Privacy Policy

Create & Grow Media ABN 87 827 983 604 ("we", "us", "our") is committed to protecting the privacy of your personal information. This Privacy Policy explains how we collect, use, store, and disclose personal information in accordance with the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs).

This policy applies to all personal information collected through our website (createandgrow.au), our client portal (clients.createandgrow.au), and through the provision of our digital marketing services.

We may collect the following types of personal information:

• Contact information: name, email address, phone number, business name, and postal address • Business information: ABN, industry, website URL, and marketing goals • Account credentials: login details for platforms and services we manage on your behalf • Financial information: billing details and payment history (processed securely via Stripe) • Website usage data: IP address, browser type, pages visited, and interaction data collected via cookies and analytics tools • Communication records: emails, messages, and notes from meetings or phone calls • Marketing data: campaign performance data, advertising account information, and analytics

We do not collect sensitive information (such as health data, political opinions, or biometric data) unless specifically required and with your explicit consent.

We collect personal information:

• Directly from you: when you fill in a contact form, send us an email, book a meeting, sign a service agreement, or communicate with us by phone • Through our website: via cookies, analytics tools (such as Google Analytics 4), and contact forms • Through third-party platforms: when we manage your accounts on platforms such as Google Ads, Meta (Facebook and Instagram), HubSpot, or other marketing tools • From publicly available sources: such as your business website, social media profiles, or public directories

Where practicable, we collect personal information directly from you. We will inform you at or before the time of collection about the purposes for which the information is being collected.

We use personal information for the following purposes:

• To provide, manage, and improve our digital marketing services • To communicate with you about your projects, campaigns, and account • To issue invoices and process payments • To send marketing communications (with your consent, and with an option to unsubscribe at any time) • To analyse website usage and improve our website and services • To comply with legal obligations and resolve disputes • To manage and operate our client portal

We will not use your personal information for purposes other than those for which it was collected, unless we obtain your consent or are required or authorised by law to do so (APP 6).

We may disclose personal information to:

• Third-party service providers who assist us in delivering services, including hosting providers (Vercel), email services (Resend), payment processors (Stripe), CRM platforms (HubSpot), and analytics services (Google) • Advertising platforms (Google Ads, Meta) in order to manage campaigns on your behalf • Professional advisers, including accountants and legal counsel • Government agencies or law enforcement, where required by law

We take reasonable steps to ensure third-party providers comply with the APPs or equivalent privacy protections. Some of these providers may store data overseas (for example, in the United States). Where this occurs, we ensure that appropriate safeguards are in place in accordance with APP 8.

Our website uses cookies and similar tracking technologies to:

• Remember your preferences and settings • Analyse website traffic and user behaviour (using Google Analytics 4) • Track the effectiveness of marketing campaigns • Provide a better user experience

You can control cookies through your browser settings. Disabling cookies may affect the functionality of our website.

We may also use tracking pixels and scripts from third-party platforms (such as Google and Meta) to measure advertising effectiveness. These tools collect anonymised or pseudonymised data.

We take reasonable steps to protect personal information from misuse, interference, loss, and unauthorised access, modification, or disclosure (APP 11). Our security measures include:

• Encrypted data transmission (SSL/TLS) across all our websites and portals • Secure authentication and access controls • Regular review of data handling practices • Restricting access to personal information to authorised personnel only • Using reputable, security-compliant third-party service providers

No method of electronic storage or transmission is 100% secure. While we strive to protect your personal information, we cannot guarantee absolute security.

We retain personal information only for as long as necessary to fulfil the purposes for which it was collected, or as required by law.

• Client records and service data: retained for the duration of the engagement and for seven (7) years after the engagement ends (to meet tax and legal obligations) • Marketing communications data: retained until you unsubscribe or request deletion • Website analytics data: retained in accordance with the policies of the analytics provider (typically 14 months for Google Analytics 4)

When personal information is no longer needed, we will take reasonable steps to destroy or de-identify it.

Under the Australian Privacy Principles, you have the right to:

• Access: request access to the personal information we hold about you (APP 12) • Correction: request correction of inaccurate, incomplete, or out-of-date information (APP 13) • Opt out: unsubscribe from marketing communications at any time • Complain: make a complaint if you believe we have breached the APPs

To exercise any of these rights, please contact us using the details below. We will respond to your request within 30 days.

If you are not satisfied with our response, you may lodge a complaint with the Office of the Australian Information Commissioner (OAIC) at www.oaic.gov.au.

Our website may contain links to third-party websites. We are not responsible for the privacy practices or content of those websites. We encourage you to read the privacy policies of any third-party websites you visit.

We may update this Privacy Policy from time to time to reflect changes in our practices or legal requirements. The updated policy will be posted on our website with the revised date. We encourage you to review this policy periodically.

If we make material changes that affect how we handle your personal information, we will notify you by email or through a notice on our website.

If you have any questions about this Privacy Policy or wish to exercise your rights, please contact us:

Create & Grow Media Email: hello@createandgrow.au Location: Brisbane, QLD, Australia