MyTPMS Australia Privacy Policy

This Privacy Policy describes the personal information handled by MyTPMS Australia in connection with our website, orders, workshop bookings, TPMS compatibility assistance and customer support. The Australian Business Register records the holder of ABN 53 807 701 500 as The Trustee for Automate TPMS Australia Trust. MyTPMS Australia is the registered business name. Our workshop and dispatch address is Unit 5–6, 44–50 Westall Road, Springvale VIC 3171, Australia.

Our website, mytpms.com.au, uses WordPress and WooCommerce. We supply TPMS sensors, diagnostic and programming tools, DIY kits and related automotive accessories. This policy covers browsing, checkout, account registration, booking communications, technical enquiries, trade applications, returns, warranty claims and complaints.

We are committed to protecting personal information and use the Australian Privacy Principles (APPs) as a framework for the commitments in this policy. The statutory application of the Privacy Act 1988, the APPs and other privacy laws depends on the business and the processing involved. Nothing in this policy excludes a legal obligation or an individual’s applicable rights.

This policy concerns information we handle. Third-party payment services, social platforms and companion applications may have separate privacy notices. A link to an app download does not establish that MyTPMS operates the app or controls its permissions. Contact us for the relevant provider details before supplying information to an unfamiliar service.

Please also read our Cookie Policy, Payment Security Policy and Terms of Service. For a copy of this policy or assistance in another accessible format, contact our privacy contact at [email protected] or 1300 818 030.

The information we collect depends on the service you request and the website features you use. Our collection is limited to information reasonably needed for the stated purpose. Providing an item of information voluntarily is not, by itself, a reason to retain or reuse it indefinitely.

Customer, order & booking information

• Identity and contact: Your name, email address, telephone number and preferred contact method; business name and contact-person details for trade enquiries.
• Addresses: Delivery and billing address, suburb, state, postcode and country, together with delivery instructions relevant to the order.
• Account information: Username, account authentication information, preferences, saved addresses and order history when you create an account. Do not send your account password to our team.
• Transactions: Products ordered, order value, invoice details, payment-method type, transaction references, payment status, refunds and dispatch information. Payment references and limited transaction details are distinct from full card credentials.
• Workshop bookings: Appointment date and time, requested service, vehicle details, booking status and related communications. A booking may be linked to the corresponding WooCommerce order.
• Messages and case records: Enquiry details, email and SMS correspondence, call notes and messages submitted through an available contact channel.
• Returns and warranty: Proof of purchase, reported fault, inspection details, photographs, correspondence and the outcome of the claim.

Vehicle & TPMS technical information

• Vehicle details: Make, model, year, build information, registration details where supplied, and variant information needed for the fitment enquiry or booking.
• VIN: A VIN or vehicle-identification photograph may help distinguish applications. It may be associated with your order, booking or support record. We do not treat vehicle information as anonymous when it can be linked to you, and we do not use VINs for marketing.
• Sensor and tool information: OE references, sensor IDs, programming or cloning details, relevant diagnostic outputs and the steps you have already tried.
• Photographs: Sensor, valve, dashboard, vehicle-identification and tool-display images you choose to provide. Crop unrelated people, address details and documents from images where practical; image files can also contain metadata.

Technical & website usage information

• Website operation: IP address, browser and device information, security events and session information associated with using the site.
• Interactions: Pages viewed, product searches, cart and purchase events, referral information and advertising click or cookie identifiers where the relevant measurement tools operate.
• Location: Addresses you enter and approximate location associated with your connection may be relevant to delivery or website settings. This policy does not grant an app permission to collect precise device location.
• Tracking choices: Consent records and opt-out preferences, where captured by the relevant systems. Sections 8 and 9 explain tracking categories and the disclosures that depend on active configuration.

Wholesale & trade details

Trade-account applications may include business name, ABN or equivalent registration, business type, contact details and information relevant to trade eligibility and account administration. A contact person’s information remains personal information even when supplied for business purposes.

Information may be collected directly from you, through the website, or from a service provider involved in your transaction. We aim to explain the relevant collection at or before it occurs, or as soon as practicable afterwards, rather than relying on a policy link alone.

Directly from you

• Checkout, accounts and bookings: Details you enter to purchase, create an account, arrange a workshop service or update a booking.
• Enquiries: Information you send by email, telephone, contact form, SMS or an available chat/social channel.
• Technical support: Vehicle and sensor information you submit to request a compatibility check, pre-programming or troubleshooting assistance.
• Returns, warranties and complaints: The details and evidence you provide when asking us to investigate a problem.
• Trade registration: Information supplied through the Wholesale Registration Form.
• Marketing choices: Contact details and the specific opt-in preferences you provide when subscribing.

Automatically through the website

Website servers and active security tools may record connection and technical information. Optional analytics and advertising tools may collect interaction and attribution information as described in Sections 8 and 9. Information transmitted directly to a third-party platform can still be relevant to our privacy responsibilities when we deploy its technology.

From third-party sources

• Payments: The chosen payment service may return transaction references, authorisation or payment status, refund information and fraud-related results.
• Delivery: A carrier may return tracking events, delivery status and proof of delivery relevant to the shipment.
• Messaging: Email and SMS providers may return message-delivery information. Guni SMS is used for MyTPMS service messages.
• Platforms: A social platform may supply the profile details and messages you choose to share. Advertising or analytics services may supply campaign results and event records according to the features configured.
• A person acting for you: An authorised workshop, purchaser or representative may provide details needed for an order or support request. They should have authority to share them.

We use information for the purpose for which it was collected and for other uses permitted by the applicable law. Where APP 6 applies, a secondary use needs an available basis, such as consent, a related purpose you would reasonably expect, or another applicable exception. Sensitive information attracts additional restrictions. A business benefit alone is not a general “legitimate interests” exception under the APPs.

We do not sell or rent customer contact lists. This promise is separate from disclosures to service providers and from any advertising-data sharing that must be accurately described and controlled. A service-provider privacy policy does not remove our own responsibilities for choosing and configuring that service.

An online purchase or TPMS support case may involve several records. Payment credentials, transaction references and vehicle details are different information categories; keeping one does not mean the others must be retained for the same period.

Payment information

Use the payment methods displayed in the live checkout. Payment services have their own privacy notices covering how they handle payment information, identity checks and transactions. Our order records may include the selected method, transaction identifiers, payment status and limited payment details returned by the provider.

We do not ask customers to send full card numbers, security codes, banking passwords or one-time banking codes by email, SMS or chat. Contact us using the published details if a message requests this information. An encrypted connection protects data in transit; it is not a certification of the seller or a guarantee that all systems are secure.

See Section 11 for retention and Section 12 for access, correction and deletion requests. A product warranty does not automatically justify retaining every photograph or technical detail for an indefinite period.

We share information relevant to the requested service or another disclosed, lawful purpose. Access should be limited to what each recipient reasonably needs. Some providers process information on our behalf; others also have independent legal or service purposes, which their privacy terms explain.

Technology services and international deliveries can involve recipients outside Australia. The relevant locations can include where a provider stores information, where support staff have access and the destination of an international shipment. An Australian business address or a local website host does not establish that every recipient and backup is in Australia.

Cross-border safeguards

Where APP 8 applies, we must take the required reasonable steps in relation to overseas recipients unless a valid exception applies. The appropriate measures depend on the recipient, information, access and purpose. These may involve assessing the provider, contractual protections, limits on information and access, and follow-up where issues arise.

Cookies, pixels and similar technologies can support website operation, preferences, measurement and advertising. See our Cookie Policy for information about cookies and your choices. The categories below explain their purposes.

Consent controls

This policy does not treat continued browsing, silence or an order as consent to optional tracking. Our commitment is to provide a clear choice before optional analytics or advertising tracking operates, and a way to change that choice.

Additional controls

• Browser settings: Your browser can block or clear cookies and other storage. This may affect login, cart or checkout. Clearing a cookie can also remove a saved preference, and does not necessarily undo information already received by a provider.
• Google Analytics: Google’s Analytics opt-out browser add-on provides a browser-specific control for supported Analytics implementations; it is not a universal blocker for every website or advertising service.
• Google advertising: My Ad Center can manage Google ad personalisation. It does not mean every form of measurement or data collection is disabled.
• Other platforms: Use the platform’s own privacy/ad controls as relevant. Industry opt-out tools cover participating services only and do not necessarily remove all storage or prevent all tracking.
• Assistance: Contact our privacy contact at [email protected] or 1300 818 030 if a choice is unavailable or does not work.

Google Merchant Center product data and customer measurement data are different. Product-feed information describes the goods offered for sale. Advertising and analytics tags may separately process information about people who visit or purchase.

Google Analytics

Where Google Analytics 4 is used, it can process website events, device/browser information, online identifiers and approximate location. Reports may be aggregated, but the underlying information should not all be described as anonymous. Google states that GA4 does not log or store individual IP addresses; that does not establish that no network information reaches Google, or that cookie and event identifiers cannot relate to a person.

Retention, Google Signals, advertising personalisation, User-ID, user-provided data and linked advertising services depend on the property and tag settings.

Consent Mode

Consent Mode changes Google-tag behaviour in response to consent signals; it does not obtain consent by itself. Under an advanced implementation, denied storage can still result in cookieless signals being sent. Under a basic implementation, tags can remain blocked until consent.

Merchant Center and advertising

• Product submissions: Product catalogue fields such as title, price, availability, image and product identifiers are not permission to upload customer details. Customer information should not be included in public product titles, descriptions or images.
• Conversion measurement: Where active, measurement may use purchase events, amounts and identifiers to associate a transaction with an ad interaction. Aggregated reports do not make every underlying event anonymous.
• Enhanced conversions: This optional feature can send hashed customer-provided identifiers, such as an email address or phone number, to Google for matching. Hashing is not the same as anonymising data.
• Customer Match and remarketing: We retain the commitment not to upload customer contact lists for Customer Match without separate explicit consent for that purpose. Optional website remarketing must also follow the advertised tracking choices and applicable requirements.
• Additional Google features: Reviews, order-tracking signals and other customer-data features may involve information separate from product catalogue data. Their use is subject to the relevant disclosures and privacy choices.

We are committed to taking reasonable technical and organisational steps to protect personal information against misuse, interference, loss and unauthorised access, modification or disclosure. Where APP 11 applies, both the systems and the way they are managed are relevant. No internet service or storage system can be guaranteed completely secure.

Security priorities

• Website connections: Use HTTPS for account, checkout and other information exchanges, and investigate unexpected insecure-connection warnings.
• Account credentials: Use the site’s password-reset process rather than asking staff to recover an existing password.
• Access: Limit staff and contractor access to what their role requires and remove it when no longer needed.
• Maintenance: Review software updates, security warnings, hosting controls and backup arrangements.
• Payment security: Use the relevant payment service’s secure payment process and handle transaction information according to its purpose.

People and procedures

• Staff handling: Explain appropriate access, identity checks, safe sharing and incident reporting to staff who handle personal information.
• Provider management: Review what service providers receive, their access and their contractual/independent purposes. Do not assume every provider is prohibited from all independent processing.
• Data minimisation: Avoid unnecessary copies of customer files, payment credentials, identification and technical photographs.
• Review: Reassess disclosures, retention and security when adding plugins, channels or services that change the handling of personal information.

Retention depends on the type of information and the reason it is still needed. We should keep information only while reasonably necessary for the service, a relevant continuing warranty or dispute, a lawful record-keeping requirement or another permitted purpose. Once that basis ends, reasonable deletion or de-identification steps should follow. This is not an instruction to erase evidence needed for an active claim.

Deletion requests

You may request deletion through our privacy contact at [email protected] or 1300 818 030. We aim to respond within 30 days, explain what can be deleted or de-identified, and identify any records that must remain and the reason. We will not present an internal business retention preference as a legal prohibition. We will explain the practical completion process, including any relevant backup limitations, rather than promise immediate removal from every system.

You can contact us to ask about information we hold, request access or correction, seek deletion, change marketing preferences or raise a privacy concern. Statutory rights depend on the law that applies and may have exceptions; the service commitments below do not remove those rights.

Making a request

Contact [email protected], 1300 818 030 or write to our privacy contact at Unit 5–6, 44–50 Westall Road, Springvale VIC 3171, Australia. Include enough information to identify the relevant record and explain your request. An order number may help, but is not mandatory for a person who has not placed an order.

We may check your identity or a representative’s authority in a proportionate way before releasing another person’s information. Do not send a passport or driver-licence copy unless we explain why it is needed and arrange an appropriate channel. We will assist with a request that cannot conveniently be made in writing.

Our marketing commitment is express opt-in: placing an order or requesting support does not automatically subscribe you to promotional emails or SMS. Where a law permits broader consent in particular circumstances, that does not silently replace the stricter commitment made in this policy.

Marketing choices and service messages

• Separate choice: Marketing consent should be collected distinctly from information needed to complete a purchase or booking. We do not treat an unchecked box, an abandoned cart or possession of a phone number as express marketing consent.
• Identification: A marketing message should clearly identify MyTPMS Australia and provide valid contact details.
• Unsubscribe: Use the functional unsubscribe method in the message or contact [email protected] or 1300 818 030. Requests will be actioned within five working days, without a fee or a requirement to create an account.
• Contact-list commitment: We do not sell or rent subscriber lists or provide them for another business’s unrelated direct marketing. Providers used to deliver our own messages are addressed in Section 6.
• Service messages: Booking confirmations, reminders, workshop updates, invoice, dispatch and claim communications can be needed to provide a requested service. Calling a promotional message “transactional” does not exempt it from marketing requirements.
• Review requests and cart follow-ups: These should be assessed for their actual content and applicable consent requirements. Any follow-up must respect the relevant consent and unsubscribe choices.
• International recipients: We respect additional marketing requirements where applicable, including requirements relevant to Canadian recipients.

Some website and service functions use automated rules. These may process the information relevant to a booking, payment, delivery calculation or promotional code. Contact us to query an outcome or request staff review of a matter within our control.

Australian transparency requirements from 10 December 2026

From 10 December 2026, additional APP 1 disclosure obligations apply to covered entities arranging for a computer program to use personal information in decisions reasonably expected to significantly affect an individual’s rights or interests. They can also cover a program doing something substantially and directly related to making such a decision; the presence of a human does not automatically remove the requirement.

Where the requirements apply, the policy needs to describe the kinds of personal information used, kinds of decisions made solely by computer programs, and kinds of decisions substantially and directly assisted by them.

MyTPMS sells technical automotive products and its purchasing arrangements are intended for adults, or for a parent or guardian purchasing for a younger person. That is a purchasing policy, not proof that no child can visit the website or generate website logs.

• Information minimisation: Children should not submit unnecessary personal information. A parent or guardian can contact us to arrange a purchase or request help.
• Marketing: We do not intend to direct promotional campaigns at children. Do not use the adult focus of the catalogue as a substitute for appropriate audience settings and safeguards.
• Unintended collection: If we become aware of information about a child that is not needed, we will assess appropriate deletion, de-identification or restricted handling, considering the child’s safety and any lawful retention needs.
• Parental enquiries: We will assess authority and the child’s circumstances before disclosing information or notifying another person; a claimed family relationship does not automatically authorise disclosure.
• Children’s privacy rules: We will assess applicable rules, including the scope and commencement of the Australian Children’s Online Privacy Code. Whether a service is likely to be accessed by children can matter; an “adults only” description is not itself an exemption.

To report a concern, contact our privacy contact at [email protected] or 1300 818 030. Provide only the details needed to locate the issue.

We will take a suspected data incident seriously, contain it where possible, investigate the information affected and consider steps that reduce potential harm. Statutory reporting depends on the law and circumstances. The Australian Notifiable Data Breaches (NDB) scheme applies to covered entities and information; not every incident is legally notifiable.

When an incident may be notifiable

Under the NDB scheme, an eligible breach generally involves unauthorised access to or disclosure of personal information, or loss with likely unauthorised access/disclosure, where serious harm to an individual is likely. Effective remedial action and statutory exceptions can affect whether notification is required.

Response process

• Contain and reduce harm: Take proportionate immediate steps, preserve relevant evidence and involve the appropriate hosting or service provider.
• Assess promptly: Where there are grounds to suspect an eligible breach, conduct a reasonable and expeditious assessment. The NDB scheme requires all reasonable steps to complete that assessment within 30 days of becoming aware of the grounds for suspicion.
• Do not wait unnecessarily: Where there are already reasonable grounds to believe an eligible breach occurred, notification obligations arise as soon as practicable; the assessment period is not permission to wait 30 days.
• Notify where required: Provide the required statement to the OAIC and notify relevant individuals, subject to any valid exception. If direct notification is impracticable, the applicable publication and publicity steps must be considered.
• Give useful information: Explain the incident, kinds of information involved, contact details and protective steps people can take.
• Review: Address the cause and relevant controls. Other jurisdictions may impose additional duties or different deadlines where their laws apply.

International customers may have additional rights where a local law applies to MyTPMS or to a particular service provider. Applicability depends on the law’s territorial and other scope, not merely on someone opening the website from another country. Australian-law wording is not intended to remove mandatory overseas protections.

EU/EEA & UK requests

Where applicable, you may request access or correction, erasure or restriction, object to relevant processing, or request portability of eligible information. These rights have conditions and exceptions. Direct-marketing objections and consent withdrawals must be handled according to the applicable law. You may also have protections relating to significant automated decisions and a right to complain to the relevant supervisory authority.

California sale / sharing and other US rights

Where California law applies, “sharing” can include cross-context behavioural advertising even where no customer list is sold for money. Applicable rights may include opting out of sale or sharing and using recognised privacy preference signals. Contact us about the information relevant to your request and the choices available.

Contact us if you believe information has been collected, used, retained or disclosed incorrectly, or a privacy request has not been handled properly. We will consider the concern fairly and explain the outcome. You will not be charged for lodging a privacy complaint.

Step 1 — Contact our privacy contact

Email [email protected], call 1300 818 030, use the Contact Us page, or write to Unit 5–6, 44–50 Westall Road, Springvale VIC 3171, Australia. Describe what happened, the relevant date or record if known, and the outcome you seek. A particular subject line or order number is helpful but not mandatory.

Business-day calculations use Melbourne local time and exclude Victorian public holidays. The broader Complaints & Dispute Resolution Policy can provide an earlier service-response or update commitment; this privacy process does not cancel that commitment or extend a statutory deadline.

Step 2 — Independent advice or escalation

The OAIC generally expects a written complaint to the business first and a reasonable opportunity to respond, usually 30 days. It determines whether a complaint is within its jurisdiction. You may seek advice earlier, and nothing here requires you to delay urgent action or miss a legal or payment-dispute deadline.

Other complaint, court or legal rights may be available. This page neither waives those rights nor guarantees that no privacy claim could arise. Seek independent advice where needed.

We may revise this policy when our services, data handling, legal obligations or privacy controls change. The date shown on this page identifies the latest revision.

• Material changes: Give appropriate notice of material changes through the website and, where appropriate, direct communication. An important privacy or service notice is not limited to customers who subscribed to advertising.
• Consent and existing information: Publishing new wording does not retrospectively authorise a different use of existing information or turn continued browsing into consent. Obtain fresh consent or another valid basis where required.
• Previous promises: Do not use an update simply to withdraw a privacy commitment already made or to avoid an existing request. Retain a record of policy versions and consider the information and notices applicable at collection.
• Previous versions: Contact [email protected] for an earlier policy version; we will make reasonable efforts to provide it.
• Upcoming requirements: Review the actual automated-decision disclosures before the applicable 10 December 2026 requirements, and assess children’s privacy rules as they develop.

We review this policy when introducing a payment, marketing, support, hosting or customer-data service that changes how personal information is handled.

The following guide summarises the 13 Australian Privacy Principles. Their application depends on legal coverage, relevant exceptions and the circumstances in which personal information is handled.

For more information, see the OAIC’s Australian Privacy Principles guidance.

These pages explain other aspects of shopping and support. They do not turn this privacy notice into blanket consent or remove applicable privacy rights.