Privacy, in plain English.

Website enquiries.

Crescent saves website enquiries securely and uses email notifications to help respond. A submission confirms receipt of your request; it does not confirm product availability, supply terms or a response time.

Who is responsible.

The website operator is Yum Cha Group Pty Ltd, ABN 55 660 717 466, trading as Crescent Yum Cha.

The privacy contact is privacy@crescentyumcha.com.au.

What forms collect.

Crescent collects only the details needed for the chosen request:

• Consumer demand: location, retailer and product interest, with an optional email only when a person separately asks for availability updates.
• Retail trade: business, contact and ranging-enquiry details.
• Food service: business, contact, distributor and enquiry details, with a separate required acknowledgement before information is shared with a selected distributor.
• General contact: name, email, enquiry type and message, plus limited conditional details when relevant.

These forms do not request phone, SMS or WhatsApp details, attachments, payment data or account credentials. Please do not include unnecessary sensitive information in your message.

How information may be used or shared.

Crescent may use submitted information to understand demand, assess a retail or food-service enquiry, manage a message and provide a one-to-one response.

Consumer-demand information may be shared only in de-identified or area-level form with retailers and distributors. An optional consumer email address is not shared through that pathway.

Food-service information may be shared only with the distributor or distributors selected by the business, using the approved minimum fields and only after the required acknowledgement. A form submission does not create marketing permission.

Cloudflare hosts the website, stores enquiry records and provides Turnstile security checks. Its database has an Oceania location hint; this does not guarantee that processing stays in Australia. Turnstile processes network and device signals to help distinguish people from automated traffic.

Resend sends enquiry notifications from Tokyo, Japan, and stores email content and delivery records in the United States. Crescent receives these emails through Google Workspace. These services may use subprocessors and process information overseas. Crescent does not promise Australian-only storage.

Provider information: Cloudflare Turnstile privacy notice, Resend processing and retention and Resend subprocessors. Provider statements do not replace Crescent's responsibility for its own handling of enquiries.

Retention periods.

We delete information earlier when it is no longer needed for its recorded purpose, unless an applicable hold requires retention.

Anonymous consumer demand

24 months, then delete the raw record or irreversibly de-identify it.

Consumer demand with email

24 months after the last meaningful activity or renewal. Withdrawal stops future contact and removes the email promptly, subject to minimum evidence that may need to remain.

Retail trade and food service

3 years after the last meaningful contact, unless the business becomes a customer or a specific legal hold applies.

Ordinary general contact and privacy requests

2 years after the matter is resolved. Privacy requests retain restricted access; choosing a privacy enquiry does not automatically extend retention.

Serious product-safety complaints or serious privacy disputes

Up to 7 years after resolution only where Rowan records a specific continuing reason. This is a business retention ceiling, not a statutory minimum. Access is restricted, the need is reviewed at least annually and information is deleted earlier when no longer needed. Applicable legal or court-order holds are recorded and reviewed separately.

Email delivery and replay audit

12 months after delivery or failure is resolved, without keeping message payload copies in logs.

Deletion must cover the enquiry database, related mailbox copies and any exports, rather than only the main record. Crescent's Google mailbox does not automatically delete enquiries when database retention ends; Rowan reviews due copies monthly and when an accepted deletion request requires action. Google's Trash and administrator recovery windows can retain deleted mail temporarily. Local mail apps, forwards and exports are checked separately. Resend publishes a 30-day email/log retention period and seven-day backup retention; early removal requires contacting Resend. Cloudflare database recovery history can retain earlier copies for seven days on Free or 30 days on Paid. Those are provider limits, not proof that a particular record or every copy has been deleted. Lawful holds or other justified retention may affect a request.

Cookies and analytics.

Turnstile protects forms from automated submissions. Cloudflare Access protects operator actions. The form keeps a random retry key in session storage so a retry does not create a duplicate; it does not store submitted form values there.

Optional Cloudflare Web Analytics measures page visits and loading performance only after you choose Allow analytics. Choose Keep analytics off, or change your choice using Analytics choices at the foot of a page. Turning analytics off stops new reports on the current page. When the change is saved or the old choice is removed, other open Crescent tabs receive the change and future page visits stay off. A page refreshes if its analytics script has loaded. Reports already sent are not withdrawn.

Your accepted or rejected choice is stored in this browser for up to 180 days, without a visitor identifier or form values. Clearing browser storage resets the choice. If a new choice cannot be saved, this page stops reporting and tries to remove the old choice. If the browser blocks both saving and removal while an earlier Allow analytics choice remains, only this page is stopped. Other open tabs and future page visits may still use that earlier choice. We show a warning asking you to close other Crescent tabs and clear this site's stored choice before continuing.

Analytics is excluded from enquiry, trade, privacy and operator pages, preview hosts, and URLs containing query strings or fragments. Some referrals are also excluded to avoid passing private URL details. We do not send enquiry fields, messages, email addresses, phone numbers or precise location to analytics. Marketing pixels are not included.

Your choices and questions.

You can ask about access, correction or deletion and withdraw an optional consumer availability email choice. Rowan handles privacy requests, complaints and data-breach decisions. AI may assist with organising or drafting but cannot make or send the final decision.

For a privacy request or complaint, write to privacy@crescentyumcha.com.au with enough detail to identify the enquiry, such as its reference. Do not send passwords, payment-card details or unnecessary identity documents. Crescent may need to verify identity before providing or changing personal information.

Crescent will assess the request, explain any information needed and provide a response or explain a refusal where applicable. Privacy complaints should first be raised with Crescent. If the complaint remains unresolved after giving Crescent a reasonable opportunity to respond, you can contact the Office of the Australian Information Commissioner.

Go to Contact