1. Who is responsible

Apni Dukaan is operated by RH Foods & Meats Pty Ltd, ABN 41 668 798 892. This policy covers our online store at apnidukaan.com.au, including Aayat Collections and Fragrance Bazaar purchases through the store.

For a privacy question or request, email info@apnidukaan.com.au with the subject “Privacy”, or call 1300 385 226. Our business correspondence address is 2B Quandong St, Leppington NSW 2179, Australia. This is a correspondence address, not a walk-in shop or automatic returns address.

2. Information we collect

Information you provide can include your name, email address, phone number, billing and delivery addresses, postcode, account details, order contents, delivery instructions, membership information, and messages or photos you send about an order. If you provide another person’s delivery details, please make sure you are authorised to do so.

Transaction records can include the order value, payment status, refund history, payment-provider references and limited payment-method information. Payment providers process the information needed to complete your payment. Do not send a full card number, security code or password to our support team.

When you browse, technical and activity information can include your IP address, browser and device information, pages and products viewed, basket activity, referral source, cookie identifiers and interactions with our messages. What is collected depends on the features used, service configuration, and your browser or privacy choices.

3. How we collect and use information

We collect information when you browse the store, enter a postcode, create an account, place an order, join Plus, subscribe to updates or contact us. We also receive payment and delivery updates from the providers handling your order.

We use relevant information to process and fulfil orders; check delivery coverage and applicable prices; administer accounts and memberships; send order, payment and delivery updates; provide customer support and refunds; protect the store from fraud and misuse; maintain business records; and understand and improve the shopping experience.

Email and SMS marketing choices are separate and optional. We use marketing services such as Klaviyo to manage subscriptions and, where we have the required consent, send offers, product recommendations and automated reminders, including about an unfinished basket. Our checkout signup lists use confirmation of subscription (double opt-in). Merely placing an order, opening an account or providing a phone number for delivery does not by itself subscribe you to marketing.

Order, customer and website activity information can be processed by connected services for the purposes described in this policy even where you have not subscribed to marketing; that processing is not itself permission to send you marketing. Necessary service communications about an order, delivery, payment or account are handled separately from promotional subscriptions. You can unsubscribe from marketing as explained below.

4. Service providers and information sharing

Our store uses WordPress and WooCommerce. We share relevant information with providers that help operate the website and business, including website hosting and security services, payment processors, couriers and fulfilment services, customer-support tools, email and marketing services, and analytics or advertising services. We may also provide relevant records to professional advisers or authorities where required or permitted by law.

The store’s integrations include Automattic/WordPress and Jetpack, Stripe, Visa Acceptance Solutions, Klaviyo, Google Analytics, Meta for WooCommerce and Tidio. The information a provider receives depends on the service you use and which features are enabled. For example, a courier needs delivery and contact details; a payment provider needs information to process and protect a transaction; and an email service may process subscription, order and message-interaction information.

These providers have their own privacy information. See Automattic’s privacy policy, Stripe’s privacy policy and Klaviyo’s privacy notice. Contact us for help identifying the provider relevant to a particular feature or transaction.

5. Cookies, postcode preferences and tracking

Cookies and similar browser storage help keep the basket working, maintain account sessions, remember preferences and support website security. Our postcode selector remembers the selected postcode on the device for up to 30 days; the delivery address entered at checkout is used to confirm the order’s delivery options and prices.

Analytics, email and advertising integrations may use cookies, pixels or similar technologies to measure visits, product and basket activity, message opens and clicks, and advertising interactions. Depending on the enabled integration, this activity may be linked with an account, email profile or platform identifier.

You can control or remove cookies through your browser settings and use privacy or advertising settings provided by the relevant platform. Blocking necessary cookies may affect your basket, login or other store functions. Unsubscribing from marketing stops marketing messages; it does not by itself remove browser cookies or delete an account.

6. Storage and overseas processing

Information is held in our website databases, order and business records, email and support systems, and service-provider systems. It is not stored or processed exclusively in Australia. Overseas processing can include the United States and countries in Europe, including Poland, depending on the service. For example, Klaviyo identifies US hosting for its cloud and email-delivery providers, while Tidio operates through US and Polish entities and describes processing within the European Economic Area and transfers to the US.

Providers can use additional locations for support and other services. Their current location details are available in the Klaviyo subprocessor register, Tidio privacy information, Automattic privacy information and Stripe privacy information. Not every location in a provider’s list is necessarily used for your information; it depends on the relevant feature and processing arrangement. Contact us for help with a specific service or disclosure.

We retain information for order support, refunds, account and membership administration, security, business records and legal obligations. There is no single fixed automatic deletion period configured for all customer or order records in our store. Account closure or marketing unsubscription does not automatically erase transaction history or records we need to retain. Contact us to request access, correction or deletion, or to ask about the retention of a particular record. We assess the request against the continuing purpose and applicable obligations and explain any information we must keep.

We take reasonable steps to protect the information we handle and limit access to those who need it for their work. No website or method of electronic transmission is completely risk-free. Use a strong account password and contact us promptly if you suspect unauthorised use of your account.

7. Marketing choices

Use the unsubscribe link in a marketing email or SMS to stop that type of marketing. Texts sent from the name ApniDukaan may not accept replies, so do not rely on replying STOP to a named sender: use the unsubscribe link in the message instead. You can also email info@apnidukaan.com.au or call 1300 385 226 and identify the email address or phone number to remove. You do not need to log in or create an account to unsubscribe.

Marketing is optional, and consent is not a condition of purchase. Message frequency varies. Necessary service communications about an existing order, delivery, payment or account may still be sent. Unsubscribing is separate from requesting deletion of an account or changing browser-cookie settings. This policy is not itself a request for, or proof of, your marketing consent.

You can choose not to provide optional information. Some information is necessary to process an order or deliver it; without that information, we may not be able to provide the requested service.

8. Access, correction and complaints

Contact us to request access to the personal information we hold about you, correct inaccurate information, ask about account closure or deletion, or raise a privacy complaint. Please describe your request and provide enough information for us to locate the relevant records. We may need to verify your identity before releasing or changing information.

We will assess the request or complaint, investigate where needed and explain our response, including any legal or practical limitation on providing access or deleting records. We will let you know if additional information or time is needed.

If you are dissatisfied with our response, you can contact the Office of the Australian Information Commissioner for information about privacy rights and available complaint pathways.

9. Other websites and policy changes

Links to social platforms, payment services and other external websites lead to services with their own privacy practices. Please read their privacy information when using those services.

We may update this policy when our services or information-handling practices change. Changes to this policy do not replace any consent that is required for a new use of personal information. Contact us for a copy or an explanation of this policy.