1. About this policy
This Privacy Policy explains how Cosmo packaging pty ltd, trading as Cosmo Food Service (ABN 46 605 173 279) ("CFS", "we", "us", "our") collects, holds, uses and discloses personal information through the Cosmo Food Service ordering website and mobile app (together, "the Service"), and how you can access or correct your information or make a complaint. This policy is intended to comply with the Australian Privacy Principles (APPs) under the Privacy Act 1988 (Cth). The Service is provided for use by approved trade customers and CFS sales representatives only — there is no public account sign-up — and it can also be browsed as a guest without signing in, which this policy covers as well.
2. Information we collect
Account & profile information: your name, email address, phone number, business address, organisation, allocated branch, role (customer or sales representative), and the feature permissions set on your account — provisioned by CFS when your account is created, and editable by you only for your display name.
Order & quotation information: order and quotation history, line items and quantities, delivery date and address, contact details and notes you add, and (for sales representatives) unit and cost pricing, margin data, aged trial balance figures (current, 14, 30 and 45 day and total outstanding amounts, and trade terms) and sales report totals for the customers you manage.
Lists & cart information: saved product lists (e.g. "My Pantry", custom lists) and your current cart contents.
Device & notification information (app only): if you use our mobile app and allow notifications, a push notification token for this installation, an installation identifier the app generates itself (not a hardware identifier and not an advertising ID), your device type (iOS or Android), your device model and operating system version, and the app version — used to route notifications to the right device and to help support staff diagnose a problem with one particular installation. We also keep a record of the notifications sent to you and whether each has been read, so the app can show your notification list and unread count.
App version & update information (app only): whether or not you sign in or allow notifications, the app sends its version number and your device type (iOS or Android) with each request to our servers, so we can tell whether that version of the app is still supported. Each time it opens, the app also checks the Expo update service for a newer version of its content, as described in clause 12.
Support & authentication information: what you send through the Contact Us / Support form (your name, email address, subject and message), password reset requests (your email address, so a reset link can be sent), and secure session tokens used to keep you signed in, stored in your device's or browser's encrypted secure storage — we do not see or store your password beyond the moment you enter it to sign in.
3. Location information (optional)
If you choose to allow it, the Service uses your device's approximate location (foreground only, while the website or app is open) to show products available at your nearest branch when browsing as a guest. In the app, your device shows its standard permission prompt when you first open the app (on iOS, with a short explanation of why it is needed); on the website, your browser may ask. This permission is optional. If you decline, we respect that choice: we do not prompt you to change it, and the Service uses a default branch and continues to function normally. You can grant, revoke or change this permission at any time in your browser or device settings.
4. Microphone & voice search (optional, app only)
Our mobile app offers voice search as an alternative to typing in the product search box. If you choose to use it, microphone access is requested at the moment you tap the microphone icon — never on startup — and is used only to convert what you say into text that is placed in the search box. Speech is converted to text by your device's own operating system speech recognition (Apple on iOS, Google or your device manufacturer's speech service on Android), not by CFS: depending on your device and its settings, that conversion may be performed on the device or by that provider's servers, and where it is performed by their servers your speech is handled under that provider's privacy terms and may be processed outside Australia. CFS does not record, store, or receive your audio, and no recording is saved on your device — only the resulting search text enters the app, and it is used exactly as if you had typed it. This permission is optional and can be declined or revoked at any time in your device Settings; if it is not granted, voice search is unavailable and the app continues to function normally with keyboard search. The website does not request or use microphone access.
5. Notifications (optional, app only)
Push notifications are only available through our mobile app and are optional. Permission is requested after you sign in — never before you have an account, and never on first launch — and may be declined; if declined, the app works normally and you simply receive nothing. You can turn notifications off at any time in your device Settings, and on Android you can mute 'Offers & specials' while keeping 'Orders & deliveries', or the reverse. If you allow notifications, the app registers this installation with our servers using the device and notification information described in clause 2, re-registers it when you sign in (a token can change when the app is reinstalled or restored), and deactivates that registration when you sign out. Delivering a notification necessarily means sending it — including its title and text, which may contain an order or quotation reference — through the Expo push notification service and then through Apple's or Google's notification service to your device; see clause 12 (Overseas disclosure). The count shown on the app icon badge comes from your unread notifications on our own servers, not from anything about your use of your device.
6. Information generated through use of the Service
Like most connected apps and websites, our systems generate standard technical logs when the Service communicates with our backend (e.g. request timestamps and error details) so we can operate, secure, and troubleshoot it. In the app, those requests also include the app's version number and your device type (iOS or Android); if a version is no longer supported, the app shows a screen asking you to update it from the App Store or Google Play. Files you choose to export (order, quotation, balance and sales-report CSV exports, and PDF documents) are generated on your own device: on the website they are downloaded through your browser; in the app, Android asks you once to choose a folder to save them into and remembers that choice locally, and on iOS they are shared through your device's share sheet at your direction. In every case, CFS does not receive a separate copy of an exported file through that process.
7. Permissions we request, and information we do not collect
The only device permissions ever requested by the Service are the optional ones described above — approximate foreground location (clause 3), the app's microphone for voice search (clause 4), app notifications (clause 5) — and, on Android, permission to write exported files into a folder you choose (clause 6). Each is optional, is used only for the purpose described in its clause, and the Service works without it. We do not request access to your camera, contacts, calendar, photo library, precise or background location, or the files already on your device, and we do not collect payment card details (the Service does not process payments). We do not use third-party advertising or analytics tracking, do not use an advertising identifier, and do not serve advertising.
8. How we collect information
We collect information you or your sales representative provide directly (e.g. account setup, notes on an order, a support enquiry, updating your display name), and information generated automatically through your use of the Service (e.g. order history, technical logs, the app's version and update checks, and — where you have permitted it — approximate location and, for app users, this installation's notification and device details).
9. Why we use your information
We use your information to: create and manage your account and authenticate you; process, fulfil and route orders and quotations to your allocated branch; enable your sales representative to act on your behalf where applicable; send you notifications about activity on your account and keep your unread count and app icon badge accurate; respond to enquiries you send through the Contact Us / Support form and to password reset requests; provide customer support; maintain saved lists and cart contents between sessions; keep the Service secure, diagnose faults (including faults affecting one device model or app version) and improve reliability; keep the app up to date and tell you when your version of the app needs to be updated; and meet our legal, accounting and regulatory obligations.
10. Promotional messages & opting out
Where you have allowed app notifications, we may also send you messages about offers, specials and CFS announcements, and we may send similar information by email in connection with your trading account. You can stop promotional notifications at any time — on Android by muting the 'Offers & specials' category in your device Settings, on iOS by turning notifications off for the app, or by asking us using the contact details in clause 20 (Complaints & contact us) — and doing so does not stop notifications about your own orders and quotations, which are part of providing the Service. Any commercial electronic message we send will identify CFS and offer a way to unsubscribe, consistent with the Spam Act 2003 (Cth). We do not provide your information to anyone else for their own marketing.
11. Disclosure of your information
We may disclose your information to: the CFS branch allocated to your account and your assigned sales representative, for order fulfilment; CFS personnel who need it to provide the Service and related services; our IT, cloud hosting, email delivery, notification delivery and app update providers, who process information on our behalf under confidentiality and security obligations and do not use it for their own purposes — including the Expo push notification service, the Expo update service (EAS Update) and, for delivery to your device, Apple Push Notification service (iOS) and Google Firebase Cloud Messaging (Android); and any party where required or authorised by law (e.g. a lawful request from a regulator or court).
12. Overseas disclosure
The systems that hold your account, order, quotation, balance and notification data are hosted within Australia. Three parts of the Service, all specific to the mobile app, necessarily involve information leaving Australia. Notifications: to deliver a push notification, it is sent with this installation's push token and the notification's title and text (which may include an order or quotation reference) to the Expo push notification service and then to Apple Push Notification service or Google Firebase Cloud Messaging. Those providers are located in, or operate infrastructure in, the United States and other countries and handle that information under their own privacy terms; if you do not use the app or do not allow notifications, none of this occurs. App updates: each time the app opens, it contacts the Expo update service (EAS Update) to check for and download newer app content, sending a randomly generated identifier for this installation (separate from the installation identifier in clause 2, and not a hardware or advertising identifier), your device type (iOS or Android), the app's version and release channel, and the identifier of the content currently installed; like any internet request, this also reveals your device's IP address. No account, order or contact information is included. Expo is located in, or operates infrastructure in, the United States and other countries and handles that information under its own privacy terms; if you do not use the app, none of this occurs. Voice search: as described in clause 4, speech-to-text conversion is performed by your device's own operating system speech service, which — depending on your device and its settings — may process your speech on that provider's servers outside Australia. In each case we take reasonable steps to ensure the recipient handles the information consistently with the Australian Privacy Principles, as required by Australian Privacy Principle 8. If our hosting arrangements change so that other information is held overseas, we will update this policy to name the relevant countries where practicable.
13. Data security
We take reasonable technical and organisational steps to protect your information from misuse, interference, loss, and unauthorised access, modification or disclosure. This includes encrypted, access-controlled storage of authentication tokens on your device or browser (via your device's secure keystore where applicable), encrypted transmission between the Service and our servers, role-based access controls on our systems, and per-account controls over which commercially sensitive screens a sales representative can open (for example aged trial balances and sales reports). No method of electronic storage or transmission is completely secure, and we cannot guarantee absolute security.
14. Data retention & information stored on your device or browser
We retain your personal information for as long as your account remains active and for as long afterwards as is necessary to meet our legal, accounting, tax and record-keeping obligations, to resolve disputes, and to enforce our agreements. Your notification history is kept as a record of what was sent to you; a push token registered to a device is deactivated when you sign out of it. The Service also keeps information locally so that it works quickly and, in the app, offline: your cart and saved lists; in the app, a copy of recently loaded catalogue, order, quotation, balance and account data, kept for up to 24 hours, plus a product image cache, your profile details, session tokens, push token and installation identifier (held in your device's encrypted secure storage), any app updates the app has downloaded together with the update service's installation identifier, and, on Android, the export folder you chose; on the website, session tokens and cart/list data held in your browser's storage. Signing out clears cached server data and session tokens from that device or browser; your cart and saved lists are deliberately kept so they are still there when you sign in again. Uninstalling the app, or clearing your browser's site data, removes everything the Service has stored there.
15. Your rights & choices
You may request access to, or correction of, the personal information we hold about you by contacting us using the details in clause 20 (Complaints & contact us). Your display name can be updated directly in your account settings; your email address, phone number, business address, branch, organisation and the feature permissions on your account are managed by CFS as part of your trading account and can be changed by contacting your sales representative or CFS directly. Your notification history and its read status are a record of what we sent you and cannot be edited within the Service — contact us if you need something about it addressed.
16. Account closure & data retention
Accounts are provisioned by CFS as part of your trading relationship rather than created through self-service sign-up, and the Service does not provide a feature or contact channel for you to request deletion of your account or your personal information. We retain your personal information, in accordance with clause 14 (Data retention), for as long as your trading relationship with CFS continues and for as long afterwards as is necessary to meet our legal, accounting, tax and record-keeping obligations and to resolve disputes or enforce our agreements. Once information is no longer required for those purposes, we take reasonable steps to destroy it or ensure it is de-identified, consistent with Australian Privacy Principle 11, as part of our own data-handling practices rather than in response to an individual request. If your trading account with CFS ends, contact us using the details in clause 20 (Complaints & contact us) if you have a question about how your information will subsequently be handled.
17. Children's privacy
The Service is a business-to-business trade ordering tool intended for use by adult representatives of our trade customers and by CFS sales representatives. It is not directed at, and we do not knowingly collect personal information from, children.
18. If your data is compromised
If we become aware of a data breach involving your personal information that is likely to result in serious harm, we will assess and, where required, notify you and the Office of the Australian Information Commissioner (OAIC) in accordance with the Notifiable Data Breaches scheme under the Privacy Act 1988 (Cth).
19. Cookies & tracking
Our website may use strictly necessary cookies or local storage to keep you signed in and remember your cart between visits. Our mobile app is a native application and does not use browser cookies. As noted in clause 7 (Permissions & information we do not collect), we do not embed third-party analytics or advertising tracking on the Service.
20. Complaints & contact us
If you have a question, wish to exercise a right described in this policy, or wish to make a complaint about how we have handled your personal information, contact Cosmo Food Service at info@cosmofoodservice.com.au or through the Contact Us section of our website or app. We will acknowledge your complaint and aim to resolve it within a reasonable time. If you are not satisfied with our response, you may lodge a complaint with the Office of the Australian Information Commissioner (OAIC) at oaic.gov.au.
21. Changes to this policy
We may update this Privacy Policy from time to time to reflect changes to the Service or our data handling practices, or to comply with changes in the law. The "Last updated" date at the top of this page shows when it was last revised. Continued use of the Service after changes take effect constitutes acceptance of the revised policy.