Privacy Policy

1. About us

Amato's Liquor Mart (trading name) operates from Shop 2, 267–277 Norton Street, Leichhardt NSW 2040. We sell alcohol, packaged food, and related products both in-store and online, and we host events throughout the year.

This policy applies to personal information we collect through:

• our event ticketing website at events.amatos.au, where you can reserve seats for our events;
• our online store at amatos.com.au, where you can purchase alcohol, packaged food, and related products for delivery across Australia; and
• any other interactions you have with us, including by telephone, email, or in-store.

Our online store at amatos.com.au is temporarily unavailable while we work to restore it. You can still book event tickets at events.amatos.au.

When we say "we", "us", or "our" in this policy, we mean Amato's Liquor Mart. When we say "you" or "your", we mean any individual whose personal information we collect.

2. What personal information we collect

Event bookings (events.amatos.au)

• guest names and age confirmations (as required by NSW liquor licensing);
• your dietary preferences, where you choose to provide them;
• your contact details for the person making the booking (name, email, and phone number); and
• payment and transaction details: for card payments, processed by Stripe (card numbers are handled entirely by Stripe and never touch our systems); or, where offered, bank transfer details you use and records we hold to reconcile your payment.

Event ticketing and Mailchimp: making a booking on events.amatos.au does not, by itself, add your details to our Mailchimp marketing database or change any marketing preferences. If we ever link bookings to marketing, we will obtain appropriate consent and update this policy before doing so.

Customer mailing list (Mailchimp)

We use Mailchimp (operated by The Rocket Science Group LLC, a subsidiary of Intuit Inc.) to hold our marketing audience and to send promotional and informational emails to customers who have opted in (for example store news, products, and events). Audience members may have joined through our online store at amatos.com.au, in-store or at-event sign-ups, or other channels where we collect explicit consent for marketing. We use Mailchimp only in line with the consent each person gave.

Online store (amatos.com.au)

When you shop with us through our online store, we may collect:

• your name, email address, and phone number;
• your delivery address and postcode;
• age verification confirmation (you must be 18 or older to purchase alcohol);
• your order and purchase history;
• payment information (handled by our payment provider for card payments — card details are not stored by us; or, where offered, bank transfer details and reconciliation records for direct deposit); and
• any other information you provide when you contact us about an order.

Amato's Rewards program

If you join our Amato's Rewards loyalty program (in-store or online), we may also collect:

• your full name, email address, date of birth (to provide birthday specials), and contact details (such as phone number);
• your billing address (for program administration and account integrity);
• your purchase history and product preferences (to personalise your rewards experience and tailor member-only offers); and
• your rewards program activity (points earned, redeemed, and account status).

In-store and other interactions

When you contact us by phone, email, or visit our store, we may collect your name and contact details in order to respond to your enquiry or provide our services.

3. How we collect your information

We collect personal information in the following ways:

• Directly from you — through online forms on our websites, by email, by phone, or in-store (including paper sign-up forms, tablet, QR code, or verbally via staff).
• Through our payment provider (Stripe) — when you pay by card, you are redirected to Stripe's hosted checkout page. Stripe collects your card details directly. We never receive or store your card number - we receive only a payment reference and confirmation status.
• By direct deposit — when you pay by bank transfer using details we provide, we receive information needed to reconcile the payment (such as payer name, reference, and amount) from our bank records; we do not receive card numbers for those payments.
• From a third party acting on your behalf — if someone else makes a booking on your behalf, they may provide your details as part of that booking. This is permitted under APP 3.6 where it is impracticable to collect from each individual directly.

In-store and event sign-ups

When you sign up in-store or at an event, there are two separate opt-ins available to you:

1. Mailing list — to receive invitations, newsletters, and promotions (managed via Mailchimp). We will only add you to our Mailchimp audience with your explicit consent (for example when you sign up in-store, at an event, or through an opt-in on our websites). As noted in Section 2, completing a booking on events.amatos.au alone does not subscribe you to Mailchimp.
2. Amato's Rewards membership — our loyalty program, which involves the collection of additional personal information as described in Section 2.

You can opt into one without the other. Each requires its own consent.

Cookies and tracking

Our websites do not use cookies for tracking or analytics. Booking information is held temporarily in your browser's session storage during the checkout process and is cleared after your order is confirmed.

Our websites load resources from third-party services (such as Google Fonts, Stripe, and our banking partners) which may set their own cookies or collect technical data such as your IP address. Please refer to those providers' privacy policies for details.

4. Why we collect your information

We collect and use personal information for the following purposes:

• Processing and confirming your bookings or orders
• Age verification as required by NSW liquor licensing laws
• Event catering (where dietary preferences are provided)
• Sending booking or order confirmations and operational communications
• Processing payments through our payment provider
• Marketing communications via Mailchimp (only for customers who have opted in)
• Order fulfilment and delivery for our online store
• Administering the Amato's Rewards program, including tracking points, personalising offers based on your purchase history and preferences, and providing birthday specials
• Meeting our legal and licensing obligations

5. Sensitive information

Information that could reveal health-related or religious details (for example, dietary preferences for event catering). Under the Australian Privacy Principles, this is considered sensitive information.

We only collect sensitive information when you provide it voluntarily, and solely for event catering purposes. By providing this information, you consent to its collection for that purpose.

Sensitive information is not used for marketing, shared with our marketing platform, or used for any purpose other than catering for the event you are attending.

6. What happens if you don't provide your information

We give you the option of not identifying yourself where it is lawful and practical.

However, if you don't provide your personal information, we may not be able to give you the service you want. For example:

• We need your contact details and age verification to process and confirm your order. Without these, we cannot complete it.
• We are required by law to verify that attendees are aged 18 or over for events involving alcohol service.
• For event bookings, if you choose not to provide dietary preferences, we may not be able to cater to your specific requirements.
• If you join Amato's Rewards but do not provide your date of birth, we will not be able to send you birthday specials.
• Marketing communications are entirely optional — you will only receive them if you actively opt in.

7. Who we share your information with

We may share your personal information with the following third parties:

We may also share personal information with other service providers who help us operate our business (for example, delivery and logistics partners for our online store, or IT service providers), and where required by law or regulation.

When we share information with third parties, we take reasonable steps to ensure they handle it safely and consistently with Australian privacy laws.

You can find the privacy policies of our third-party service providers here:

• Stripe Privacy Policy
• Mailchimp (Intuit) Privacy Statement
• Google Privacy Policy

8. Overseas transfers

Some of our service providers are based outside Australia. Your personal information may be transferred to and processed in the following countries:

For Stripe and Google, we take reasonable steps to ensure they handle your personal information in accordance with the Australian Privacy Principles.

9. Direct marketing

We only use your personal information for direct marketing when you have given us your explicit opt-in consent. Marketing communications are not pre-selected — you must actively choose to receive them.

Mailchimp and our customer audience

We use Mailchimp to hold our customer marketing list and to send email to customers who have agreed to receive marketing and promotional messages from us (for example products, store news, and events). Booking tickets on events.amatos.au does not, by itself, add you to Mailchimp or sign you up for marketing. See Section 8 for overseas transfer details.

Amato's Rewards communications

If you are an Amato's Rewards member, we may also send you rewards-related communications, including points balance updates, birthday offers, and member-exclusive promotions. Transactional rewards notifications (such as points earned or redeemed confirmations) may be sent regardless of your promotional communication preferences. We primarily use email for these messages where you have agreed to receive them or where the law allows service messages.

Opting out

You can withdraw your consent and opt out at any time by:

• clicking the unsubscribe link included in every marketing email; or
• emailing us at amatos@amatos.com.au.

We will action opt-out requests promptly and free of charge.

10. How we keep your information safe

We take reasonable steps to protect your personal information from misuse, interference, loss, unauthorised access, modification, or disclosure. These steps include:

• using HTTPS to encrypt data in transit between your browser and our servers;
• ensuring all card payments are processed through Stripe, which is PCI DSS compliant — card numbers and payment card details are never stored on our systems;
• not retaining order information in your browser beyond the checkout process;
• restricting access to records to authorised staff only via password-protected administration pages; and
• storing data on secure servers with appropriate access controls.
• storing data on Amazon Web Services (AWS) infrastructure in the Sydney (ap-southeast-2) region. AWS maintains SOC 2 Type II, ISO 27001, ISO 27018, and PCI DSS Level 1 certifications, and is assessed under the Australian Government's IRAP framework.

11. How long we keep your information

We keep personal information only for as long as it is needed for the purposes for which it was collected, and as required by law.

When data is no longer required, we will destroy or de-identify the personal information within a reasonable timeframe.

Event booking data

If you make an event booking, we retain your booking information (including guest names, dietary preferences, and payment status) for the duration needed to administer the event and process any outstanding payments or refunds. If your order is cancelled — whether by you or by us due to non-payment — we retain the booking record for a reasonable period to meet our legal, financial, and record-keeping obligations before destroying or de-identifying it.

Amato's Rewards data

If you are an Amato's Rewards member, we retain your membership information (including date of birth, purchase history, and points balance) for as long as your membership remains active. If you close your account or your membership is terminated, we will retain your information for a reasonable period to meet our legal and record-keeping obligations before destroying or de-identifying it.

12. Your rights - access and correction

You have the right to request access to the personal information we hold about you, and to ask us to correct it if it is inaccurate, out of date, incomplete, or misleading.

To make a request:

• Email amatos@amatos.com.au with the subject line "Privacy - Access Request" or "Privacy - Correction Request".
• We will respond within 30 calendar days.
• Access and correction are provided free of charge.

If we are unable to grant your request (for example, because it would unreasonably affect another person's privacy), we will write to you to explain our decision and your options.

13. Complaints

If you believe we have not handled your personal information in accordance with this policy or the Australian Privacy Principles, you can lodge a complaint.

How to make a complaint

Email amatos@amatos.com.au with the subject line "Privacy Complaint".

How we handle complaints

• We will acknowledge your complaint in writing.
• We will investigate the matter, including gathering relevant facts and reviewing relevant records.
• We will provide you with a written response, including our findings and any steps we will take to resolve the issue.
• In most cases, we will respond within 30 calendar days. If we need more time, we will let you know and agree a revised timeframe.

If you are not satisfied

If you are not satisfied with our response, you may lodge a complaint with the Office of the Australian Information Commissioner (OAIC):

• Phone: 1300 363 992
• Email: enquiries@oaic.gov.au
• Website: www.oaic.gov.au
• Complaints form: oaic.gov.au/privacy/privacy-complaints

14. How to contact us

For privacy enquiries, access or correction requests, or complaints:

15. Changes to this policy

We may update this policy from time to time to reflect changes in our practices, services, or legal obligations. When we make changes, we will update the "Last updated" date at the top of this page.

You can always find the most up-to-date version of this policy on our website.