Privacy Policy

Jiancha Australia Pty Ltd · ABN 34 684 173 304 · ACN 684 173 304
22 Clare Crescent, Russell Lea NSW 2046, Australia
Email: Info.aus@jianchatea.com

Version 2.0 · Effective 27 August 2026 · Last updated 27 August 2026

In short

This summary is here to help you find things quickly. It is not a substitute for the full policy below.

Contents

1. Introduction
2. Who and what this policy covers
3. Dealing with us anonymously or by pseudonym
4. What personal information we collect and why
5. Sensitive information
6. Payment information
7. Information collected automatically
8. Cookies and tracking technologies
9. How we use and disclose your information
10. Direct marketing and your choices
11. Automated processing and personalisation
12. Overseas disclosure
13. How your personal information is held and secured
14. How long we keep your information
15. Access, correction, update and deletion
16. Data breach notification
17. Children and young people
18. Third-party sites and services
19. Complaints and how to contact us
20. Changes to this Privacy Policy
21. Governing law

1. Introduction

Jiancha Australia Pty Ltd (ABN 34 684 173 304, ACN 684 173 304) (Jiancha, we, us, our) respects your privacy. We are committed to handling personal information in accordance with the Privacy Act 1988 (Cth) (Privacy Act) and the Australian Privacy Principles (APPs).

This Privacy Policy explains what personal information we collect, why we collect it, how we use and disclose it, how we protect it, how long we keep it, and the rights and choices available to you.

In this Privacy Policy, personal information has the meaning given in the Privacy Act: information or an opinion about an identified individual, or an individual who is reasonably identifiable, whether the information is true or not and whether recorded in a material form or not.

2. Who and what this policy covers

This Privacy Policy applies to Jiancha Australia Pty Ltd and its related entities operating in Australia, and covers our dealings with you through:

• our stores in Australia, including in-store and self-service ordering;
• our website;
• the Jiancha loyalty program and our customer relationship management (CRM) system;
• our mobile application;
• our wholesale and stockist relationships; and
• any other way you interact with us, including by email, phone or social media.

We operate the loyalty program and the app using a third-party platform provider. Jiancha Australia Pty Ltd remains responsible under the Privacy Act for the personal information handled through those systems on our behalf.

Jiancha is part of a wider group with businesses outside Australia. This policy covers only Jiancha Australia Pty Ltd. Other companies in the group are separate legal entities, operate under the laws of their own countries, and are not covered by this policy.

3. Dealing with us anonymously or by pseudonym

Where it is lawful and practicable to do so, you have the option of not identifying yourself, or of using a pseudonym, when dealing with us.

You can browse our website and buy from our stores without telling us who you are. Joining the loyalty program is optional — you never have to join in order to buy from us.

Some dealings cannot work anonymously. To deliver an order, administer a loyalty account, process a refund, or respond to an enquiry, we need at minimum your name and either your email address or your mobile number. Where identification is required, we will tell you at the point of collection.

4. What personal information we collect and why

We only collect and hold personal information that is reasonably necessary for the proper performance of our functions and activities.

Optional information. You may choose to give us your date of birth or birth month, your suburb or postcode, and your drink and product preferences. We use date of birth or birth month only to send you a birthday offer, and preferences only to make the offers and content you receive more relevant. Providing optional information is never a condition of buying from us or of holding a loyalty account.

The minimum for loyalty membership is your name and either an email address or a mobile number. Everything else is optional.

Information from other sources. Where we collect personal information about you from someone other than you — for example, from a delivery partner, or from a retailer through which you bought our products — we will take reasonable steps to notify you of that collection, unless an exception under the Privacy Act applies.

If you choose not to provide the personal information we request, we may not be able to supply you with some or all of our products and services.

5. Sensitive information

We do not seek to collect sensitive information as defined in the Privacy Act — such as health information, racial or ethnic origin, political opinions, religious beliefs, sexual orientation or criminal record.

You may, however, choose to tell us about an allergy, intolerance or dietary requirement — for example in an order note, a product enquiry, or a wholesale discussion. Information of that kind is health information and is treated as sensitive information under the Privacy Act. Where you provide it, we:

• collect it only with your consent, which you give by choosing to provide it to us;
• use it only for the purpose you gave it to us — to answer your question, to fulfil your order correctly, or to advise you about our products;
• do not use it for marketing, profiling or segmentation; and
• limit access to it to those of our people who need it for that purpose.

Please do not send us sensitive information that we have not asked for and that you do not need us to have.

6. Payment information

When you make a payment to us, your card details are captured and processed by third-party payment providers, not by us. Jiancha does not store your full card number, expiry date or card security code (CVV) on its systems.

Our payment providers are certified under the Payment Card Industry Data Security Standard (PCI DSS) and handle your card data under their own privacy policies.

We receive and may retain only what we need to identify a transaction, issue a receipt, process a refund, and respond to a payment dispute or suspected fraud: a payment reference, the amount and date, the card type, and the last four digits of the card.

If you would like to know which payment providers we currently use, please contact us using the details in section 19.

7. Information collected automatically

When you visit our website or use our app, certain technical information is collected automatically. This includes your IP address, browser type and version, device and operating system information, app version, the date and time of your visit, the pages or screens you viewed, and the website you came from.

Some of this information — including your IP address — may be personal information under the Privacy Act, either on its own or when combined with other information we hold. We treat it accordingly.

We use this information to operate and secure our website and app, to detect and prevent fraud and misuse, to diagnose technical problems, and to improve how our services work.

Device permissions. Our app accesses features of your device — such as notifications, the camera, or location — only where you grant permission on your device. You can withdraw any of those permissions at any time in your device settings, though some features of the app may then not work. The categories of data our app collects are also declared in our listings on the Apple App Store and Google Play; we keep those declarations and this policy consistent with each other.

We do not use automatically collected information to try to identify you personally, unless we are required to do so by law or it is necessary to investigate suspected fraud or unlawful activity.

8. Cookies and tracking technologies

We use cookies and similar technologies on our website. A cookie is a small file placed on your device that allows a website to recognise that device on return visits.

Third-party services

We use third-party analytics and advertising services, which set their own cookies and identifiers and collect information about your visit for traffic, audience-measurement and re-marketing purposes. Where we use Google or Meta (Facebook and Instagram) services, you can read how those companies handle information, and control what they show you, here:

• Google — policies.google.com/privacy; ad settings at myadcenter.google.com
• Meta — facebook.com/privacy/policy

We will only combine your personal information with information collected by these services where you have expressly agreed to that.

Managing cookies

You can block or delete cookies through your browser settings, and most browsers let you refuse third-party cookies while keeping the ones our site needs to function. Turning off cookies may affect how parts of our website work for you.

If you would like to know what information we hold about your visits, or ask us to stop using analytics or advertising cookies in connection with you, contact us using the details in section 19.

9. How we use and disclose your information

We use your personal information for the purpose for which it was collected, for related purposes you would reasonably expect, and for any other purpose you have agreed to. In practice that means to supply our products and services, to operate the loyalty program, to process and communicate with you about your orders, to respond to enquiries and complaints, to meet our legal obligations, and — only where you have opted in — to send you marketing.

We may disclose your personal information to:

• the platform provider that operates our loyalty program, CRM and app on our behalf;
• delivery, freight and logistics providers, so that your order can be shipped to you;
• payment providers and financial institutions, so that your payment can be processed;
• other service providers who perform functions on our behalf — including website hosting and e-commerce platforms, data storage, email and SMS messaging, analytics, marketing, warehousing, and customer support;
• our professional advisers, including lawyers, accountants and auditors;
• a purchaser or prospective purchaser, in connection with an actual or proposed sale, merger or restructure of our business;
• any person, where necessary to prevent, detect or investigate actual or suspected fraud, misuse or unlawful activity;
• any person, where necessary to enforce our legal rights or those of others, or to protect the safety of any person; and
• a court, tribunal, regulator or government authority, where we are required or authorised to do so by law.

When we disclose personal information to a service provider, we take reasonable steps — including through our contracts with them — to require that it is handled consistently with the Australian Privacy Principles, used only for the purpose for which it was disclosed, and not used for that provider's own purposes.

We do not sell your personal information.

10. Direct marketing and your choices

We will only send you direct marketing — by email, SMS or push notification — where you have expressly opted in to receive it.

Joining the loyalty program, buying from us, or downloading our app does not by itself sign you up to marketing. Marketing consent is asked for separately, and you can give it or withhold it without affecting your membership or your ability to buy from us.

In accordance with the Spam Act 2003 (Cth) and APP 7:

• every marketing message we send will clearly identify Jiancha as the sender and include a functional way to unsubscribe;
• you may opt out at any time by using the unsubscribe link in any marketing email, replying STOP to any SMS, turning off notifications in your app or device settings, or emailing Info.aus@jianchatea.com;
• we will action your opt-out within 5 business days, at no cost to you.

Opting out of marketing will not stop us sending you messages we need to send to supply what you have bought or to administer your account — for example order confirmations, shipping notifications, receipts, points and reward statements, product safety or recall notices, security notices, and changes to our terms.

You may also ask us where we obtained personal information we have used to market to you, and we will tell you within a reasonable period unless it is impracticable or unreasonable to do so.

11. Automated processing and personalisation

Our CRM and loyalty systems use automated processes to analyse your purchase history and preferences in order to group members and personalise the offers, rewards and content you receive.

These automated processes:

• are used only for marketing personalisation and loyalty benefits;
• do not use sensitive information (see section 5);
• are not used to make decisions that deny you access to our products or services, refuse you credit, or otherwise affect your legal rights; and
• can be limited by opting out of marketing (section 10), or by asking us to stop profiling you, using the contact details in section 19.

If we ever introduce a computer program that uses personal information to make, or to substantially and directly assist in making, a decision that could reasonably be expected to significantly affect your rights or interests, we will update this policy to describe those decisions and the kinds of personal information used, as required under APP 1.7.

12. Overseas disclosure

Some of the service providers we rely on — including our loyalty and CRM platform, website hosting, e-commerce, email and SMS, analytics and advertising providers — store or process information outside Australia. This means your personal information may be disclosed to, or accessible from, recipients located overseas, including in the United States.

The countries involved depend on which providers we use at the time. A current list of the countries in which your personal information may be stored or accessed is available free of charge on request from our Privacy Officer, using the details in section 19.

Before disclosing personal information to an overseas recipient, we take reasonable steps to ensure that the recipient does not breach the Australian Privacy Principles in relation to that information, including by relying on the contractual protections in our agreements with those providers.

We remain accountable under the Privacy Act for personal information we disclose to overseas recipients, except where an exception under APP 8 applies.

13. How your personal information is held and secured

We take reasonable steps to protect the personal information we hold from misuse, interference and loss, and from unauthorised access, modification or disclosure. Those steps include:

• using established third-party hosting, loyalty platform, e-commerce and payment providers rather than handling sensitive parts of the process ourselves;
• protecting information sent between your device and our services using encryption in transit (TLS), and requiring encryption at rest from the providers that hold it for us;
• limiting access to personal information to those of our people who need it to do their job, and reviewing who holds that access;
• requiring multi-factor authentication on staff access to systems that hold customer information;
• requiring our people to keep personal information confidential, and training them on their privacy obligations;
• assessing the privacy and security practices of our service providers before we engage them; and
• destroying or de-identifying personal information when we no longer need it and are not required to keep it.

No method of transmission or storage is completely secure. While we take our obligations seriously, we cannot guarantee absolute security, and you provide information to us at your own risk. You are responsible for keeping any account password or verification code confidential and for telling us promptly if you believe your account has been accessed without your authorisation.

14. How long we keep your information

We keep personal information only for as long as we need it for the purposes described in this Privacy Policy, or for as long as the law requires us to keep it. When it is no longer needed and we are not required to retain it, we destroy it or de-identify it.

In practice:

• Records of your purchases and payments are kept for at least seven years from the date of the transaction, because Australian tax and corporations legislation requires it.
• Loyalty account and profile information is kept while your account is open. If your account has had no purchase, redemption or sign-in activity for three years, we will delete or de-identify it. We will contact you before we do so, using the email address or mobile number on your account.
• Account information after closure is kept for a reasonable period after you close your account, so that we can resolve anything outstanding, and is then deleted or de-identified.
• Wholesale and stockist account records are kept for the life of the trading relationship and then for the period required by those same record-keeping obligations.
• Correspondence and support records are kept for as long as needed to handle your enquiry and any follow-up, and to improve our service.
• Records of your marketing opt-out are kept indefinitely, so that we can keep honouring your choice.
• Website and app logs and analytics information are kept for as long as needed for security, troubleshooting and audience measurement, and are then deleted or de-identified.

15. Access, correction, update and deletion

You have the following rights in relation to the personal information we hold about you. There is no charge for making a request.

Access

You may ask for access to the personal information we hold about you. We will respond within 30 days. In limited circumstances the Privacy Act allows us to refuse access — for example where giving access would have an unreasonable impact on the privacy of others, would prejudice an investigation of unlawful activity, or would reveal commercially sensitive information. If we refuse, we will tell you why in writing and explain how you can complain about that decision.

Correction and update

If the information we hold about you is inaccurate, out of date, incomplete, irrelevant or misleading, you may ask us to correct it. If you have a loyalty account, you can update many of your details yourself in the app or through your account settings. If we decide not to make a correction, we will tell you why in writing, and you may ask us to attach a statement to the record noting that you consider it inaccurate.

Deletion and closing your account

You may ask us to delete the personal information we hold about you and to close your loyalty account. You can make that request in the app, or by contacting our Privacy Officer using the details in section 19.

We will action deletion requests within 30 days. Closing your account will forfeit any unredeemed points or rewards. We must keep some information even after a deletion request:

• purchase and payment records we are legally required to retain (see section 14);
• information needed to establish, exercise or defend a legal claim; and
• a record of your marketing opt-out, so that we can continue to honour it.

Where we cannot delete information, we will restrict its use to the purpose that requires us to keep it, and delete or de-identify it once that purpose ends.

Verifying your identity

To protect your privacy and the privacy of others, we need reasonable evidence of your identity before we act on an access, correction or deletion request. We will only ask for what we need to confirm who you are, and we will not keep identity evidence for longer than we need it for that purpose.

How to make a request

Contact our Privacy Officer using the details in section 19.

16. Data breach notification

We maintain a data breach response plan. If we become aware of a data breach involving personal information we hold, we will act promptly to contain it and to assess whether it is likely to result in serious harm to anyone affected.

Where a breach is likely to result in serious harm and we cannot prevent that harm through remedial action, we will notify the affected individuals and the Office of the Australian Information Commissioner (OAIC), consistent with the Notifiable Data Breaches scheme in Part IIIC of the Privacy Act. Our notification will describe what happened, what information was involved, and what we recommend you do in response.

Where a breach affects information held by one of our service providers, we will work with that provider so that affected individuals are told what has happened and what they can do about it.

17. Children and young people

Our loyalty program, our app and our marketing communications are intended for individuals aged 18 years and over. We do not knowingly collect personal information from a person under 18 for loyalty or marketing purposes.

If you are under 18, please do not sign up to the loyalty program or to our marketing without the consent of a parent or guardian.

If you are a parent or guardian and you believe we hold personal information about your child that was provided without your consent, please contact our Privacy Officer and we will take reasonable steps to delete it. If we become aware ourselves that we have collected personal information from a person under 18 without appropriate consent, we will delete it.

We are monitoring the development of the Children's Online Privacy Code and will comply with its requirements once it is registered and in force.

18. Third-party sites and services

Our website, our app and our social media pages may link to, or work alongside, third-party websites and services that we do not control — including retailers and marketplaces that sell our products, payment providers, delivery providers, app stores, and social media platforms.

This Privacy Policy does not apply to those third parties. We are not responsible for how they handle your information, and we encourage you to read their privacy policies before giving them personal information.

19. Complaints and how to contact us

If you have a question about this Privacy Policy, want to make an access, correction or deletion request, want the current list of our service providers or the countries where your information may be held, or wish to complain about how we have handled your personal information, please contact our Privacy Officer.

Email: Info.aus@jianchatea.com

Post:
The Privacy Officer
Jiancha Australia Pty Ltd
22 Clare Crescent
Russell Lea NSW 2046
Australia

We will acknowledge your complaint promptly and aim to respond within 30 days. If it will take us longer to resolve, we will tell you and give you a date by which we expect to respond. We will tell you the outcome of our investigation, and our reasons, in writing.

If you are not satisfied with our response

If you are not satisfied with how we have handled your complaint, you may refer it to the Office of the Australian Information Commissioner:

Website: www.oaic.gov.au

Phone: 1300 363 992

Post:
Office of the Australian Information Commissioner
GPO Box 5218
Sydney NSW 2001

20. Changes to this Privacy Policy

We may update this Privacy Policy from time to time to reflect changes to our practices, our products and services, or the law. The current version, with its version number and effective date, is always published on this page and available in our app.

Where a change is material — for example, if we begin using your personal information for a substantially different purpose, or begin disclosing it to a new category of recipient — we will take reasonable steps to tell you in advance by email or by in-app notice, and where the law requires it, we will ask for your consent.

Minor changes take effect when published. If you continue to use our website or app, or buy from us, after a change takes effect, that indicates your acceptance of the updated Privacy Policy.

Previous versions are available on request from our Privacy Officer.

21. Governing law

This Privacy Policy is governed by the laws of New South Wales, Australia. You and we submit to the non-exclusive jurisdiction of the courts of that State and the courts competent to hear appeals from them.

Jiancha Australia Pty Ltd · ABN 34 684 173 304 · ACN 684 173 304
22 Clare Crescent, Russell Lea NSW 2046, Australia
Version 2.0 · Effective 27 August 2026 · Last updated 27 August 2026