retention

Information may be held in WordPress, WooCommerce, the website database, email systems, payment records, backups and limited operational records. We use reasonable administrative, access-control and technical safeguards appropriate to a small online retailer. No internet or storage system can be guaranteed completely secure.

We keep information for as long as reasonably needed for accounts, orders, support, fraud prevention, dispute handling, backups and legal or accounting obligations. We then delete, de-identify or securely dispose of it where reasonably practicable and lawful. Some order and transaction records must be retained even after an account closes.

9. Access and correction

You can review or update common contact, address and preference information through My Account. You may also email us to request access to, or correction of, personal information we hold. We may need to verify your identity and may refuse or limit access where permitted by law, in which case we will explain the available review or complaint options where required.

10. Privacy complaints

Email admin@tobybros.com.au with the subject “Privacy complaint” and explain what happened and the outcome you are seeking. We will acknowledge and investigate the complaint within a reasonable period, may request further information, and will tell you the outcome. If you remain dissatisfied and the Privacy Act applies, you may contact the Office of the Australian Information Commissioner.

11. Email communications

We use email primarily for account, order and service messages. If we introduce optional marketing emails, we will provide any consent and unsubscribe controls required by law. Service emails needed to operate an account or order may still be sent.

12. Changes to this policy

We may update this policy when the website, providers or legal requirements change. The current version and update date will be published on this page.

Privacy contact: admin@tobybros.com.au