Itzsan YakinikuMembers

Privacy Policy

Effective date: 2026-10-25

2.1 Who we are

AHA 888 PTY LTD trading as Itzsan Yakiniku operates the membership service at itzsanyakiniku.com and the Lidcombe and Chatswood branches listed in the Terms.

ABN: 34 656 398 042. Business address: 104 Rowe Street, Eastwood NSW 2122.

This policy explains how we handle information for the website and membership service.

2.2 Information we collect

We collect:

We use cookies for login and security. We use browser storage on your device to coordinate your login session and to keep the offline member QR card.

2.3 Collection, storage and purposes

You provide your name, your mobile number and, if you choose, your date of birth. Sign-up details are stored when you submit them, before your mobile number is verified by OTP. On 20 October 2026, existing members' names, mobile numbers and, where available, dates of birth were transferred from the previous Itzsan membership system. Our membership and counter systems provide member level and visit or sale records. Technical data is collected when you use the website or installable web app.

We hold information in membership, counter and operational systems, including cloud infrastructure, backups and logs. Our membership system is operated with technical support from KTP, listed in section 2.5.

We use information to:

2.4 How and why we handle information

We handle personal information in accordance with the Privacy Act 1988 (Cth) and the Australian Privacy Principles. We collect only what is reasonably necessary for our functions and activities.

We use or disclose information for the purpose explained when it is collected, a related purpose you would reasonably expect, or with your consent. We may also do so where Australian law or a court or tribunal order requires or permits it.

Optional information is identified as optional. Without required information, we may be unable to create or secure your account, verify your identity or provide the relevant membership service.

2.5 Service providers and overseas handling

We do not sell personal information.

We share information as needed for hosting, authentication, SMS delivery, counter integration, security and technical support. We may also disclose it with your consent or where required by law.

Twilio, our SMS delivery provider, receives your mobile number and delivery information to send OTP messages.

Our service providers and where they handle information:

Personal information may be processed overseas in the United States.

We take reasonable steps to ensure appropriate safeguards when information is handled overseas. We will update these details if the providers or countries change.

2.6 Storage and retention

We keep personal information only for as long as needed. As our own policy, we keep your membership profile while your membership is active and delete it when you request deletion through the process in section 2.7.

When you confirm deletion, we clear the identifying fields of your profile and deactivate your membership and member QR code in our membership system. The identifying fields are your name, mobile number, hashed and encrypted copies of that number, and date of birth. We keep your member identifier, the date and time you accepted the Terms, and associated records such as ledgers and import records. Copies of this information in operational logs and backups are removed within 30 days, and copies held by store counter systems within 24 hours.

Section 286 of the Corporations Act 2001 (Cth) requires us to keep financial records, including transaction records such as sale records, for seven years after the transactions they cover are completed. This period runs from the transaction, not from account deletion. After account deletion these records are kept only in anonymised form, no longer linked to your name or mobile number, for accounting, audit and legal record-keeping purposes.

Store counter systems apply deletion at their next synchronisation, within 24 hours. Copies in operational logs and backups are removed through their rotation cycles within 30 days. Access to copies awaiting deletion is restricted. They are not used for other purposes. Deleted accounts are not restored for ordinary operation. If a disaster recovery backup is restored, deletion records are reapplied where technically practicable.

2.7 Account deletion

Open the Members page and choose Delete account. Request an OTP for your registered mobile number. Enter the code and confirm deletion.

If you cannot access your number, contact info@itzsan.com for an alternative identity check. We ask only for information reasonably needed to verify the request.

If deletion is blocked, contact us for help resolving the restriction.

If the outcome of a deletion request is uncertain, for example because the connection drops, the web app signs you out and does not reopen the account. Log in again to check: if your number is no longer registered, the deletion was completed.

When deletion is confirmed:

A QR code saved for offline display on another device cannot be erased remotely. It may still display on that device until it expires, at most 30 days after it was last verified online, but it no longer identifies an active membership at the counter.

Counter copies, backups and technical logs follow the timing described in section 2.6. Account deletion does not remove rights that cannot be excluded by law.

You can sign up again with the same mobile number. There is no waiting period. A new account is created; the deleted account is not restored.

2.8 SMS messages

OTP and essential account messages support verification and account security. Marketing SMS requires your opt-in. Agreeing to membership terms does not provide marketing consent.

You can withdraw marketing consent at any time. Every marketing SMS will include a working unsubscribe method. We will action requests within five working days. You may also contact us. This does not stop essential service messages. The website and installable web app do not send push notifications.

2.9 Children and security

The service is not primarily directed to children. A person who cannot understand the handling of their information may need a parent or guardian's consent or help. We may restrict, deactivate or delete an account created without that involvement where appropriate.

We use technical and administrative safeguards to protect personal information. These include encryption, access controls and session management. Where the Privacy Act applies, we assess and notify eligible data breaches to affected people and the Office of the Australian Information Commissioner as required by law.

2.10 Access, correction and complaints

You can request access to your information, ask us to correct it, request account deletion, withdraw marketing consent or make a privacy complaint.

Contact info@itzsan.com, which is also our privacy contact. For a date of birth correction, contact us rather than changing it in the app. We may ask for reasonable supporting information.

Describe your request and provide enough information to identify your account. Do not send unnecessary identity documents. We may verify your identity using only what is reasonably necessary.

We will acknowledge and investigate complaints. We generally aim to respond in writing within 30 days. If more time is needed, we will tell you. If we refuse access or correction, we will provide written reasons and complaint options where required by law.

If our response is unsatisfactory, or we do not respond within a reasonable period, you may complain to the Office of the Australian Information Commissioner (OAIC), where the Privacy Act applies.

2.11 Contact

Privacy and deletion contact: