1. Introduction and Data Controller

Playandtuck operates www.playandtuck.com and sells children’s room storage products. We respect the privacy of our customers and handle personal information in accordance with applicable Australian privacy requirements and relevant European data protection laws.

Playandtuck is the data controller for personal information processed in connection with our website, customer enquiries and order administration, where applicable under data protection law.

This policy explains what information we collect, why we use it, how long we retain it and how you may exercise your privacy rights.

2. Personal Information We Collect

Depending on how you use our website, we may collect:

  • Contact details: name, email address, telephone number and billing or delivery address.
  • Order information: items ordered, order reference, transaction status and purchase history.
  • Payment-related information: payment status, transaction references and relevant payment details supplied or made available through our payment service provider.
  • Customer communications: messages, enquiries and information you provide when contacting us.
  • Website information: IP address, browser type, device information, access logs and cookie preferences, where collected.

We collect information that is reasonably necessary for the purposes described in this policy or otherwise permitted by applicable law.

3. How We Use Personal Information

We may use personal information to:

  • Process and administer orders and payments.
  • Arrange order fulfilment and respond to order-related enquiries.
  • Provide customer service and communicate with customers.
  • Maintain website functions and remember cookie preferences.
  • Review unusual transactions and address suspected misuse.
  • Maintain business records and meet applicable legal obligations.
  • Improve our understanding of general website usage where permitted by law and, where required, with your consent.

We do not use personal information for unrelated purposes unless permitted by law or otherwise authorised by you.

4. Payment Processing by Stripe

Payments made through our website are processed by Stripe, an independent payment service provider.

When you make a payment, relevant information may be provided to Stripe, including transaction details, contact information, billing details and payment information required to process the transaction. Stripe processes such information under its applicable privacy documentation and contractual arrangements.

Depending on the processing activity, Stripe may act as a processor on our behalf or as an independent controller for its own purposes, including applicable payment administration, fraud prevention, regulatory compliance and risk assessment.

We do not intentionally retain full payment card numbers or card security codes in our own website records. Payment information handled by Stripe is subject to Stripe’s applicable retention practices.

For further information, please consult Stripe’s privacy policy at https://stripe.com/privacy.

5. Disclosure of Personal Information

We may disclose relevant information to service providers involved in operating our website, processing payments, providing website hosting, maintaining business records and fulfilling orders.

Information may also be disclosed where necessary to comply with applicable law, respond to lawful requests from public authorities, establish or defend legal claims, or address suspected unlawful activity.

Service providers are permitted to handle personal information only as authorised by the relevant arrangements and applicable law. Where information is transferred internationally, we take steps required by applicable privacy legislation, including relevant Australian requirements and European data transfer rules where applicable.

6. Data Retention Periods

We retain personal information only for as long as reasonably necessary for the purposes for which it was collected, taking account of applicable legal, accounting and record-keeping obligations.

Our intended retention periods are:

  • Order and accounting records: generally up to 7 years after the relevant transaction, where required for business records, legal obligations or the establishment or defence of claims.
  • Customer service correspondence: generally up to 24 months after the enquiry has been resolved, unless a longer period is reasonably necessary.
  • Customer account information: for as long as the account remains active and, after closure, for the period reasonably required to address outstanding matters or applicable legal obligations.
  • Payment records held by Stripe: retained by Stripe in accordance with its applicable policies, contractual arrangements and legal obligations.
  • Website logs and analytics information: generally up to 12 months, unless a different period is necessary for the relevant purpose and permitted by law.
  • Cookie consent records: retained for the period needed to record and manage consent, in accordance with our Cookie Policy and applicable requirements.

These periods are applied according to the type of information and the purpose of retention. Where information is no longer required and no legal obligation requires its continued retention, we take appropriate steps to delete or de-identify it.

7. Cookies and Similar Technologies

Our website uses cookies and similar technologies for essential website functions and, where applicable, preferences and website analytics.

A cookie banner allows visitors to make a choice about non-essential cookies. We activate non-essential cookies requiring consent only after you click “Accept” on the cookie banner. Strictly necessary cookies may operate where permitted by law.

You may change or withdraw your cookie consent through the available website settings. Further information is provided in our Cookie Policy.

8. Data Handling and Protection

We take reasonable steps appropriate to the circumstances to protect personal information against misuse, interference, loss and unauthorised access, modification or disclosure.

Access to personal information is limited according to business needs. We also take reasonable steps to maintain the accuracy of information used for order administration and customer communications.

Where a personal data breach occurs, we will assess and respond to it in accordance with applicable legal requirements, including notification obligations where they apply.

9. Your Privacy Rights

Depending on your location and the applicable law, you may have the right to:

  • Request access to personal information we hold about you.
  • Request correction of inaccurate or incomplete information.
  • Request deletion of personal information where the legal conditions are met.
  • Request restriction of, or object to, certain processing activities.
  • Request a copy of eligible personal information in a portable format.
  • Withdraw consent where processing is based on consent.
  • Lodge a complaint with the relevant privacy or data protection authority.

These rights are subject to applicable legal conditions and exceptions, including circumstances where certain records must be retained to meet legal obligations.

To exercise a right, please contact us using the details in Section 12.

10. Marketing Communications

We may send promotional communications where permitted by applicable law. Where consent is required, we will obtain it before sending such communications.

You may opt out of marketing emails by using the unsubscribe option provided in the message or by contacting us directly. Requests will be handled in accordance with applicable requirements. Service messages relating to an existing order may still be sent where necessary.

11. Updates to This Policy

We may revise this Privacy Policy when our information-handling practices or applicable legal requirements change. The updated version will be published on this page with a revised effective date where appropriate.

12. Contact Information

For privacy enquiries, access or correction requests, or complaints concerning the handling of personal information, please contact us:

Brand Name: Playandtuck
Data Controller: Playandtuck
Registered Company Name: [Registered Company Name]
Website: www.playandtuck.com
Email: platform@playandtuck.com
Registered Address: [Company Address]
Telephone: [Telephone Number]

We aim to respond to email enquiries within 24–48 hours. Requests requiring further review may take longer, and we will handle them within the time limits required by applicable law.