Legal
Privacy Policy
Last updated 10 October 2026
This policy explains what personal information we collect when you visit orbavie.shop or buy from us, why we collect it, who we share it with and what rights you have. It is written to meet the Australian Privacy Principles under the Privacy Act 1988 (Cth) and, for visitors in the European Economic Area and the United Kingdom, the EU and UK General Data Protection Regulation (GDPR).
Who is responsible
The controller of your personal information is PRINCESS POLLY ONLINE PTY LTD (ABN 43 169 210 520), trading as ORBAVIE, QLD 4220, Australia. Email: support@orbavie.shop · Phone: +61 431 092 217. Contact this address for any privacy question or request.
What we collect
- Order information: name, billing and delivery address, email address, phone number (optional), the items you order, order value and currency, and your chosen language.
- Payment information: payments are processed by our payment providers. We receive a confirmation, the payment method type and, for cards, the last four digits and expiry date. We never receive or store your full card number or security code.
- Account information: if you create an account — your email address, a password (stored only in encrypted form) and your saved addresses and order history.
- Messages: what you send us by email, phone, the contact form or the withdrawal form.
- Technical information: IP address, browser type and the pages you request, which our hosting provider records in server logs for security; the country derived from your IP address, used to show prices in your currency.
We do not use analytics, advertising or social media tracking on this site, and we do not send marketing emails. We do not knowingly collect information from children under 16.
Why we use it and on what legal basis
| Purpose | Legal basis (GDPR) |
|---|---|
| Taking, delivering and supporting your order, refunds and withdrawals | Performance of a contract (Art. 6(1)(b)) |
| Running your customer account | Performance of a contract (Art. 6(1)(b)) |
| Answering your messages | Legitimate interests in responding to you (Art. 6(1)(f)), or steps before a contract (Art. 6(1)(b)) |
| Keeping tax and accounting records | Legal obligation (Art. 6(1)(c)) |
| Preventing fraud and keeping the site secure | Legitimate interests (Art. 6(1)(f)) |
| Showing prices in your currency and the site in your language | Legitimate interests (Art. 6(1)(f)); the cookies involved are strictly necessary |
Under Australian law, we collect personal information only where it is reasonably necessary for these functions, and we use it only for the purpose it was collected for or a related purpose you would reasonably expect.
Who we share it with
We share personal information only with service providers who help us run the shop, under agreements that require them to protect it and use it only for us:
- our website host (Hostinger), which stores the site and its database;
- our payment providers (Stripe and/or PayPal, as offered at checkout), which process payments and screen for fraud as independent controllers for some purposes — see their own privacy policies;
- our email provider, which delivers order, dispatch and support emails;
- postal and courier companies, which receive your name, delivery address and, where needed for delivery, your phone number or email;
- professional advisers and authorities where the law requires it.
We do not sell or rent your personal information.
International transfers
We are based in Australia, and our service providers may process information in Australia, the European Union, the United Kingdom and the United States. When personal information of people in the EEA or the UK is transferred to a country without an adequacy decision, we rely on Standard Contractual Clauses or another lawful transfer mechanism. Under Australian Privacy Principle 8, we take reasonable steps to ensure overseas recipients handle your information consistently with the Australian Privacy Principles.
How long we keep it
- Order and payment records: 7 years, as required by Australian tax and corporations law.
- Customer accounts: until you close the account, then deleted except for order records we must keep.
- Messages and withdrawal requests: 3 years after our last contact, so we can deal with follow-up questions or claims.
- Server logs: up to 30 days.
Your rights
You can ask us for access to the personal information we hold about you and ask us to correct it. If you are in the EEA or the UK, you also have the right to erasure, restriction of processing, data portability and to object to processing based on legitimate interests. To make a request, email support@orbavie.shop. We answer within 30 days and may ask you to confirm your identity.
Complaints
Please contact us first so we can try to resolve your concern. If you are not satisfied, you can complain to the Office of the Australian Information Commissioner (oaic.gov.au). If you are in the EEA or the UK, you can also complain to the data protection authority where you live or work — for example Datatilsynet in Denmark, the data protection authority of your federal state in Germany, Integritetsskyddsmyndigheten (IMY) in Sweden, the CNIL in France or the Information Commissioner’s Office (ICO) in the UK.
Security
The whole site is served over an encrypted (HTTPS) connection. Payment details are entered into forms provided by our payment providers, which are certified to PCI DSS. Access to our systems is limited to people who need it.
Cookies
We only use cookies and similar storage that the shop needs to work. Details are in our Cookie Policy.
Changes
We will update this policy when our practices change and show the date of the latest version at the top of this page.