Privacy Policy

01 The personal information we collect

"Personal information" means information or an opinion about an identified individual, or an individual who is reasonably identifiable. The kinds of personal information we collect and hold include:

Information you give us directly

• Identity and contact details: your name, email address, postal and delivery address, billing address and telephone number.
• Order and account information: purchase history, products ordered, subscription preferences and cadence, account login details, and any details you save to your account.
• Payment information: billing details necessary to process your order. We do not store full payment card numbers (see Payment Processing below).
• Communications and content: messages you send us, customer service enquiries, product reviews, ratings, photos or other user-generated content, and competition, survey or tasting vote responses.
• Marketing preferences: your consent to receive, and choices about, our newsletters and marketing communications.

Information we collect automatically

• Technical and device data: IP address, device type, operating system, browser type, language settings and approximate location derived from your IP address.
• Usage data: pages viewed, products browsed, items added to cart, time on site, referring website, and how you interact with the Site and our emails.
• Cookies and similar technologies: collected as described in Section 5.

Information we collect from third parties

• Our payment processors, shipping and logistics providers, and fraud prevention services.
• Social media and advertising platforms where you engage with our content or advertisements.
• Analytics providers and marketing partners who help us understand and reach our audience.

Sensitive information

We do not generally collect sensitive information (such as health information, racial or ethnic origin, or religious beliefs). Our products are foods and beverages, not therapeutic goods, and we do not require health information to fulfil an order. We will only collect sensitive information with your consent and where it is reasonably necessary for our functions or activities, or where otherwise permitted by law.

Payment processing

Payments made through the Site are processed by third-party payment providers such as Shopify Payments, Stripe, PayPal and buy now pay later providers. Your full card details are entered directly with the payment provider and are handled in accordance with the Payment Card Industry Data Security Standard (PCI DSS). We do not receive or store your full card number.

02 How we collect your information

We collect personal information in a number of ways, including:

• directly from you when you place an order, create an account, subscribe, contact us, leave a review, or participate in a campaign, survey or promotion;
• automatically through your use of the Site, including via cookies and similar technologies;
• from third parties such as our service providers, payment processors and advertising platforms.

Where it is reasonable and practicable, we collect personal information directly from you.

If you provide us with personal information about another person (for example, a gift recipient), you must ensure you are authorised to do so and that they are aware of this Privacy Policy.

03 Why we collect, hold, use and disclose your information

We collect, hold, use and disclose your personal information for the following purposes:

• to process, fulfil and deliver your orders and subscriptions, and to manage returns, refunds and exchanges;
• to create and manage your account and provide customer support;
• to communicate with you about your orders, enquiries and account;
• to send you marketing communications, newsletters and offers where you have consented or where otherwise permitted by law (see Section 6);
• to operate, personalise, improve and secure the Site, and to understand how it is used;
• to run and analyse campaigns, surveys, promotions and product development activities (for example, demand sensing and tasting votes);
• to detect, investigate and prevent fraud, security incidents and other unlawful activity;
• to comply with our legal obligations and to establish, exercise or defend legal claims.

We will not use or disclose your personal information for a purpose other than that for which it was collected, unless you would reasonably expect us to, you have consented, or the use or disclosure is otherwise required or permitted by law.

04 Lawful bases for processing (overseas individuals)

For individuals in the European Economic Area (EEA) or the United Kingdom, our lawful bases for processing personal data are:

• Performance of a contract – to fulfil your orders, process payments, deliver products and provide customer support.
• Consent – for marketing communications and certain cookies, which you may withdraw at any time.
• Legitimate interests – to operate, secure and improve our business, balanced against your rights and interests.
• Legal obligation – to comply with applicable laws, regulations and legal requirements.

Further rights for individuals located in the EEA and the United Kingdom are outlined in Section 14 of this Privacy Policy.

05 Cookies and tracking technologies

The Site uses cookies and similar technologies (such as pixels, tags and local storage) to make the Site work, remember your preferences, measure performance and deliver relevant marketing.

The categories of cookies and technologies we use include:

You can manage cookies through our cookie banner or consent tool where available, and through your browser settings.

Disabling some cookies may affect how the Site functions. Where required by law, we obtain your consent before setting non-essential cookies.

06 Direct marketing and your choices

With your consent, or where otherwise permitted under the Spam Act 2003 (Cth) and the Privacy Act 1988 (Cth), we may send you marketing communications by email and other electronic channels about our products, offers and content.

Every marketing message includes a clear and functional way to unsubscribe, and identifies us as the sender.

You can opt out at any time by using the unsubscribe link in our emails or by contacting us using the details in Section 18.

We will action opt out requests promptly.

Opting out of marketing communications will not prevent us from sending transactional messages relating to your orders, subscriptions, account activity, customer service enquiries, or other administrative communications that are necessary to provide our products and services.

07 Who we share your information with

We do not sell your personal information. We disclose personal information only to the following categories of recipients, and only as reasonably necessary for the purposes described in this Privacy Policy:

We require our service providers to protect your personal information and to use it only for the purposes for which it was disclosed.

We may also disclose personal information in connection with a sale, merger or restructure of our business, subject to appropriate confidentiality protections.

08 Overseas disclosure

Some of our service providers are located, or store data, outside Australia. As a result, your personal information may be disclosed to, or accessed from, overseas recipients.

The countries in which these recipients are likely to be located include the United States and Canada, and other countries where our providers operate data infrastructure.

Before disclosing personal information overseas, we take reasonable steps to ensure that recipients handle it in a manner consistent with the Australian Privacy Principles, including through contractual protections.

Where we transfer personal data from the European Economic Area (EEA) or the United Kingdom, we rely on appropriate safeguards such as Standard Contractual Clauses or an adequacy decision.

09 How we keep your information secure

We take reasonable steps to protect your personal information from misuse, interference and loss, and from unauthorised access, modification or disclosure.

These steps include encryption in transit, access controls, the use of reputable platforms and service providers, and ongoing staff awareness and security practices.

While we work to safeguard your information, no method of transmission over the internet or method of electronic storage is completely secure.

Accordingly, although we take reasonable steps to protect personal information, we cannot guarantee absolute security.

10 How long we keep your information

We retain personal information only for as long as is necessary to fulfil the purposes for which it was collected, including to meet legal, accounting, tax and reporting obligations, and to resolve disputes and enforce our agreements.

The length of time we retain personal information will depend on the nature of the information, the purpose for which it was collected, and any legal or regulatory requirements that apply.

When personal information is no longer required, we take reasonable steps to securely destroy it or de-identify it in accordance with applicable laws and our internal data retention practices.

11 Accessing and correcting your information

You may request access to the personal information we hold about you, and ask us to correct it if it is inaccurate, out of date, incomplete, irrelevant or misleading.

You can do this by contacting us using the details provided in Section 18 of this Privacy Policy.

We will respond to requests within a reasonable period. In most cases, access is provided free of charge, although we may charge a reasonable fee for retrieving certain information where permitted by law. We will notify you in advance if a fee applies.

If we refuse a request for access or correction, we will provide written reasons for the decision and information about how you may make a complaint.

12 Data breaches

We maintain procedures to identify, contain and assess actual or suspected data breaches involving personal information.

If we experience an eligible data breach that is likely to result in serious harm to affected individuals, we will notify those individuals and the Office of the Australian Information Commissioner (OAIC) as required under the Notifiable Data Breaches scheme in Part IIIC of the Privacy Act 1988 (Cth).

We continually review and improve our security practices and incident response procedures to help protect personal information and minimise the impact of any security incident.

13 Automated decision making and artificial intelligence

We use automated tools, including some that rely on artificial intelligence (AI) and machine learning, to help us operate, secure and improve our business. These tools are often built into the third-party platforms we use, such as our e-commerce platform, our email and marketing platform, and our analytics and advertising platforms.

We use these tools for purposes including fraud screening and security, analytics and understanding how the Site is used, personalising your experience and product recommendations, measuring and optimising our marketing and advertising, and assisting our customer service.

We do not make decisions that produce legal effects, or similarly significant effects, about you based solely on automated processing without human involvement. Where an automated tool supports a decision that could significantly affect you, a member of our team reviews the outcome.

We do not use your personal information to train third-party generative AI models, and we do not sell your personal information to AI providers.

You can ask us about the personal information used by these tools, request access to or correction of your information, or raise a concern, by contacting our Privacy Officer using the details in Section 18.

If our use of AI or automated decision making changes in a way that significantly affects how we handle your personal information, we will update this Privacy Policy to describe the kinds of personal information involved and the nature of the processing, consistent with our transparency obligations under applicable privacy laws.

14 Your rights as an overseas individual

European Economic Area and United Kingdom (GDPR / UK GDPR)

If you are located in the European Economic Area (EEA) or the United Kingdom, you have the right to:

• access the personal data we hold about you;
• request the correction of inaccurate personal data;
• request the erasure of your personal data in certain circumstances;
• restrict or object to the processing of your personal data;
• request the transfer of your personal data to another organisation;
• withdraw consent at any time where processing is based on consent.

You also have the right to lodge a complaint with your local data protection supervisory authority.

To exercise any of these rights, please contact us using the details provided in Section 18 of this Privacy Policy.

California (CCPA / CPRA)

If you are a California resident, you may have rights under the California Consumer Privacy Act (CCPA) and the California Privacy Rights Act (CPRA), including the right to:

• know what personal information we collect and how it is used;
• request deletion of personal information we hold about you;
• request correction of inaccurate personal information;
• opt out of the "sale" or "sharing" of personal information.

We do not sell your personal information for money.

We will not discriminate against you for exercising any privacy rights available to you under applicable law.

To make a request, please contact us using the details provided in Section 18.

15 Children's privacy

The Site is intended for adults and is not directed at children.

We do not knowingly collect personal information from children.

If you believe a child has provided us with personal information, please contact us and we will take reasonable steps to delete that information as soon as practicable.

16 Third party links

The Site may contain links to third-party websites and services that we do not own, operate or control.

This Privacy Policy does not apply to those third parties, and we are not responsible for their privacy practices, policies or content.

We encourage you to review the privacy policies of any third-party websites or services you visit before providing personal information or engaging with their products and services.

17 Changes to this policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal obligations or business operations.

The current version of this Privacy Policy will always be available on the Site, with the effective date shown at the top of the document.

Where appropriate, material changes will be communicated by reasonable means, including through the Site or by direct communication where required by law.

Your continued use of the Site after any update to this Privacy Policy constitutes acceptance of the revised policy.