Privacy policy

Last updated: July 21, 2026

1. About this Privacy Policy

1.1 Tribal Sport Pty Ltd (ABN 38 981 017 861, “Tribal Sport”, “we”, “us”, “our”) operates the website at tribalsport.com.au and the online team stores hosted on that domain (together, the “Services”).

1.2 This Privacy Policy describes how we collect, hold, use and disclose your personal information when you visit our website, place an order, register an account, contact us, or interact with one of our team stores. It applies to all customers, website visitors, parents, players, club and school administrators, and other individuals whose personal information we handle.

1.3 This Privacy Policy is governed by the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs). For European Economic Area and United Kingdom residents, additional rights are set out in clause 11.

1.4 By using the Services, you acknowledge that you have read and understood this Privacy Policy.

2. Personal information we collect

2.1 The personal information we collect depends on how you interact with us. We do not collect more information than we need.

2.2 Information you provide to us directly:

2.2.1 Contact details — name, postal address, email address, phone number.

2.2.2 Order and shipping details — delivery address, billing address, items ordered, order history.

2.2.3 Account details — username (your email), password (stored securely by Shopify; we do not have access to your password), saved preferences.

2.2.4 Garment customisation details — where a team store offers customised garments (e.g. name or number on a jersey), the parent or purchaser enters the player’s first name (or surname/initial) and number as line-item attributes on their order.

2.2.5 Communications — the content of any email, phone call or written correspondence you have with our customer service team.

2.3 Information collected automatically through the Services:

2.3.1 Device and network information — IP address, browser type, operating system, device identifiers.

2.3.2 Usage information — pages visited, items viewed, items added to cart, time and date of visit, referring website.

2.3.3 Cookies and similar technologies — see clause 5.

2.4 Information we collect from third parties:

2.4.1 Payment confirmation details from our payment processor. We do not collect, store or process your credit or debit card numbers — these are handled directly by a PCI DSS Level 1 certified payment service.

2.4.2 Order routing and delivery status updates from freight providers.

2.5 We do not knowingly collect sensitive information (including health information, racial or ethnic origin, religious beliefs, sexual orientation, biometric data or criminal record information). If you provide sensitive information voluntarily, we will only use it for the purpose for which you provided it and will not retain it longer than necessary.

3. How we use your personal information

3.1 We use your personal information only for the following purposes:

3.1.1 To fulfil your order — process payment, arrange manufacturing where customisation is required, arrange shipping, process returns and exchanges.

3.1.2 To operate your account — authentication, password reset, order history, saved preferences.

3.1.3 To provide customer service — answer your enquiries, process complaints, manage returns.

3.1.4 To send transactional communications — order confirmations, shipping notifications, return updates. These are sent to fulfil your order and are not subject to marketing opt-in.

3.1.5 To send marketing communications — only to subscribers who have opted in via the newsletter signup at checkout or on our website. You can unsubscribe at any time using the link in any marketing email.

3.1.6 To improve the Services — aggregated and de-identified analytics about how the website is used.

3.1.7 For security and fraud prevention — detecting and preventing fraudulent transactions, abuse and unauthorised access.

3.1.8 To comply with legal obligations — Australian taxation, consumer law, and record-keeping requirements.

3.2 We do not use your personal information for any other purpose without first obtaining your consent or unless permitted under the Privacy Act.

4. How we disclose your personal information

4.1 We disclose your personal information only to the following categories of service providers, and only to the extent necessary for them to perform their function:

4.1.1 E-commerce and hosting platform — hosts our website, team stores, customer accounts, and order records.

4.1.2 Payment processor — processes card payments via a PCI DSS Level 1 certified service; we do not receive or store card numbers.

4.1.3 Content delivery and security — DNS, content delivery network, and web application firewall services.

4.1.4 Team store framework — multi-vendor plugin enabling school and club stores.

4.1.5 Freight providers — receives your name and delivery address to fulfil your order.

4.1.6 Manufacturing suppliers — receives customisation attributes (e.g. name, number, size) and order quantities to produce your garments.

4.1.7 Internal operations — email, document management, and order processing platforms used by Tribal Sport staff when handling your order.

4.2 Each provider is engaged under terms that require them to handle your personal information consistently with the Australian Privacy Principles.

4.3 We do not sell your personal information. We do not share it with advertising networks, data brokers, or social media platforms for audience-building purposes, except that, where you have consented via our cookie consent banner, we may share limited identifiers (such as cookie and pixel data) with third-party advertising platforms — including Meta (Facebook/Instagram) — to measure the effectiveness of our marketing and to serve relevant advertisements to you on those platforms. See clause 5 for how to manage your cookie preferences.

4.4 We may also disclose your personal information in the following circumstances:

4.4.1 Where you have consented to the disclosure.

4.4.2 Where required or authorised by Australian law or a court/tribunal order.

4.4.3 Where reasonably necessary for an enforcement-related activity by an enforcement body.

4.4.4 Where reasonably necessary to protect the safety of any individual.

4.4.5 In connection with a sale, merger or restructure of our business, subject to confidentiality protections.

4.5 Team-store administrators (school / club staff). The Services operate as team stores. When you place an order through a school’s or club’s store, the nominated administrators of that store — typically the school staff or teachers who manage the store — can access the details of orders placed in their store, including the customer’s name, email address, delivery address, the items ordered and any customisation details, for the purpose of managing, approving and fulfilling those orders. This access is standard for team and club stores. These administrators are required to handle personal information in accordance with this Privacy Policy and the Australian Privacy Principles.

4.6 Sub-processors. The following sub-processors may collect, process, store or otherwise handle personal information in connection with the Services. We review this list periodically; where a change is material, registered users are notified by email (see clause 12).

4.7 Some installed Shopify applications (e.g. product-option, bundling and pricing apps) process limited order and product data within the Shopify platform under Shopify’s sub-processor terms.

5. Cookies and tracking technologies

5.1 We use cookies and similar technologies on the Services. Some are necessary for the Services to function (for example, keeping you signed in and remembering your cart). Others support analytics and improvements to the Services. For further information about how our e-commerce platform uses cookies, see the Shopify Cookie Policy (https://www.shopify.com/legal/cookies).

5.2 Cookie categories used by Tribal Sport:

5.2.1 Strictly necessary cookies — required for the Services to operate (set automatically; cannot be disabled).

5.2.2 Functional cookies — remember your preferences and saved cart.

5.2.3 Analytics cookies — help us understand how the Services are used (set only with your consent).

5.2.4 Marketing cookies — used to measure the effectiveness of our marketing campaigns and, where you have opted in, to support remarketing on third-party advertising platforms including Meta (Facebook/Instagram). These cookies share limited identifiers (such as pixel data) with those platforms so we can show relevant advertisements to people who have previously visited our Services. They are set only with your consent and can be withdrawn at any time via the cookie consent banner or the “Cookie settings” link in the website footer.

5.3 You can manage your cookie preferences via the consent banner displayed when you first visit the Services and via the “Cookie settings” link in the website footer. You can also control cookies through your browser settings. Blocking cookies may affect the functionality of the Services.

6. Storage, security and retention

6.1 Your personal information is stored on infrastructure operated by our service providers, including cloud infrastructure located primarily in the United States and Canada, and our content delivery provider’s global edge network.

6.2 Our primary platform providers encrypt data in transit (TLS 1.2 or higher) and at rest (AES-256), and hold independent security certifications including SOC 2 Type II, ISO/IEC 27001 and PCI DSS Level 1.

6.3 Tribal Sport access to your personal information is restricted to staff and contractors who require it for their role, protected by multi-factor authentication, and reviewed periodically. Staff are bound by confidentiality obligations.

6.4 If we become aware of a data breach that is likely to result in serious harm to any individual, we will notify the Office of the Australian Information Commissioner and affected individuals in accordance with the Notifiable Data Breaches scheme under Part IIIC of the Privacy Act 1988 (Cth).

6.5 Retention periods:

6.5.1 Order records — retained for at least 7 years to comply with Australian taxation and consumer law.

6.5.2 Customer account records — retained while your account is active; inactive accounts are reviewed and anonymised after 36 months of inactivity.

6.5.3 Customer service correspondence — retained for 24 months.

6.5.4 Marketing subscriber records — retained until you unsubscribe.

6.6 We will delete or de-identify your personal information when we no longer require it, unless we are required by law to retain it longer.

7. Overseas transfers

7.1 Some of your personal information is transferred to or processed by service providers located outside Australia, including in the United States, Canada, India, Singapore, and China. Some service providers (such as content delivery networks) operate across a global edge network and may process data in multiple countries.

7.2 Where we engage overseas recipients, we take reasonable steps to ensure they handle your information consistently with the Australian Privacy Principles, including by relying on the contractual terms of those providers and their independent certifications. We remain accountable under s 16C of the Privacy Act for how overseas recipients handle your information.

7.3 Data location change notification. We will notify customers (including registered users and team-store administrators) by email at least 30 days prior to any relocation or expansion (change of country) of:

7.3.1 the cloud infrastructure hosting user data or related data, including system components; or

7.3.2 any person (vendor or cloud-infrastructure staff, external contractors or associates) with access to unencrypted customer data, or with a means of accessing or extracting unencrypted data (for example, access to encryption keys and encrypted customer data).

7.4 Notifications under clause 7.3 are issued through the email notification mechanism described in our Legal & Policy Document Change, Approval, Consent & Notification Procedure.

7.5 If you have specific questions about overseas transfers, please contact us using the details in clause 13.

8. Your rights

8.1 Under the Privacy Act 1988 (Cth), you have the right to:

8.1.1 Access the personal information we hold about you — we will respond to access requests within 30 days.

8.1.2 Correct personal information that is inaccurate, out of date, incomplete or misleading — we aim to respond within 30 days.

8.1.3 Request deletion of your personal information, where we are not required by law to retain it.

8.1.4 Object to certain uses of your personal information, including direct marketing.

8.1.5 Withdraw consent at any time where we rely on your consent (for example, marketing or non-essential cookies).

8.1.6 Opt out of direct marketing — every marketing email contains an unsubscribe link; you can also email us.

8.1.7 Manage cookies via the cookie consent banner or your browser.

8.2 To exercise any of these rights, please contact us using the details in clause 13. We do not charge a fee. We may need to verify your identity before responding.

9. Children

9.1 The Services are not directed at children. Parents and guardians may use the Services to order garments and customised apparel for their children — in this case, the parent’s account holds the order and any customisation details (such as a player’s name or number on a jersey). Tribal Sport does not create accounts for children, does not contact children directly, and does not use children’s information for marketing.

9.2 If you believe a child has provided personal information directly to us, please contact us at mytribe@tribalsport.com.au and we will delete it.

10. Complaints

10.1 If you believe we have breached this Privacy Policy or the APPs, please contact our Privacy Officer using the details in clause 13. We will acknowledge your complaint within 5 business days and respond substantively within 30 days.

10.2 If you are not satisfied with our response, you may lodge a complaint with the Office of the Australian Information Commissioner (OAIC): website www.oaic.gov.au; phone 1300 363 992.

11. Additional rights for EEA, UK and other jurisdictions

11.1 If you are a resident of the European Economic Area, the United Kingdom or another jurisdiction with applicable data protection law, you may have additional rights, including:

11.1.1 The right to restrict processing.

11.1.2 The right to object to processing.

11.1.3 The right to data portability.

11.1.4 The right to lodge a complaint with your local data protection authority.

11.2 Where GDPR or UK GDPR applies, we process your personal information on the following legal bases: contract performance (to fulfil your order and operate your account), legitimate interests (fraud prevention and service improvement), and consent (marketing communications and non-essential cookies).

11.3 For overseas transfers to or from the EEA or UK, we rely on Standard Contractual Clauses or equivalent mechanisms where applicable.

12. Changes to this Privacy Policy

12.1 We may update this Privacy Policy from time to time. We will update the “Last updated” date at the top of this Privacy Policy and post the revised policy on tribalsport.com.au. Where a change is material, registered users will be notified by email and, where required, asked to review and accept the updated Privacy Policy.

13. Contact us

13.1 Privacy Officer, Tribal Sport Pty Ltd, 45 Clarence Street, Coorparoo QLD 4151, Australia. Email: mytribe@tribalsport.com.au. Phone: 1300 880 666.

13.2 For the purposes of the Privacy Act 1988 (Cth), Tribal Sport Pty Ltd is the entity responsible for the personal information described in this Privacy Policy.