Privacy policy.
What we collect, why, who else holds it, and how to get it back or have it deleted.
Last updated: [DATE]
1. Who we are
Sunday Best is a brand of Ian Hammond as trustee for the Hammajack Trust, ABN [ABN], of [TRADING ADDRESS], Victoria, Australia.
This policy explains what personal information we collect, why we collect it, who else holds it, and how you can get at it or have it deleted.
Contact us about privacy at [SUPPORT EMAIL].
2. What we collect
When you buy. Your name, email address, delivery address, and what you ordered. If you send a gift, the recipient's name and delivery address, and the message you want on the card.
When you sign up for emails. Your email address, and your name if you give it.
When you email us. Whatever you put in the email.
When you visit the site. Your IP address, browser and device type, the pages you look at, how you got to us, and cookie identifiers.
What we never see. Your card number, expiry date and security code. Those go straight to Stripe. We do not receive them and we cannot store them.
3. Why we collect it
- To take your order, make your socks, and send them to you.
- To email you about your order.
- To handle a refund, a size change, or a fault.
- To write your gift card by hand.
- To send you marketing emails, if you asked for them.
- To see how the site is being used so we can improve it.
- To keep the business records the law requires us to keep.
We do not sell your personal information. We do not trade it and we do not rent it.
4. Who else holds it
We are a small operation and we use other companies to run the business. Each of them holds some of your information.
Stripe. Takes your payment and holds your order and payment details, including your name, email and delivery address, and your gift card message if you entered one at checkout. Stripe is based in the United States and stores and processes data overseas. Stripe's privacy policy is at stripe.com/privacy.
HubSpot. Runs our website and holds our email list and customer records. If you sign up for emails or fill in a form, your details go into HubSpot. HubSpot is based in the United States and stores and processes data overseas. Our HubSpot data is hosted in [HUBSPOT DATA REGION]. HubSpot's privacy policy is at legal.hubspot.com/privacy-policy.
Our delivery carrier, [CARRIER]. Gets the name and address on the parcel so it can deliver it.
By buying from us or signing up, you accept that your information is held and processed overseas by Stripe and HubSpot. Overseas providers are subject to the laws of the countries they operate in, and Australian privacy law may not apply to them in the same way.
5. Cookies and tracking
Our website runs on HubSpot and uses cookies. Some cookies are needed to make the site work. Others tell us how many people visit, which pages they read, and where they came from.
You can refuse the non-essential cookies using the banner when you arrive, and change your mind later using the link in the footer. Refusing them does not stop you buying.
You can also block or delete cookies in your browser. Some parts of the site may stop working properly if you do.
6. Marketing emails
We only email you marketing if you asked us to, or if you bought from us and would reasonably expect to hear from us about the product.
Every marketing email says who it is from, gives our contact details, and has an unsubscribe link. Unsubscribing takes one click. We act on it within five business days and usually the same day.
Unsubscribing from marketing does not stop emails about an order you have placed. We still need to tell you when your socks ship.
7. How long we keep it
We keep order and payment records for seven years, because tax law requires it.
We keep your gift card message until your order ships, then we delete it.
We keep your email address on our marketing list until you unsubscribe, then we keep a record that you unsubscribed so we do not email you again.
8. Keeping it safe
We limit who can get into our Stripe and HubSpot accounts, and those accounts have two-factor authentication on them.
No system is completely secure. If personal information we hold is lost or accessed without permission and it is likely to cause you serious harm, we will tell you and we will tell the Office of the Australian Information Commissioner.
9. Getting a copy, fixing it, or deleting it
Email [SUPPORT EMAIL].
A copy. Ask and we will send you what we hold. We aim to respond within 30 days. We do not charge for this.
A correction. Tell us what is wrong and we will fix it.
Deletion. Ask and we will delete you from our marketing list and our CRM. We cannot delete order and payment records we are required to keep for tax purposes until that period runs out. We will tell you what we have kept and why.
Someone else's details. If you sent a gift and want the recipient's address removed, email us. If you are the recipient and want your details removed, email us directly.
10. Complaints
Email [SUPPORT EMAIL] and we will look into it and reply within 30 days.
If you are not satisfied, you can complain to the Office of the Australian Information Commissioner at oaic.gov.au or 1300 363 992.
11. Changes
We may update this policy. The current version is always on this page with the date it was last changed.