Privacy Policy

1. About this policy

McClay Industries Pty Ltd ("we", "us", "our") operates the website at mcclay.au (the "Service"). We are based in Queensland, Australia, and we are committed to protecting your privacy.

This policy explains how we collect, hold, use, disclose and protect your personal information. It is designed to comply with the Privacy Act 1988 (Cth) and the 13 Australian Privacy Principles (APPs), which are the federal privacy laws that apply to our business in Queensland and across Australia. Where the Service is distributed through the Google Play Store, this policy is also intended to meet Google Play's User Data and Data Safety requirements.

By using the Service, you agree to the collection and use of your information in accordance with this policy.

2. Who we are and how to contact us

If you have any questions about this policy, want to access or correct your information, or wish to make a privacy complaint, you can reach us at:

• Entity: McClay Industries Pty Ltd
• ABN: 87 161 725 113
• Email: info@mcclay.au
• Postal address: 15 Kitney Close, Tanawha QLD 4556, Australia

We are the entity responsible for the personal information we collect and hold.

3. What personal information we collect

We collect the following types of personal information. (This list reflects what the Service actually does; categories not listed are not collected.)

We do not operate user accounts, store passwords, collect profile data, or use any third-party social login. We do not collect sensitive information (such as health, racial, religious or biometric data), and we do not collect precise device location, contacts or similar data.

4. How we collect your information

• Directly from you — when you make an enquiry, make a payment, submit a project, or otherwise contact us.
• Automatically — through your use of the Service, including device and usage data collected via our own first-party page tracking (which stores a random session identifier in your browser's local storage), server logs, and IP-based location lookups.
• From third parties — our payment processor (Stripe) confirms the outcome of your transaction to us. Other than this, we do not collect personal information about you from third parties, and we do not use third-party social or single sign-on logins.

Where it is lawful and practicable, you have the option of dealing with us anonymously or using a pseudonym. However, for most features of the Service we need to identify you in order to provide the Service to you.

5. How we use your information

We use your personal information to:

• provide, maintain and improve the Service;
• respond to your enquiries and provide support;
• process payments and fulfil your orders, including sending receipts and handling refunds;
• review and respond to project submissions you send us;
• send you service-related communications (such as order and enquiry confirmations);
• send you marketing communications only where you have consented, with an option to opt out (see section 9);
• keep the Service secure and detect, prevent and respond to fraud, abuse and technical issues; and
• comply with our legal obligations.

We only use your information for the purposes for which it was collected, for a directly related purpose you would reasonably expect, or where you have consented.

6. Disclosure to third parties

We do not sell your personal information. We disclose personal information only to the third parties we rely on to run the Service, and only to the extent needed. These include:

• Stripe, Inc. — to process payments securely.
• Replit, Inc. — to host the Service and store data in our PostgreSQL database.
• ZeptoMail (Zoho Corporation) — to send transactional emails such as enquiry confirmations, order confirmations and project notifications.
• ip-api.com — to convert your IP address into an approximate location (country and city) for our analytics.

We may also disclose personal information where required or authorised by law, to enforce our terms, or to protect the rights, property or safety of our users, the public or us.

7. Overseas disclosure

Some of the third-party services we use store and process personal information outside Australia. This means your personal information may be disclosed to, and held by, recipients located overseas.

Based on the services we currently use, your personal information may be handled in:

• United States — Stripe (payment processing), Replit (hosting and database), and ZeptoMail / Zoho Corporation (email delivery).
• Germany — ip-api.com (IP-based location lookups).

Before disclosing personal information overseas, we take reasonable steps to ensure that overseas recipients handle your information in a way consistent with the Australian Privacy Principles.

8. Payment handling

Payments are processed by Stripe, Inc. When you make a payment, your card details are collected and processed directly by Stripe under their own security standards and privacy policy — we do not see or store your full card number on our servers. We retain limited records of transactions (such as amount, date and a payment reference) to manage your order, provide receipts, handle refunds and meet our record-keeping obligations.

You can review Stripe's privacy practices at https://stripe.com/au/privacy.

9. Direct marketing and your opt-out rights

At present we send only service and transactional emails — such as enquiry confirmations, order confirmations and project submission notifications. We do not currently operate a newsletter, mailing list or marketing email program.

If in the future we send marketing communications, we will do so only where you have consented, and every marketing email will include an unsubscribe link. You will also be able to opt out at any time by contacting us at info@mcclay.au, and we will action your request promptly.

Opting out of marketing does not stop essential service messages (such as order or enquiry confirmations), which we may still need to send you.

10. Cookies and tracking

We use essential local storage in your browser to keep a random session identifier (used to group your page views for our own analytics) and to remember your shopping cart. Our staff admin area uses a session cookie for login.

We use first-party analytics (built into the Service) to understand how the Service is used. We do not use third-party advertising or analytics cookies such as Google Analytics. The web fonts used by the Service are served from our own servers, so displaying the site does not send your data to any third-party font provider.

You can control or delete cookies and local storage through your browser or device settings. Disabling essential storage may stop parts of the Service from working.

11. How we hold and secure your information

We take reasonable technical and organisational steps to protect your personal information from misuse, interference, loss, and unauthorised access, modification or disclosure. These steps include encryption in transit (HTTPS), access controls, reputable cloud infrastructure (Replit), and using a PCI-DSS-compliant payment processor (Stripe) so that card data is handled by Stripe rather than us.

No method of transmission or storage is completely secure, and we cannot guarantee absolute security. If we no longer need your personal information and are not required by law to keep it, we will take reasonable steps to destroy it or de-identify it.

12. Data retention

We keep your personal information only for as long as we need it for the purposes described in this policy, or for as long as the law requires. In general:

• Contact and enquiry data is deleted or de-identified 24 months after we receive your enquiry.
• Project submissions and any uploaded files are deleted or de-identified 24 months after you submit them, and uploaded files are removed from our storage at the same time.
• Order and transaction records (orders and payment references) are kept for 7 years, as required by Australian tax and financial record-keeping laws.
• Usage and analytics data (including approximate location) is deleted or de-identified after 14 months.

Clean-up is performed manually by our staff for records that have passed these retention periods. There is no automated deletion schedule; records remain stored until staff run the clean-up.

13. Accessing, correcting and deleting your information

You have the right to:

• Access the personal information we hold about you;
• Correct information that is inaccurate, out of date, incomplete or misleading; and
• Request deletion of your personal information.

As we do not operate user accounts, you can exercise these rights by contacting us at info@mcclay.au. We will respond within a reasonable time. There is normally no charge to access your information, though we may charge a reasonable cost for some access requests, and we will tell you in advance if so. If we refuse access or correction, we will explain why and how you can complain.

14. Data breach notification

We have processes in place to detect, assess and respond to data breaches. If a data breach occurs that is likely to result in serious harm to any individual whose information is involved, we will comply with the Notifiable Data Breaches scheme under the Privacy Act 1988 (Cth): we will notify the affected individuals and the Office of the Australian Information Commissioner (OAIC) as soon as practicable, and tell you what happened and what steps you can take.

15. Automated decision-making

We do not use computer programs to make automated decisions that could significantly affect your rights or interests.

16. Children's privacy

The Service is a business-to-business resource for the construction industry and is not intended for or directed at children under 18. We do not knowingly collect personal information from children without appropriate consent. If you believe a child has provided us with personal information, please contact us and we will take reasonable steps to delete it.

17. Complaints

If you believe we have breached the Australian Privacy Principles or mishandled your personal information, please contact us first at info@mcclay.au so we can try to resolve it. We will acknowledge your complaint and respond within a reasonable time.

If you are not satisfied with our response, you can escalate your complaint to the Office of the Australian Information Commissioner (OAIC):

• Website: www.oaic.gov.au
• Phone: 1300 363 992

18. Changes to this policy

We may update this policy from time to time to reflect changes in our practices, the Service or the law. When we do, we will change the "Last updated" date at the top of this page, and where the changes are significant we will take reasonable steps to notify you. We encourage you to review this policy periodically. Your continued use of the Service after an update means you accept the revised policy.