PRIVACY POLICY
1. ABOUT THIS PRIVACY POLICY
Arima Homewares (“Arima Homewares”, “Arima”, “we”, “us” or “our”) respects the privacy of individuals and is committed to handling personal information responsibly.
This Privacy Policy explains how we collect, hold, use and disclose personal information when you:
• visit www.arimahomewares.com.au (the “Website”);
• confirm your age when entering the Website;
• create or use an account;
• place or attempt to place an order;
• make a payment;
• contact us by email or live chat;
• request a return, refund, exchange, warranty assessment or other service;
• report a delivery issue;
• make a complaint or dispute a transaction; or
• otherwise interact with Arima Homewares.
Arima Homewares accepts orders for delivery to Australian addresses only and does not offer international delivery. However, some technology, payment and service providers that support our Australian business may process or store personal information outside Australia, as explained in this Privacy Policy.
Where the Privacy Act 1988 (Cth), the Australian Privacy Principles or other privacy laws apply to us or to a particular activity, we will handle personal information in accordance with those requirements. Whether or not a particular exemption applies, we intend to handle personal information consistently with this Privacy Policy.
This Privacy Policy applies from the date it is published. It does not retrospectively make an earlier use or disclosure lawful if that use or disclosure was not permitted when it occurred.
2. AGE RESTRICTION AND SALES OF KNIVES OR CONTROLLED ITEMS
The Website is intended only for persons aged 18 years or over. We use an age-confirmation mechanism when a person enters the Website and may use a cookie or similar technology to remember that confirmation.
The Website age confirmation is a self-declaration only. It does not, by itself, verify a person’s identity or establish that the person is legally entitled to purchase a knife or other age-restricted product.
We do not knowingly accept orders from persons under 18 years of age.
Where an order contains a knife or another controlled or age-restricted item, we may require evidence that the purchaser and, where relevant, the recipient is at least 18 years of age.
For an order containing a knife or controlled item for delivery to Queensland, where we agree to supply the item, we generally require acceptable evidence of age before accepting, processing or dispatching the order.
We may also conduct age verification for other Australian destinations where required by law, required by a supplier or delivery provider, or reasonably necessary to prevent an unlawful sale.
Age or identity evidence may include:
• a driver licence;
• a proof of age card;
• an Australian or foreign passport;
• a digital authority, digital evidence of age or digital evidence of identity that is recognised under applicable law; or
• a verification result provided by an age or identity-verification provider, where that method is legally sufficient for the relevant transaction.
For a controlled item supplied to Queensland, the evidence used for the age check must satisfy the applicable Queensland definition of acceptable evidence of age. We will not rely on another form of evidence where it would not satisfy the applicable legal requirements.
For age or identity verification, we may collect or review:
• your name;
• date of birth;
• photograph;
• document type;
• document expiry date;
• limited document details;
• billing or delivery address;
• the name of the person receiving the order;
• a digital verification result, reference number or token; and
• information reasonably necessary to identify suspected alteration, impersonation or fraud.
We will request only the information reasonably necessary for the verification. Where practicable, you may obscure information that we do not need, provided that the remaining information is sufficient to complete the verification.
Where a third-party verification provider performs the check, that provider may process identity information under its own privacy policy. Where practicable, we will receive only the verification result rather than a complete copy of the identity document.
Where a complete copy or image of an identity document is provided directly to us, we will generally delete it promptly after the verification has been completed, unless temporary retention is reasonably necessary:
• to complete or review the verification;
• because the verification is disputed;
• to investigate suspected fraud or unlawful activity;
• to respond to a regulator, law-enforcement body or court;
• to establish, exercise or defend a legal claim; or
• because retention is otherwise required or permitted by law.
We may retain a limited verification record, such as:
• confirmation that the person was verified as 18 years or over;
• the date and method of verification;
• the type of evidence sighted;
• the order or transaction reference; and
• the outcome of any manual review.
We do not use a driver licence number, passport number or other government-related identifier as our own customer or account identifier.
When we request age or identity evidence, we may provide a separate collection notice explaining the information requested, the purpose of the verification, the consequences of not providing sufficient information, the usual recipients of the information and our intended retention practices. That notice should be read together with this Privacy Policy.
We may refuse, suspend or cancel an order if:
• age or identity cannot be satisfactorily verified;
• information appears false, altered, inconsistent or misleading;
• the purchaser or recipient appears to be under 18;
• the product cannot lawfully be supplied to the destination;
• the required delivery or age-verification service is unavailable; or
• the transaction otherwise presents an unacceptable legal, safety or fraud risk.
3. PERSONAL INFORMATION WE MAY COLLECT
The personal information we collect and hold depends on your dealings with us and may include the following.
Identity and contact information:
• name;
• email address;
• telephone number;
• billing address;
• delivery address;
• account username or account details; and
• details of another person authorised to receive an order.
Order and transaction information:
• products ordered or viewed;
• order history;
• order value;
• discounts and gift-card information;
• invoices and receipts;
• payment method;
• payment or transaction reference;
• billing status;
• refund, exchange and return information; and
• limited payment information supplied by a payment provider or financial institution.
We do not ordinarily receive or store your complete payment-card number, security code or complete payment credentials.
Delivery and fulfilment information:
• courier and freight-provider details;
• tracking and consignment numbers;
• dispatch, scan and delivery records;
• delivery date and time;
• proof of delivery;
• signatures;
• recipient or receiver details;
• authority-to-leave information;
• delivery photographs;
• driver notes;
• GPS, geolocation or pin information supplied by a courier;
• mailroom, loading-dock, reception or parcel-room information;
• parcel-locker records; and
• records concerning a missing, delayed, damaged, stolen or disputed delivery.
Customer-service information:
• emails;
• live-chat records;
• enquiries and feedback;
• complaint information;
• return, refund and warranty communications;
• photographs, videos or documents you provide; and
• records of our responses and attempts to contact you.
Age and identity-verification information:
• age confirmation;
• date of birth;
• identity-document information;
• verification results and references; and
• information reasonably required to assess whether an order is genuine and lawful.
Website and technical information:
• IP address;
• browser type;
• device type;
• operating system;
• network and approximate location information;
• referring website;
• pages viewed;
• searches;
• shopping-cart activity;
• checkout activity;
• cookies and similar identifiers; and
• information concerning how you interact with the Website.
Fraud, security and dispute information:
• fraud or risk indicators;
• payment-provider risk assessments;
• device and transaction information;
• suspected account or payment misuse;
• previous disputes, refunds or chargebacks;
• communications with payment providers, banks, card schemes, couriers or insurers; and
• information reasonably relevant to a suspected unauthorised transaction, payment dispute or legal claim.
We may also collect any other personal information that you voluntarily provide to us.
We do not ordinarily seek to collect sensitive information. If an identity document or other material incidentally reveals sensitive information that is not required for our purpose, we will not use that information for an unrelated purpose.
4. HOW WE COLLECT PERSONAL INFORMATION
We may collect personal information:
• directly from you when you visit the Website, enter information, place an order, contact us or provide documents;
• automatically through Shopify, cookies, pixels, analytics tools, server logs and similar technologies;
• from payment gateways, banks, card issuers, card acquirers, card schemes and financial institutions;
• from suppliers, distributors, manufacturers, warehouses, fulfilment partners and drop-shipping providers;
• from couriers, freight companies, delivery drivers and logistics providers;
• from age-verification, identity-verification, cybersecurity, fraud-prevention and risk-assessment providers;
• from insurers, professional advisers and dispute-resolution providers;
• from building owners, owners corporations, strata managers, building managers, reception staff, concierge staff, mailrooms, parcel rooms, loading docks or parcel-locker operators where reasonably necessary to investigate a delivery;
• from publicly available sources where reasonably necessary for a legitimate business purpose;
• from a person authorised to act for you; and
• where otherwise required or permitted by law.
You may deal with us anonymously or using a pseudonym for some general enquiries. However, we generally cannot process an order, payment, delivery, return, warranty, age verification, privacy request or transaction dispute without sufficient identifying information.
5. WHY WE COLLECT, HOLD, USE AND DISCLOSE PERSONAL INFORMATION
We may collect, hold, use and disclose personal information to:
• process, verify and fulfil orders;
• receive and verify payments;
• arrange delivery, collection, redelivery, returns and exchanges;
• provide refunds, credits and warranty services;
• communicate with you about an order, account, delivery or enquiry;
• provide customer support;
• verify identity, age, payment authority or delivery details;
• comply with laws concerning knives, controlled items and other restricted products;
• manage suppliers, warehouses, fulfilment partners and delivery providers;
• maintain accurate transaction, accounting, tax and business records;
• operate, secure, maintain and improve the Website;
• understand Website performance and customer use;
• prevent, detect and investigate fraud, unlawful activity, misuse, account compromise and unauthorised transactions;
• assess order, payment and delivery risk;
• investigate missing, delayed, damaged, stolen, misdelivered or disputed consignments;
• locate or recover goods;
• investigate and resolve complaints;
• respond to chargebacks, payment reversals, card disputes, insurance claims and other transaction disputes;
• protect the rights, property, merchandise, customers, staff, suppliers and legitimate interests of Arima Homewares;
• establish, exercise or defend legal or contractual rights or claims;
• participate in confidential dispute-resolution processes;
• comply with legal obligations, court or tribunal orders and lawful requests from regulators or enforcement bodies;
• obtain legal, accounting, insurance, technical or other professional advice;
• manage a proposed or completed sale, merger or restructuring of the business; and
• send direct marketing where you have consented or where otherwise permitted by law.
We may use or disclose personal information:
• for the primary purpose for which it was collected;
• for a related secondary purpose that a reasonable person would expect;
• with your consent;
• where required or authorised by Australian law or a court or tribunal order;
• where a permitted general situation or other legal exception applies; or
• where otherwise permitted under applicable privacy law.
We will not use or disclose personal information for an unrelated purpose unless you consent or the use or disclosure is otherwise permitted or required by law.
6. DELIVERY INVESTIGATIONS, COMPLAINTS AND PAYMENT DISPUTES
When a delivery, payment or transaction is questioned or disputed, we may use, collect and disclose personal information reasonably necessary to:
• confirm whether an order was accepted, paid for, dispatched or delivered;
• confirm the delivery address, building or location;
• identify the person or area to which a consignment was delivered;
• determine whether a parcel was accepted, moved, stored, collected or accessed;
• locate or recover a consignment;
• investigate loss, theft, damage, misdelivery or suspected fraud;
• obtain or verify proof of delivery;
• respond to a chargeback, payment reversal, insurance claim or other dispute; and
• establish, exercise or defend our legal or contractual rights.
For these purposes, we may communicate with or disclose limited relevant information to:
• the courier, freight provider, driver or logistics contractor;
• the supplier, distributor, warehouse or fulfilment partner;
• Shopify or another ecommerce platform provider;
• payment gateways, banks, financial institutions, card issuers, acquirers and card schemes;
• insurers, investigators, lawyers, accountants and other professional advisers;
• a building owner, owners corporation, strata manager, building manager, reception, concierge, mailroom, parcel room, loading-dock representative or parcel-locker operator responsible for the delivery address;
• law-enforcement agencies, regulators, courts and tribunals; and
• another person or organisation reasonably responsible for managing or recording deliveries at the relevant address.
Information used or disclosed during an investigation may include:
• recipient name;
• email address or telephone number where necessary;
• unit number and delivery address;
• order and tracking numbers;
• courier information;
• delivery date and time;
• carton dimensions, weight or description;
• a description of the goods;
• proof of delivery;
• signatures or receiver details;
• delivery photographs;
• scan, driver-note or GPS records;
• age or identity-verification outcome;
• relevant customer communications; and
• other information reasonably necessary for the particular investigation.
We will limit a disclosure to the minimum personal information reasonably necessary for the investigation or dispute. We will not disclose complete payment-card credentials or information that is unrelated to the matter.
Where appropriate, we may first make an enquiry without identifying the customer and provide further information only if reasonably necessary to conduct the investigation.
Nothing in this Privacy Policy limits any right or remedy available to a consumer under the Australian Consumer Law or prevents a person from raising a legitimate complaint or payment dispute.
7. WHO WE MAY SHARE PERSONAL INFORMATION WITH
We may disclose personal information, to the extent reasonably necessary, to:
• Shopify and providers that support our ecommerce platform;
• payment providers and financial institutions, including providers such as Shopify Payments, PayPal and Afterpay where available at checkout;
• banks, card issuers, card acquirers and card schemes, including Visa, Mastercard and American Express;
• suppliers, manufacturers, distributors, warehouses, fulfilment partners and drop-shipping providers;
• Australia Post, couriers, freight companies and other delivery providers;
• identity, age-verification, cybersecurity, fraud-prevention and risk-assessment providers;
• website hosting, cloud-storage, IT, technical-support and security providers;
• email, customer-service, analytics, advertising and marketing providers;
• lawyers, accountants, auditors, insurers, investigators and other professional advisers;
• debt-recovery, goods-recovery and dispute-resolution providers;
• building and parcel-management representatives described in section 6;
• regulators, law-enforcement agencies, government bodies, courts and tribunals;
• a prospective purchaser, purchaser or successor in connection with a sale, merger or restructuring of all or part of the business; and
• any other person where you consent or where disclosure is permitted or required by law.
We do not sell or rent customer lists for monetary consideration.
Some third parties process personal information under their own privacy policies and legal obligations.
8. PAYMENT INFORMATION
Payments may be processed by Shopify, PayPal, Afterpay, banks or other payment providers available at checkout.
Those providers may collect payment-card, financial, billing, device, identity and transaction information under their own privacy policies.
Arima Homewares generally receives:
• confirmation of whether a payment was approved;
• payment method;
• transaction reference;
• amount paid;
• limited card information, such as card type or last digits where supplied;
• billing information; and
• fraud or risk information.
We do not ordinarily receive or store complete payment-card credentials.
9. COOKIES, ANALYTICS AND ADVERTISING
The Website may use cookies, pixels, tags, local storage and similar technologies to:
• operate the Website and checkout;
• maintain a shopping cart;
• remember account or Website preferences;
• remember an age-confirmation selection;
• maintain security and prevent fraud;
• analyse traffic, Website use and performance;
• measure advertising;
• personalise content or advertising; and
• understand whether communications or advertisements are effective.
Some technologies are provided by Shopify or third-party providers, which may include Google Analytics, Google Ads, Meta or other analytics, advertising and email-marketing providers where those services are enabled.
An age-confirmation cookie ordinarily records that an age confirmation was made. It does not necessarily contain your date of birth or establish that your age was independently verified.
You may be able to manage cookies through:
• Website cookie settings, where available;
• browser settings;
• device settings; or
• the opt-out controls provided by the relevant third party.
Blocking necessary cookies may prevent some Website or checkout functions from operating correctly.
10. DIRECT MARKETING
Where you have consented, or where otherwise permitted by law, we may send information about products, promotions, availability and store updates.
You may unsubscribe by:
• using the unsubscribe link in the communication;
• changing available account preferences; or
• contacting us.
Unsubscribing from marketing does not prevent us from sending necessary transactional, security or service communications relating to an order, payment, delivery, account, return, refund, warranty, age verification or dispute.
11. AUTOMATED TOOLS AND RISK ASSESSMENT
Shopify, payment providers and other service providers may use automated systems, machine learning or rules-based tools to:
• process or decline payments;
• identify suspicious transactions;
• assign a fraud or risk indicator;
• identify unusual account, device or order activity;
• detect security threats; and
• recommend that an order be manually reviewed.
The personal information used by these systems may include:
• name and contact information;
• billing and delivery addresses;
• order history and value;
• payment and transaction information;
• IP address, browser and device information;
• account activity;
• delivery information; and
• previous fraud, refund or dispute indicators.
Within Arima Homewares, an automated result may cause an order to be held for review or may prompt us to request further information. We do not ordinarily rely solely on an automated fraud score to make a significant adverse decision where meaningful human review is reasonably available.
A payment provider may automatically approve or decline a transaction under its own systems and privacy policy. We may not be able to override a payment provider’s decision.
12. OVERSEAS PROCESSING AND DISCLOSURE
Arima Homewares delivers products only within Australia. This does not mean that all personal information is stored or processed only in Australia.
Some providers that support our Website, payments, marketing, security, communications and data storage operate outside Australia.
Likely overseas locations may include:
• Singapore;
• Canada;
• the United States of America; and
• other countries in which a relevant service provider or its subprocessors operate.
For example, Shopify may receive or process information relating to Australian customers through its Singapore entity and may transfer information to other locations used by Shopify and its service providers.
Where applicable law requires us to do so, we will take reasonable steps to ensure that an overseas recipient handles personal information appropriately. However, overseas recipients may be subject to privacy and disclosure laws that differ from Australian law.
We may update the likely countries listed in this section if our service providers or information-handling arrangements change.
13. SECURITY OF PERSONAL INFORMATION
We take reasonable administrative, technical and physical steps to protect personal information from:
• misuse;
• interference;
• loss;
• unauthorised access;
• unauthorised modification; and
• unauthorised disclosure.
Measures may include:
• limiting staff and contractor access;
• account and access controls;
• secure service providers;
• encrypted transmission where appropriate;
• payment-industry security controls;
• system monitoring;
• staff procedures;
• secure deletion processes; and
• separating or restricting access to identity-verification information.
Third-party service providers are expected to apply appropriate security measures to information they handle.
No method of transmission over the internet or electronic storage is completely secure. We cannot guarantee absolute security, but we will take reasonable steps appropriate to the nature of the information and the risks involved.
14. RETENTION AND DELETION
We retain personal information only for as long as reasonably necessary for a purpose permitted by law.
We may retain order, transaction, communication, delivery and verification records where reasonably required to:
• complete an order, delivery, refund, return, exchange or warranty;
• comply with tax, accounting and record-keeping obligations;
• maintain evidence of an age or identity verification;
• investigate fraud, unlawful activity or security concerns;
• investigate a delivery issue;
• respond to a chargeback, complaint, insurance claim or legal proceeding;
• recover a debt or goods;
• enforce our terms or protect legal rights; or
• comply with a legal hold, court order or regulatory requirement.
Complete identity-document images received directly by us are generally retained for a much shorter period than the related order record and are deleted when the verification purpose has been completed, subject to the exceptions described in section 2.
A limited age-verification result or audit record may remain associated with the order.
When personal information is no longer reasonably required for any permitted purpose, we will take reasonable steps to destroy it or de-identify it.
Some deleted information may remain temporarily in protected system backups or archives until those copies are overwritten or securely deleted in the ordinary operation of the relevant system. Information retained only in a backup will not ordinarily be used for another purpose.
15. DATA BREACHES
If we become aware of unauthorised access to, disclosure of or loss of personal information, we will assess and respond to the incident.
Where required by the Privacy Act or another applicable law, we will notify affected individuals and the Office of the Australian Information Commissioner of an eligible data breach.
We may also contact relevant service providers, insurers, professional advisers, regulators or enforcement bodies as reasonably necessary to manage and investigate the incident.
16. ACCESS, CORRECTION AND DELETION REQUESTS
You may ask us to:
• provide access to personal information we hold about you;
• correct information that is inaccurate, out of date, incomplete, irrelevant or misleading; or
• delete information that is no longer reasonably required.
A request does not need to use a particular form, but providing your name, contact details, order number and a clear description of the information will help us locate and respond to the request.
We may take reasonable steps to verify that:
• you are the individual concerned; or
• a person making the request is authorised to act for you.
We will request only the minimum information reasonably necessary to verify the requester.
We aim to respond within a reasonable period and ordinarily within 30 days.
There is no charge to make an access or correction request. Where permitted by law, we may charge reasonable costs of providing access, but we will explain any proposed charge before incurring it.
We may refuse access or deletion, or provide only partial access, where permitted or required by law. This may include where:
• access would unreasonably affect another person’s privacy;
• disclosure would be unlawful;
• the information relates to existing or reasonably anticipated legal proceedings;
• access would prejudice an investigation into suspected unlawful activity, serious misconduct or fraud;
• access would prejudice an enforcement activity;
• the request is frivolous or vexatious; or
• the information remains reasonably necessary for an order, legal obligation, chargeback, dispute, fraud investigation or legal claim.
Where required, we will provide written reasons for refusing a request and explain available complaint options.
17. PRIVACY COMPLAINTS
If you believe we have mishandled your personal information, please contact our Privacy Officer in writing.
Please include:
• your name and contact details;
• a description of the issue;
• relevant dates or order details;
• any supporting information; and
• the outcome you are seeking.
We will handle privacy complaints fairly and investigate them according to the circumstances.
We aim to acknowledge a complaint promptly and ordinarily provide a substantive response within 30 days. If the matter is complex and requires more time, we will inform you.
A complaint about privacy is separate from a product, delivery, payment or Australian Consumer Law complaint, although the same matter may involve both types of issue.
Where the Privacy Act applies and you are not satisfied with our response, you may be entitled to complain to the Office of the Australian Information Commissioner after giving us a reasonable opportunity to address the complaint.
18. THIRD-PARTY WEBSITES AND SERVICES
The Website may contain links to websites or services operated by third parties.
Arima Homewares is not responsible for the privacy practices of a third party that does not act for us. You should review the third party’s privacy policy before providing personal information directly to that party.
19. CHANGES TO THIS PRIVACY POLICY
We may update this Privacy Policy to reflect changes in:
• our business;
• our information-handling practices;
• technology;
• service providers; or
• applicable law.
The current version will be published on the Website with an updated date.
Where a change is material, we may provide additional notice where reasonably appropriate.
A policy update will not retrospectively convert an earlier use or disclosure into one that was permitted at the time it occurred.
20. CONTACT US
Privacy Officer
Arima Homewares
Email:
info@arimahomewares.com.au
Post:
Arima Homewares
C017/444 Jones Street
Ultimo NSW 2007
Australia
Customer service and privacy enquiries are handled by email, Website live chat or post.