Privacy Policy

Last updated: 18 June 2026 · Version 1.0

Privacy Policy

1. Introduction

This Privacy Policy (Privacy Policy or Policy) outlines how Carmelian Productions Pty Ltd (ACN: 651 795 514) trading as MK Empire Rewards (we, us, our) collects, holds, uses and discloses personal information when you access or use our website at https://mkempirerewards.com.au/ (Website), our membership platform, member draws and/or promotional draws, giveaways, scavenger hunts, partner deals, referral program, merchandise store and related services (Services).

This information is collected, used and disclosed in accordance with the Privacy Act 1988 (Cth) (Privacy Act) and the Australian Privacy Principles (APPs).

This Privacy Policy is incorporated by reference into our Terms and Conditions (Terms). Any capitalised terms not defined in this Policy are defined in the Terms. You agree to comply with all Terms when accessing or using our Website and Services, including this Privacy Policy.

Our payment processing is handled by Stripe. The Stripe Privacy Policy applies to personal information collected, stored and processed on Stripe’s servers. We may also use this personal information for the purposes set out in this Policy.

Our online merchandise store is powered by Shopify. The Shopify Privacy Policy applies to personal information collected, stored and processed on Shopify’s servers. We may also use this personal information for the purposes set out in this Policy.

2. What information do we collect and how is it collected?

We collect personal information, as defined in the Privacy Act (including sensitive information as defined in the Privacy Act), when you access or use our Website and Services.

2.1 Personal information provided by you

We collect information that you provide to us via use of our Website and Services as well as through any other means used to contact us. The kinds of personal information we may collect include:

full name;
email address;
phone number;
date of birth or age confirmation;
residential or postal address, particularly for prize delivery;
account login details (including username and password);
membership tier and status;
subscription and payment status;
Stripe customer ID or payment reference information;
referral code, referral link, referral history and reward status;
member draw and/or promotional draw entry history and giveaway participation history;
scavenger hunt participation information, token codes, answers to verification or skill questions, and photographs, selfies or videos submitted to verify token discovery or participation;
prize and winner details, and winner verification information;
identity documents or identity verification information for higher-value prizes, where required;
photographs, videos, audio recordings, interviews, livestream clips, phone call recordings, winner reactions and social media content;
social media handles or usernames where you interact with us online;
comments, messages, reviews, challenge entries, testimonials or user-submitted content;
support requests and communications with us; and
marketing preferences and consent records.

Some information we collect may constitute sensitive information under the Privacy Act (for example, identity verification documents or photographs and recordings that reveal personal characteristics). We handle sensitive information with additional care and in accordance with the Australian Privacy Principles, and will only collect it where necessary and with your consent or as otherwise permitted by law.

We reserve the right to maintain and store any personal information where we reasonably believe that doing so is required to comply with any legal or regulatory obligation, to prevent criminal or other unlawful activity, or where we have a legitimate business reason, including collecting amounts owed, resolving disputes, enforcing our Terms or for record-keeping integrity.

2.2 Automatically collected personal information

We automatically record information from your device and its software when you access our Website and Services, including your IP address, browser and device type, internet service provider, mobile phone carrier, platform type, the website from which you came and the website to which you go when you leave our Website, date and time stamp, and cookies that may uniquely identify your browser or account.

When accessing our Website using a mobile device, we may also receive and collect identification numbers associated with your device, mobile carrier, device type and manufacturer, and, if enabled, approximate geographical location data (including GPS). Please note that some of the information we collect, for example an IP address, can sometimes be used to approximate a device's location.

2.3 Personal information collected via cookies

Our Website uses cookies and similar tracking technologies. Cookies are small data files stored on your device by your browser. We (or our third-party service providers) may use cookies and similar technologies for purposes including website analytics, conversion tracking, advertising measurement, retargeting and remarketing, referral and affiliate tracking, search engine optimization and search performance reporting, heatmap or session analytics, fraud prevention, managing user sessions, payment processing, subscription management, billing, transaction reporting and improving your user experience.

If you wish to disable cookies, you may do so through your browser settings. Please be aware that disabling certain cookies may affect the functionality of our Website and Services.

By continuing to use our Website, you consent to our use of cookies and similar tracking technologies as described in this Policy.

The Stripe platform is governed by its own Cookie Policy. We bear no responsibility for how Stripe uses your data for cookies. If you are concerned, please contact Stripe Support directly.

The Shopify platform is governed by its own Cookie Policy. We bear no responsibility for how Shopify uses your data for cookies. If you are concerned, please contact Shopify Support directly.

2.4 Personal information collected via Google Tag Manager and other tracking tools

We use Google Tag Manager and other tracking tools on our Website. Google Tag Manager is a tag management tool provided by Google LLC that allows us to deploy and manage analytics, advertising, conversion, referral, affiliate and other tracking tags. Google Tag Manager itself does not collect personal information, but it may deploy tags, including Google Analytics 4, Google Ads conversion tags, Meta Pixel, TikTok Pixel, Viral Loops tracking, Microsoft Clarity and other tools that collect information about your use of our Website as described in this Policy.

We may use a range of services and functions offered by Google. For information on how Google collects and uses your data, and how to opt out of Google Analytics tracking, please see https://policies.google.com/technologies/partner-sites and https://tools.google.com/dlpage/gaoptout.

We may later add other analytics, advertising, conversion or tracking tools, affiliate tracking, heatmap tools or fraud prevention tools. If we do, we will update this Policy where the tools utilised by us are materially different.

2.5 Personal information collected via Meta Pixels

We use Meta Pixel (formerly Facebook Pixel) on our Website. Meta Pixel collects data through cookies and other tracking technologies about your interactions with our Website, such as pages viewed, links clicked and actions taken (including sign-up and checkout events). We use Meta Pixel to measure conversions from our Facebook and Instagram advertisements, optimise campaigns, build targeted and lookalike audiences, and conduct retargeting and remarketing.

Meta Pixel may collect information such as your IP address, browser and device information, pages visited, website interactions, referral source, and cookie or device identifiers. This information may be transmitted to and processed by Meta in the United States and other countries. Meta’s Data Policy is available at https://www.facebook.com/privacy/policy/.

We may use a range of services and functions offered by Meta Business Tools. Please note we are not liable for the way Meta uses your information. You can access Meta Business Tools Terms here.

These third-party tools may collect or receive information about your interactions with our Website and Services, including pages viewed, links clicked, sign-up and checkout events, referral source, cookie or device identifiers, IP address, browser and device information, token or referral information, and transaction or subscription events. We use this information for analytics, advertising and retargeting, conversion tracking, referral and affiliate tracking, search engine optimisation and search performance reporting, payment processing, subscription management, billing, fraud prevention and transaction reporting.

2.6 Third party payment processor

We use third-party payment processors and gateways to process payments made to us in the provision of our Services. All personal information, including any financial information such as credit card numbers, is collected and used directly by our third-party payment processors. We do not store or retain sensitive financial information such as credit card numbers or bank account details obtained in connection with processing such payments.

2.7 Anonymity and the use of pseudonyms

When we collect your personal information, as far as reasonably practicable, you are permitted to interact with and/or contact us anonymously or by using a pseudonym, except where:

(a) we are required or authorised by a law or a court or tribunal order to deal with identified individuals; or
(b) it is impracticable for us to deal with individuals who have not identified themselves, for example when processing membership applications, draw entries, prize claims or payments.

3. For what purposes do we collect and use personal information?

3.1 Use of personal information

We collect your personal information as outlined in this Privacy Policy for the purposes described below:

(a) for provision of the Services which shall include without limitation fulfilling your Orders;
(b) for communication with you and to provide messaging and/or communications to you in association with the functions and features of the Website;
(c) for communicating to you any announcements and updates, updated terms, conditions and policies, security alerts, technical notices, support and administrative messages, for analysis, monitoring, development and improvement of our Website and Services, including other products or services;
(d) for security purposes, including to protect the Website and our property from abuse, fraud, malicious, unauthorised access or potentially illegal activities, and to protect our rights, safety and property and that of our other users;
(e) to manage membership tiers, billing, subscription status, upgrades, downgrades, cancellations and failed payments;
(f) to process payments through Stripe and provide member benefits, partner deals and discounts;
(g) to manage our referral program and referral rewards;
(h) to allocate and track draw entries, conduct member and/or promotional draws, and select, contact and verify winners;
(i) to deliver prizes and conduct identity or KYC verification checks for higher-value prizes where required;
(j) to record and publish winner proof, winner calls, winner reactions, photographs, videos and testimonials where consent has been obtained or where permitted by our Terms;
(k) to run scavenger hunts, manage clue access, verify token codes, assess skill questions and verify submitted photographs, selfies or other evidence of token discovery or participation;
(l) to send service messages, membership updates, draw updates, deal updates, customer support communications and marketing communications where permitted;
(m) to improve our Website, offers, promotions and user experience;
(n) to analyse traffic, engagement, referrals, conversions and advertising performance, including through Meta Pixel and Google Tag Manager;
(o) to detect and prevent fraud, fake accounts, referral abuse, chargeback abuse, bot activity and suspicious behaviour;
(p) to protect the safety and security of our users, members, partners, staff and business; and
(q) to comply with our legal, tax, accounting, regulatory, permit, trade promotion and reporting obligations.

4. Winner content, photographs, videos and recordings

As part of our promotional activities, we may collect, record, use and publish winner-related content, including winner phone calls and voicemails, winner reactions and responses, first name, photographs, videos, livestream clips, social media screenshots, interview recordings, testimonials and prize handover content. This content may be published on our Instagram, TikTok, YouTube, Facebook and other social media accounts, our Website, in email communications, in paid advertising campaigns, and through other promotional channels.

By participating in a member and/or promotional draw or giveaway, you consent to us recording, using and publishing your winner content (including your first name, photograph, video, testimonial and winner reaction) for the promotional purposes described in this Policy, subject to the terms of any separate winner agreement or consent form we may ask you to sign as a condition of claiming your prize. Where we wish to use winner content in paid advertising, we will seek your additional express consent before doing so, where required by applicable law.

We will not publish your full name, residential address or other sensitive identifying information without your express consent.

5. Winner verification and identity checks

For higher-value prizes, we may be required to verify your identity and eligibility before awarding a prize. This may involve collecting government-issued photo identification, proof of age, proof of address, phone and email verification, a signed prize acceptance form, and bank or payment details where a cash prize or cash alternative is awarded.

Where a scavenger hunt requires participants to locate a token, submit a token code, answer a skill question or provide photographic evidence or a selfie, we may collect and use that information to verify participation, eligibility and prize entitlement.

Identity and verification information will be used solely to verify your eligibility to receive the prize and for compliance with applicable trade promotion permit conditions. Identity documents will be stored securely, accessed only by authorised personnel, and retained only for as long as necessary to complete verification and resolve any related disputes. We will delete or de-identify identity documents when they are no longer required, unless we are required by law or permit conditions to retain them for longer.

6. How do we store and protect your information?

6.1 Storage of personal information

We take reasonable steps to protect your personal information in accordance with this Privacy Policy. The personal information we collect from you is transferred and stored electronically via a secured SSL connection, in secured, password-protected servers located in Australia. You agree and consent to us storing your personal information on such servers.

We take reasonable steps to protect your personal information in accordance with this Privacy Policy. The personal information we collect from you is transferred and stored electronically via a secured SSL connection, in secured Shopify servers, subject to change as required by Shopify (if such information is held on the Shopify system) or in password-protected servers located worldwide in locations such as North America, Europe, Asia and Australia. You agree and consent to us storing your personal information on such servers.

We take reasonable steps to protect your personal information in accordance with this Privacy Policy. The personal information we collect from you is transferred and stored electronically via a secured SSL connection, in secured Stripe servers, subject to change as required by Stripe (if such information is held on the Stripe system) or in password-protected servers located worldwide in locations such as Canada, New Zealand, United States, United Kingdom, Singapore, Ireland, Germany, France, Netherlands, Sweden, Denmark, Finland, Belgium, Italy, Spain, Portugal, Norway, Czech Republic, Austria, Switzerland, Malaysia and Australia. You agree and consent to us storing your personal information on such servers.

6.2 Who can access your personal information?

Your personal information is accessible to our employees, contractors and authorised third-party service providers on a need-to-know basis. We may also store your personal information in password-protected email databases for the purpose of sending communications and marketing emails in accordance with this Policy.

Please note that no method of electronic transmission or storage is 100% secure and we cannot guarantee the absolute security of your personal information. Transmission of personal information over the internet is at your own risk, and you should only enter personal information on our Website within a secure environment. It is your responsibility to ensure that you keep your personal information safe, including keeping your software up to date to prevent security breaches.

We reserve the right to maintain and store any information or data where, we reasonably believe, in our sole discretion, that such action is required to comply with any legal or regulatory obligations, to prevent criminal or other unlawful activity whether immediate or in the future, or where we have a legitimate business reason, including collecting amounts owed, resolving disputes, enforcing our Terms or for record-keeping integrity.

We destroy or de-identify your personal information when it is no longer needed for the purposes outlined in this Policy, subject to our legal obligations to retain certain records for longer periods under applicable laws.

7. To whom your personal information is disclosed?

Your personal information may be disclosed to individuals and companies for the purposes described in this Policy, as outlined below.

7.1 Carmelian Productions Pty Ltd and Related Bodies Corporate

Your personal information may be accessed by us, including our directors, employees, officers and contractors. You consent to us providing your personal information, including sensitive information, to our related bodies corporate (as defined in the Corporations Act 2001 (Cth)).

7.2 Parties required by law

Your personal information may be disclosed by us to any party to whom we are required by law to provide it, or where we reasonably believe that disclosure is required to comply with any court orders, subpoenas, or other legal process or investigation including by tax authorities. Where possible and appropriate, we will notify you if we are required by law to disclose your personal information.

7.3 Direct marketing

You agree and expressly consent to us using or disclosing your personal information (other than sensitive information) to keep you informed about our products, services and other products and services that may be of interest to you, in accordance with the Spam Act 2003 (Cth) and this Policy. You can opt out of direct marketing communications at any time by clicking the “Unsubscribe” link in any marketing email or by contacting us.

We may send you the following types of communications: welcome emails; account-related emails; membership and billing notifications; subscription renewal or failed payment notifications; member and/or promotion or giveaway draw reminders and updates; winner announcements; partner deal emails; referral program updates; scavenger hunt updates; grand opening and founding member offer communications; important website, account, legal or policy update notifications; customer support replies; and abandoned sign-up or checkout reminder emails, where legally permitted.

Even if you opt out of marketing communications, we may still send you important service and account-related messages, including billing and subscription notifications, membership status updates, member and/or promotion or giveaway draw eligibility notifications, prize claim and winner verification communications, legal and policy updates, security alerts, and customer support replies. These service messages are necessary for the operation of your account and will continue regardless of your marketing preferences.

We do not currently send SMS marketing communications. However, we may contact you by phone or SMS for operational purposes, including to notify you of a prize win, to conduct winner verification, or for urgent account or prize delivery matters. Such contact is operational in nature and does not constitute marketing.

We do not currently use push notifications. If we introduce push notifications in the future, we will update this Policy and obtain any required consent.

We may use Meta Pixel, TikTok Pixel, Google Tag Manager, Google Analytics 4, Google Ads tracking, Viral Loops tracking, affiliate tracking and other advertising, analytics and referral tools to display targeted advertisements to you on third-party platforms based on your previous interactions with our Website (retargeting and remarketing). You may opt out of interest-based advertising through your account settings on the relevant platforms.

7.4 Other third parties

We may share your personal information with third parties where reasonably related to the provision of our Services and for the other purposes as outlined in this Policy, including:

Stripe — for payment processing, subscription management and billing portal;
Supabase — for database hosting and back-end infrastructure;
Shopify — for our online merchandise store;
shipping, courier and fulfilment providers — for merchandise orders and prize delivery;
email marketing platforms and customer support tools;
analytics providers and advertising platforms (including Google Tag Manager, Google Analytics 4, Google Ads, Meta Pixel, TikTok Pixel, Google Search Console, Microsoft Clarity and similar tools);
social media platforms — where winner or promotional content is published;
random draw providers — to conduct and verify member and/or promotion or giveaway draws;
identity verification and KYC providers — for winner verification where required;
prize suppliers;
referral platforms, affiliate networks and partner brands or retailers — to provide member deals and prizes;
accountants, lawyers, insurers and professional advisers; and
regulators, government bodies, law enforcement and trade promotion permit authorities, where required.

We may also share your personal information where necessary to identify, contact or bring legal action against anyone damaging or interfering with our rights or property, to protect against harm to the rights, property or safety of us, our users or the public, or in connection with a company transaction such as a merger, sale of assets, change of control or acquisition.

7.5 Overseas disclosure

Please note that some of the parties listed above to whom your personal information may be disclosed may be located overseas, including in the United States, Canada, the United Kingdom, Ireland, Singapore, Germany, France, the Netherlands and other countries where our technology partners operate.

We use reasonable steps to ensure that these parties are either governed by substantially similar and enforceable privacy laws to the Australian Privacy Principles, or adhere to the Australian Privacy Principles. However, by providing your personal information to us, you acknowledge and consent to the disclosure of your personal information to such overseas recipients.

8. Third party websites and social media

Our Website may, from time to time, contain links to and from websites which are owned or operated by other parties. You acknowledge and agree that we have no control over, and shall not be liable for, the privacy practices or content of these third-party websites. You are responsible for checking the privacy policy of any such third-party websites so that you can be informed of how they handle personal information.

We operate pages on social media platforms including Facebook, Instagram, TikTok and YouTube (Social Media Platforms). By accessing and using our social media pages, you agree to the terms and privacy policies of those Social Media Platforms. Those platforms may collect your information independently of us, and we hold no responsibility for such privacy practices.

Social Media Platforms may allow public access to your public profile, including your username, age range and other publicly available information. We may from time to time have access to statistics and insights regarding user interactions with our social media pages and may use such information for marketing and promotion purposes.

9. Data retention

We retain personal information only for as long as is necessary for the purposes for which it was collected, or as required by applicable law, regulation or legitimate business need. When personal information is no longer required, we destroy or de-identify it securely.

As a general guide: account and membership information is retained while your account is active and for a reasonable period after closure; payment and transaction records are retained for the period required by taxation and corporations legislation (generally a minimum of seven years); draw and promotion records are retained as required by trade promotion permit conditions; identity verification documents are deleted or de-identified once winner verification is complete and any related disputes are resolved (unless longer retention is legally required); and marketing consent records are retained for the period needed to demonstrate compliance with direct marketing obligations.

10. How can you access or update your personal information?

At any time, you may request access to personal information we hold about you. We may refuse to provide access if the law allows us to do so, in which case we will provide reasons for our decision as required by law.

We take reasonable steps to keep your personal information accurate, complete and up to date. If, at any time, you discover that information held about you is incorrect, you may contact us to have the information corrected.

You may request access to the information we hold about you, or request that we delete, update or correct any personal information, by setting out your request in writing and sending it to us using the contact details in the Contact Us section below. We may need to verify your identity before responding to your request.

We will process your request as soon as reasonably practicable, provided we are not otherwise prevented from doing so on legal grounds. If we are unable to meet your request, we will let you know why. Please note that we may be unable to delete certain information where required by law or needed to resolve a dispute, enforce our Terms or comply with our legal obligations.

11. How can you make a complaint about our privacy practices?

You may submit a written complaint about how we handle your personal information to our Privacy Officer at privacy@mkempirerewards.com.au or support@mkempirerewards.com.au. Please provide full details of your complaint and any supporting information. We will acknowledge your complaint and aim to respond within 30 days, or within a reasonable period if the matter is complex.

If you are not satisfied with our handling of your complaint or we have not replied within a reasonable period of time, you are entitled to make a complaint to the Office of the Australian Information Commissioner (OAIC).

12. Amendments

We reserve the right to amend this Privacy Policy from time to time with reasonable notice to you. While we endeavour to notify you as soon as reasonably possible of any changes by email or by a notice on our Website, it is your responsibility to keep up to date with any changes or amendments by checking this page prior to using our Website and Services. This page contains the most accurate and up-to-date version of our Privacy Policy.

13. Contact us

All requests for access or corrections to your Personal Information and complaints should be directed to our Privacy Officer. If submitting a complaint, please provide our Privacy Officer with full details of your complaint and any supporting documentation:

(a) by contact form on our Website;
(b) by e-mail to: privacy@mkempirerewards.com.au; or
(c) by letter to The Privacy Officer, PO Box W180, 1102 Sturt Street, Ballarat Central, VIC 3350.

14. Application of GDPR

For the purpose of clarity, we process personal data of individuals in the European Union (EU) only occasionally. While we have not designated an EU representative at this time, we remain committed to compliance with applicable GDPR requirements. However, the General Data Protection Regulation (GDPR) (EU) 2016/679 may apply to you if you are a resident of, reside in, or are located in the EU.

If the GDPR applies, in this Privacy Policy, “Personal Information” shall also include the definition of “Personal Data” under the GDPR and terms defined in the GDPR shall be defined in accordance with the GDPR.

If the GDPR applies, this paragraph applies in addition to the above paragraphs to the extent that we are acting as a “Data Controller” with respect to your personal information.

14.1 Consent and right to withdraw consent

By clicking accept to this Privacy Policy or otherwise notifying us of your acceptance, you acknowledge that you are providing express, freely given consent to us processing your personal information for the purposes outlined in this Policy. We will only process your personal information in accordance with this Policy and applicable laws.

To the extent that our legal basis for processing your personal information is consent, you have a right to withdraw consent at any time by sending us a written request via the contact details above.

14.2 Legal basis

Our legal bases for collecting and processing your personal information may be:

(a) your express consent;
(b) our legitimate interests in providing information about our Services, providing the Services, and improving and developing the Services; and/or
(c) in order to perform a contract with you for the provision of paid Services.

14.3 Your rights

We have summarised your key rights under the GDPR below. You may exercise these rights by contacting us using the contact details above.

(a) Right of access — You have the right to obtain confirmation as to whether your personal information is being processed and, if so, to request access to it. The first copy will be provided free of charge; additional copies may be subject to a reasonable fee.
(b) Right of rectification — You have the right to obtain the rectification of inaccurate personal information and to have incomplete personal information completed.
(c) Right to erasure — You have the right to request deletion of your personal information without undue delay in certain circumstances, including where it is no longer necessary for the purposes for which it was collected, you withdraw consent, or it has been unlawfully processed. Exceptions apply where processing is necessary for compliance with a legal obligation or for the establishment, exercise or defence of legal claims.
(d) Right to restriction of processing — You have the right to restrict the processing of your Personal Information if:

you contest the accuracy of the Personal Information;

(i) processing is unlawful but you oppose erasure;
(ii) we no longer need the Personal Information for the purposes of our processing, but you require Personal Information for the establishment, exercise or defence of legal claims; or
(iii) you have objected to processing, pending the verification of that objection.

Where processing has been restricted on this basis, we may continue to store your Personal Information, however we will only process it with your consent, for the establishment, exercise or defence of legal claims, for the protection of the rights of another natural or legal person, or for reasons of important public interest.

(e) Right to data portability

To the extent where your Personal Information has been provided based on consent, under a contract, or where processing is carried out by automated means, you have a right to receive Personal Information concerning you in a structured, commonly used and machine-readable format and you have a right to transmit that data to a Data Controller, except where this would adversely affect the rights and freedoms of others.

(f) Right to object — You have the right to object to our processing of your personal information for direct marketing purposes. If you make such an objection, we will cease processing your personal information for that purpose.