Privacy Policy

Version: 2026-08-legal-l4

1. This Policy and How It Applies

This Privacy Policy is issued by Protein Link Pty Ltd ACN 696 889 433 (Protein Link, we, us or our). It explains how we collect, hold, use and disclose personal information, and how you may access or correct that information or make a complaint.

This Policy applies to everyone who uses the Protein Link Platform, including buyers, suppliers and visitors to our website. It operates together with the Platform Terms of Use, the Buyer Terms, the Supplier Agreement, the Marketplace Transaction Terms, the Freight Responsibility Matrix, the Refund and Dispute Policy and the Food Safety and Recall Policy. This Policy prevails over every other document on the handling of personal information. On every other matter, the order of precedence in the Platform Terms of Use applies.

Because we are required to verify the identity of every business on the Platform, it is not practicable for you to deal with us anonymously or under a pseudonym.

2. Information We Collect

We collect the following categories of information:

Account information: name, email address, phone number, company name, ABN, company type, and password (stored as a one-way hash).
Transaction data: order requests, order history, pricing, and delivery details.
Usage data: pages visited, features used, and session information for Platform improvement.
Legal acceptance records: timestamps, IP addresses, and user agent strings recorded when you accept Platform agreements.

We collect only the information that is reasonably necessary for our functions and activities, and we collect it from you directly where it is reasonable and practicable to do so.

3. How We Use Your Information

To provide and operate the marketplace Platform.
To process transactions and facilitate communication between buyers and suppliers.
To verify business identity and prevent fraud.
To send Platform notifications and important service updates.
To comply with legal obligations, including food safety reporting.

We use information only for the purposes set out above and for purposes you would reasonably expect, unless you consent to another use or the use is required or authorised by law. If we use your information to send you marketing material we will give you a simple means of opting out, and we will stop if you ask us to.

4. Payment Information

Payment processing is handled by Stripe. Protein Link does not store credit card numbers, bank account details, or other sensitive payment credentials. Stripe collects payment credentials directly from you. We receive from Stripe only a payment reference, the outcome of a transaction and the last four digits of a card. We do not hold your funds and we do not hold your payment credentials in any form, whether encrypted or otherwise. Stripe’s privacy policy governs the handling of payment data.

5. Information Sharing

We share information only in the following circumstances:

Between transaction parties: Buyer and supplier names and order details are shared to facilitate transactions.
Payment processing: Transaction details are shared with Stripe as required for payment processing.
Legal requirements: We may disclose information when required by law, including in response to food safety investigations or court orders.
Service providers: We share information with the providers who host our Platform, deliver our email and provide our support tools, in each case only so far as they need it to provide that service to us.
Recalls and food safety: We share the information necessary to identify affected products and notify affected buyers, as described in the Food Safety and Recall Policy.

6. Overseas Disclosure

The Protein Link Platform and the database that supports it are hosted in Australia.

We disclose personal information to recipients located outside Australia. Stripe, our payment provider, stores and processes information in the United States of America and in the other countries in which Stripe operates. We also disclose personal information to Resend, which delivers our transactional email, and to Cloudflare, which provides the CAPTCHA protection on our public forms.

Before we disclose personal information to an overseas recipient we take steps that are reasonable in the circumstances to ensure that the recipient does not breach the Australian Privacy Principles. Under section 16C of the Privacy Act we remain accountable for the handling of that information by an overseas recipient to whom we disclose it.

7. Data Security

We implement reasonable security measures including encrypted connections (HTTPS), hashed passwords, role-based access controls, and structured audit logging. We do not store secrets, full cookies, authentication headers, or uploaded file contents in legal or audit metadata. We take steps that are reasonable in the circumstances, including technical and organisational measures, to protect personal information from misuse, interference and loss, and from unauthorised access, modification or disclosure.

8. Data Breaches

If we suspect that a data breach has occurred which is likely to result in serious harm, we will assess it as quickly as reasonably possible and in any event within 30 days. If we confirm an eligible data breach, we will notify the Office of the Australian Information Commissioner and the individuals at risk of serious harm as soon as practicable, and we will tell you what happened, what information was involved and what you should do in response.

9. Data Retention

Account data is retained for the duration of your account and for a reasonable period thereafter to comply with legal and regulatory obligations. Transaction records are retained for a minimum of seven years as required by Australian tax law. Legal acceptance records are kept in a form that cannot be altered, and are retained for seven years after your account is closed. We keep traceability records for seven years, which matches the period in the Food Safety and Recall Policy. When personal information is no longer needed for any purpose for which it may be used or disclosed, and we are not required by law to keep it, we destroy it or de-identify it.

10. Your Rights

You may request access to, correction of, or deletion of your personal information by contacting us. Deletion requests are subject to our legal retention obligations. We will respond to requests within 20 business days. We do not charge you for making a request. If we refuse a request for access or correction, or a request to give access in a particular way, we will tell you in writing why we have refused it and how you may complain. If we correct information we have already disclosed to another entity, we will tell that entity as well if you ask us to, unless that is impracticable or unlawful.

11. Complaints and How to Contact Us

If you have a question about this Policy, or you wish to access or correct your personal information, contact our Privacy Officer at admin@proteinlink.com.au.

If you are not satisfied with how we have handled your personal information, please tell us. We will acknowledge your complaint promptly and respond within 20 business days. If you remain dissatisfied you may complain to the Office of the Australian Information Commissioner at oaic.gov.au or on 1300 363 992.

12. Australian Privacy Act

This Policy is drafted in accordance with the Australian Privacy Principles (APPs) under the Privacy Act 1988 (Cth). If you have a complaint about our handling of your personal information, you may contact us or lodge a complaint with the Office of the Australian Information Commissioner (OAIC).

13. Changes to This Policy

We may update this Policy from time to time. Material changes will be notified via email to registered users. The latest version is always available at this page. We will notify you before a material change takes effect and we will keep earlier versions available on request.

14. Governing Law

This Policy is governed by the laws of New South Wales. Each party submits to the exclusive jurisdiction of the courts of New South Wales and of any court that may hear appeals from them.