Privacy policy

Who we are

parteepea.com is operated by TBC (ABN TBC). In this policy, “we” and “us” mean that business. You can contact us about anything in this policy at hello@parteepea.com.

We handle personal information in accordance with the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs).

What we collect

We collect only what we need to run the network and to keep an accurate record of what is owed:

• Account details. Your email address and name, plus an optional profile image, when you create an account.
• Consultant details. If you join as a consultant: your first and last name, your verified email, your country, the referral code we assign to you, and the member who introduced you. Your public name in the network is your first and last name. If an account was set up for you in advance, we hold the email address it was reserved for until you claim it.
• Contact and postal details. The phone number you give when you join, and — if you add them on My details — the postal address you want anything sent to.
• Commission payment details. If you give us an account to be paid into: the account name, the bank or institution, the branch or routing code, and the account number. See “How we protect your payment details” below — these are held encrypted, not in the clear.
• Order details. The buyer’s name and email address, what was ordered, the amount, and the referral link that attributed the sale. You can enter a different name or email at checkout from the one on your account, for example when buying on someone else’s behalf.
• Earnings records. The commission lines generated by sales, and payment status.

We do not collect or store card numbers. No card data ever reaches our database, and we do not ask for it. Bank account details are collected only to pay your commission, and are held encrypted — never in plain text.

How we protect your payment details

If you give us a bank account for commission, the account number, account name, bank and branch code are encrypted with AES-256-GCM before they are written to the database. The encryption key is held separately from the database, in the server’s secret configuration — so a copy of the database on its own does not reveal an account number, and tampering with a stored value makes it fail to decrypt rather than silently become a different account.

We keep the last three digits unencrypted so you can recognise the account you entered. Three digits are not enough to move money. Your account number is never displayed back to you in full, and is never sent to your team, your sponsor, or anyone else in the network.

You can remove your payment details at any time from My details, which deletes them. Once we connect a payment provider, that provider will collect these details directly and we will stop holding account numbers ourselves.

Why we collect it

• to create and administer your account, and to let you sign in;
• to attribute sales correctly and calculate commission, including working out which consultant is owed what;
• to prevent commission being paid on a consultant’s own or household’s purchase, which requires comparing buyer and consultant identities;
• to record the one-time joining fee and whether it was paid, waived or is still owed;
• to keep the financial records we are obliged to keep; and
• to respond to you when you contact us.

Cookies

We set one cookie of our own: a referral cookie that records which consultant’s link you arrived through, so a later sale can be credited to them. It lasts 30 days, is first-party, and is not used for advertising or tracking you across other sites. We do not run advertising or analytics cookies.

Signing in uses Clerk, our authentication provider. Clerk sets the cookies it needs to keep you signed in, as described in its own privacy policy.

Who we share it with

• Clerk — our authentication provider, which handles sign-in and stores your account credentials. Clerk processes data on servers outside Australia, so using this site involves an overseas transfer of your account details.
• The operator, by email. When you join, a copy of the details on the new-member screen — name, email, mobile, country, member number, and who sponsored you — is sent to join@parteepea.com so the account can be administered. That message does not include your password or any payment details. We do not store card or bank details.
• Our hosting provider — the server this site and its database run on.
• Consultants, in a limited way. If you buy through a consultant’s link, that consultant can see the order and what it paid them, because that is the record of what they are owed. Sponsor consultants upstream of a sale can see the commission generated by sales in their line.
• Third-party products. If a product is supplied by a different business and a sale of it generates commission, the supplier must have given us written permission for that. We do not sell personal information.

We may also disclose personal information where the law requires it, or to take advice from professional advisers.

How long we keep it

Financial records — orders and commission lines — are kept because they are the evidence of what is owed to whom. When an account is deleted, we unlink the identity from the financial record rather than deleting the record: names and contact details go, and the amounts and the history remain, so past payouts stay auditable. This is a deliberate design choice, not an oversight. Commission rows themselves can never be edited or deleted; a reversal is recorded as a new row against the original.

Deleting an account also erases your phone number, your postal address and your commission payment details — including the encrypted account number and the last three digits — from the consultant record. What remains is an identifier with no personal information attached, so the financial history stays auditable without holding anything that points at you.

The one-time joining fee is recorded as charged, and separately marked as either received or waived.

Copies kept outside our systems

We take backups of the database so that records can be recovered. Those backups include personal information. A backup may be downloaded by an authorised operator and kept at another location, so that a failure of this server does not destroy the only copy of the records. Every such download is logged.

Backups kept outside this server contain the same personal information as the database. We take reasonable steps to ensure they are stored with protection at least equivalent to this server, and that they are not kept longer than they are needed.

Keeping it secure

Access to personal information is limited to people who need it to operate the business. The database is only reachable from the application server, and traffic to this site is encrypted in transit. No card data is stored, so there is no payment credential on this server to steal.

No system is perfectly secure. If a breach occurs that is likely to result in serious harm, we will notify affected individuals and the Office of the Australian Information Commissioner as required by the Notifiable Data Breaches scheme.

Access, correction and complaints

You can ask us for a copy of the personal information we hold about you, and ask us to correct it if it is wrong. Email hello@parteepea.com and we will respond within a reasonable time.

If you are unhappy with how we have handled your information, contact us first. If we cannot resolve it, you can complain to the Office of the Australian Information Commissioner at oaic.gov.au.

Changes to this policy

If this policy changes, we will update the date at the top. If the change is significant, we will make that clear on the site.