Our website displays products available from independent vendors ("Vendors"). We act as their agent and receive payments on their behalf.

We and our Australian Vendors are bound by the Australian Privacy Principles. To the best of our ability, we and our Vendors also comply with privacy laws in jurisdictions where Vendors or their customers are located, including the EU General Data Protection Regulation (GDPR).

In this policy, "we", "us" and "our" mean OFC (Aust) Pty Ltd (ABN 68 642 587 381) of Suite 201, 5 Alexander Street, Crows Nest, NSW 2065. We are the controller of personal information collected on our website.

Sign-up. Every visitor can subscribe to our email list to receive product and offer information from our Vendors. This is optional - the only information collected is your email address.

Account, shipping & billing. The first time you check out, you'll set up an account with an email and password, and provide shipping details (name, address, phone) and billing details. We store this so you don't have to re-enter it next time.

Checkout. Payments run through credit card, PayPal or AfterPay, processed by Stripe. We do not store your card details in our own system.

Purchase details. We record purchase details for tax and contractual purposes.

Messaging. We keep transactional messages relating to your order and any messages with our Customer Service team, sometimes via third-party messaging providers.

Wishlists, Rewards & Gift Vouchers. We may collect related information when you use these features - what's collected will be obvious from the context.

Direct marketing. If you've signed up or purchased, we may contact you by email, text or post about products and offers, hosted via ActiveCampaign. Every promotional email includes a link to set your frequency preferences, and your gender and birth date if you'd like birthday offers. You can unsubscribe at any time.

Cookies. We use cookies and similar technologies to record the pages you visit and time spent on them, to improve site performance and personalise marketing.

Analytics. We record browser type and IP address to analyse, maintain and improve site performance and compatibility.

We collect order information as agent for our Vendors and pass it on to them. They're contractually obliged to use it only to provide the products you ordered.

We disclose information to independent entities engaged to support our website, customer service and marketing, including Google, Bing, Facebook, ActiveCampaign, Swell and Yotpo. They're legally and contractually bound to maintain privacy and confidentiality, and to use information only to provide the services we've contracted.
If required by law, we may also provide information to government agencies and courts.

Cross-border transfers. Our database is hosted by Amazon Web Services on servers in Australia and Singapore, under a GDPR-compliant Data Processing Agreement. If you buy from a Vendor in another country, your name, address and purchase information will cross borders to that Vendor - our Vendors are bound by the privacy laws of the countries where they operate.

We use cookies and technologies that perform similar functions to collect information. If your browser accepts cookies, they let us record the pages you visit and time spent on them - used to improve site performance and make browsing and marketing more relevant to you.

You can use your browser's privacy settings to block our cookies. We don't recommend this, as it may affect how the site works for you.

We retain information relating to purchases on our website for 5 years, in accordance with Australian tax law. We retain information relating to your browsing history for as long as your account remains active, or until you withdraw your consent to our use of it - whichever happens first.

Under Australian privacy law, you have rights that may include the right to access, rectify and erase your information, and to withdraw your consent to its use. If you're outside Australia, you may have further rights under the law where you live.

To exercise your privacy rights, contact us - we'll respond as soon as possible. If we're unable to resolve your concern within 30 days, you can lodge a complaint with the OAIC (Office of the Australian Information Commissioner). If you're outside Australia, you may also lodge a complaint with the supervisory authority for privacy in your home state, province or country at any time.

You can edit and update your Wishlist, and delete stored card details, from your account page.

We take reasonable steps to ensure personal information we collect is accurate, up-to-date, complete and relevant, and to safeguard it from unauthorised access, destruction, use, modification or disclosure.

Our servers and IT systems are password-protected and comply with security standards. Our payment providers use SSL encryption for credit card numbers and other critical data. Paper files are stored in premises that are locked when unattended.

For questions about this policy, or to exercise any of your privacy rights, contact us at shop@onefinebaby.com.au, or write to OFC (Aust) Pty Ltd, Suite 201, 5 Alexander Street, Crows Nest, NSW 2065.

This policy is effective from 3 December 2019. Any changes will be posted on this page; if a change is significant, we may also notify you by email or note it clearly on our home page.