Privacy Policy

Last updated 3 August 2026

1. Who we are

The Gourmet Pantry is a business operated by Gourmet Brands Two Pty Ltd (ABN 98 112 255 259) (we, us, our). We operate the website at thegourmetpantry.com.au and supply gift hampers and gourmet food gifts.

We are bound by the Privacy Act 1988 (Cth) (Privacy Act) and the Australian Privacy Principles (APPs).

This policy explains how we handle personal information in connection with The Gourmet Pantry business. It applies to our website, to orders placed with us by phone or email, to our corporate ordering portal, to our sales on eBay under the name GourmetX, and to our dealings with customers, gift recipients and corporate customers. Section 5 explains how we handle orders placed through a retail partner or marketplace.

This policy does not apply to our handling of employee records in connection with a current or former employment relationship, which is exempt under the Privacy Act.

2. The kinds of personal information we collect and hold

The information we collect depends on how you deal with us. It may include:

• Contact and identity details: your name, email address, postal and delivery addresses, and phone number.
• Order and transaction information: what you ordered, order numbers and dates, delivery details and instructions, order value, payment status and method, and refunds and returns.
• Gift recipient information: where you send a gift, the recipient's name and delivery address, their phone number or email address where you give them to us, and the gift message you write. See section 4.
• Account information: your login email address, an encrypted form of your password, and your saved addresses, saved recipients and order history.
• Business customer information: your business name, ABN, your role, and purchase order references.
• Communications with us: emails, enquiry and contact form submissions, support tickets, and recordings of telephone calls.
• Marketing information: your subscription status, whether you have unsubscribed, and how you interact with our emails.
• Website and device information: your IP address, device and browser details, an approximate location derived from your IP address, the pages and products you view, searches you run, items you add to your cart, and identifiers stored in cookies and similar technologies. See section 6.
• Information we generate: records we create about you from other information, such as customer segments and order history categories.

Sensitive information

Sensitive information under the Privacy Act includes information or an opinion about a person's health, racial or ethnic origin, religious beliefs, philosophical beliefs, political opinions, sexual orientation and criminal record. It generally may only be collected with consent.

We do not ask you for sensitive information and we do not set out to collect it. Two things are worth knowing. First, gift messages and order notes are free text, so what you write is up to you, and we hold it as part of the order record. Second, information about the products you view and buy is collected by us and shared with advertising and analytics providers as described in section 6, and depending on the circumstances that information may indicate something about a person, such as a dietary preference.

3. How we collect personal information

We collect most personal information directly from you: when you place an order, create an account, subscribe to our emails, complete an enquiry or bulk order form, enter a promotion, or contact us.

We also collect personal information:

• from a person sending a gift, about the recipient (see section 4);
• from a business ordering gifts for its staff, clients or others (see section 4);
• from a retail partner or marketplace, where you bought from them (see section 5);
• automatically when you use our website (see section 6);
• from our delivery, payment and advertising providers; and
• from publicly available sources, such as company websites and the Australian Business Register.

Telephone calls. We record incoming and outgoing calls with our customer service and sales teams for training, quality assurance and record keeping. If you would prefer a call not to be recorded, tell us at the start of the call and we will deal with your enquiry another way.

If we receive personal information we did not ask for and could not have collected under the APPs, we will destroy or de-identify it where it is lawful and reasonable to do so.

4. When you give us someone else's details

We are a gifting business, so most orders involve one person giving us information about another person. If you place a gift order we will ask for the recipient's name and delivery address, and sometimes their phone number or email address so that we or our delivery partner can contact them about delivery.

Before you give us another person's details, please make sure you are entitled to do so, and make that person aware of this policy and how we will handle their information. The simplest way is to send them a link to this page.

We collect this information because it is reasonably necessary for us to make and deliver the gift you have ordered. We collect it from you rather than from the recipient because it is not reasonable or practicable to obtain it from the recipient directly: we have no dealings with them when the order is placed, we usually have no way of contacting them, and approaching them beforehand would ordinarily spoil the gift. The Privacy Act permits collection of personal information about an individual from someone other than that individual where it is unreasonable or impracticable to collect it only from them.

We use recipient details to make up and deliver the order, to communicate about delivery, to deal with any delivery problem, and to keep a record of the order. We disclose them to our delivery partners, and where you order through an account we store them so you can reuse them.

We do not add gift recipients to our marketing lists. If you received a gift from us, we do not use your details to send you marketing. You can subscribe yourself on our website if you would like to hear from us.

Corporate and bulk gifting

If you order gifts for your business you will usually give us a list of recipients. That list is personal information about each of those people. Please make sure you are entitled to provide it and that the people on it have been made aware of this policy.

Dietary and allergen information. Some corporate customers include dietary or allergen notes against individual recipients. Information of that kind can be sensitive information under the Privacy Act, which generally may only be collected with the person's consent. If you are providing dietary or allergen information about an identifiable individual, please only do so where that person has agreed to it being given to us for this purpose. Alternatively, tell us the dietary requirement without identifying who it relates to and we will work with you on the order.

If you use our corporate ordering portal we also hold your account details, including your login email, an encrypted form of your password, your saved recipient lists and branding files, and your order history.

If you received a gift from us

If you want to know what we hold about you or where we got it, or you want it corrected or removed, contact us using the details in section 13. We will tell you who provided your details unless it is impracticable or unreasonable to do so.

5. Orders placed through a retail partner, or on eBay

Retail partners and marketplaces. We supply and fulfil products that are sold through other retailers and online marketplaces. If you bought from one of them, your customer relationship is with that retailer or marketplace, not with us. They collected your information, they decide how it is handled in that relationship, and their own privacy policy applies to it. If you have a question or complaint about how they handle your information, please contact them.

To make and deliver your order, they pass us the details we need, typically the recipient's name and delivery address, delivery instructions, any gift message, and an order reference. We use those details to fulfil and deliver the order, to deal with any delivery problem, and to keep a record of the transaction, and we disclose them to our delivery partners. We do not use them to send you our own marketing.

eBay. We also sell on eBay under the name GourmetX. When you buy from us on eBay you are buying from us, so this policy applies to the information we receive about your order in the same way as an order placed on our own website. eBay handles your information separately under its own privacy policy.

Because we hold this information, the rest of this policy applies to it, including how we secure it (section 10), your right to ask us for access to it and to have it corrected (section 11), and your right to complain to us (section 12).

6. Cookies, website analytics and advertising

We and our service providers use cookies, tags, tracking pixels and similar technologies to collect information automatically when you use our website. This includes the pages and products you view, searches you run, items you add to your cart, your IP address and device details, and identifiers that recognise your browser across visits. Where you place an order or sign in, we link this information to your customer record.

We also make a recording of your visit, covering pages viewed, clicks and scrolling, and information entered into forms. Payment card numbers, security codes and passwords are masked and are not captured. These recordings are used to investigate problems, provide support and improve the website, and are deleted 30 days after they are made. The website activity records described above are kept for longer. If you contact our support team by phone, an agent may view your current session to help you, and can only interact with the page if you accept an on-screen request.

We use analytics and advertising providers, including Google and Meta, to measure how our website is used and to advertise our products. Information shared with them may include the pages and product categories you view, items added to your cart, order value and contents, advertising click identifiers, your IP address and device details, and cookie identifiers. It may also include your contact details, usually in a scrambled (hashed) form, so that a purchase can be matched to an advertisement or a review invitation can be sent to you, and we upload customer contact details in that form to build advertising audiences and to exclude existing customers from campaigns. Hashing makes the information harder to read but still allows you to be matched to a profile the platform already holds. These providers are located overseas and use this information for their own purposes as well as ours, under their own privacy policies.

You can limit some of this collection by blocking or deleting cookies through your browser settings, and by managing personalised advertising through your Google and Meta account settings. 

Session recording. We record browsing sessions on our website so we can see how our pages are used and diagnose problems customers report to us. A recording captures the pages you view, your scrolling, mouse movement and clicks, and the information you type into forms on our site — including your name, business name, email address, phone number and delivery address. It does not capture your card number, card security code (CVV), card expiry date or any password: those fields are excluded at the point of capture, and payments are completed on our payment provider's own page, which we do not record. Recordings are held for 30 days and are then deleted automatically. They are accessible only to our staff and are used solely to operate, support and improve the website. If you would prefer we did not record your sessions, contact us using the details in section 13.

7. Why we collect, hold, use and disclose personal information

We collect, hold, use and disclose personal information to:

• take, process, make up, pack and deliver orders, including gifts you send to others;
• fulfil orders placed with our retail and marketplace partners;
• take payment, issue invoices, and process refunds, returns and replacements;
• communicate with you about your order, including confirmations, dispatch and delivery notifications and delivery problems;
• create and administer your account and store your saved addresses and recipients;
• respond to enquiries, quote requests and complaints, and provide customer support;
• administer corporate accounts and manage bulk and repeat gifting;
• send you marketing where we are permitted to do so (see section 8);
• operate, secure, troubleshoot and improve our website, systems and products;
• advertise and promote our products, including measuring the effectiveness of our advertising;
• understand our customers and our business, including reporting and analysis;
• detect, investigate and prevent fraud, chargebacks and other unlawful activity;
• manage our business records and obtain professional advice; and
• comply with our legal obligations and establish, exercise or defend legal claims.

We also use and disclose personal information where you have consented, or where we are permitted or required to do so by law.

8. Direct marketing

Where we are permitted to do so, we use your personal information to send you marketing by email, SMS and post, and to show you advertising on other platforms. We send marketing emails to people who have subscribed or who have bought from us. We send marketing SMS only to customers who have given us a mobile number. We do not send marketing to gift recipients whose details were given to us by somebody else, unless they have subscribed themselves, and we do not send our own marketing to people whose orders came to us through a retail partner or marketplace other than eBay. We do not use the information we hold for this business to market our other businesses to you, or to build advertising audiences for them.

You can opt out at any time by clicking unsubscribe in any marketing email, replying STOP to any marketing SMS, emailing privacy@gourmetbrands.com.au, or calling 03 5277 2775. We will action your request within a reasonable period and there is no charge. Opting out will not stop messages we need to send you about an order, such as confirmations and delivery notifications.

If we use or disclose your personal information for direct marketing, you can ask us to tell you the source of that information. We will tell you within a reasonable period, free of charge, unless it is impracticable or unreasonable to do so.

9. Who we disclose personal information to

We disclose personal information to:

• delivery and logistics providers, including Australia Post and other couriers, and our shipping platform, so that orders can be delivered (Australia Post's privacy policy is at auspost.com.au/privacy);
• retail and marketplace partners, where an order came to us through them, so that we can send them delivery and fulfilment updates;
• payment providers, being Stripe, which processes card payments for us (stripe.com/au/privacy). We do not store full card numbers in our order and customer systems. Where you pay by phone, our team enters your card details directly into Stripe's system;
• our ecommerce, email marketing and customer service platforms;
• analytics, advertising, site search and customer review providers (see section 6);
• sign-in and address verification providers, so that you can log in and delivery addresses can be checked before dispatch;
• our hosting, infrastructure and IT providers;
• professional advisers, including our lawyers, accountants, auditors and insurers;
• a purchaser or prospective purchaser, if we sell or transfer all or part of our business, on the basis that the information continues to be handled in accordance with a policy of this kind; and
• law enforcement, regulators, courts and government agencies, where required or authorised by law.

We also disclose personal information where you have consented or where the Privacy Act otherwise permits it.

10. Overseas disclosure and how we hold information

Our own systems and databases are hosted in Australia.

Some of the providers we use are located overseas, or store or process information overseas. We are likely to disclose personal information to recipients located in the United States, Canada, the United Kingdom, New Zealand and Denmark.

Where we disclose personal information to an overseas recipient, we take steps that are reasonable in the circumstances to ensure the recipient does not breach the APPs in relation to that information. Those steps include using established providers and relying on the contractual terms and privacy commitments they offer. We do not control how the large advertising and analytics platforms handle information once they receive it, and they handle it for their own purposes under their own privacy policies as well as for ours.

We hold personal information electronically in our own systems and in the systems of the providers described in section 9. Information about you from different sources is combined and linked so that we have a complete record of your dealings with this business. Some information is held in email and business records, and some paper records are held at our premises.

We take steps that are reasonable in the circumstances to protect personal information from misuse, interference and loss, and from unauthorised access, modification and disclosure. Those steps include access controls and role based permissions, multi-factor authentication for staff systems, encryption of information in transit, and limiting staff access to what is needed for a person's role. No method of transmission or storage is completely secure, and we cannot guarantee the security of information transmitted to us over the internet.

We keep personal information for as long as we need it for the purposes described in this policy and to meet our legal, tax and record keeping obligations.

If we experience a data breach that is likely to result in serious harm, we will assess it and, where the Notifiable Data Breaches scheme in Part IIIC of the Privacy Act requires, notify the affected individuals and the Office of the Australian Information Commissioner.

11. Accessing and correcting your personal information

Access. You can ask us for access to the personal information we hold about you by contacting us using the details in section 13. We may ask you to verify your identity first. We will respond within a reasonable period, which we would ordinarily expect to be within 30 days, and will give you access in the way you have asked for where it is reasonable and practicable to do so.

There is no charge for making a request. If giving access would involve substantial work we may charge a reasonable fee, which will not be excessive, and we will tell you what it is before we do the work.

The Privacy Act allows us to refuse access in some circumstances, including where giving access would have an unreasonable impact on the privacy of other people, where the request is frivolous or vexatious, where the information relates to actual or anticipated legal proceedings between us, or where giving access would be unlawful. If we refuse, we will give you written notice setting out our reasons, unless it would be unreasonable to do so, and explaining how you can complain about the refusal. Where we can, we will try to give you access in another way.

Correction. If the information we hold about you is inaccurate, out of date, incomplete, irrelevant or misleading, you can ask us to correct it, and you can update your account details by logging in. We will take reasonable steps to correct it, at no charge, within a reasonable period. If we have disclosed the information to someone else and you ask us to notify them of a correction, we will take reasonable steps to do so unless it is impracticable or unlawful.

If we decide not to correct information, we will give you written notice with our reasons and information about how to complain. You can also ask us to attach a statement to the information noting that you consider it inaccurate, out of date, incomplete, irrelevant or misleading, and we will take reasonable steps to make that statement apparent to anyone who looks at the information.

12. Complaints

If you think we have breached the APPs, or you are concerned about how we have handled your personal information, please tell us. Contact our Privacy Officer using the details in section 13 and describe what happened and what you would like us to do. It helps if you put your complaint in writing, but you can also raise it by phone.

We will acknowledge your complaint and tell you who is handling it. We may ask for more information so that we understand what has happened. We will investigate and give you a written response setting out our findings, whether we consider the complaint substantiated, and what we propose to do. We aim to respond within 30 days. If we need longer we will tell you why and give you an expected timeframe. There is no charge for making a complaint.

If you are not satisfied with our response, you can refer your complaint to the Office of the Australian Information Commissioner at oaic.gov.au/privacy/privacy-complaints, by phone on 1300 363 992, or by post to GPO Box 5288, Sydney NSW 2001. The Commissioner will usually expect you to have complained to us first and to have given us an adequate opportunity to deal with your complaint.

13. Contact us, anonymity and changes

Privacy Officer: Andrew Richards
Gourmet Brands Two Pty Ltd (ABN 98 112 255 259)
Email: privacy@gourmetbrands.com.au
Phone: 03 5277 2775
Post: 27-30 Success Court, Corio, Victoria 3214

Anonymity and pseudonyms. You do not have to tell us your name to browse our website or make a general enquiry, and you can ask us to deal with you under a pseudonym. As section 6 explains, we still collect information about your device and your activity, and give your browser an identifier that lets us recognise it on later visits. We cannot do so where we are required or authorised by law to deal with an identified person, or where it is impracticable, such as where we need a name and address to deliver an order.

Changes. We may update this policy from time to time. The current version is published at thegourmetpantry.com.au/privacy-policy and the date at the top shows when it was last updated. Where a change is significant we will take reasonable steps to bring it to your attention. This policy is free, and if you would like it in another form, ask us and we will take reasonable steps to provide it that way.