Kanga Gardening

Privacy policy

Effective 11/10/2026. This version replaces every earlier one.

Kanga Gardening is a sole trader business (ABN 12 317 309 473) based in Edithvale, Victoria, and run by its owner, Tim Le Grand. This policy sets out what personal information we collect, why we collect it, who else handles it and where they are, and how you can see, correct or delete what we hold. It is written to be accurate rather than long.

What we collect

From the quote forms on the home page and service pages: your name, a phone number or an email address so that we can reply, and the site address or suburb and a message if you choose to add them. Only your name and one way to reach you are required.

From the contact page form: your name, your email address and your message. All three are required.

From the lawn height request card at /lawn: the property address, the unit or townhouse number and your height preference, plus the optional detail you choose to add. This card asks for no name and no contact details.

From the feedback card at /feedback: whatever you write in the message, which is the only required field. A name and a phone number or email are optional, and a card left blank arrives with no name attached. A tag on the QR code tells us which site the card came from, not who sent it.

If you call, text, email or write to us: your contact details and whatever you choose to tell us. Correspondence is kept as an ordinary business record.

If you become a client: contact details for the site, committee or manager, access details such as a gate code where you give one to us, the scope and schedule we agree, invoicing details, and photographs of the site as described below.

Automatically, when you load a page: your IP address and the ordinary details of the request reach Cloudflare, which serves this site, and a page view is counted by Cloudflare Web Analytics, by Google Analytics, by Microsoft Clarity and by the Microsoft Advertising tag. None of those identifies you by name. The Google tag described under Cookies and analytics runs on every page. The profiles page also shows two directory badges whose images come from the servers of ShowMeLocal and Service.com.au, so opening that page sends those two companies your IP address and the address of this website. No other page loads anything from them.

We do not take payments through this website and we hold no card details for anyone. Invoices are paid by bank transfer, so the only payment information we hold is what appears on a bank statement.

Why we collect it

To answer your enquiry, quote your site and arrange a walkthrough. To schedule and carry out the work, and to write the seasonal condition reports for your site. To invoice you, and to keep the tax and business records the law requires us to keep. That is the whole list. We do not sell, rent or trade personal information, and we do not use it to build profiles of people.

Who else handles it, and where they are

An enquiry sent through this website is handled overseas before it reaches us. Three providers are involved, and it is worth being plain about them.

• Web3Forms (India). The enquiry forms on this site post to api.web3forms.com, a third-party form service operated from India. It turns your submission into an email and sends it to us, so everything you type into a form passes through it. Its email delivery routes through overseas providers.
• Cloudflare (United States). This site is hosted and served on Cloudflare Pages, so Cloudflare processes every request made to it, including your IP address. Cloudflare is a United States company operating servers in many countries.
• Google (United States). Enquiry emails arrive in a Gmail mailbox, so Google holds that correspondence on its servers.

If you would rather your details did not travel, call or text 0406 937 593 instead of using the form or emailing us.

Beyond those three we disclose personal information only where we have to: to our insurer or accountant if a claim or a tax matter requires it, to a debt recovery service if an invoice is left unpaid, or where a law, a court or a tribunal requires it. We do not hand your details to other contractors, list brokers or marketers.

Cookies and analytics

Since 21/09/2026 this website carries the Google tag on every page, and it does two things. It runs Google Ads conversion tracking, which we use to see whether our Google advertising brings in enquiries, and since 26/09/2026 it runs Google Analytics, which we use to see how visitors move through the site, for example which pages get read, how long people stay, how far down a page they read, which FAQ answers get opened, which documents get downloaded, which quote or call button gets pressed, and whether an enquiry form that was started gets sent. For a form we record which field was touched last, how many fields were filled in and whether a phone number or an email was given, never what was typed. On any visit, Google's tag sets its own cookies. The advertising measurement cookie lasts up to 90 days. The Google Analytics cookies, named _ga and _ga followed by the property code, last up to two years and tell one visit from the next without identifying you by name. Google may also set a short-lived test cookie on its doubleclick.net domain. If you arrive here from one of our Google ads, Google also records the ad click and this site keeps the click reference in a cookie of its own for 90 days, so that an enquiry you send can be matched to the ad that brought you. If you then send an enquiry, the email address and phone number you type may be passed to Google Ads and Google Analytics in a hashed form to improve that matching, and for nothing else.

If you arrive here from one of our Google ads, the phone number shown on this site, and the number behind the Call button, may be replaced by a Google forwarding number. It rings the same phone. It lets Google tell us that the ad led to a call, with the time of the call, how long it lasted, whether it was answered and the number it came from. Visitors who did not arrive from an ad always see our own number.

Google Analytics on this site has Google signals switched on. That means if you are signed in to a Google account that has ads personalisation turned on, Google may combine what it sees here with that account, for aggregated reporting and so that our ads can be shown again to people who have visited this site. We only ever see totals, never individuals, and Google Analytics does not store your IP address. Event level data held by Google Analytics is kept for fourteen months and then deleted by Google. We do not use any of it to build profiles of people.

You can manage Google's advertising settings at adssettings.google.com, you can stop Google Analytics in every browser with Google's opt-out add-on at tools.google.com/dlpage/gaoptout, and blocking cookies in your browser switches all of this off without affecting the forms. Beyond that, this website sets two small cookies of its own, named kg_ft and kg_lt, from 27/09/2026. They record how you first reached the site and how you most recently reached it, for example a search engine, an AI assistant, another website, a link we tagged, or one of our Google or Microsoft ads and the campaign and keyword that ad belonged to, together with the page you landed on and the date. They hold no name, no email address and nothing you type, they last 90 days, and blocking cookies switches them off without affecting the forms. If you send an enquiry, that record and the visit identifier from Google's _ga cookie travel with it in hidden form fields, so that we know which channel the enquiry came through and can match it to our own analytics. A browser that we use ourselves can be marked with one further cookie, kg_owner, which switches off all of the measurement described on this page for that browser so that our own visits are not counted. It is set only by a link that we open ourselves, never by an ordinary visit. The site keeps nothing in your browser's local storage. It holds three short-lived markers in session storage, which your browser clears when the tab closes. One is set while an enquiry form is being sent and cleared on the thank you page, one counts the pages opened during the visit, and one notes that the visit has already been counted as an engaged visit, so that it is only counted once.

Cloudflare Web Analytics runs on every page, so we can see which pages actually get read. It is cookieless and it does not fingerprint your device or follow you around other websites. It does process the request your browser makes, and that request includes your IP address.

Microsoft Clarity runs on every page from 27/09/2026. It records how visitors move through a page, where they scroll, tap and click, and can replay a visit as an anonymised recording, so we can see where a page confuses people and fix it. Clarity masks what people type into forms, so we never see names, emails or messages in a recording. It sets its own cookies, named _clck and _clsk, which last up to a year and a day respectively and tell one visit from the next without identifying you, and Microsoft processes that data in the United States under its own privacy statement at privacy.microsoft.com. Blocking cookies or scripts in your browser switches it off without affecting the forms.

Microsoft Advertising measurement runs on every page from 28/09/2026, through Microsoft's Universal Event Tracking tag, and does for our Microsoft and Bing advertising what the Google tag does for our Google advertising. It counts page views, enquiries, engaged visits, email clicks and phone taps so we can see whether those ads bring in work. It sets its own cookies, named _uetsid and _uetvid, which last one day and thirteen months respectively and tell one visit from the next without identifying you, and Microsoft may set a MUID cookie on its bing.com domain. If you arrive here from one of our Microsoft ads, the click reference in the address is kept in this site's own click cookie for 90 days, exactly as for a Google ad, and if you then send an enquiry the email address and phone number you type may be passed to Microsoft in a hashed form to improve that matching, and for nothing else. Microsoft processes that data in the United States under its privacy statement at privacy.microsoft.com, you can manage its advertising settings at account.microsoft.com/privacy/ad-settings, and blocking cookies or scripts in your browser switches it off without affecting the forms.

Photographs of sites

We photograph the sites we maintain. The photos are used for two things: the seasonal condition reports that go to the client, committee or manager for that site, and marketing on this website and our social accounts.

We do not publish a recognisable image of private property without the owner's consent. Where a photo is published, it is captioned by suburb and never by street address, and we leave out house numbers and anything else that would let a stranger identify the property. We do not publish photographs of people without their consent. If a photo of your property is already published and you want it taken down, email or ring and it comes down. You do not have to give a reason.

How long we keep it

Enquiries that do not turn into work are kept for up to two years, so we can pick up the thread if you come back to us, and are then deleted. Web3Forms, which carries the form submissions, holds its own copy of each submission for up to three years and then deletes it automatically. Client records are kept while you are a client. When an agreement ends, the records that touch on money, meaning invoices and the bank records behind them, are kept for at least five years because tax law requires it, and the rest is deleted within twelve months. Photographs are kept until you ask us to remove them.

How we keep it safe

There are no staff. Tim Le Grand is the only person in the business who sees your details. The mailbox and the tools used to run the business are protected with unique passwords and two-factor authentication, and the devices they are used on are locked with a passcode. Paper records are kept to a minimum.

No arrangement is perfect. If something goes wrong and information about you is exposed in a way likely to cause you serious harm, we will tell you what happened, what was involved and what we are doing about it, and we will do it promptly rather than quietly.

How to see or correct what we hold

You can ask for a copy of the personal information we hold about you, ask us to correct it, or ask us to delete it. The steps are:

• Email hello@kangagardening.com.au with "Privacy request" in the subject line, call or text 0406 937 593, or write to Kanga Gardening, Edithvale VIC 3196.
• Tell us which you want: a copy, a correction, or deletion. If it is a correction, tell us what the right detail is.
• We may need to check that you are who you say you are. For an existing client that is usually a call back on the number we already hold.
• We will reply within 30 days. There is no charge for asking and no charge for a correction. If a request would take real digging, we will tell you what it would cost before we start, and you can decide.
• If we cannot do what you have asked, we will give you the reasons in writing. The usual ones are that a record has to be kept for tax purposes, or that the information is about someone else as well as you. We will still do the part we can do.

If we hold health information about you

We do not ask for health information and we do not go looking for it. A little reaches us anyway from time to time, for example when a resident tells us about an allergy or a chemical sensitivity so a spray can be planned around it, or when a subcontractor gives us a medical detail relevant to working safely.

The Health Records Act 2001 (Vic) applies to any organisation holding health information in Victoria, whatever its size. If we hold health information about you and you want access to it:

• Ask in writing. Include your full name, address and date of birth, and say what you want: to view the record, a copy of it, or a summary of it.
• We may ask you to prove your identity before we hand anything over.
• We will respond without unreasonable delay, and within 45 days at the latest.
• If we refuse, we will give you the reasons in writing.
• Copying fees are capped by regulation. In practice anything we hold will be a line in an email, and we will simply send it to you at no charge.
• If you are unhappy with how we handle it, the Health Complaints Commissioner (Victoria) takes complaints on 1300 582 113 or at hcc.vic.gov.au.

Marketing

We will reply to your enquiry, and we will contact you about a quote you have asked for or about work in progress. We will not add you to a mailing list, we will not send you marketing, and we will not pass your details to anyone who would. If that ever changes we will ask your permission first and there will be an obvious way out. That is what the Spam Act 2003 (Cth) requires, and it is also how we prefer to work.

Complaints

If you think we have mishandled information about you, tell Tim directly, by email or on the phone. Say what happened and what you would like done about it. We will acknowledge it within 5 business days and give you an answer within 30 days.

If that does not settle it:

• For health information, the Health Complaints Commissioner (Victoria), 1300 582 113, hcc.vic.gov.au.
• For anything else, the Office of the Australian Information Commissioner, 1300 363 992, oaic.gov.au. Because of the small business exemption described below, the OAIC may not have power to investigate a complaint against us, but it can still give you advice.
• If you believe this policy itself is inaccurate or misleading, that is a matter for Consumer Affairs Victoria on 1300 55 81 81, or for the ACCC.

Where this policy stands legally

Kanga Gardening is a sole trader operating below the $3 million annual turnover threshold in section 6D of the Privacy Act 1988 (Cth). A business that size is generally not covered by that Act and is not bound by the Australian Privacy Principles. We are not claiming otherwise, and we have not opted in.

What that means in practice is that this policy is a commitment we are making to you rather than a form we are obliged to file. As a matter of practice we handle personal information consistently with the Australian Privacy Principles, because it is the sensible standard and because the managers and committees we work for expect it.

Some things apply regardless of that exemption. Victorian health records law applies to anyone holding health information, as set out above. Since 10 June 2025 there has also been a statutory cause of action for a serious invasion of privacy, which carries no small business exemption, and that is one reason we are careful about site photography. And because this policy is published in the course of business, it would be misleading conduct under the Australian Consumer Law if it were inaccurate. That is why it names the actual providers instead of talking about trusted third parties.

Who to contact

Tim Le Grand, owner, Kanga Gardening.
Email: hello@kangagardening.com.au
Phone: 0406 937 593, Mon-Fri 8:00-17:00, Sat 9:00-13:00, Sun closed.
Post: Kanga Gardening, Edithvale VIC 3196.
ABN 12 317 309 473.

Kanga is a service-area business working from a vehicle and from client sites, so there is no shopfront address to publish. Email or phone will reach us a good deal faster than post.

Changes to this policy

If this policy changes, the new version goes up on this page with a new effective date. We will not backdate a change. This version is effective from 11/10/2026.