PRIVACY POLICY

Effective date: 26 May 2026
Last updated: 26 May 2026

1. ABOUT THIS POLICY

Alby Cosmetics (ABN 28 605 769 747) ("Alby", "we", "us", "our") respects your privacy and is committed to protecting the personal information we collect, hold, use and disclose when you visit albycosmetics.com.au (the "Site"), buy from us, or otherwise interact with us.

This Privacy Policy explains how we handle personal information in accordance with the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs), and how we use third-party advertising and analytics tools such as the Meta (Facebook and Instagram) Pixel, the TikTok Pixel, the Pinterest Tag and Google Analytics.

By using the Site, placing an order, signing up to our email or SMS lists, or otherwise giving us your personal information, you agree to the practices described in this Policy. If you do not agree, please do not use the Site.

2. WHO WE ARE

• Business name: Alby Cosmetics
• ABN: 28 605 769 747
• Business address: P.O. Box 20, Paterson NSW 2421, Australia
• Contact email: Contact@albycosmetics.com.au
• Website: albycosmetics.com.au

Alby Cosmetics is a small Australian business. Although the small-business exemption under the Privacy Act 1988 (Cth) may currently apply to us, we have chosen to comply with the Australian Privacy Principles as a matter of good practice and in anticipation of reforms expected in 2026–2027.

3. THE PERSONAL INFORMATION WE COLLECT

The kinds of personal information we collect depend on how you interact with us.

3.1 Information you give us directly
• Contact details: your name, email address, postal/shipping address, billing address and phone number.
• Order details: items purchased, order value, delivery instructions and any gift messages.
• Payment details: handled by our payment processors (see Section 5). We do not store full card numbers on our servers.
• Account details: if you create an account, your username and password (passwords are stored encrypted by Shopify).
• Marketing preferences: your email and SMS subscription status and any preferences you tell us.
• Customer-service correspondence: messages, photos or other information you send us by email, contact form, DM or SMS.
• Reviews and user-generated content: photos, ratings, names and comments you submit through our reviews provider (Judge.me).

3.2 Information we collect automatically
When you visit the Site we automatically collect technical and usage information using cookies, pixels and similar technologies. This includes:
• Device and browser information (device type, operating system, browser type, language, screen size).
• IP address and approximate location (city/region/country level).
• Pages visited, products viewed, items added to cart, time spent on pages, scroll depth and click activity.
• Referring URL and the source you arrived from (for example a Facebook ad, an Instagram post, a TikTok bio link or a Google search).
• Date, time and timezone of your visit.

3.3 Information we receive from third parties
• Our payment processors (Shopify Payments and PayPal) confirm payment status and provide fraud-prevention information.
• Our shipping partners (such as Australia Post) provide tracking and delivery status.
• Social media and advertising platforms (Meta, TikTok, Pinterest, Google) report aggregated information about how people interact with our ads and posts, and let us build audiences from people who have engaged with us.
• Marketing tools (such as Yotpo and our reviews provider) provide engagement and deliverability information.

3.4 Sensitive information
We do not seek to collect sensitive information (such as health information, racial or ethnic origin, political opinions, religious beliefs, sexual orientation or biometric data). Please do not send us this kind of information.

3.5 Children
The Site and our products are intended for adults. We do not knowingly collect personal information from anyone under 16. If you believe a child has given us their personal information, please contact us and we will delete it.

4. WHY WE COLLECT, HOLD, USE AND DISCLOSE YOUR PERSONAL INFORMATION

We collect and use your personal information so we can:
• Process your orders, take payment, arrange delivery and provide receipts and order updates.
• Provide customer service, respond to enquiries and handle returns, refunds, exchanges and warranty claims.
• Send you transactional messages about your account or order.
• Send you marketing emails or SMS messages where you have subscribed or where the law otherwise permits (you can unsubscribe at any time).
• Operate, secure and improve the Site, prevent fraud and detect technical problems.
• Measure and improve our advertising and marketing — including showing ads to you on Facebook, Instagram, TikTok, Pinterest and Google, measuring how those ads perform, building audiences of people who have visited our Site or engaged with our content, and creating "lookalike" or "similar audience" audiences of people who behave like our existing customers.
• Comply with our legal obligations, including tax, consumer law, and Australian Consumer Law obligations.

5. THIRD PARTIES WE SHARE YOUR INFORMATION WITH

We share personal information only as needed to run our business. The main categories of recipient are:

• Shopify (Shopify Inc., Canada) — hosts our online store, processes orders and runs the checkout. Receives order, account, customer, payment and analytics data.
• Shopify Payments and PayPal — process payments and detect fraud. Receive card or PayPal details, billing address and order amount.
• Australia Post and other shipping partners — deliver your order and provide tracking. Receive name, delivery address, phone number and email.
• Meta Platforms, Inc. (Facebook and Instagram) — runs and measures our Facebook and Instagram ads, builds custom and lookalike audiences, and retargets visitors. Receives Pixel and Conversions API events (page views, add-to-cart, checkout, purchase) and hashed email, phone, name, IP, browser information and ad click ID where available.
• TikTok (TikTok Pte. Ltd. / ByteDance) — runs and measures our TikTok ads and the TikTok sales channel. Receives TikTok Pixel events and hashed identifiers.
• Pinterest (Pinterest, Inc.) — runs and measures our Pinterest ads. Receives Pinterest Tag events and hashed identifiers.
• Google (Google LLC) — provides website analytics (Google Analytics) and search/display advertising (Google Ads). Receives pageviews, sessions, traffic source, device information and IP address.
• Yotpo (Yotpo Ltd.) — sends our email and SMS marketing and manages loyalty. Receives name, email, phone number, order data and marketing engagement.
• Judge.me (Judge.me Pty Ltd) — collects and displays product reviews. Receives name, email, order data and any reviews you submit.
• Other apps used by our store (Notify! Back in Stock, Fokkio Automatic Gift, Rockit Discounts & Sales, While Supplies Last) — receive only what is needed to send back-in-stock alerts, apply discounts and run promotions (typically email address, product interest and cart contents).
• Professional advisers (accountants, lawyers) and government agencies — for tax, accounting, legal and regulatory compliance. They receive only what is necessary.

We do not sell your personal information.

6. COOKIES, PIXELS AND TRACKING TECHNOLOGIES

We use cookies, pixels, software development kits (SDKs), web beacons and similar technologies to make the Site work, measure how it is used, and deliver advertising. These technologies are used by us and by the third-party providers listed in Section 5.

6.1 Categories of cookies and tracking
• Strictly necessary: required for the Site, cart and checkout to function (set by Shopify).
• Analytics: help us understand how the Site is used (Shopify analytics, Google Analytics).
• Marketing and advertising: deliver, target and measure our advertising (Meta Pixel and Conversions API, TikTok Pixel, Pinterest Tag, Google Ads tags, Yotpo).
• Functional: remember your preferences (such as discount codes, recently viewed items).

6.2 Meta (Facebook and Instagram) Pixel and Conversions API
We use the Meta Pixel and the Meta Conversions API, which are tools provided by Meta Platforms, Inc. The Pixel is a small piece of code on our Site; the Conversions API sends data from our Shopify store to Meta server-to-server.

These tools allow Meta to receive information about your interactions with our Site — for example which pages you viewed, what you added to cart, whether you started a checkout and whether you completed a purchase. They also share contact information such as your email address, phone number and name in hashed (irreversible) form, along with your IP address, browser information and the ad you clicked, where available.

We use this information to:
• Measure the performance of our ads on Facebook and Instagram.
• Show ads to you on Facebook and Instagram based on your interest in our products (retargeting).
• Build "Custom Audiences" of people who have visited our Site or engaged with us.
• Build "Lookalike Audiences" of people who behave similarly to our existing customers.

Meta acts as a separate data controller for the data it receives. You can read Meta's Data Policy and control how Meta uses your information using the links in Section 11.

6.3 TikTok Pixel, Pinterest Tag and Google tags
If you visit the Site after clicking a TikTok, Pinterest or Google ad — or while connected to a TikTok, Pinterest or Google account — these platforms may also receive similar information about your visit. We use this to measure and improve our advertising on those platforms.

6.4 Managing cookies and opting out
You can:
• Control cookies in your browser settings (delete them, block them, or be notified before they are set). Note that blocking strictly necessary cookies may stop the checkout from working.
• Opt out of personalised advertising on Facebook and Instagram in your Meta Accounts Centre ad preferences.
• Opt out of personalised advertising on TikTok, Pinterest and Google in each platform's privacy or ad settings.
• Opt out of interest-based advertising across many networks via Your Online Choices Australia at youronlinechoices.com.au.

Opting out does not stop you from seeing ads — you may still see general ads from us, just not ones personalised to you.

7. CROSS-BORDER DISCLOSURE

Several of the third parties listed in Section 5 are based outside Australia. Where we share your personal information with them, it may be stored or processed in countries including:
• United States (Meta, Pinterest, Google, Yotpo and others).
• Canada (Shopify, Judge.me).
• Singapore and other countries where TikTok / ByteDance operate.
• Other countries where our service providers host data centres.

We take reasonable steps to make sure overseas recipients handle your personal information consistently with the Australian Privacy Principles, including by using the privacy and security commitments built into our service-provider contracts. By using the Site, placing an order or interacting with our ads, you consent to your personal information being disclosed to these overseas recipients for the purposes set out in this Policy.

8. DIRECT MARKETING

If you have opted in (or where the Spam Act 2003 (Cth) otherwise permits, such as where you have purchased from us), we may send you marketing communications by email or SMS about new products, restocks, sales and brand updates.

Every marketing message from us will include a clear way to unsubscribe — usually an "unsubscribe" link in emails and a "STOP" reply for SMS. You can also tell us to stop sending marketing at any time by emailing Contact@albycosmetics.com.au.

If you unsubscribe, we will still send you transactional messages (such as order confirmations and shipping updates) that you cannot opt out of while we have an active order with you.

9. HOW WE STORE AND PROTECT YOUR INFORMATION

Your personal information is stored on the secure systems of our service providers, primarily Shopify. We take reasonable steps to protect your personal information from misuse, interference, loss and from unauthorised access, modification or disclosure, including:
• Hosting on Shopify, which uses TLS encryption in transit and at-rest encryption for stored data.
• Restricting staff access to personal information on a need-to-know basis.
• Using payment processors (Shopify Payments, PayPal) that are PCI-DSS compliant so we do not store full card details ourselves.
• Reviewing and removing personal information when it is no longer needed.

No method of transmission or storage is completely secure. If we ever become aware of a data breach that is likely to result in serious harm, we will notify affected individuals and the Office of the Australian Information Commissioner (OAIC) in line with the Notifiable Data Breaches scheme.

10. HOW LONG WE KEEP YOUR PERSONAL INFORMATION

We keep your personal information for as long as it is needed for the purposes described in this Policy, and then for any additional period required by law. As a general guide:
• Order, tax and accounting records: 7 years from the date of the transaction (Australian Taxation Office requirements).
• Account information: while your account is open, plus a reasonable period afterwards.
• Marketing data: until you unsubscribe, plus a short period to manage suppression lists.
• Cookie and pixel data: typically up to 13 months from the date of collection, depending on the provider.
• Customer-service correspondence: typically up to 7 years, in line with our other business records.

11. YOUR RIGHTS AND CHOICES

Under the Australian Privacy Principles you have the right to:
• Ask us what personal information we hold about you and request a copy (APP 12 — Access).
• Ask us to correct personal information that is inaccurate, out-of-date, incomplete, irrelevant or misleading (APP 13 — Correction).
• Withdraw your consent to marketing at any time.
• Ask us to delete your personal information, subject to our legal record-keeping obligations.
• Make a complaint about how we have handled your personal information (see Section 12).

To exercise any of these rights, email us at Contact@albycosmetics.com.au. We may need to verify your identity before responding. We will respond within a reasonable time — generally within 30 days. There is no charge to make a request, though we may charge a reasonable cost for providing access in some circumstances.

You can also manage how Meta, TikTok, Pinterest and Google use your information directly with each platform:
• Meta — Privacy Policy: https://www.facebook.com/privacy/policy/ | Ad preferences: https://accountscenter.facebook.com/ad_preferences
• TikTok — Privacy Policy: https://www.tiktok.com/legal/privacy-policy-en
• Pinterest — Privacy Policy: https://policy.pinterest.com/en/privacy-policy
• Google — Privacy Policy: https://policies.google.com/privacy | My Ad Center: https://myadcenter.google.com
• Australia — Your Online Choices: https://www.youronlinechoices.com.au/

12. COMPLAINTS

If you think we have breached the Australian Privacy Principles or otherwise mishandled your personal information, please contact us first at Contact@albycosmetics.com.au. We will acknowledge your complaint within 7 days and aim to resolve it within 30 days.

If you are not satisfied with our response, you can lodge a complaint with the Office of the Australian Information Commissioner (OAIC):
• Website: oaic.gov.au
• Phone: 1300 363 992
• Post: GPO Box 5288, Sydney NSW 2001

13. CHANGES TO THIS POLICY

We may update this Privacy Policy from time to time to reflect changes to our practices, new tools we use, or changes in the law. When we do, we will update the "Last updated" date at the top of this Policy and, for significant changes, will give notice on the Site or by email.

14. CONTACT US

If you have any questions about this Privacy Policy or how we handle your personal information, please contact us:
• Email: Contact@albycosmetics.com.au
• Post: Alby Cosmetics, P.O. Box 20, Paterson NSW 2421, Australia

Thank you for trusting us with your information. Love, ALBY Cosmetics.