Privacy policy

The competition is run by The Acacia Tree Pty Ltd, ABN 65 625 836 044, trading as The Acacia Tree Furniture, of 1048 Geographe Bay Road, Geographe WA 6280. We are responsible for the personal information collected through this site, and in this policy we are “we” and “us”.

You can reach us about anything in this policy by post at 1048 Geographe Bay Road, Geographe WA 6280, or through the contact details published at theacaciatree.com.au.

The Privacy Act 1988 generally does not apply to a business with an annual turnover of $3 million or less. We have not relied on that. This site was built to the standard of the Australian Privacy Principles, and we handle your information to that standard whether or not the Act applies to us.

Two things apply no matter what our turnover is, and we treat them as binding: the Spam Act 2003, which governs the emails we send, and the right to take action for a serious invasion of privacy, which has been available in Australia since 10 June 2025.

This policy covers the competition site. Shopping at The Acacia Tree Furniture is covered by the privacy policy published at theacaciatree.com.au.

When you enter, we collect four things about you:

• A display name. You choose it, and it is shown publicly on the leaderboard.
• An email address. We store it as you typed it, and also in a simplified form used to make sure one person cannot hold two entries.
• A postcode. Four digits. We use it to understand which parts of the country the competition reached and which of our showrooms is nearest you.
• A phone number, if you choose to give one. It is optional, and it is only used to reach you if you win and we cannot get you by email.

What the competition itself records

• Your season entry code, which is how you get back to your board.
• Every board you submit, any score guess, and the time each one arrived. Boards are kept rather than overwritten, so there is a complete history.
• Whether your email address has been verified, and when.
• That you confirmed you are 18 or over and live in Australia, and the moment you confirmed it.
• Whether you agreed to marketing, when you agreed, and the exact wording you were shown.
• A record of the emails we sent you, which kind they were, and when they were sent.
• From 9 August 2026, whether an email appears to have been opened and which links were clicked. Postmark measures opens with an invisible image and measures clicks by briefly routing the link through its secure redirect service. It may also record approximate location, browser, device or email-app information. Open figures are estimates: privacy features in some email apps can register an open even when a person did not read the message.

Two things we scramble on the way in

When you sign up we record the internet address you signed up from and the browser you used, but never in a readable form. Only a scrambled version is stored, which lets us spot duplicate entries and abuse without holding the original. It cannot be turned back.

If you create an account

An account is optional. Everything in the competition works without one. It exists so you can see your own history and change your own details.

Creating one collects two more things: your name, and a password. Your name is used to contact you if you win and is never shown publicly. The password is handled by our sign-in provider and we never see it.

Your postcode and phone number are stored in one place only, on your entry. Creating an account later does not make a second copy, which means correcting or removing them happens once and cannot leave a stale copy behind somewhere else.

What we never collect

No payment information of any kind, because entry is free and there is no way to pay us for anything on this site. No date of birth. No suburb or street address at sign-up, and no city typed as free text: the locality shown to you is worked out from your postcode, so there is only ever one location field and nothing to contradict it. We ask the winner for a delivery address after the season, and not before.

We collect the least we can and use it for the things below, and nothing else.

• Display name: to identify you on the leaderboard.
• Email address: to verify your entry, send you your code, remind you before a round locks, send your results, and contact you if you win.
• Email engagement: to confirm that important competition messages are reaching entrants, diagnose support requests, and improve the timing and clarity of those messages.
• Simplified email address: to enforce one entry per person.
• Postcode: to report on where the competition reached, and to work out which of our showrooms is nearest you.
• Phone number: to reach a winner we cannot reach by email.
• Boards and score guesses: to score the competition and to settle a query about a score.
• Scrambled sign-up details: to detect duplicate entries and abuse.
• Marketing consent: to prove we had your permission before we sent you anything, and when.

Every field on the entry form says what it is for, beside the field, before you fill it in. That is deliberate: you should know why something is being asked for at the moment you are asked.

If you leave out the display name, the email address or the postcode you cannot enter, because the competition cannot be run without them. The phone number is genuinely optional and leaving it blank changes nothing.

Reporting on postcodes is done in groups: how many entrants are near each showroom, in each state, in each region. If we ever want to email you about the showroom nearest you, that is marketing, and we only do it if you agreed to marketing.

You do not have to use your real name. Pick something you are happy for anyone to see.

Boards stay private until the round locks. After that they can be seen, which is what makes the weekly comparison work.

The display name and the email address are the two things you cannot change yourself, because the name appears on past leaderboards and the address is what keeps one entry to one person. Write to us and we will change either of them.

We set one cookie that matters to you. It remembers which entry you are, so the leaderboard can highlight your row and your board loads without you typing your code again. It holds a scrambled reference to your entry rather than the code itself, scripts on the page cannot read it, and it lasts up to 180 days.

There are no advertising cookies, no analytics cookies and no third-party trackers on this site. Nothing here follows you to another website.

Two other cookies exist for housekeeping: one remembers whether you have asked us not to show you results before you have watched, and one remembers that you have passed the access screen while the site is still private. Neither identifies you to anyone else.

Your information is held in a hosted database and is encrypted while it travels between your device and us.

Nothing in a browser can read the entrant records. The table that holds email addresses, phone numbers and postcodes is not readable by visitors at all, in any operation. It is read and written only by our server.

The table that holds account holders’ names is protected twice over: each row is restricted to the account that owns it, and the browser has no access to the table in the first place. Either measure alone would be enough.

The admin screens need a named account. Administrators are added individually and can be removed individually, there is no shared password, and every administrative action is recorded against the person who took it in a log that cannot be edited or deleted afterwards.

Those screens show email addresses and phone numbers partly hidden, because they are open during phone calls and appear in screenshots. Seeing a full address takes a deliberate export, and the export is itself recorded.

Passwords are hashed by our sign-in provider and are never visible to us, so there is no readable password store to steal.

If personal information is lost or reached by someone who should not have it, and that is likely to cause you serious harm, we will tell you and the Office of the Australian Information Commissioner as soon as we can. We treat that as our obligation whether or not the Privacy Act applies to us.

We never sell, rent or trade your personal information, and we never give it to anyone else for their own marketing. Not to a sponsor, not to a list broker, not to anyone.

We use three service providers to run the competition, and they only handle your information in order to provide those services to us:

• Vercel, which serves this website.
• Supabase, which stores the database and handles account sign-in.
• Postmark, which sends the emails.

Some of them store or process information outside Australia, including in the United States. We name the exact regions here before entries open.

Nothing is shared with any broadcaster, production company or programme. They have no part in running this competition and receive no data from it.

We may have to disclose information if the law requires it, and we would tell you unless we were prevented from doing so.

We keep the competition records, including entries and every board submitted, for 5 years after the season ends, and then delete them. Five years is the longest period any Australian state requires records of a promotion like this to be kept.

We keep the record of the winner and of the prize for as long as our accountant needs it for tax and warranty purposes.

If you unsubscribe or withdraw marketing consent, we keep the record of that request rather than deleting it, because the record is the evidence that we honoured it. It is not used to send you anything.

The record of which emails we sent you is kept for the season and for one year after it, so we can answer a question about an email that did not arrive.

There is never a charge for any of this.

If you have an account you can see and change your name, your phone number and your postcode yourself, at any time, on your profile page. Clearing your phone number there removes it outright. The record of when you confirmed you were 18 or over cannot be edited, because it is a record of something you said at a moment.

If you do not have an account, write to us and we will do it for you. Ask us for a copy of what we hold, ask us to correct it, or ask us to delete it, and we will answer within 30 days.

We reply to the email address your entry was verified with, which is how we check that a request is really from you. If you have lost access to that address, write to us and we will find another way to confirm who you are.

Deleting your information ends your entry, because the entry is the information. If you have an account, you can ask us to delete the account and keep the entry, since the two are separate.

Marketing is separate from entering, always optional, and never ticked for you. Whether you agree to it makes no difference to your entry, your score or your chance of winning.

We record what you agreed to, the wording you were shown, and when. You can withdraw at any time using the unsubscribe link in any email we send you. It works without signing in or creating an account, it keeps working for at least 30 days after the email was sent, and we action it within 5 working days.

Unsubscribing stops the round emails as well as the marketing, because it is a request to stop hearing from us. Your entry, your boards and your place on the leaderboard are untouched, and you can carry on playing by visiting the site.

This competition is for adults. Before you can enter you tick a box confirming that you are 18 or over and live in Australia, and we record the moment you ticked it. If you also create an account, that declaration is recorded on the account too.

We do not knowingly collect information about anyone under 18. If we find out an entrant is under 18 we remove the entry and delete what we hold about them.

If you think we have mishandled your information, write to us at 1048 Geographe Bay Road, Geographe WA 6280 or through the contact details published at theacaciatree.com.au. Tell us what happened and what you would like us to do. We acknowledge a complaint within 5 working days and answer it within 30 days.

If you are not satisfied with our answer, you can take it to the Office of the Australian Information Commissioner at oaic.gov.au. We do not treat that as depending on whether the Privacy Act applies to us.

If we change this policy, the new version is published on this page. If a change affects how we use information we already hold about you, we email you before it takes effect.