Privacy policy

Privacy Policy

Last updated: 14 October 2026

1. Who we are

Crafty Hobbies Australia ("we", "us", "our") is the data controller of your personal information for the purposes of the EU General Data Protection Regulation (GDPR), the UK GDPR, and the Australian Privacy Act 1988 (Cth).

ABN: 64 265 295 184
Address: 17 Sellers Crescent, Bellambi NSW 2518, Australia
Email: info@craftyhobbies.com.au
Phone: +61 2 4216 7950

2. What information we collect

Identity and contact data: name, email address, postal address, phone number.
Order and transaction data: products ordered, order value, payment method (we do not store full card numbers — these go directly to our payment processor).
Account data: login email, password (hashed), order history, wishlist.
Communications: emails, contact-form messages, product reviews, support tickets.
Marketing data: subscription preferences, email opens and clicks (via Klaviyo).
Technical data: IP address, browser type, device identifiers, pages viewed, referring URL, approximate location derived from IP.
Cookies and similar technologies: see our Cookie Policy.

3. How we use your data and our legal basis (GDPR Article 6)

Processing your order and delivering goods — performance of a contract.
Customer support and order communication — performance of a contract.
Account creation and login — performance of a contract.
Sending marketing emails — consent.
Product review requests via Judge.me — legitimate interest, or consent in the EU/UK.
Fraud prevention and chargeback management — legitimate interest.
Site analytics and product improvement — legitimate interest; consent for non-essential cookies.
Tax, accounting and legal record-keeping — legal obligation.

4. Who we share your data with

We share personal information only with the service providers we need to operate the store. Each is bound by a written data processing agreement.

Shopify Inc. (Canada / USA) — e-commerce platform and order data hosting.
Shopify Payments / PayPal Australia — payment processing.
Klaviyo Inc. (USA) — marketing email delivery and analytics.
Judge.me (Hong Kong) — product review collection and display.
Swym Corporation (USA / India) — wishlist functionality.
Shipping carriers (Australia Post, Sendle, Aramex and similar) — delivery of physical goods.
Our accountants and legal advisers, where strictly required.
Government and regulatory bodies, where required by law.
Google (USA) — Google Sheets and Apps Script, used to sync stock and orders between our store and online marketplaces

5. International transfers

Some of our processors are located outside Australia, the EEA or the UK (notably the USA). Where personal data is transferred from the EEA or UK to a country that has not received an adequacy decision, we rely on the European Commission's Standard Contractual Clauses (2021), the UK International Data Transfer Addendum, and supplementary technical measures (encryption in transit and at rest). Copies are available on request.

6. How long we keep it

Order records: 7 years from the order date (Australian tax law).
Customer account data: until you delete your account, then 30 days for technical erasure.
Marketing list data: until you unsubscribe, then deleted within 30 days.
Site analytics data: 14 months (Klaviyo) / 13 months (Shopify analytics).
Support correspondence: 3 years from last contact.
Backups: a further 35 days after the above periods, then permanently destroyed.

7. Your rights

Wherever in the world you are, you have the right to:

Access the personal data we hold about you;
Have it corrected if inaccurate;
Have it deleted (subject to legal retention obligations);
Object to or restrict certain processing;
Withdraw any consent you have given us, at any time, without affecting the lawfulness of processing before withdrawal;
Receive a copy of your data in a structured, commonly used and machine-readable format (data portability) — applies to data we process on the basis of consent or contract;
Lodge a complaint with a supervisory authority. In Australia: the Office of the Australian Information Commissioner (oaic.gov.au). In the EU: your local Data Protection Authority (list at edpb.europa.eu). In the UK: the Information Commissioner's Office (ico.org.uk).

To exercise any right, email info@craftyhobbies.com.au. We will respond within 30 days. We may need to verify your identity first.

8. Cookies and tracking

We use cookies and similar technologies. See our Cookie Policy for details and to change your preferences at any time.

9. Automated decision-making and profiling

We do not make decisions about you that produce legal or similarly significant effects using automated means. Klaviyo segments customers for marketing personalisation based on purchase and engagement history; this is not used for credit, employment or other significant decisions.

10. Children

The site is not intended for children. We do not knowingly collect personal data from anyone under 16. If you believe we have, contact us and we will delete it.

11. Security

We use TLS encryption for all data in transit, encrypted storage at our processors, two-factor authentication on admin accounts, and least-privilege access for staff. No system is completely secure; if a breach occurs, we will notify affected individuals and regulators within the timeframes required by applicable law (72 hours under GDPR; "as soon as practicable" under the Australian Notifiable Data Breaches scheme).

12. EU and UK representative

We are based in Australia and do not have an establishment in the EU or UK. We do not actively market to EU or UK residents. If you are in the EU/UK and wish to exercise your rights, please contact us at info@craftyhobbies.com.au and we will respond directly.

13.Marketplace orders (Amazon and eBay)

We also sell through online marketplaces such as Amazon and eBay. When you buy from us on a marketplace, the marketplace gives us the information we need to fulfil your order: your name, delivery address, the items ordered and the order total. For these orders:

We use this information only to pick, pack and post your order, to deal with delivery or return queries, and to keep the financial and tax records the law requires.
We do not use it for marketing, we do not contact you outside the marketplace’s own messaging, and we do not sell, rent or share it with anyone other than the carrier delivering your parcel and the service providers listed in section 4 that host our order records.
The information is stored only in our Shopify store and in our Google Sheets order records, with access limited to named, password-protected accounts that use two-step verification.
Your name and delivery address are deleted or anonymised from our systems within 30 days after delivery. We keep only the order number, items and amounts for as long as tax law requires (see section 6).

Marketplace buyers can also ask us to access or delete their information by emailing info@craftyhobbies.com.au, as described in section 7.

14. Changes to this policy

We will post any update to this policy on this page and update the "Last updated" date. Material changes will be notified by email to account holders.