Spam from Wine O Wine Targeting Ex Mountain Designs Customers?

timmypete on 24/08/2018 - 17:19
Last edited 04/07/2021 - 20:04 by 1 other user

tl;dr

Are former Mountain Designs customers getting unsolicited Wine o Wine emails?
Should I report a company with a crappy response to my privacy enquiry to the authorities?

Contact with WoW

Last Thursday Wine o Wine sent me an email titled "Treat Dad (or yourself) with wine this Father’s day".

I'd never heard of the company, nor signed up to their lists. The email address it was sent to - mountaindesigns@[my domain name].com - was a one-off address I only ever shared with (the now-closed) Mountain Designs.

I emailed them within an hour and a half, asking how they'd got my details. They promptly replied with:

"Your email address was part of a database collated by an intern who is no longer with the company. I will make all efforts to contact them to ascertain where they sourced your email but can assure you that we do not as a company buy information from data brokers."

They seem flat-out shady:

The response had no name against it, and they then ignored two subsequent emails.
They do not list ~~an ABN or~~ phone contact details on their website. (updated)
Their initial message has an unusually conspicuous unsubscribe message in the body text, suggesting they knew their address list is sketchy.
They have a boilerplate legal policy which refers to a section "Right to access, correct and delete data and to object to data processing", but they've deleted this section.
The registrant listed in Whois records (Rose Imports, and ex-rugby player Jono Jenkins) is a rose distributor (aka the used-car-sellers of the wine industry).

Report them?

What's the collective thought of OzB hivemind?

I'm in a mixed mindset about whether to report them to the ACMA (for a breach of the consent provisions of the Spam Act) or the Office of the Australian Information Commissioner (as their response to a formal request under the Privacy Act was lacking).

On the one hand it's harassing a probably small business who may not have known that this kind of marketing activity is illegal in Australia. On the other hand, it looks like they've been acting shady and have ignored three opportunities (complaint, followup 1 and followup 2) to prove otherwise.

Anywhere else I should approach? What's a reasonable period of time to wait before escalating?

Poll Options

9
Report them
0
Wait a little longer
3
Forget the whole thing

Internet

Related Stores

wineowine.com.au

Comments

c64 on 24/08/2018 - 18:13

+2

report them if it was unsolicited, they don't identify themselves in the email or there is no functional unsubscribe mechanism. doesn't take long. https://www.acma.gov.au/Citizen/Phones/Mobile/Dealing-with-m…
- timmypete on 24/08/2018 - 21:38
  
  Definitely unsolicited, identification is iffy but likely clear enough, and there is an unsubscribe option.
  
  I'm mainly peeved at how they acquired a one-off address, and seemingly dishonest reply. I frankly don't believe that an intern is to blame, or that this intern was so difficult to contact within hours of the first apparent use of the list they created.
  - spal on 25/08/2018 - 04:39
    
    I must salute you for creating once of email addresses in such fashion. It makes it absolutely easy to identify the source of privacy breach.
    - timmypete on 25/08/2018 - 09:41
      
      There's a feature for a lot of email providers that support domains (including gSuite, Fastmail, and Office365) called Catch all or Wildcard.
      
      Good explanation from (the really excellent) Fastmail here, but essentially it forwards anything sent to addresses at your domain (that do not match a real inbox) into a specific inbox.
      
      This is useful for setting mail handling rules (especially when matched with subdomains), and makes it easy to monitor how addresses are shared.
      
      I make five or six info requests like this a year to companies who acquire my address. On the whole they answer genuinely, unlike the subject of this discussion.
    - blitz on 25/08/2018 - 09:59
      
      @tplen1: I do the same thing, but my provider is ceasing operation of catch-all email addresses. Not sure what I'm going to do.
    - timmypete on 26/08/2018 - 10:45
      
      @blitz:
      
      Fastmail is really good and Australian. Not sure how feasible a migration is, but can highly recommend.
      
      It may also be possible to do stuff upstream at the registrar or MX stage:
      
      There are a few firms that run spam filtering or forwarding services that might integrate with your current email provider
      
      if not possible at the domain level, perhaps set a subdomain, and give it its own MX record at another service, forwarding the mail back to your normal provider. In my own case I use the @m.[my domain].com subdomain for stuff I know will almost certainly be marketing. Emails to this subdomain that contain "Tax Invoice", "Shipment Notification", my postal address or mobile, etc go to a higher priority folder, otherwise they land in the marketing folder. Ditto w subdomain for work, c for comps, etc.
tranter on 25/08/2018 - 21:25

+1

There is ABN on their website and contact email address. It's actually not a requirement for businesses to list ABN on their website.
- timmypete on 26/08/2018 - 10:19
  
  Good spot of the ABN on the website's footer. I'd looked in contact us, and the privacy policy and not seen them there. Have updated op.
  - tranter on 26/08/2018 - 17:16
    
    Don't know if it helps but if you google wine o wine it comes up with the same address as rose imports and a mobile number.
Rifraf on 25/08/2018 - 21:48

You don't know how to click "Block" within your email?
- timmypete on 26/08/2018 - 10:33
  
  I do, but that won't answer how a wine company in Sydney got access to information that was only ever shared with a now-closed company.
  
  WoW has ruled out a data broker, and is unwilling to outline a plausible innocent explanation (eg. purchase of customer database in asset sale, corporate link to Spotlight Group who purchased the MD brand name similar to Kogan's DSE deal) of how they obtained my details. That's ballsy in the post-GDPR era.
  
  I'm more interested in an access to info answer, than merely reporting them for a breach of spam laws. The OzB post was really more to get an idea of if any other MD customers had been signed up inadvertently too.
Rifraf on 26/08/2018 - 15:02

Good for you for having the energy to pursue it.

I've gotten a little jaded by all spam finding its way into my email and won't mention the endless calls to my phone.