Privacy policy
The Quirky Cup Collective (ACN: 662 606 797) is a stationery brand based in Adelaide, SA, Australia and is bound by the Australian Privacy Principles (APPs) in the Privacy Act 1988 (Cth) (Privacy Act).
We are also required to comply with the General Data Protection Regulation (Regulation (EU) 2016/679) (GDPR) to the extent that we collect the personal information of residents of the European Union. The Quirky Cup Collective is a data controller for the purposes of the GDPR.
We understand the importance of, and are committed to, protecting your personal information.
This Privacy Policy explains how we manage your personal information (that is, information or an opinion about you, whether true or not, which identifies you or from which your identity is reasonably identifiable), including our obligations and your rights in respect of our dealings with your personal information.
Please take a moment to read our Privacy Policy as it describes what happens to your personal information that is collected via our website at https://thequirkycupcollective.com.au/ (the Website).
1. How we collect your personal information
The Quirky Cup Collective uses third-party service providers to collect, hold, use and disclose personal information on our behalf.
We operate the Website on servers of the service provider Shopify Inc, which is based in Canada. They provide us with an online e-commerce platform that allows us to sell our products and services to you. Shopify Inc. collect and processes your data on our behalf. For further information on the categories of information that might be collected by Shopify Inc., please refer to their Privacy Policy here.
More information about our use of Shopify and other third-party providers is outlined below under sections 2, 3, 4, 5 and 6.
In circumstances where we collect and hold your personal information directly, we will do so in a fair and lawful manner, and not in an intrusive way. Where it is reasonably practical to do so, we will collect your personal information directly from you.
We may collect the personal information you give us directly, or indirectly via third parties, through some of the following means:
(a) when you place an order for or make an inquiry in relation to our goods, including through the Website;
(b) when you place an order for or make an inquiry in relation to our goods via one of our service providers, including our online Etsy store operated by Etsy Inc., the Shop App operated by Shopify and through Instagram;
(c) when you contact us via telephone, email, the Website or our social media accounts, including Etsy, Instagram, Facebook, Tiktok and Pinterest;
(d) while conducting customer satisfaction and market research surveys, including, but not limited to, through third party email marketing providers such as Google, Omnisend and Loox Online Ltd; and/or
(e) as otherwise required to manage our business.
However, in certain cases we may collect personal information from publicly available sources and third parties, such as suppliers, contractors, business partners.
If we collect personal information about you from a third party we will, where appropriate, request that the third party inform you that we are holding such information, how we will use and disclose it, and that you may contact us to gain access to and correct and update the information.
2. Types of personal information we collect
The type of personal information we may collect (including by using third party service providers) can include your name, age, date of birth, gender, postal address, email address, telephone numbers, billing and payment information
If you choose a direct payment gateway to complete your purchase, your credit card data is stored by Shopify Inc. Where you do not wish to provide us with your personal information, we may not be able to provide you with requested goods or services. Other types of information that we may collect can include:
(a) user interactions with the online store, including order history, cart activity, wish list items, browsing history, and search behaviour;
(b) date of birth;
(c) open and click-through rates and conversion metrics for marketing communications; and/or
(d) paid marketing data (which is de-identified).
3. Our purposes for handling your personal information
As a small business, we use third-party providers to provide our goods and services to you.
As a general rule, we only process personal information for purposes that would be considered relevant and reasonable in the circumstances.
We primarily use third parties to collect, hold, use and disclose personal information in order to:
(a) offer and provide you with our goods and services;
(b) manage and administer those goods and services, including account keeping procedures, e-commerce platforms, shipping, labelling and tracking providers, web hosting providers, cloud service providers, IT systems administrators, electronic network administrators, payment processors, data entry service providers;
(c) communicate with you, including (but not limited to) sending you SMS messages and/or emailing you tax invoices, receipts, dispatch and tracking information, returns, any exchange authorisations, marketing communications, restock notifications, surveys and reviews;
(d) comply with our legal and regulatory obligations; and
(e) to otherwise manage our business.
We will not use or disclose your personal information for any other purpose unless you have consented to that use or disclosure.
In circumstances where we collect, hold and use your personal information directly, we may disclose personal information to third party service providers for the purposes of administering our business functions. These service providers may include debt collectors, insurers, and professional advisors such as accountants, solicitors, business advisors and consultants.
If we disclose information to a third party, we generally require that the third party protect your information to the same extent that we do.
4. Protection of personal information
In circumstances where we collect your personal information, we take reasonable precautions and follow industry practices to protect your information from being inappropriately lost, misused, accessed, disclosed, altered or destroyed.
Data collected by Shopify Inc. is stored through Shopify Inc’s data storage, databases and the general Shopify application on a secure server behind a firewall.
All direct payment gateways adhere to the standards set by the Payment Card Industry Data Security Standard (PCI-DSS) as managed by the PCI Security Standards Council, which is a joint effort of brands like Visa, MasterCard, American Express and Discover. PCI-DSS requirements help ensure the secure handling of credit card information by our store and its service providers.
If you provide us with your credit card information, the information is encrypted using secure socket layer technology (SSL) and stored with an AES-256 encryption. Although no method of transmission over the Internet or electronic storage is 100% secure, we follow all PCI-DSS requirements and implement additional generally accepted industry standards.
For more information, please read Shopify’s Terms of Service here or Privacy Policy here.
All other personal information will be held electronically by our service providers. In circumstances where we do hold personal information directly, this will be held electronically on our intranet system, in cloud storage, and in some cases, records on third party servers, which may be located overseas. This may include, but not be limited to: United States, Canada, the United Kingdom, Ireland, France, and Slovakia.
We maintain appropriate physical, procedural and technical security for our offices and information storage facilities to prevent any loss, misuse, unauthorised access, disclosure, or modification of personal information. This also applies to disposal of personal information.
We further protect personal information by restricting access to personal information to only those who need access to the personal information do their job. Physical, electronic and managerial procedures have been employed to safeguard the security and integrity of your personal information.
We will destroy or de-identify personal information once it is no longer needed for a valid purpose or required to be kept by law.
5. Direct marketing and cookies
Direct Marketing
With your permission, we may send you emails or SMS messages about our store, new products, promotions and other updates. We may utilise the services of third parties to assist us with undertaking our direct marketing activities.
We may ask you to provide feedback on our products and services. We may ask you questions that relate to your experiences, our brand or your customer satisfaction with our products and services.
By subscribing to receive The Quirky Cup Collective emails, you agree to receive automated marketing messages from us about our products and services at the email address or telephone number you provided when you subscribed, and that the messages may be sent via third-parties on behalf of The Quirky Cup Collective or through other means. Consent is not a condition of purchase.
Provided that you have not unsubscribed or otherwise opted out, we may use your information for direct marketing:
(a) where you have agreed to receive direct marketing communications from us; or
(b) where you have engaged with us directly, and we believe that you would reasonably expect to receive direct marketing from us.
We will not disclose your personal information to third parties for marketing purposes without your consent. You may opt out at any time if you no longer wish to receive commercial messages from us. You can make this request by:
(a) replying STOP, END, CANCEL, UNSUBSCRIBE or QUIT to opt-out of SMS notifications and marketing communications, or HELP for customer support. You may receive an additional SMS message confirming your decision to opt-out;
(b) selecting the 'Unsubscribe' link in our marketing email communications to opt out of marketing emails; or
(c) contacting our Privacy Officer using the contact details included at the end of this Privacy Policy.
Cookies
A cookie is a small text file stored in your computer’s memory or on your hard disk for a pre-defined period of time. We use cookies to identify specific machines in order to collect aggregate information on how visitors are experiencing the Website, including visitor behaviour, session duration and referral sources. Analytics tools may also aggregate data on device usage, geographic trends, and overall site performance.
This information will help to better adapt the Website to suit personal requirements. While cookies allow a computer to be identified, they do not permit any reference to a specific individual. For information on cookie settings of your internet browser, please refer to your browser’s manual.
We primarily use essential cookies which are necessary for website functionality (e.g., session management, shopping cart). We also use analytics cookies which allow us to track website visits and user behaviour to improve performance.
The cookies on this site have varying durations: some are temporary session cookies that expire when you close your browser, others last for short periods like 30 minutes or a day, while certain cookies persist for longer durations such as two weeks (eg, your cart) or indefinitely until manually cleared.
If you want further information about the cookies used by us or to opt-out of any cookies, please contacting our Privacy Officer using the contact details included at the end of this Privacy Policy.
6. Third-parties
This Privacy Policy identifies the purposes for which the Quirky Cup Collective uses third-party service providers to collect, hold, use and disclose personal information on its behalf. We have also identified the instances and purposes for which we will disclose personal information to third parties.
You can request a list of the third-party providers we use by contacting our Privacy Officer.
Generally, the third-party providers used by us will only collect, use and disclose your information to the extent necessary to allow them to perform the services they provide to us.
Payment processors
However, certain third-party service providers, such as payment gateways and other payment transaction processors, have their own privacy policies in respect to the information we are required to provide to them for your purchase-related transactions. Where you use a payment gateway or other third-party payment processors, we recommend that you read their privacy policies so you can understand the way your personal information will be handled by these providers.
Some third-party providers may be located or have facilities that are located overseas (which may be a different jurisdiction from you (the visitor) or us). If you elect to proceed with a transaction that involves the services of a third-party service provider, your information may become subject to the laws of the jurisdiction(s) in which that service provider or its facilities are located.
By using our website, you (the visitor) agree to allow third parties to process your IP address, to determine your location for the purpose of currency conversion. You also agree to have that currency stored in a session cookie in your browser (a temporary cookie which gets automatically removed when you close your browser). We do this in order for the selected currency to remain selected and consistent when browsing our website so that the prices can convert to your local currency.
Links to third-party sites
When you click on links on our store, they may direct you away from our site. Once you leave our store’s website or are redirected to a third-party website or application, you are no longer governed by this Privacy Policy or the Website’s Terms of Service. We are not responsible for the privacy practices of other sites and encourage you to read their privacy statements.
7. Age of consent
By using the Website, you represent that you are at least the age of majority in your state or province of residence, or that you are the age of majority in your state or province of residence, and you have given us your consent to allow any of your minor dependants to use the Website.
8. Accessing, correcting and deleting your personal information
You may contact our Privacy Officer at any time to request:
(a) that we provide you with access to the personal information that we hold about you;
(b) that corrections be made to the personal information that we hold about you where that information is inaccurate; and/or
(c) that the personal information that we collect about you be deleted (unless it is required to be kept by law).
On the rare occasions when we refuse your request, we will provide you with a written notice stating our reasons for that refusal. We may seek to recover from you reasonable costs incurred for providing you with access to any of the personal information about you held by us.
We are not obliged to correct any of your personal information if we do not agree that it requires correction and, in that event, may refuse to do so. If we refuse a correction request, we will provide you with a written notice stating our reasons for refusing.
We will respond to all requests for access, correction or deletion of personal information within a reasonable time.
9. Overseas transfers of personal information
We disclose your personal information to certain service providers which are located or have facilities that are located overseas, which may include, but not limited to, in the United States, Canada, the United Kingdom, Ireland, France, and Slovakia.
As at the date of this Privacy Policy, we are not likely to disclose personal information to other overseas recipients. If in the future we do propose to disclose personal information overseas, we will do so in compliance with the requirements of the Privacy Act. We will, where practicable, advise you of the countries in which any overseas recipients are likely to be located.
By providing your personal information to us, you consent to us disclosing your personal information to any such overseas recipients for purposes necessary or useful in the course of operating our business, and agree that APP 8.1 will not apply to such disclosures. For the avoidance of doubt, in the event that an overseas recipient breaches the Australian Privacy Principles, that entity will not be bound by, and you will not be able seek redress under, the Act.
If you do not want us to disclose your information to overseas recipients, please let us know
10. Automated decision-making processes
As at the date of this Privacy Policy, we may use computer programs to make or do a thing that relates to the making of a decision using your personal information from time to time. This includes the circumstances where we use Google Sheets, random name generators or comment selectors to run competitions and/or customer surveys.
11. Notice to residents of the European Union and California
General Data Protection Regulation (GDPR)
Use and disclosure of information
This Privacy Policy provides notice of the categories of personal information to be collected and the purposes for which that information is collected, used, stored or disclosed (including by third-party service providers).
In circumstances where we do collect and hold your personal information, we retain this information only for the period of time necessary to provide you with our goods and services (as outlined above). Your personal information will be stored for no longer than necessary or as may be prescribed by the Australian Privacy Principles or other applicable regulatory requirements.
You also have the right to:
(a) request access to or transfer of your personal data, including to receive the personal data you have provided to us in a structured, commonly used and machine readable format;
(b) request that we transmit your personal data directly to another data controller;
(c) object to or restrict the processing of your personal data in certain circumstances. This means that you can limit the way that we use your data (as an alternative to requesting the erasure of your data); and
(d) require us to rectify inaccurate personal data or erase your data in certain circumstances.
If you have any questions, concerns or complaints about our compliance with the GDPR, please contact the Privacy Officer (who is also our Data Protection Officer) in the first instance.
Cookie information for European residents
To the extent that any cookies placed on our website by us or a third party can uniquely identify a European resident, the requirements of the GDPR will be adhered to. In particular, we will ensure that:
(a) consent is obtained prior to the setting of the cookies;
(b) consent to the use of cookies can be provided by clear affirmative, positive action;
(c) rejecting the use of cookies will be an option in the sense that a European resident can continue to access our website and its functions even if all but the essential cookies have been rejected;
(d) consent is renewed every 12 months and can be withdrawn at any time by changing the relevant settings;
(e) consent provided is documented and stored securely; and
(f) personal information is deleted upon request.
You can opt out of the collection and use of your information for ad targeting and other marketing purposes. For information on cookie settings of your internet browser, please refer to your browser’s manual.
California Consumer Privacy Act (CCPA)
Although we are a small business and not expressly captured by the CCPA, we are committed to taking steps to comply with the privacy rights of individuals residing in the State of California.
This Privacy Policy provides notice of the categories of personal information to be collected and the purposes for which that information is collected, used or disclosed (including by third-party service providers). We do not "sell" your personal information for the purposes of the CCPA.
In circumstances where we do collect and hold your personal information, we retain this information only for the period of time necessary to provide you with our goods and services (as outlined above). Unless it is required by law to be kept for a longer period of time, your personal information will be stored for no longer than 12 months.
You may request that:
(a) your personal information that we have collected be deleted;
(b) your personal information that we have collected be corrected where this is inaccurate; or
(c) we disclose to you the personal information that we have collected, used or disclosed as described by this Privacy Policy.
You can make a request by contacting the Policy Officer or via the "Contact Us" page on our Website, available at: https://thequirkycupcollective.com.au/pages/contact-us.
12. Resolving personal information concerns
If you have any questions, concerns or complaints about this Privacy Policy, or how we handle your personal information, please contact our Privacy Officer:
The Privacy Officer
2/20 Lindsay Road
Lonsdale SA, 5160
Australia
Email: info@thequirkycupcollective.com.au
Subject: PRIVACY POLICY QUERY
We take all complaints seriously and will review and will aim to respond to your complaint within 30 business days. If further information is required to assess your complaint, we will write to you.
If you are dissatisfied with the handling of your complaint, you may lodge a complaint with the relevant regulatory or supervisory authority in your jurisdiction.
If you are an Australian resident, you may contact the Office of the Australian Information Commissioner:
Office of the Australian Information Commissioner
GPO Box 5218
Sydney NSW 2001
Telephone: 1300 363 992
Email: enquiries@oaic.gov.au
13. Changes
We reserve the right to change the terms of this Privacy Policy from time to time, without notice to you. An up-to-date copy of our Privacy Policy is available on our Website.
The last update to this document was 20 March 2025.
