Privacy policy

Last updated: 24 September 2026

1. What personal information we collect

Depending on how you interact with us, we may collect:

Contact and identity details — your name, email address, phone number, and billing and delivery addresses.
Order and transaction details — products you view, add to your cart, purchase, return or cancel, order history, and delivery instructions.
Account details — if you create an account, your login details and preferences.
Payment information — payments are processed by Shopify and our payment providers. We do not store your full card number; we receive only limited details such as the card type, last four digits and payment status.
Communications — messages, enquiries, product reviews, photos you send us (for example, of a damaged product) and survey responses.
Marketing preferences — whether you have subscribed to our emails or SMS messages.
Device and usage information — IP address, browser and device type, pages viewed, referring website and similar information collected through cookies and similar technologies.

We do not intentionally collect sensitive information (such as health information). Please do not send us sensitive information. If you choose to tell us about a skin or scalp reaction to a product, we will use that information only to handle your enquiry or claim, and to meet any product-safety reporting obligations.

You can browse our store without identifying yourself. However, we need your name, contact details and delivery address to process and deliver an order.

2. How we collect personal information

Directly from you — when you place an order, create an account, subscribe to marketing, contact us or leave a review.
Automatically — through cookies, pixels and similar technologies when you use our website (see section 8).
From third parties — such as Shopify, our payment and fraud-prevention providers, Australia Post (delivery status), and advertising and analytics partners.

3. Why we collect, hold, use and disclose personal information

to process, fulfil and deliver your orders and handle payments;
to provide customer service and to handle returns, refunds and claims under the Australian Consumer Law;
to create and manage your account;
to send you order, shipping and service messages;
to send you marketing communications, where you have consented (see section 6);
to understand how our website is used and to improve our products, website and services;
to detect and prevent fraud, security incidents and misuse of our website; and
to comply with our legal obligations (including tax, accounting, consumer and product-safety laws) and to establish, exercise or defend legal claims.

We will only use or disclose your personal information for the purpose it was collected, for a related purpose you would reasonably expect, with your consent, or as otherwise permitted or required by law.

4. Who we disclose personal information to

We may disclose your personal information to:

Shopify, which hosts our online store and processes store data on our behalf;
payment providers and fraud-prevention services;
delivery providers, such as Australia Post and, for international orders, overseas postal and courier partners and customs authorities;
IT, email, SMS, analytics, customer-service and marketing service providers;
advertising partners such as Meta (Facebook and Instagram), Google and TikTok, where you have not opted out of relevant tracking;
professional advisers, such as our accountants, auditors, insurers and lawyers;
the Sunny Isle brand owner and manufacturer, only where necessary to handle a product quality or safety issue; and
government and regulatory authorities and law enforcement, where required or authorised by law.

We do not sell your personal information.

5. Overseas disclosure

Some of our service providers store or process personal information outside Australia. In particular, Shopify and its sub-processors may store and process information in Canada, the United States, Ireland and other countries where they or their service providers operate. Our payment, email, analytics and advertising providers may process information in the United States, Europe, Singapore and other countries. For international orders, your details will be disclosed to delivery and customs agencies in the destination country. Before disclosing personal information overseas, we take reasonable steps to ensure the recipient handles it in a way that is consistent with the APPs.

6. Marketing

We will only send you marketing emails or SMS messages if you have consented, as required by the Spam Act 2003 (Cth). Every marketing message will identify us and include a working way to unsubscribe. You can opt out at any time by using the unsubscribe link, replying STOP to an SMS, or contacting us. We will still send you transactional messages about your orders and account.

7. Automated decisions

We do not use computer programs to make decisions that could reasonably be expected to significantly affect your rights or interests without human involvement. Shopify and our payment providers use automated fraud-analysis tools that use order, payment, device and address information to assess the risk of an order. If an order is flagged as high risk, a member of our team reviews it before deciding whether to fulfil or cancel it. If you believe your order was cancelled in error, please contact us.

8. Cookies and similar technologies

We and our service providers use cookies, pixels and similar technologies to keep our store working (for example, to remember your cart), to understand website traffic, and to show you relevant advertising on other websites and social media. You can control cookies through your browser settings and through any cookie preferences available on our website. Blocking some cookies may affect how the store works. For more information about how Shopify uses personal information, see the Shopify Consumer Privacy Policy.

9. How we hold and protect your information

We hold personal information electronically using secure, access-controlled systems provided by Shopify and our other service providers. Our store uses encrypted (HTTPS) connections, and payment card details are handled by PCI-DSS compliant payment providers. We take reasonable steps to protect personal information from misuse, interference, loss and unauthorised access, modification or disclosure. We keep personal information only as long as we need it for the purposes described in this policy or as required by law (for example, we generally keep transaction records for 5 years for tax purposes), after which we take reasonable steps to destroy or de-identify it.

If we experience a data breach that is likely to result in serious harm, we will notify affected individuals and the Office of the Australian Information Commissioner (OAIC) as required under the Notifiable Data Breaches scheme.

10. Accessing and correcting your information

You can ask to access the personal information we hold about you, or ask us to correct it if it is inaccurate, out of date, incomplete, irrelevant or misleading. You can update many account details yourself by logging in. For other requests, please contact us. We will respond within 30 days. We may need to verify your identity first. We will not charge you for making a request, but we may charge a reasonable fee for providing access in some cases. If we refuse a request, we will explain why in writing and tell you how to complain.

You may also ask us to delete your account and personal information. We will do so unless we need to keep it to meet legal obligations or to resolve disputes.

11. Children

Our store is intended for adults. If you are under 18, please use the store with the involvement of a parent or guardian. We do not knowingly collect personal information directly from children for marketing purposes.

12. Complaints

If you have a concern or complaint about how we have handled your personal information, please contact us in writing using the details below. We will acknowledge your complaint promptly and aim to resolve it within 30 days. If you are not satisfied with our response, you can complain to the Office of the Australian Information Commissioner (OAIC): www.oaic.gov.au, phone 1300 363 992.