Privacy Policy — Pepper Marketing

Last updated: 6 October 2026

1. What we collect

We collect personal information in three ways.

Information you give us. When you submit the contact form, email us, call us or engage us to provide services, we collect what you provide. On the website this is your first name, surname, company, email address, phone number and the content of your message. When you become a client we may also collect your job title, business address, billing details and the information needed to deliver the services you have engaged us for.

Information collected automatically. When you visit the website, analytics and tracking tools collect information about your device and how you use the site. This includes your IP address, browser type and version, operating system, referring website, the pages you view, how long you spend on them and the links you click. Some of this is collected through cookies and similar technologies. See section 4.

Information from other sources. We may receive personal information about you from your employer or colleagues where they engage us on your organisation's behalf, from publicly available sources such as LinkedIn or company websites, and from data providers we use for business-to-business marketing on behalf of clients.

We do not knowingly collect sensitive information (such as health, religious or political information) through the website. If you send it to us unprompted, we will only hold it where needed to respond to you.

2. Why we collect it

We collect and use personal information to:

respond to enquiries submitted through the website or by other means
provide marketing services to our clients and manage those engagements
send you information about our services, insights or events where you have asked for it or would reasonably expect it, with an option to opt out each time
understand how visitors use the website so we can improve it
meet our legal, accounting and regulatory obligations
protect the security of our systems and website.

We will only use your information for a purpose other than the one it was collected for where you would reasonably expect it, you have consented, or the law allows or requires it.

3. Who we share it with

We share personal information with the service providers we use to run our business and deliver our services. The main ones are:

Provider type	What it does	Where data is stored
CRM platform	Stores contact form submissions and contact records, and tracks website visitor activity	Australia (Sydney), with some processing in the United States
Website analytics and tag management	Website usage analytics and management of tracking tags	United States and other countries where the provider operates
Web host	Hosts the website	United States, delivered through a global content delivery network. Australian visitors are served from Sydney. The host holds only standard request logs (IP address and browser details).

The email, document storage and accounting software we use to run our business also holds some personal information; those providers store data in Australia and the United States. We share information with our professional advisers (lawyers, accountants, insurers), with contractors who work on client engagements under confidentiality obligations, and with regulators, courts or law enforcement where required by law.

Where we act for a client, the personal information we handle on their behalf is shared with that client and used under their instructions.

We do not sell personal information.

4. Cookies and tracking

The website uses cookies and similar technologies through three types of tool.

Tag management. A tag manager loads and controls the tracking tags on the site. It does not itself collect personal information, but it controls the tools below.

Website analytics. Our analytics provider collects information about how visitors use the site, including pages viewed, time on page, approximate location derived from IP address, device and browser. We use this in aggregate to understand traffic and improve the site. The provider may combine this data with other information it holds about you.

CRM visitor tracking. Our CRM platform places a cookie that records your visits and activity on the site. If you later submit the contact form or otherwise identify yourself to us, that browsing history is linked to your contact record so we can see which pages you looked at before getting in touch.

You can block or delete cookies through your browser settings. Doing so may affect how some parts of the site work.

5. Overseas disclosure

Our CRM platform stores data in Australia, with some processing in the United States. Our analytics, tag management and hosting providers described in section 3 store data outside Australia, mainly in the United States. Our clients and the people we deal with are in Australia and the United States. By using the website or providing your information to us, you acknowledge that your personal information will be transferred to and stored in those countries, where privacy laws differ from Australia's. We choose providers that are subject to privacy and security obligations and that have contractual commitments to handle data appropriately.

6. How we protect it

We take reasonable steps to protect personal information from misuse, interference, loss, unauthorised access, modification or disclosure. This includes access controls on our systems, multi-factor authentication on the platforms that hold personal information, encryption in transit, and confidentiality obligations on staff and contractors. No method of transmission or storage is completely secure and we cannot guarantee absolute security.

7. How long we keep it

We keep personal information for as long as it is needed for the purposes it was collected for, and for as long as we are required to by law. Contact form submissions and enquiry records are kept for two years unless you become a client or ask us to delete them earlier. Client records are kept for seven years after the engagement ends to meet tax and accounting obligations. Google Analytics retains event-level data for two months under Google's default setting; aggregated reporting data is kept beyond that. When information is no longer needed we destroy it or de-identify it.

8. Marketing communications

We do not send bulk marketing email to people who contact us through the website. Replies to enquiries come directly from a Pepper director. If we send you marketing email in future, it will comply with the Spam Act 2003 (Cth) and include an unsubscribe option, which we will action within five business days.

9. Access and correction

You can ask us for access to the personal information we hold about you and ask us to correct it if it is inaccurate, out of date, incomplete or misleading. Contact us using the details below. We will respond within 30 days. We may need to verify your identity before releasing information. We do not charge for access requests, but where a request is complex we may charge a reasonable fee for the time involved and will tell you before proceeding. If we refuse access or correction, we will give you written reasons and tell you how to complain.

10. Complaints

If you believe we have breached the APPs or mishandled your personal information, contact our Privacy Officer at the address below. We will acknowledge your complaint within seven days and aim to resolve it within 30 days. If you are not satisfied with our response, you can complain to the Office of the Australian Information Commissioner at www.oaic.gov.au or on 1300 363 992.

11. Changes to this policy

We may update this policy from time to time. The current version is always published on this page with the date it was last updated. Material changes will be flagged on the website.

12. Contact us

Privacy Officer
Pepper Marketing Pty Ltd
15 Yarra Street, South Melbourne VIC 3205
PO Box 215, South Melbourne VIC 3205
Phone: (03) 8566 6719
Email: info@peppermarketing.com.au