Privacy Policy

Last updated: 31 August 2026

This Privacy Policy explains how A.C.N. 678 038 876 Pty Ltd (ABN 34 678 038 876), trading as Controlled Stores, handles personal information in connection with controlledstores.com.au.

We aim to collect only information reasonably required to operate, protect and improve the marketplace.

1. Information we may collect

Depending on how you use Controlled Stores, we may collect information including:

Account information

• name;
• display name;
• email address;
• phone number;
• state or general location;
• account settings;
• seller type;
• account creation information.

Listing information

• listing titles;
• descriptions;
• prices;
• photographs;
• item location;
• item condition;
• provenance information;
• serial numbers or identifying information voluntarily or necessarily provided;
• seller declarations.

Messages and marketplace activity

• messages sent through Controlled Stores;
• listings viewed;
• listings posted;
• saved items;
• reports made;
• reports received;
• moderation history;
• account warnings;
• account restrictions.

Private Platform messages are not publicly visible merely because they are sent through Controlled Stores.

However, authorised personnel may access relevant messages where reasonably necessary for:

• support;
• investigating reports;
• fraud prevention;
• safety;
• prohibited-item investigations;
• moderation;
• legal compliance.

Verification and security information

Depending on the verification systems used by Controlled Stores, we may collect or receive:

• verified email status;
• verified phone status;
• authentication information;
• login records;
• security logs;
• IP address;
• device or browser information;
• information used to detect suspicious accounts.

If we introduce a third-party verification provider, we will update this Privacy Policy to describe how that provider handles information.

Technical information

We may collect technical information including:

• IP address;
• browser type;
• device information;
• session information;
• cookie identifiers;
• log information;
• usage information;
• security events.

2. Passwords

Authentication may be provided through Sharetribe or other infrastructure providers used by Controlled Stores.

Controlled Stores does not need to know or display a user's plaintext password in order to operate the marketplace.

Users are responsible for keeping their credentials secure.

3. Payment information

Controlled Stores does not currently process purchase payments between buyers and sellers.

We therefore do not ordinarily collect buyer credit-card information for the purchase price of user-listed goods.

If Controlled Stores later introduces paid Platform features or an integrated payment service, we will update this Privacy Policy to explain the relevant payment provider and data handling.

4. Why we use information

We may use information to:

• create and manage accounts;
• operate listings;
• provide search;
• provide marketplace messaging;
• moderate advertisements;
• enforce the Item Rules;
• detect prohibited products;
• detect scams and fraud;
• investigate user reports;
• investigate suspected stolen property;
• investigate suspected counterfeit goods;
• investigate suspicious Defence or government property;
• maintain Platform security;
• provide support;
• communicate about listings and accounts;
• improve the Platform;
• keep records of moderation decisions;
• prevent users evading account bans;
• protect users and Controlled Stores;
• comply with legal obligations;
• respond to lawful government, police, court and regulatory requests;
• send marketing where permitted and appropriately consented to.

5. Moderation and messages

Controlled Stores is a moderated marketplace.

Our moderators may review listing information before publication.

We may also review relevant account information or messages where reasonably necessary to investigate:

• a user report;
• a scam;
• prohibited goods;
• suspected stolen property;
• counterfeit goods;
• threats;
• harassment;
• Platform abuse;
• security incidents;
• unlawful conduct.

We do not promise that every message will be proactively monitored.

6. Public information

Listings are intended to be viewed by other users and may be publicly accessible.

Information visible publicly may include:

• display name;
• seller status;
• general item location;
• listing description;
• photographs;
• account age;
• seller feedback or marketplace history where that feature exists.

We do not intend to publicly display a user's private email address or telephone number unless the user expressly chooses to publish it or a specific Platform feature clearly indicates otherwise.

7. Who we may share information with

We may disclose or make information available to service providers reasonably necessary to operate Controlled Stores.

These may include:

Sharetribe — used to provide marketplace infrastructure, accounts, listings, messaging and related marketplace functionality.

Microsoft 365 — used for Controlled Stores business email and support communications.

Hosting, security, analytics and technical providers — where used to operate, secure, maintain or understand the Platform.

Other users — information a user chooses to publish in a listing or profile is available to other marketplace users. Information may also be exchanged between a buyer and seller as part of their dealings.

Related businesses — Controlled Stores and Budget Finance (budgetfinance.au) are operated by the same company. We may share information between them, including so they can contact you about relevant services.

Professional advisers — where reasonably necessary, information may be provided to lawyers, accountants, insurers or other professional advisers.

Authorities — information may be provided to police, regulators, courts, government agencies or other authorities where:

• required by law;
• authorised by law;
• necessary to respond to valid legal process;
• reasonably necessary in connection with suspected serious unlawful activity or safety concerns where disclosure is legally permitted.

8. Overseas data handling

Some technology providers used by Controlled Stores may store, process or provide access to information using infrastructure located outside Australia.

The countries involved can change as providers change infrastructure and sub-processors.

Where Australian privacy law applies to Controlled Stores, we will take steps required by applicable law in relation to cross-border handling or disclosure of personal information.

Users should understand that internet-based services commonly use globally distributed infrastructure.

9. We do not sell personal information

Controlled Stores does not sell customer lists or personal information to data brokers.

We do not operate the marketplace for the purpose of selling users' personal information.

10. Cookies and similar technology

Controlled Stores and its technology providers may use cookies and similar technologies for purposes including:

• login;
• authentication;
• security;
• maintaining sessions;
• Platform functionality;
• preferences;
• basic analytics;
• fraud prevention.

Blocking essential cookies may prevent parts of the Platform from operating correctly.

If we introduce non-essential advertising or analytics cookies, we will update our cookie disclosures and consent settings.

11. Marketing

Controlled Stores may send operational communications necessary to run the marketplace.

These may include:

• security messages;
• listing decisions;
• account notifications;
• responses to reports;
• service notices;
• important Terms or Privacy Policy changes.

Marketing communications are separate.

Where required, we obtain consent before sending commercial electronic marketing.

Marketing communications will identify Controlled Stores and provide an appropriate method to unsubscribe.

Unsubscribing from marketing does not prevent essential operational or security communications.

12. Data retention

We retain personal information only for as long as reasonably necessary for purposes such as:

• maintaining an active account;
• operating the Platform;
• resolving disputes;
• investigating scams;
• investigating prohibited listings;
• preventing repeated rule violations;
• preventing ban evasion;
• maintaining security;
• complying with legal obligations;
• responding to regulatory or legal matters.

Closing an account does not necessarily result in immediate deletion of every record.

For example, we may need to retain limited information relating to:

• removed prohibited listings;
• fraud investigations;
• account bans;
• transaction disputes;
• legal requests;
• security incidents.

Where information is no longer reasonably required, we may delete or de-identify it subject to applicable law.

13. Security

We take reasonable steps appropriate to the nature of the Platform to protect information from:

• misuse;
• interference;
• loss;
• unauthorised access;
• unauthorised modification;
• unauthorised disclosure.

No online system can be guaranteed to be completely secure.

Users should:

• use a strong password;
• not reuse passwords;
• protect verification codes;
• report suspicious account activity.

14. Access and correction

You can request access to or correction of personal information Controlled Stores holds about you by contacting support@controlledstores.com.au.

We may need to verify your identity before providing access or making certain changes.

Where applicable, requests will be handled in accordance with Australian privacy law.

15. Account deletion

Users may request account closure by contacting support@controlledstores.com.au.

We may retain information after account closure where reasonably necessary for:

• security;
• fraud prevention;
• moderation records;
• disputes;
• legal compliance;
• enforcement of account bans;
• legitimate record-keeping.

Where required by applicable law, information that is no longer needed will be deleted or de-identified.

16. Privacy complaints

If you believe Controlled Stores has mishandled your personal information, contact support@controlledstores.com.au.

Please provide enough information for us to understand and investigate the issue.

Where the Privacy Act applies and you are dissatisfied with our response, you may have the right to complain to the Office of the Australian Information Commissioner.

17. Changes to this Privacy Policy

We may update this Privacy Policy as Controlled Stores, its technology or applicable law changes.

The current version will be published on the website with an updated date.

Material changes may also be communicated to account holders where appropriate.

18. Contact

Controlled Stores A.C.N. 678 038 876 Pty Ltd ABN 34 678 038 876 support@controlledstores.com.au