Privacy Policy

1. Scope of the Privacy Policy

At Blu Your Mind Pty Ltd (“Company” or “we” or “our”), we place the highest priority on respecting your data privacy. This privacy policy (“Policy”) describes how we collect and process information from which you can be directly or indirectly identified (“Personal Data”) when you interact with us through our digital offerings (including our websites and mobile applications (“apps”), social media channels, stores, events, or other products and services). It also describes how your Personal Data is used, shared, and protected, the choices you have regarding your Personal Data, and how you can contact us.

For some of our products or services, the way in which we may use or collect your Personal Data may differ from what is set forth in this Policy; for such cases, we will clearly link you to any dedicated policies within this Policy.

We may change this Policy from time to time. If we make any important changes to this Policy (for example, changes that affect the Personal Data we collect, or how or why we use it), then we will inform you about those changes and the date of the changes at the top of this Policy.

2. Who is responsible for processing your Personal Data?

The respective Company responsible for the processing of your Personal Data (“Data Controller”) will depend on how you interact with us, and where you are located in the world. The respective Data Controller is included within each data processing activity in this Policy.

For certain products or services, two Company entities or Company and another third party may jointly determine how your Personal Data is used (“Joint Controllers”) for the purposes identified in this Policy. Whenever we act as a Joint Controller, we act based on a specific arrangement that sets out the distribution of agreed roles and responsibilities of each party for compliance with their obligations. Such joint controllership arrangements govern in particular:

• How and which Joint Controller shall provide the information to data subjects on the underlying data processing;
• Which Joint Controller shall be the designated point of contact for communication with data subjects and supervisory authorities; and,
• Which Joint Controller shall be responsible for the notification of a personal data breach to supervisory authorities and data subjects.

Further details regarding Joint Controllerships are provided in the specific section for the respective Personal Data processing activity.

3. How do we collect Personal Data from you?

There are several ways we may collect your Personal Data depending on how you interact with us. Below are several examples. However, for more detailed information on each category of Personal Data we collect, please visit the section “How and why do we use your Personal Data?”.

• Personal Data you provide us directly: You may provide us with your Personal Data directly, for example when you use our websites or apps, participate in our events or promotions, subscribe to our newsletters, purchase our products or services, create a user account, visit one of our official premises, or communicate with us through one of our social media platforms.
• Personal Data we collect automatically: When you use our websites or apps, we may automatically collect certain types of information, such as information about your visit or page interactions.
• Personal Data we receive from other sources: We may also receive information about you from other sources if you use any of our websites or apps, or services. We are also working closely with third parties (including for example sub-contractors in technical, payment and delivery services), credit agencies (for example, if you purchase from our online shops), business and sponsorship partners and may receive information about you from them (including information that is publicly available).

4. How and why do we use your Personal Data?

Here you will find detailed information about the different ways in which we process Personal Data when you use our products or services, in particular which categories of Personal Data we collect and with which third parties (if any) we share the Personal Data.

A. OUR WEBSITES

i. Provision of the Website (Creation of Log Files)

Purpose of Data Processing
You can visit or use our websites without having to create a user account and actively disclose your Personal Data. However, each time you visit one of our websites, your browser automatically transmits certain information to us. Such information is stored by us in so-called server log files (log files).

We may process your Personal Data for the following purposes, including to:

• Provide and deliver our websites and to guarantee the functionality of our websites;
• Optimize our websites (e.g., to improve loading times);
• Ensure the security and stability of our IT systems.

Legal Basis for Data Processing
The temporary storage and processing of this Personal Data is based on our legitimate interests to ensure the stability and functionality of our websites.

Categories of Personal Data
The following Personal Data may be collected:

• Browser information (e.g., IP address, browser type and version, operating system and interface used, language and version of the browser software, etc.);
• Date and time of access and time zone difference to Greenwich Mean Time (GMT);
• Volume of data transmitted in bytes;
• Websites from which the user’s system accesses our websites;
• Websites accessed by the user’s system via our websites;
• Access status / HTTP status code.

Data Recipient(s)
Your Personal Data may be transferred to:

• IT service providers (e.g., hosting providers, cloud service providers, etc.);
• Backup and disaster recovery specialists.

Data Controller
The Data Controller of the data processing is the company named in the footer of the respective website.

Storage Duration
In as much as the Personal Data are stored in log files, these files will only be retained for as long as necessary for the respective data processing.

ii. Cookies and Similar Technologies

When you visit our websites, we process Personal Data using cookies and similar technologies (e.g., tags, web beacons, local/session storage, and JavaScript) (hereinafter collectively “Cookies”). Cookies are small text files that are stored on your end device (PC, laptop, tablet, or smartphone). These text files are downloaded by your browser when you visit our websites for the first time. When you visit a website again with the same device or browser, the Cookie and the information stored in it are either sent back to the website that created them (first party Cookie) or sent to another website to which it belongs (third-party Cookie). As a result, the website “recognizes” that it is the same user and adjusts the display of content on the website.

Our cookie settings automatically appear at the first visit of our websites. You can set your personal preferences within the cookie settings. Unless the use of a Cookie is absolutely necessary for example for technical reasons, you may accept or decline the use of such Cookies. You can change your cookie settings any time via the cookie settings in the footer of the respective website. Cookies already stored can be deleted at any time. If Cookies are deactivated for our website, it is possible that you will not be able to take full advantage of all the functions of the website.

We use Cookies for the following purposes:

• To provide basic functions of the websites and provide any services requested by you, e.g., to save your cookie settings or to offer secure areas for logged-in users (more on this in detail under “Absolutely Necessary Cookies”);
• For analysis of website usage (“web statistics”), so that we can continuously improve our digital offerings and better tailor them to our users’ needs and interests (for more information see “Performance Cookies”);
• For the professional presentation of the content of our websites, e.g., by integrating map material, video services (for more on this see “Third Party Service Embeds”);
• To personalize our offers, e.g., to display personalized advertising on the end device used, (for more information see “Marketing Cookies”).

a. Absolutely Necessary Cookies
Purpose of Data Processing
We use Absolutely Necessary Cookies to:

• Administer our websites for internal operations, including troubleshooting purposes and to understand any errors you may encounter on our websites;
• Provide basic functions for our websites. Without these Cookies, we cannot provide core services, such as shopping carts;
• Keep our websites safe and secure and to help manage and administer our IT systems; and,
• Improve use and content of our websites to ensure that the content is presented in the most effective way for you and your devices.

Legal Basis for Data Processing
The temporary storage and processing of Personal Data is based on our legitimate interests to:

• Provide our products or services to you, including fully functional websites and the services you require;
• Ensure that our websites and IT are secure and are being used in an appropriate manner.

Categories of Personal Data, Storage Duration and Categories of Data Recipient(s)
You can find further information about which Absolutely Necessary Cookies we use, as well as what categories of Personal Data we process, for how long we store and to which third parties we transfer them in the cookie settings on the respective website.

Data Recipients
Your Personal Data will be transferred to IT service providers (e.g., hosting providers, cloud service providers, consent management providers, log-in service providers).

Data Controller
The Data Controller for the Personal Data processing is the company named in the footer of the respective website.

b. Performance Cookies
Purpose of Data Processing
Subject to your consent, we will process your information to measure and improve the performance of our websites (for example, by counting visits and traffic sources to help us understand which pages are the most and least popular and see how visitors move around the websites).

Should you not consent to such processing, this will not have a direct effect on the functioning of the websites, but without the information gained using the Performance Cookies it will be more difficult for us to further develop our websites.

You can find further information about which Performance Cookies we use, what purpose they serve and how long they are stored for in the cookie settings on the respective website.

Legal Basis for Data Processing
The collection and processing of this Personal Data is based on your consent, where applicable in conjunction with the provisions of the E-Privacy Directive or its national implementation. You can withdraw your consent at any time and without giving any reasons. However, the withdrawal of consent does not affect the lawfulness of the processing before the withdrawal.

Categories of Personal Data
The following Personal Data may be collected, for example Personal Data about:

• Your visit including the URL clickstream to, through and from our websites;
• The page views and the usage of the application within a session (e.g., number of clicks, length of visit to certain pages);
• The origin of the first request;
• Your device, operating system and browser;
• The device location;
• Videos you have viewed, searched for or accessed;
• Download or playback errors;
• Video player and the playing mode;
• Promotions placed on the websites.

Data Recipient(s)
Your Personal Data will be transferred to IT service providers (e.g., consent management providers, log-in service providers and cloud hosting providers).

Data Controller
The Data Controller for the data processing is the company named in the footer of the respective website.

Storage Duration
Cookie data shall be stored for thirty (30) minutes after the last hit has been processed, but for a maximum of 3.5 hours after being set (browser session).

Your browser’s “sessionStorage” and “localStorage” store data in the browser; “sessionStorage” is stored temporarily and session storage data are gone when you close the browser tab (also referred to as “browser session”). The ”localStorage“ is persistent, meaning it has no expiration date. You may erase them by deleting your browser’s history or deleting the local storage (depending on the browser you used).

c. Third Party Service Embeds
On our websites, we integrate content from third-party providers to provide you with an engaging user experience. The following section provides you with information concerning the data processing activities resulting from the use of such embedded third-party content. In a first step, we provide you with general information on the use of third-party embeds applicable to several third-party embed providers. This is followed by more detailed information on the processing activities regarding specific third-party content, which is of particular importance to us.

i. General Information on Third-Party Service Embeds
Purpose of the Data Processing
On some of our websites, we integrate interactive third-party content, applications, or plug-ins (together “Content”) to provide an engaging user experience.

Examples of such Content include interactive maps, video players, social media plug-ins or interactive functions such as commenting or sharing. Subject to your consent, third parties who provide the Content may collect Personal Data about your use of such Content and may process information from you, which will be used by them in accordance with their own privacy policies. We therefore recommend that you also read the privacy notices and information of the respective third-party content provider as detailed below.

We process Personal Data in relation to the use of third party embeds for the following purposes, including to:

• Improve use and content of our websites, to ensure that the content is presented in the most effective way for you and your devices;
• Provide a consistent experience across devices and platforms.

The third-party providers of this Content collect the Personal Data mentioned for advertising, market research and/or needs-based design of its website. Such an evaluation is carried out (even for users who are not logged in or users without a corresponding account) to provide needs-based advertising and to inform other users of the social network about your activities on our websites. You have a right to object to the creation of these user profiles, although you must contact the respective third-party provider of the Content to exercise this right.

Legal Basis for Data Processing
The processing of this Personal Data is based on your consent. You can withdraw your consent at any time and without giving any reasons. However, the withdrawal of consent does not affect the lawfulness of the processing before the withdrawal.

Third-party embeds set Cookies on your browser to store Personal Data. We therefore recommend that you read the section about Cookies in this Policy as well as the cookie policy of the respective embed provider.

Categories of Personal Data
The Personal Data collected in relation to the use of third party embeds may include:

• IP address;
• Referrer URL (the webpage that sends visitors to our websites using a link);
• Information about the operating system and its interface;
• Cookie-based data (for example Cookies set to ensure the workability of social plugins);
• User device information (language settings, location, browser type and version);
• Date and time of the request;
• Time zone difference to Greenwich Mean Time (GMT);
• Content of the request (specific page);
• Access status/HTTP status code;
• Location.

Data Recipient(s)
If you consent to the use of our third-party embeds, your Personal Data may be shared with the third party providing the embed. For an overview of the third-party embeds in use, see cookie settings of the respective website.

Data Controller
Depending on the specific third-party embed, the company named in the footer either:

• acts as a Joint Controller with the respective company providing the third-party content for the collection and disclosure by transmission to the company providing the third-party content of the Personal Data. Regarding the further processing activities both Data Controllers act as independent Data Controllers respectively. Concerning further processing activities performed by the company providing the third-party content, such as the potential processing for market research purposes, this company acts as an independent Data Controllers; for further information, please consult the privacy policy of the respective company; or,
• acts as an independent Data Controllers for the data processing activities. The respective company providing the third-party content shall act as independent Data Controllers for the data processing activities performed by the company. For further information, please consult the privacy policy of the respective company.

Storage Duration
As regards storage duration of any third-party cookies that are set within the third-party embed, please refer to the privacy policy of the respective company providing the third-party content.

ii. Specific Third-Party Service Embeds
This section provides you with information on third-party embeds of specific third-party providers. For further information, please consult the privacy policy of the third-party content provider as linked below.

Facebook (Privacy Policy of Facebook available here)
Purpose of the Data Processing
On our websites, we integrate interactive third-party content from Facebook to provide an engaging user experience. This includes the embedding of Facebook posts, Facebook photos, Facebook videos, Facebook Plugins (e.g., the “Like” or “Share” button) and Facebook Pixel.

We will process this information to:

• Improve use and content of our websites to ensure that the content is presented in the most effective way for you and your devices;
• Provide a consistent experience across devices and platforms.

Subject to your consent, Facebook who is providing this content may collect data about your use of such Content and may process information from you which will be used in accordance with the Facebook Privacy Policy. We therefore recommend that you also read the privacy policy of Facebook.

Legal Basis for Data Processing
The data processing is based on your consent. You can withdraw the consent at any time and without giving reasons; however, the withdrawal of consent does not affect the lawfulness of the processing before the withdrawal.

Facebook also sets Cookies on your browser to store Personal Data, we therefore recommend you read our Policy carefully and to look at Facebook’s privacy policy.

Categories of Personal Data
The following Personal Data may be collected depending on the specific Facebook tool and if you have a Facebook Account or are logged in:

• Facebook Account data (Name, Preferences, Likes, etc);
• IP address;
• Information about the operating system and its interface;
• Cookie-based data (for Cookies set to ensure the workability of posts, photos, videos and plugins);
• Date and time of the request;
• Content of the request (the specific post, video, photo);
• Access status/HTTP status code.

Data Recipients
If you consent to the use of the respective Facebook embed, your Personal Data may be shared with Facebook Ireland Ltd., 4 Grand Canal Square Grand Canal Harbour, Dublin 2, Ireland.

Data Controller
If your Personal Data is collected and forwarded via our embedded Facebook components, the Company named in the footer of the respective website and Facebook Ireland Ltd. are Joint Controllers with respect to the data processing. Joint commitments were also set out in a publicly available agreement here. Among other things, it states that we must clearly inform you about the use of Facebook tools on our website. We are also responsible for ensuring that the tools are securely integrated into our websites and are in accordance with the applicable privacy laws.

Facebook, on the other hand, is for example responsible for the data security of Facebook’s products. If you have any questions about Facebook’s data collection and processing, you can contact the company directly. Should you direct the question to us, we are obliged to forward it to Facebook. However, should any further processing occur, then Facebook is solely responsible for this Personal Data. Data subjects may exercise their rights with respect to their Personal Data processed by Facebook Ireland directly against Facebook Ireland. For further information regarding the data processing performed by Facebook, including the legal basis and the possibilities to enforce data subject rights, consult the privacy policy by Facebook.

Storage Duration
As regards storage duration of Facebook, please refer to Facebook’s privacy policy.

Instagram (Privacy Policy of Instagram available here)
Purpose of the Data Processing
On our websites, we integrate interactive Instagram features such as content including photos and videos as well as plug-ins to provide an engaging user experience.

We will process this information to:

• Improve use and content of our websites to ensure that the content is presented in the most effective way for you and your devices;
• Provide a consistent experience across devices and platforms.

Legal Basis for Data Processing
The processing is based on your consent. You can withdraw the consent at any time and without giving reasons; however, the withdrawal of consent does not affect the lawfulness of the processing before its withdrawal.

Instagram also sets Cookies on your browser to store Personal Data, we therefore recommend you read our Policy carefully and look at the Instagram privacy policy.

Categories of Personal Data
The following Personal Data may be collected depending on if you have an Instagram account or are logged into your Instagram Account:

• Instagram Account data (name, addresses, phone numbers, etc);
• IP address;
• Information about the operating system and its interface;
• Cookie-based data (for Cookies set to ensure the workability of posts, photos, videos and plugins);
• Date and time of the request;
• Content of the request (the specific post, video, photo);
• Access status/HTTP status code.

Data Recipients
Whenever you visit our websites that have Instagram functions (i.e., Instagram photos or plugins) integrated to them, your browser automatically connects with Instagram’s servers. Thereby, if you consent to the use of the respective Instagram embed, Personal Data is sent to, as well as saved and processed by Instagram. This always happens, whether you have an Instagram account or not. Instagram shares the information obtained within the Meta businesses.

Instagram is maintained by:
Meta Platforms, Inc.
1601 Willow Rd
Menlo Park
CA 94025
USA

Data Controller
If your Personal Data is collected and forwarded via our embedded Instagram components, the Company named in the footer of the respective website and Meta Platforms, Inc. are Joint Controllers with respect to the data processing. Joint commitments were also set out in a publicly available agreement here. Among other things, it states that we must clearly inform you about the use of Instagram tools on our website. We are also responsible for ensuring that the tools are securely integrated into our website and are in accordance with the applicable privacy laws. Instagram, on the other hand, is for example responsible for the data security of Instagram’s products. If you have any questions about Instagram’s Personal Data collection and processing, you can contact the company directly. Should you direct the question to us, we are obliged to forward it to Instagram. However, should any further processing occur, then Instagram is solely responsible for this Personal Data. Data subjects may exercise their rights with respect to their Personal Data processed by Instagram directly against Instagram. For further information regarding the data processing performed by Instagram, including the legal basis and the possibilities to enforce data subject rights, consult the privacy policy by Instagram.

Storage Duration
Company does not store any Personal Data collected via Instagram embeds. As regards storage duration of Instagram, please refer to Instagram’s privacy policy.

(Note: The remaining specific third-party embeds—Google Maps, Google reCAPTCHA, YouTube, Spotify, Vimeo—follow the same structure as above, adapted for Blu Your Mind Pty Ltd. For brevity, I’ve omitted repeating them here unless you request them explicitly. They’d mirror the original with updated branding and contact details.)

iii. User Accounts

Purpose of the Data Processing
If you are a regular user of our websites, you may wish to create a user account (hereinafter “Account”) with us. An Account enables you to access certain services and may offer further functionalities (such as managing marketing communications or modifying your user setting preferences). Some accounts enable you to access other Company platforms (“Participating Platforms”) and visualize information from those Participating Platforms in your Account profile. Your Personal Data will be processed to:

• Create and manage your account and manage our relationship with you. Also, to communicate with you regarding your Account and our services;
• Improve use and content of our websites to ensure that the content is presented in the most effective way for you and your devices;
• Communicate with you and keep you up to date with our activities and events (subject to your prior consent if legally required). For example, to inform you via email or social media about products and services that may interest you;
• Provide a consistent experience across devices and platforms.

Legal Basis for Data Processing
The temporary storage and processing of this Personal Data is based on legitimate interests to provide you with an engaging and fully functioning user account service.

Categories of Personal Data
The Personal Data you provide when setting up an Account include:

• First and last name;
• Email address;
• Social media credentials (if applicable).

Data Recipient(s)
Your Personal Data will be transferred to IT service providers (e.g., hosting providers, cloud service providers, customer identity and access management providers, customer relationship management providers etc.).

Data Controller
The Data Controller is the company named in the footer of the respective website.

Storage Duration
We store your Account credentials until you terminate your Account or if you are inactive for three consecutive years. You can terminate your Account directly in your Account profile settings.

5. With whom do we share your Personal Data?

You can find detailed information on whom we may share your Personal Data under the respective data processing activity listed under section 4. Whenever we share your Personal Data with a supplier or service provider, these will be required to meet our standards on processing information and security. The information we provide them, including your Personal Data, will only be provided in connection with the performance of their function. They will not be permitted to use your Personal Data for any purposes other than those outlined in this Policy.

In addition to any listed data recipients, we may need to also share your Personal Data with the categories of data recipients listed below.

i. Within the Company Group
We may share and disclose your Personal Data whose categories are specified respectively at section 4 of this Policy within the Company Group for the purposes outlined under each respective data processing activity at section 4 of this Policy, or as required to the extent permitted by law. If we share your Personal Data, we shall ensure compliance with any applicable data privacy legislation and, wherever necessary, conclude appropriate contracts for such intercompany data transfers within the Company Group.

ii. Courts and Authorities
If we are required to do so by law or by enforceable governmental or court order, we may also disclose your information to governmental authorities (e.g., tax authorities, law enforcement agencies, regulatory agencies, etc.) or courts to the extent necessary.

6. How long do we keep your Personal Data?

We keep your Personal Data only for as long as necessary, in keeping with our stated business purposes or for legal or regulatory requirements; but not longer than three years following a period of inactivity. How long we need your Personal Data depends on what we are using it for, as set out in this Policy.

For example, we will retain your information for as long as you have an Account with Company and for a period thereafter if it necessary to meet our legal obligations, such as retaining the information for tax and accounting purposes. We may also need to keep your Personal Data for a certain period for accounting purposes, for example, where you have bought a subscription.

If we no longer need your Personal Data, we will delete it or make it anonymous by removing all details that identify you. If we have asked for your permission to process your Personal Data and we have no other lawful grounds to continue with that processing, and you withdraw your permission, we will delete your Personal Data.

If you object or opt-out of receiving direct marketing communications from us, we will remove your contact details and marketing permissions to ensure that you do not receive any future marketing communications from us.

In all cases, we will continue to protect your Personal Data in accordance with this Policy and will routinely refresh our information to ensure that we keep it up to date.

7. International Data Transfers

Given that the internet is a global environment, using the internet to collect and process Personal Data often involves the transmission of data on an international basis. While we generally endeavor to store the Personal Data, we collect about you through our websites or apps in your region (for example for Australian visitors, in Australia), it is possible that your Personal Data may be transferred to recipients outside your region (where data protection laws may be different for example in the USA), including within the Company Group.

If such an international data transfer takes place, we have implemented safeguards and data protection solutions (for example standard data protection clauses, plus supplementary measures) to ensure that your information is adequately protected in any third countries that do not have an adequate level of data protection as recognized by the national legislation.

8. Automated Decision-Making

On some of our e-commerce websites, we engage service providers who use automated decision making in order to verify your address and assess your creditworthiness. This allows us to ensure we use correct address data and to evaluate the risk of non-payment for our products and services. For more information, please consult the privacy policy of the respective service provider.

9. Data Subject Rights

As a data subject, you have certain data subject rights. Please note that you are not necessarily entitled to these rights without limitation, but only in accordance with applicable legal provisions. For example, your data subject rights may be limited if the rights and freedoms of others are affected. You can assert your data subject rights against the responsible Data Controller. You can contact us at any time for this purpose, by emailing us at the addresses indicated at the bottom of this Policy.

10. Use of this website or of our apps by minors

You should not use our website or app if you are younger than (18). If you are aged (18) or under, you must ask for your parent’s or your guardian’s permission before you use our website or app. If we find out that you are younger than (18) and have not got permission from your parent or guardian, we will stop using your Personal Data.

11. Questions, concerns and support – With whom and how can you get in touch?

If you have general questions relating to this Policy or about how we process your Personal Data, or if you would like to exercise any of your rights described in this Policy, you can contact us directly by emailing sales@bluenergy.au or by writing to the postal address of the respective Data Controller. Our postal address is 57 Victoria Street, Windsor, QLD 4030. If you would like to contact our appointed Data Protection Officer, please contact sales@bluenergy.au.