Privacy policy

Kelp & Copper (example organisation) operates this online shop from 12 Example Street, Fremantle WA 6160 (example data for this demo). Enquiries about privacy would go to hello@example.com.au.

The enquiry form collects your name, email address and your message, so we can answer you. The newsletter form collects an email address only, so we can send occasional notes about new firings.

Checkout collects your name, email address, phone number, delivery address, and the items in your order, because we cannot post a parcel or confirm an order without them. Card details would be entered directly with a payment provider and never reach our servers. On this demonstration site the card field only accepts an obvious test number and nothing is sent anywhere.

We do not collect sensitive information as defined in the Privacy Act 1988 (Cth), and we do not ask for date of birth or identity documents.

A real version of this business would handle personal information in line with the Australian Privacy Principles (APPs) in Schedule 1 of the Privacy Act 1988 (Cth). In practice that means collecting only what is needed for a stated purpose (APP 3), telling you at the time of collection (APP 5), using it only for that purpose (APP 6), keeping it secure (APP 11), and giving you access to it and the ability to correct it (APPs 12 and 13).

Order records would be kept for seven years, because Australian tax law requires business records to be retained for that period. Enquiry emails would be kept for twelve months. Newsletter subscriptions are kept until you unsubscribe, and the unsubscribe link sits at the bottom of every email.

A working version of this shop would set one essential cookie to keep your cart between pages, and would use privacy-respecting analytics that count page views without building a profile of you. No advertising or cross-site tracking cookies would be set. This demonstration site keeps the cart in the browser only, for the length of the visit.

A live shop needs a small number of suppliers: a hosting provider, a payment provider, an email delivery service and a carrier to deliver the parcel. Each would receive only what it needs — the carrier gets a delivery address, the payment provider gets the payment details, and neither gets the rest. We would not sell or rent personal information to anyone, and we would not send it overseas except where a supplier's servers are located overseas, which we would disclose here by name.

You can ask what personal information is held about you, ask for it to be corrected, or ask for it to be deleted where we are not required to keep it. A real request would go to hello@example.com.au (example data for this demo) and be answered within 30 days.

If you were not satisfied with the response, you could refer the matter to the Office of the Australian Information Commissioner.