Privacy Policy

Last Updated: 25 August 2026

Brendahickscollection ("we", "us", "our", "the Company") respects your right to privacy and is fully committed to protecting your personal data in accordance with applicable data protection legislation, including but not limited to the UK/EU General Data Protection Regulation (GDPR), the California Consumer Privacy Act (CCPA), and PCI-DSS payment security standards.

This Privacy Policy explains what personal data we collect, why we collect it, how we use and safeguard it, and your legal rights in relation to your data. By using our website and placing an order, you acknowledge that you have read and understood this Privacy Policy.

1. Data Controller & Contact

The data controller responsible for your personal information is:

Brendahickscollection
169-171 Craigieburn Road, Craigieburn Victoria 3064, Australia
Privacy Contact Email: Contact@brendahickscollection.store
Phone: 0749853648

2. Personal Data We Collect

We collect only the minimum personal data necessary to fulfil your order and provide our services. The categories of data we may collect include:

Identity & Contact Data: Full name, email address, telephone number, billing address, and shipping/delivery address.
Transaction & Order Data: Items purchased, order value, payment confirmation references, and order history.
Payment Data: Payment card type and last four digits (only). Full card numbers are never stored on our servers. All payment processing is handled by PCI-DSS Level 1 certified payment processors (such as Shopify Payments, Stripe, or PayPal).
Technical & Usage Data: IP address, browser type and version, operating system, device identifiers, referring URLs, pages visited, and time spent on pages. This data is collected via cookies and analytics tools to improve website performance.
Communication Data: Records of emails, live chat, or telephone communications between you and our customer support team for quality and training purposes.
Marketing Preferences: Whether you have opted in or out of receiving promotional communications from us.

3. Cookies & Tracking Technologies

We use cookies and similar tracking technologies on our website for the following purposes:

Cookie Type	Purpose	Mandatory?
Essential / Strictly Necessary Cookies	Required for the shopping cart, secure checkout, and user sessions to function correctly.	Yes
Functional / Preference Cookies	Remember your language, currency, and shopping preferences between visits.	Optional
Analytics Cookies	Help us understand how visitors use the site (e.g. Google Analytics) so we can improve pages and user experience.	Optional
Marketing & Retargeting Cookies	Used to deliver relevant advertising on third-party platforms (e.g. Google Ads, Meta). Only activated with your explicit consent.	Optional (Consent Required)

You can manage or withdraw cookie consent at any time via your browser settings or our cookie banner. Note that disabling essential cookies may prevent the website from functioning correctly.

4. Legal Basis for Processing (GDPR)

Under the GDPR, we rely on the following legal bases to process your personal data:

Contract Performance: Processing required to fulfil your order, arrange delivery, and handle returns/refunds.
Legitimate Interests: Fraud prevention, security monitoring, improving our website and services.
Legal Obligation: Retaining transactional records for tax, accounting, and regulatory compliance purposes.
Consent: Marketing emails and non-essential cookies — only where you have given explicit opt-in consent.

5. How We Use Your Personal Data

To process, fulfil, and deliver your order.
To send you order confirmation, shipping notification, and delivery update emails.
To process payments securely and detect/prevent payment fraud.
To provide customer support and respond to your enquiries.
To comply with applicable legal obligations (e.g. tax record keeping).
To send promotional communications (only with your explicit opt-in consent — you may unsubscribe at any time).
To analyse website usage and improve our services.

6. Data Sharing & Third-Party Disclosure

We do not sell, rent, trade, or share your personal data with any third party for their own marketing purposes. We share your data only with carefully vetted service providers who require it to deliver services on our behalf, including:

Payment Processors: Shopify Payments, Stripe, PayPal — for secure payment authorisation.
Shipping Carriers: Your name, address, and phone number are shared with our carrier partners solely to facilitate delivery.
Hosting & E-Commerce Platform: Shopify Inc. — who hosts our store under their own data processing agreements compliant with GDPR.
Analytics Providers: Google Analytics (anonymised IP data only).

All third-party service providers are contractually required to process your data only for the specific purposes we instruct and to maintain appropriate security standards.

7. Data Retention

We retain your personal data only for as long as necessary to fulfil the purposes described in this Policy or as required by law. Transactional records and order data are typically retained for up to 7 years for accounting and legal compliance purposes. Marketing consent records are retained until you withdraw consent.

8. Data Security

We implement industry-standard technical and organisational security measures to protect your personal data against unauthorised access, loss, alteration, or disclosure. These include:

256-bit SSL (TLS) encryption for all data transmitted between your browser and our website.
PCI-DSS Level 1 certified payment processing — your card details are tokenised and never stored on our servers.
Regular security monitoring, vulnerability scanning, and staff data protection training.
Restricted internal access to personal data on a strict need-to-know basis.

9. International Data Transfers

Your personal data may be processed in countries outside your home jurisdiction (including countries outside the UK/EU). Where this occurs, we ensure that appropriate safeguards are in place (such as Standard Contractual Clauses or equivalent mechanisms approved by the relevant data protection authority).

10. Your Data Protection Rights

Depending on your location, you may have the following rights regarding your personal data:

Right to Access: Request a copy of the personal data we hold about you.
Right to Rectification: Request correction of inaccurate or incomplete data.
Right to Erasure ("Right to be Forgotten"): Request deletion of your personal data (subject to legal retention obligations).
Right to Restrict Processing: Request that we limit how we use your data.
Right to Data Portability: Receive your data in a structured, machine-readable format.
Right to Object: Object to processing based on legitimate interests or for direct marketing purposes.
Right to Withdraw Consent: Withdraw any previously given consent at any time without affecting prior processing.
CCPA Rights (California Residents): Right to know, right to delete, right to opt-out of sale of personal information, and right to non-discrimination.

To exercise any of these rights, please contact us at Contact@brendahickscollection.store. We will respond within 30 days. You also have the right to lodge a complaint with your local data protection supervisory authority.

11. Children's Privacy

Our website is not directed at children under the age of 16. We do not knowingly collect personal data from children. If you believe we have inadvertently collected data from a child, please contact us immediately and we will delete it without delay.

12. Changes to This Privacy Policy

We may update this Privacy Policy periodically to reflect changes in our practices or applicable law. We will notify you of material changes by posting a notice on our website. The "Last Updated" date at the top of this page indicates when the most recent revision was made. Continued use of our website after updates constitutes acceptance of the revised Policy.