Privacy policy
Last updated: August 11, 2026
1. About this policy
Bundaberg Harley-Davidson is a trading name of Dallas & Jess Pty Ltd (ABN 84 605 383 677) (“we”, “us”, “our”). We operate the online store at shop.bundyhd.com.au and the related dealership merchandise and parts business at 41 Commercial Street, Kensington QLD 4670.
We are bound by the Privacy Act 1988 (Cth) and the 13 Australian Privacy Principles (APPs) set out in that Act. This policy explains what personal information we collect, why we collect it, who we give it to, how we keep it safe, and how you can access it, correct it or complain.
Our online store is hosted on the Shopify platform. This means Shopify, and the service providers Shopify uses, also handle some of your information. Section 8 explains that relationship.
If there is any inconsistency between this policy and our Terms of Service, this policy applies to matters concerning your personal information.
Nothing in this policy limits your rights under the Australian Consumer Law. Our returns, refunds, warranty and consumer guarantee obligations are dealt with in our separate Returns and Refunds Policy.
2. Dealing with us anonymously or by pseudonym
Wherever it is lawful and practicable, you have the option of dealing with us anonymously or under a pseudonym. For example, you can browse our store, ask a general question about stock, or call us about opening hours without telling us who you are.
It is usually not practicable for us to deal with you anonymously where we need to identify you — for instance to process and ship an order, take payment, process a return or exchange, or respond to a warranty claim.
3. What personal information we collect
The kinds of personal information we collect and hold depend on how you interact with us:
• Identity and contact details — your name, billing address, shipping address, email address and phone number.
• Order and transaction information — the items you view, add to cart, purchase, return, exchange or cancel; order numbers; delivery and tracking details; and your purchase history with us.
• Payment information — the payment method used, the last four digits and card type, the transaction amount, and whether the payment succeeded or failed. We do not collect or store your full card number, expiry date or CVV. Card details are captured directly by our payment providers over an encrypted connection and processed in accordance with the Payment Card Industry Data Security Standard (PCI DSS).
• Account information — if you create an account: your username, password (stored in encrypted form), saved addresses, and your preferences and settings.
• Communications with us — the content of emails, contact form submissions, phone enquiries, social media messages, reviews and customer service correspondence, including any information you choose to include in them.
• Technical and device information — your IP address, device type, browser type and version, operating system, referring website, and unique device or cookie identifiers.
• Usage information — pages you visit, products you view, time spent on the site, links you click, and how you navigate the store.
• Marketing information — whether you have subscribed to our mailing list or SMS list, whether you open our emails, and which links you click in them.
Sensitive information
Sensitive information includes health information, and information about your race, ethnicity, political opinions, religious beliefs, sexual orientation or criminal record. We do not seek sensitive information through our online store. If we ever need it — for example, a medical declaration for a ride day or dealership event — we will only collect it with your consent and only where it is reasonably necessary for that activity.
Government identifiers
We do not adopt a government-issued identifier (such as a driver licence, Medicare or tax file number) as our own identifier for you, and we will not use or disclose one except as permitted by law.
Unsolicited information
If we receive personal information about you that we did not ask for, and we could not have lawfully collected it ourselves, we will destroy or de-identify it as soon as practicable, provided it is lawful and reasonable to do so.
4. How we collect personal information
Wherever it is reasonable and practicable, we collect personal information directly from you. We collect it:
• Directly from you — when you place an order, create an account, subscribe to our mailing list, complete a contact or enquiry form, write a product review, phone or email us, or visit the dealership and give us your details.
• Automatically — through cookies and similar technologies when you browse the store (see section 7).
• From our service providers — for example our payment providers confirm whether a payment cleared, and our couriers confirm delivery.
• From third parties — for example if you use a social media login, or if another person places an order to be shipped to you as a gift. If someone gives us your details to send you a gift, we will use those details only to fulfil and deliver that order.
If we collect your personal information from someone other than you, we will take reasonable steps to let you know, unless an exception in the Privacy Act applies.
5. Why we collect, hold, use and disclose your information
We only use your personal information for the purposes set out below, for purposes you would reasonably expect that are related to those purposes, or where you have consented or the law requires or permits it.
• To sell you products and fulfil your order — processing payments, packing and shipping, arranging click-and-collect, sending order confirmations and shipping notifications, handling backorders, and managing returns, exchanges, refunds and warranty claims.
• To provide customer service — answering your questions, following up on enquiries, and resolving problems and disputes.
• To manage your account — creating and maintaining your account, saving your addresses and preferences, and letting you view your order history.
• To run and improve the store — understanding which products and pages are popular, fixing faults, testing changes, and improving site performance and layout.
• To market to you — sending you email or SMS about new stock, sales, dealership events and promotions, where you have consented or where the law otherwise permits it, and showing you advertising online. See section 6.
• For security and fraud prevention — verifying orders, detecting and investigating suspected fraudulent, unlawful or abusive activity, protecting our staff, customers and property, and securing our systems and premises.
• To meet our legal and record-keeping obligations — including tax and accounting records, Australian Consumer Law obligations, product safety and recall notices, responding to lawful requests from courts, regulators and law enforcement, and establishing or defending legal claims.
We will not use or disclose your personal information for an unrelated purpose without your consent, unless the Privacy Act permits it.
6. Direct marketing and your right to opt out
If you have given us your details and have consented, or where we are otherwise permitted under the Spam Act 2003 (Cth), we may send you marketing by email or SMS.
• Every marketing message we send will identify us and include a working unsubscribe option. Unsubscribing is free and does not require you to log in, create an account, or give us any additional information.
• We will action your unsubscribe request within five business days, as required by the Spam Act.
• You can also opt out at any time by emailing merchandise@bundyhd.com.au or calling +61 7 4152 1121.
• If you opt out of marketing, we will still send you transactional messages — order confirmations, shipping updates, refund notices, safety or recall notices and similar — because we need to send these to complete your purchase and meet our obligations.
• We do not sell your personal information. We do not disclose your personal information to other organisations so that they can market their own products to you, unless you have consented.
• If you ask us to tell you where we got your information from, we will tell you, unless it is unreasonable or impracticable to do so.
7. Cookies, analytics and online advertising
Our store uses cookies and similar technologies. These are small files placed on your device that let the store work properly and help us understand how it is used.
• Essential cookies keep you logged in, remember what is in your cart, and secure checkout. The store will not work correctly without these.
• Analytics cookies help us count visits and understand which pages and products people use, so we can improve the store.
• Advertising cookies may be used to show you our advertising on other websites and social media platforms, and to measure whether those ads work.
You can control cookies through your browser settings, including blocking or deleting them. If you block essential cookies, parts of the store — including checkout — may not function.
Where our store presents you with a cookie or tracking preference control, your choices there will be applied. You can also opt out of interest-based advertising with participating advertisers at youronlinechoices.com.au/opt-out.
8. Who we disclose your information to
We disclose personal information only where it is necessary for the purposes described in section 5. The categories of recipients are:
• Shopify — our e-commerce platform provider, which hosts the store, processes orders and provides analytics and related merchant tools.
• Payment providers — to process your payment, verify it and manage chargebacks and refunds.
• Delivery and logistics providers — including Australia Post and courier companies, so your order can be delivered or tracked.
• Technology and business service providers — including email and SMS marketing platforms, customer service tools, cloud storage and backup providers, website developers, analytics providers, and our accountants and auditors.
• Advertising and social media platforms — where you have not opted out, for the advertising purposes described in section 7. These platforms handle your information under their own privacy policies.
• Harley-Davidson entities — where necessary for warranty, product recall, genuine parts supply or dealership network purposes.
• Professional advisers, insurers and debt recovery agents — where reasonably necessary.
• Law enforcement, courts, regulators and government agencies — where required or authorised by law.
• A purchaser of our business — if we sell or restructure the business, personal information may be transferred as part of that transaction, on the basis that the purchaser continues to handle it in line with this policy.
We require our service providers to protect your personal information and to use it only for the purpose we engaged them for.
9. Overseas disclosure
Yes — we are likely to disclose your personal information to recipients located overseas.
This is mainly because our store runs on Shopify, whose corporate group and hosting infrastructure are located outside Australia, and because some of our marketing, analytics and customer service tools are provided by overseas companies.
The countries where these recipients are likely to be located are:
• Canada (Shopify’s head office and corporate group)
• The United States (hosting infrastructure, analytics, email and SMS marketing, advertising platforms)
• Ireland and other European Union member states (some Shopify and service provider infrastructure)
• Singapore (some regional cloud infrastructure)
Before disclosing personal information overseas, we take steps that are reasonable in the circumstances to ensure the overseas recipient does not breach the Australian Privacy Principles, generally through our contracts with those providers. Under APP 8, we generally remain accountable for what those overseas recipients do with your information.
If you would like to know the current list of overseas providers we use, contact us using the details in section 14.
10. How we keep your information secure, and how long we keep it
Security
We take reasonable steps to protect your personal information from misuse, interference and loss, and from unauthorised access, modification or disclosure. These steps include encrypted (HTTPS) connections across the store and checkout, restricting staff access to what each person needs to do their job, password protection and multi-factor authentication on our systems, secure storage of paper records at the dealership, and using reputable providers who maintain their own security controls.
No method of transmission or storage is completely secure, and we cannot guarantee absolute security. Please do not send us sensitive information — such as full card numbers or identity documents — by email or social media message.
Data breaches
We are covered by the Notifiable Data Breaches scheme in Part IIIC of the Privacy Act 1988 (Cth). If a data breach occurs that is likely to result in serious harm to you, we will notify you and the Office of the Australian Information Commissioner (OAIC) as soon as practicable, and tell you what happened and what you should do.
Retention
We keep personal information only for as long as we need it, then destroy or de-identify it. In practice:
• Order and transaction records are kept for at least seven years after the transaction, because tax and corporations law requires us to keep financial records for that period.
• Account information is kept while your account is active. If you close your account or ask us to delete it, we will delete or de-identify it, other than records we must keep by law.
• Marketing contact details are kept until you unsubscribe. After you unsubscribe we keep a minimal suppression record so we do not accidentally contact you again.
• Enquiries and customer service correspondence are generally kept for two years, or longer if they relate to a warranty claim, dispute or legal matter.
• Website analytics data is generally retained in identifiable form for no more than 26 months.
11. Keeping your information accurate
We take reasonable steps to make sure the personal information we collect, use and disclose is accurate, up to date, complete and relevant. Please tell us if your contact details change, or update them in your account.
12. Accessing and correcting your information
You have the right to ask for access to the personal information we hold about you, and to ask us to correct it.
To make a request, contact us using the details in section 14. Please tell us what information you are after so we can find it. We will need to verify your identity before we release anything, to make sure we are not giving your information to someone else.
• We will respond within a reasonable period, and in most cases within 30 days.
• Access is free. We may charge a reasonable cost-based fee for supplying the information — for example, for extensive photocopying — but we will tell you about any fee before we incur it, and we will never charge you for making the request.
• We will give you the information in the form you ask for where it is reasonable and practicable to do so.
• If we refuse access or refuse to make a correction, we will tell you in writing, explain our reasons and the law we rely on, and tell you how to complain. If we refuse to correct information, you can ask us to attach a statement to the record noting that you believe it is inaccurate, and we will take reasonable steps to do so.
• If we correct information we have already given to another organisation, you can ask us to tell them about the correction, and we will do so unless it is impracticable or unlawful.
You can also ask us to delete personal information we hold about you. We will do so where we no longer need it and no law requires us to keep it. Where we must keep records — such as sales records for tax purposes — we will tell you and will restrict how that information is used.
13. Complaints
If you think we have breached the Australian Privacy Principles or mishandled your personal information, please tell us. We would like the chance to fix it.
Step 1 — Contact us. Send your complaint to merchandise@bundyhd.com.au, marked “Privacy Complaint”, or write to us at the postal address in section 14. Please describe what happened and what outcome you are seeking.
Step 2 — We investigate. We will acknowledge your complaint within five business days and give you a written response within 30 days. If we need longer, we will explain why and tell you when to expect a response. If we got it wrong, we will tell you what we are doing to fix it.
Step 3 — Escalate to the regulator. If you are not satisfied with our response, or we do not respond within 30 days, you can complain to the Office of the Australian Information Commissioner (OAIC):
• Website: oaic.gov.au/privacy/privacy-complaints
• Phone: 1300 363 992
• Email: enquiries@oaic.gov.au
• Post: GPO Box 5218, Sydney NSW 2001
The OAIC normally requires you to raise your complaint with us first and give us 30 days to respond before it will consider it.
14. How to contact us
For any privacy question, access or correction request, or complaint:
Privacy Officer — Bundaberg Harley-Davidson
Dallas & Jess Pty Ltd (ABN 84 605 383 677)
41 Commercial Street, Kensington QLD 4670, Australia
Email: merchandise@bundyhd.com.au
Phone: +61 7 4152 1121
15. Automated decision-making
We do not use computer programs to make decisions about you that could significantly affect your rights or interests. Some of the tools we use — for example fraud screening at checkout — score transactions automatically, but a person reviews the outcome before we cancel or decline an order.
If this changes, we will update this policy to describe the kinds of personal information used and the kinds of decisions made, as required by the Privacy Act 1988 (Cth).
16. Third party websites
Our store may link to other websites, including social media platforms and Harley-Davidson sites. We are not responsible for the privacy practices or content of those sites. We encourage you to read their privacy policies before giving them your information.
17. Children
Our store is intended for adults. We do not knowingly collect personal information from children under 16 without the involvement of a parent or guardian. If you are a parent or guardian and believe your child has given us personal information, contact us and we will delete it.
18. Changes to this policy
We may update this policy from time to time to reflect changes in our practices, our technology or the law. The current version is always available on this page, and the “Last updated” date at the top shows when it last changed. If we make a significant change, we will take reasonable steps to notify you.
We encourage you to review this policy periodically.