Privacy policy.

1. About This Policy

Think Online is a trading name of MW Partnerships Pty Limited (ABN 54 684 755 486 / ACN 684 755 486). In this policy, "we", "us", and "our" refer to Think Online and MW Partnerships Pty Limited.

We are committed to protecting the privacy of personal information we collect, hold, use, and disclose. This privacy policy describes how we manage personal information in accordance with the Australian Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs).

By using our website at thinkonline.com.au or a related Think Online landing page, you acknowledge that you have read and understood this privacy policy.

2. Information We Collect

We collect personal information that is reasonably necessary for our business functions. The types of personal information we may collect include:

• Your name
• Email address
• Phone number
• Website URL
• Any additional information you provide in a message through our contact form

We may also collect certain information automatically when you visit our website, including:

• IP address
• Browser type and version
• Device type and operating system
• Pages visited, time spent on pages, and navigation paths
• Referring website or source
• Geographic location (city/region level)

3. How We Collect Information

We collect personal information in the following ways:

• Directly from you — when you submit our contact form, send us an email, or communicate with us by phone.
• Automatically via our website — through cookies and analytics tools when you browse our website (see Section 5 below).

Where practicable, you may interact with us anonymously or using a pseudonym. However, if you choose not to provide certain personal information, we may not be able to respond to your enquiry or provide our services to you.

4. How We Use Your Information

We use the personal information we collect for the following purposes:

• To respond to your enquiries and communicate with you about our services
• To provide, manage, and deliver our digital marketing services
• To improve our website, content, and user experience
• To analyse website traffic and usage patterns
• To comply with our legal obligations

We will not use your personal information for direct marketing unless you have provided consent or would reasonably expect us to do so based on an existing relationship. You may opt out of any marketing communications at any time by contacting us.

5. Cookies and Analytics

Our website uses cookies and similar tracking technologies to improve your browsing experience and help us understand how our website is used.

Google Analytics 4

We use Google Analytics 4 (GA4) to collect anonymised data about website usage, including pages visited, session duration, traffic sources, and general geographic location. GA4 uses cookies to distinguish unique users and sessions. Google Analytics data is processed by Google LLC, whose servers are located in the United States.

You can opt out of Google Analytics by installing the Google Analytics Opt-out Browser Add-on.

PostHog

We use PostHog Cloud across our website and related landing pages to understand visits, campaign attribution, page navigation, interactions, form progression, and completed enquiries or bookings. PostHog may use cookies or similar browser storage and may collect performance measurements, heatmap data, and masked session-replay data so we can identify usability problems.

Form-field values and sensitive page regions are masked from session replay before the recording data leaves your browser. Our analytics events are designed not to include your name, email address, phone number, free-text form responses, security tokens, or booking reference.

On our Google Ads offer, GA4 and PostHog may receive a controlled category derived from your Google Ads readiness selection so we can compare funnel performance. Those analytics events do not include your identity or free-text responses.

Microsoft Clarity

We use Microsoft Clarity to understand how visitors navigate and interact with our website, including aggregate clicks, scrolling, and session behaviour. Clarity uses cookies and similar technologies to help us diagnose usability issues. We do not intentionally send the contents of contact-form fields to Clarity.

Meta Pixel

We use the Meta Pixel on selected pages to measure advertising performance, including page visits, submitted applications or enquiries, qualified leads, and confirmed bookings. Our browser Pixel events do not include the contents of form fields such as your name, email address, phone number, Google Ads readiness answer, website or business details, or other free-text responses.

For Meta's server-side conversion measurement, your name, email address, phone number, and an opaque submission identifier may be normalised and cryptographically hashed before being sent to Meta. We may also send your IP address, browser user agent, and Meta click or browser identifiers for conversion matching, measurement, and campaign reporting. Hashing reduces readability but the data is still handled as personal information. We do not send your Google Ads readiness answer, website or business details, or other free-text form responses to Meta.

Meta may use cookies and similar technologies to process browser, device, and advertising interaction information in accordance with the Meta Privacy Policy.

Managing Cookies

Use the “Privacy choices” control on our website to continue with analytics or use essential site features only. Choosing essential only disables our optional browser analytics and advertising events, removes the optional offer landing-page test assignment, and suppresses Meta server-side conversion events. It does not prevent you from submitting an enquiry or booking a call. You can also configure your browser to refuse or alert you about cookies.

6. Third-Party Disclosure

We do not sell, rent, or trade your personal information to any third party.

We may share your personal information with the following categories of third-party service providers who assist us in operating our business:

• Netlify — for website hosting and form submission processing (servers located in the United States)
• Google LLC — for analytics (Google Analytics 4) and business email (Google Workspace) (servers located in the United States)
• PostHog Inc. — for website analytics, performance measurement, heatmaps, and masked session replay across our website and related landing pages (United States cloud region)
• Microsoft Corporation — for website interaction analytics and session-behaviour measurement through Microsoft Clarity
• Meta Platforms, Inc. — for advertising delivery, conversion measurement, and campaign reporting (servers may be located in the United States and other countries)
• Cal.com, Inc. — for appointment scheduling and booking workflows
• Notion Labs, Inc. — for enquiry records and customer relationship workflows
• n8n GmbH — for workflow automation and enquiry routing
• Wistia, Inc. — for video hosting, playback, and related usage analytics

These service providers are only authorised to use your personal information as necessary to provide services to us and are required to handle your information in a manner consistent with relevant privacy obligations.

We may also disclose your personal information where required or authorised by law, including to comply with a court order, subpoena, or other legal process.

7. Client Data

In the course of delivering our digital marketing services, we may access or handle personal information belonging to our clients' customers (for example, through managing advertising accounts or analytics platforms on their behalf). This information is handled in accordance with our contractual obligations to those clients and is not used for any purpose other than providing the agreed services.

8. Cross-Border Disclosure

Some of the third-party services we use are operated by organisations located outside of Australia, primarily in the United States. By providing your personal information to us, you consent to the disclosure of your information to these overseas recipients.

We take reasonable steps to ensure that overseas recipients handle your personal information in accordance with the Australian Privacy Principles.

Countries where your data may be processed: United States and other countries where the providers listed above operate infrastructure.

9. Data Security

We take reasonable steps to protect your personal information from misuse, interference, loss, unauthorised access, modification, and disclosure. These measures include:

• Secure, encrypted connections (HTTPS/SSL) across our website
• Access controls limiting who within our organisation can access personal information
• Use of reputable, security-certified third-party service providers

However, no method of transmission over the internet or method of electronic storage is completely secure. While we strive to protect your personal information, we cannot guarantee its absolute security.

10. Data Retention

We retain personal information only for as long as it is reasonably necessary for the purposes for which it was collected, or as required by law. When personal information is no longer needed, we will take reasonable steps to destroy or de-identify it.

Contact form submissions are retained for the duration of any ongoing business relationship and for a reasonable period thereafter to allow for follow-up enquiries. Google Analytics data is retained in accordance with its configured retention settings. Under our current PostHog plan, analytics events are retained for up to 12 months and session replays for up to one month.

11. Accessing and Correcting Your Information

You have the right to request access to the personal information we hold about you. You also have the right to request that we correct any information that is inaccurate, out of date, incomplete, irrelevant, or misleading.

To make an access or correction request, please contact us using the details in Section 14 below. We will respond to your request within a reasonable timeframe, and we will not charge you a fee for making a request or for making corrections.

In certain circumstances, we may refuse access to personal information in accordance with the grounds set out in the Privacy Act (for example, where providing access would pose a serious threat to the life or health of any individual).

12. Notifiable Data Breaches

In the event of a data breach that is likely to result in serious harm to any individual whose personal information is involved, we will comply with the Notifiable Data Breaches (NDB) scheme under Part IIIC of the Privacy Act 1988. This includes notifying affected individuals and the Office of the Australian Information Commissioner (OAIC) as soon as practicable.

13. Complaints

If you believe we have breached the Australian Privacy Principles or have a complaint about how we have handled your personal information, please contact us using the details below. We take all complaints seriously and will investigate and respond within 30 days.

If you are not satisfied with our response, you may lodge a complaint with the Office of the Australian Information Commissioner (OAIC):

• Website: www.oaic.gov.au
• Email: enquiries@oaic.gov.au

14. Contact Us

If you have any questions about this privacy policy or how we handle your personal information, please contact us:

• Email: admin@thinkonline.com.au

15. Changes to This Policy

We may update this privacy policy from time to time to reflect changes in our practices, technology, or legal requirements. Any changes will be posted on this page with an updated "Last updated" date. We encourage you to review this policy periodically.