Your privacy

Bliss Box is a trading name of Aus Bliss Box, a registered business name based in Adelaide, South Australia. This policy explains what personal information we collect, why we collect it, who we give it to and what you can do about it. It is written to meet our obligations under the Privacy Act 1988 (Cth) and the Australian Privacy Principles.

We know that what people buy from a shop like this one is private. Discretion is not a marketing line here, it is how the system is built.

What we collect

• When you order: your name, email address, delivery address, and a phone number if you give one. You do not need an account to buy.
• Payment details: we never see or store your full card number. Payment is handled by our payment provider and only a reference and the result come back to us.
• If you create an account: your email address, a password that is stored only as a hash, and anything you choose to save such as delivery addresses.
• When you contact us: the message you send and the address you send it from.
• Live chat: the messages you send us through the chat window on the site, and the email address you give so we can reply if you leave before we answer. They are kept with the rest of our support conversations, and deleted 12 months after the last message unless they relate to a support matter, a return or an order issue that is still open.
• Email you send us: held in our Google Workspace mailbox, with a copy kept in our support records so we can answer and follow up.
• Age confirmation: the time you confirmed you are over 18, and technical details of that request, because we are required to be able to show that the check happened.
• How the site is used: which kind of page you looked at, how long it was open in front of you, and the site that sent you here. We record the kind of page and never the exact one: a product page is recorded as "a product page" and never by name, so this can tell us that product pages are read and never which product you read. The referring site is recorded as the site only, never the full address, because a link from a search engine carries the words you searched for.
• Whether that is linked to you: only if you accept analytics cookies. If you do not, the visit is still counted, but with nothing attached: no cookie, no account, nothing that could join it to you, to your other visits, or to anything you bought.
• Your IP address, briefly: held for up to an hour so that nobody can flood our forms and our checkout with automated requests. It is not stored in our database and it is not used to work out who you are or where you live.

What we do not collect

We do not ask for information about your health, your relationships or your sexuality, and you should not send us any. We do not buy personal information from anybody, and we do not build profiles of what you might be interested in based on anything other than what you have actually bought from us.

Why we collect it

To take payment, to pack and send your order, to answer your questions, to meet our tax and consumer law obligations, and to run the shop. If you have asked for it, to send you occasional email about products and offers.

Who we share it with

We share the minimum needed, with:

• our payment provider, to take payment;
• the delivery carrier, to get the parcel to you;
• the services that host the site and send our email;
• Google, whose Workspace service holds our email and support correspondence;
• our accountants, and government agencies where the law requires it.

We do not sell your personal information, and we do not disclose it for anybody else's marketing.

Where it is stored

Some of the services above store data outside Australia, including in the United States and Singapore. Where that happens we take reasonable steps to make sure the information is handled consistently with the Australian Privacy Principles.

Marketing email

We only send marketing email to people who have asked for it. Every one of those messages has an unsubscribe link that works immediately and without you needing to sign in. Order confirmations, delivery notices and replies to your own questions are not marketing and are sent whether or not you subscribe.

Discretion

Our email never names a product in the subject line, our parcels are plain and unbranded on the outside, and the name on your bank statement is a neutral trading name rather than a description of what you bought.

Cookies

We use a small number of cookies to keep you signed in, to remember your bag, and to record that you confirmed your age. Those are necessary for the shop to work and cannot be turned off without breaking it.

The analytics cookie is the only optional one. It is a random identifier for your browser, with your name nowhere near it, and it is what lets us tell one visit from two. It is set only if you accept it, and you can change your mind at any time from the link in the footer. If you decline, we still count that a page was viewed, and there is nothing attached to that count.

We do not use advertising cookies or tracking pixels. There are none on this site and there is no plan to add any.

How long we keep it

Order and tax records are kept for at least five years because Australian tax law requires it. Marketing preferences and unsubscribe records are kept so we can prove we honoured your choice. Everything else is kept only as long as we need it.

Security

Access to customer information is restricted to the people who need it, every change is logged, and payment details never reach our systems. No system is perfect, and if a data breach happens that is likely to cause you serious harm we will tell you and the Office of the Australian Information Commissioner as the Notifiable Data Breaches scheme requires.

Getting a copy, correcting it, or deleting it

If you have an account you can see and correct your details, download a copy of your data and ask for your account to be erased from the privacy section of your account. You can also just write to us and ask.

When an account is erased we remove your name, address and contact details. We keep the order records themselves, with your details removed, because tax law requires us to hold them. We also record that your address has been erased so that it can never be added back to a mailing list.

Automated decisions

We do not use your personal information to make automated decisions that significantly affect you.

A few checks are automatic and apply the same way to everyone: the checkout refuses a product we are not allowed to send to the delivery address, and we limit repeated attempts to sign in or to pay. Our payment provider also screens card payments with its own fraud checks and may decline a card. None of these assesses you as a person.

Complaints

If you are not happy with how we have handled your information, write to us first and we will look into it. If you are still not satisfied you can complain to the Office of the Australian Information Commissioner at oaic.gov.au.

Changes

If we change this policy we will publish the new version here.