ONETOO Pty Ltd (ACN 651 365 089) as trustee for the ONETOO Trust (ABN 25 899 322 170), trading as ONETOO, is a brand strategy and design studio in Mornington, Victoria. In this policy “ONETOO”, “we”, “us” and “our” mean the studio, and “you” means anyone whose personal information we handle.
This policy explains what personal information we collect, why we collect it, who we share it with, and how you can see, correct or delete it. We handle personal information in line with the Australian Privacy Principles in the Privacy Act 1988 (Cth). Personal information means information or an opinion about you that identifies you, or could reasonably identify you.
By giving us personal information or using our website, you agree to it being handled as this policy describes.
Whose information we collect
We collect personal information about:
- our clients and prospective clients, and the people who work for them;
- our suppliers, contractors and collaborators;
- people who apply to work with us; and
- visitors to our website.
How we collect it
We collect personal information when you:
- send an enquiry, request a teardown or apply for a job through our website;
- email us, call us, meet with us or book a call with us;
- become a client, or work with us on a client’s project;
- interact with us on social media, such as Instagram, LinkedIn or Pinterest;
- subscribe to our newsletter;
- supply goods or services to us; or
- browse our website.
We collect information directly from you where we can. Sometimes it comes from someone else:
- your organisation or a colleague, if you work for a client, supplier or contractor;
- a business or person who refers or introduces you, including partner directories such as Webflow’s;
- the platforms we use, such as social media and advertising platforms; and
- public sources, such as your website, your LinkedIn profile, ASIC and the Australian Business Register.
When we collect your information, or as soon as we can afterwards, we take reasonable steps to let you know, unless it is obvious from the circumstances.
If you give us information about someone else, such as a colleague, please make sure they know and are comfortable with you sharing it.
What we collect
Depending on how you deal with us, we may collect:
- Contact details: your name, business name, job title, email address, phone number, postal address and website.
- Project details: what you tell us about your business, the services you are interested in, your budget and timing, and anything you share with us during a project.
- Your organisation: details of the business you represent, if you deal with us on its behalf.
- Job applications: the role you are interested in, your portfolio and experience, and anything else you or a recruiter send us.
- Billing details: what we need to invoice you and receive payment, including bank details you give us. We never store card numbers; card payments go straight to Stripe.
- How you use our website: the pages you view and when, how long you stay, how you arrived (the referring site, search or ad, including campaign tags and ad click identifiers), your approximate location based on your IP address, and your browser, device and operating system.
We don’t ask for sensitive information, such as details of your health, religion or political views. If it ever becomes necessary, we will ask for your consent first unless the law allows otherwise.
Why we collect it
We collect and use personal information to:
- respond to enquiries and prepare proposals and quotes;
- deliver our services and manage projects;
- manage our relationship with you, including invoicing and business records;
- assess job applications;
- protect our website and forms from spam and abuse;
- understand how our website is used, and improve it and our services;
- plan, measure and improve our marketing and advertising; and
- meet our legal obligations, resolve disputes and enforce our agreements.
We may also use it for related purposes you would reasonably expect, such as handling a complaint or inviting you to an event.
We use software tools, including AI assistants, to help organise enquiries and manage projects. They don’t make decisions about you.
Marketing
If you are a client, or you have asked to hear from us, we may send you news about our work, case studies and events. Every email gives you a way to opt out, and we respect it.
We also advertise online, on platforms such as Google, Meta, Pinterest and LinkedIn. Those platforms decide who sees our ads using information they hold about their users, including visits to our website. Opting out of our emails doesn’t change that; you can manage it in each platform’s ad settings.
Who we share it with
We don’t sell or rent personal information. We share it only as far as each party needs it:
- service providers who help us run the studio, listed below;
- contractors, printers, fabricators and specialists who work with us on your project;
- our professional advisers, such as our accountant, bookkeeper and lawyers;
- the business that referred you to us, where you would expect it;
- your employer, if you deal with us on their behalf; and
- anyone the law requires or allows us to tell, or anyone you agree we can.
Our service providers include:
- website hosting, form storage and spam protection: Cloudflare;
- email and documents: Google Workspace;
- project management and team communication: Notion and Slack;
- meeting scheduling: Calendly;
- website analytics: Google Analytics, Ahrefs Web Analytics and Cloudflare Web Analytics;
- advertising: Google Ads, Meta (Facebook and Instagram), Pinterest and LinkedIn;
- accounting and invoicing: Xero, with card payments through Stripe; and
- email newsletters: our email marketing platform, once we start one.
Each of them handles information under its own privacy policy.
Storage outside Australia
Several of these providers are global businesses that store data outside Australia, including in the United States and elsewhere in the Asia-Pacific region, such as Japan. Apart from them, we don’t send personal information overseas unless you agree or the law requires it.
Cookies and advertising
Our website uses cookies and similar technologies, loaded through Google Tag Manager, for analytics and advertising. They include Google Analytics, Google Ads (including remarketing), the Meta Pixel, the Pinterest tag and the LinkedIn Insight tag. They show us which pages are useful and which ads work, and let us show our ads to people who have visited the site.
Website data on its own doesn’t usually identify you. If you send an enquiry, we connect it with details of that visit, such as the page you came from and the ad you clicked, so we know what brought you to us.
You can block or delete cookies in your browser settings, and opt out of personalised ads in Google’s Ad Settings and Meta’s ad preferences. If you block all cookies, parts of our website may not work.
Our website links to other sites, including Calendly, Google Maps and our clients’ websites. Those sites have their own privacy practices.
Keeping it accurate
We take reasonable steps to keep personal information accurate, complete and up to date; please tell us when your details change. If you tell us something we hold is wrong and we don’t agree, you can ask us to note your view alongside it.
Security and how long we keep it
We take reasonable steps to protect personal information from misuse, interference, loss and unauthorised access, and we limit access to the people who need it. No transmission over the internet is completely secure; if you would rather not use our forms, email or call us instead.
We keep personal information for as long as we need it for the purposes in this policy, and for as long as the law requires, for example for tax records. When we no longer need it and the law no longer requires us to keep it, we delete or de-identify it.
Seeing, correcting or deleting your information
You can ask to see the personal information we hold about you, ask us to correct it, or ask us to delete it unless the law requires us to keep it. We may ask you to put the request in writing and to confirm your identity. If we refuse, we will tell you why in writing and how to complain.
Complaints
If you are concerned about how we have handled your personal information, write to us with the details and how to reach you. We will acknowledge it, look into it and reply in writing, aiming to do so within 30 days. If you are not satisfied with our response, you can contact the Office of the Australian Information Commissioner at oaic.gov.au.
If the business changes hands
If ONETOO, or part of it, is sold, merged or restructured, the personal information we hold may pass to the new owner, or to a prospective buyer, so the work can continue under this policy.
Contact us
ONETOO
18 Progress Street, Mornington VIC 3931
hello@onetoo.com.au
0400 275 439
Changes to this policy
We may update this policy from time to time. The current version is always on this page.
Version dated 3 November 2026.