Privacy Policy

Milk Department Pty Ltd (ABN 80 633 414 007) ("we", "us", "our", "The Milk Department") is committed to protecting your privacy and handling your personal information in accordance with the Privacy Act 1988 (Cth), the Australian Privacy Principles (APPs), and the Privacy Act 2020 (NZ) where applicable.

This Privacy Policy describes how The Milk Department collects and uses the information that you provide. We consider the security of your information to be extremely important and will happily disclose exactly what we do with it.

In particular, this policy relates to the personal information you submit when engaging with The Milk Department and our partners, along with the data related to our interactions with you, and the data related to any milk supplied through our services — including through the MilkMetrix platform ("Platform").

There are a number of types of information that we collect from you, depending on the nature of your relationship with us:

• Account Data: Full name, email address, organisation role, profile photograph (if provided), and authentication method used (e.g., Google, Microsoft, or magic link).
• Operational Data: Supply chain data synchronised from Salesforce, including pricing, volume schedules, supplier information, milk collection volumes and test results, and other business data which may contain business contact information.
• Payment Data: Bank details and payment information used to process payments for milk supplied through our services.
• Usage Data: Server logs, IP addresses, browser type and version, device information, pages visited, and timestamps — used for security monitoring, performance optimisation, and audit trailing.
• Cookies: We use cookies to understand how users browse our site and to allow efficient navigation. We do not use cookies for advertising or third-party tracking purposes.

We will not sell your information to any third parties or advertisers. Data is shared across our supply chain as required in order to contract with farmers, collect and test milk, and pay for that milk. We share data with:

• Farmers: Farm-specific operational and payment data as part of the supply relationship.
• Logistics Partners: Information required for milk collection and transport.
• Milk Testing Partners: Sample and quality data for laboratory testing.
• Milk Buyers: Supply and quality data to fulfil commercial requirements.
• Dairy Industry Bodies: To pay farmer levies and contribute total volume data (not distinguishable by farm) to Dairy Australia.
• Infrastructure Providers: Our hosting and authentication providers (Supabase, Vercel) who process data on our behalf under strict data processing agreements.
• Organisation Administrators: Administrators within your organisation may view your account information (name, email, role, last login) as part of team management.
• Legal Requirements: Law enforcement or regulatory authorities only where required by a valid warrant, subpoena, or court order.

Data is shared via email and via providing access for our partners to our systems. All access and transmission of data is governed by our internal security policy.

We store your data across our IT systems to enable us to deliver our services both to you and to our partners. All of The Milk Department's core business systems are cloud-based and managed by the company provisioning the service.

All data is hosted exclusively within Australia on secure cloud infrastructure. Your data does not leave Australian jurisdiction. Our infrastructure providers maintain SOC 2 and ISO 27001 compliance, and data is encrypted both in transit (TLS 1.2+) and at rest (AES-256).

We ensure your data is kept secure at all times and ensure our partners test the security of the systems to protect your data against unwanted access.

We retain personal data only as long as necessary to provide the Service, fulfil the purposes outlined in this policy, or as required by law.

• Active accounts: Data is retained for the duration of your account.
• After termination: Customer Data is available for export for thirty (30) days, then deleted or anonymised within ninety (90) days.
• Audit logs: Security and access logs may be retained for up to two (2) years for compliance purposes.

In the event of a data breach that is likely to result in serious harm to affected individuals, we will:

• Notify the Office of the Australian Information Commissioner (OAIC) as required under the Notifiable Data Breaches (NDB) scheme.
• Notify affected individuals as soon as practicable with details of the breach, the type of information involved, and recommended steps to mitigate potential harm.
• Take immediate steps to contain the breach and prevent further unauthorised access.

Under the Australian Privacy Principles, you have the right to:

• Access the personal information we hold about you.
• Correct any inaccurate or incomplete personal information.
• Request deletion of your personal information — we will remove any data we are not required to maintain by law or regulation, or in order to provide services for which a contract is in place.
• Withdraw consent where processing is based on consent, without affecting the lawfulness of prior processing.
• Export your data in a commonly used, machine-readable format.
• Choose whether or not to provide your data to The Milk Department. As a farm representative, you can choose whether to register interest and subsequently contract with our partners.

To exercise any of these rights, contact us at the details below. We will respond to your request within 48 business hours.

If you believe we have breached your privacy or mishandled your personal information:

1. Contact us at the email address below. We will acknowledge your complaint within seven (7) days and provide a substantive response within thirty (30) days.
2. If unsatisfied, you may lodge a complaint with the Office of the Australian Information Commissioner (OAIC) or the NZ Privacy Commissioner.

If you have questions about this Privacy Policy or wish to exercise your data rights, please contact us:

• Email: data@milkdepartment.com.au
• Phone: 1300 995 141
• Entity: Milk Department Pty Ltd (ABN 80 633 414 007)
• Jurisdiction: Victoria, Australia

We will respond within 48 business hours.