Privacy Policy

Depending on how you interact with the Services, we may collect or process the following, including any inferences we draw from it:

• Contact details, your name, billing and shipping addresses, email address, and phone number.
• Order and payment information, your purchases; the items you view, add to your cart, or add to your wishlist; returns and cancellations; transaction details; and payment confirmation. Card details are processed by our payment providers; we do not store full card numbers.
• Account information , if you create an account, your username, password, and preferences.
• Communications , the content of messages you send us, such as customer support enquiries and reviews.
• Marketing preferences, your email and SMS marketing consent, and any preferences you share with us, such as your favourite artists or groups.
• Order-verification footage, video recorded at our packing stations showing the contents and condition of items as they are packed, linked to your order. We use this only to verify what was dispatched if there is a dispute (see Section 09 for how long we keep it).
• Device and usage information, your device, browser, IP address, and similar identifiers, and information about how you interact with the Services, collected through cookies and similar technologies.

• Directly from you, when you create an account, place an order, contact us, sign up for marketing, or otherwise provide information.
• Automatically , from your device and through cookies and similar technologies when you use the Services.
• From our service providers , such as Shopify and our payment, analytics, and shipping providers.
• From partners and other third parties , such as advertising and marketing partners.

We use personal information only where we have a valid reason to do so. Where UK or EEA data protection law applies, we rely on the following lawful bases:

• Providing the Services: We process orders and payments, arrange delivery, handle returns and refunds, manage accounts, wishlists and Kkumi Club benefits, and provide requested support because this is necessary to perform our contract with you or take steps you request before entering into a contract.

• Reviews and customer feedback: We may invite you to review a purchase and process reviews you choose to submit for our legitimate interests in understanding customer experiences, improving our products and services, and helping customers make informed purchasing decisions. Where consent is required for an electronic review request, we rely on that consent.

• Communicating with you: We send transactional messages, respond to enquiries and maintain customer-service records as necessary to perform our contract with you and for our legitimate interest in providing effective customer service.

• Marketing: We send email or SMS marketing where you have consented. You may withdraw your consent at any time without affecting your Kkumi Club membership, points or previous purchases.

• Analytics and personalisation: Subject to your cookie choices, we analyse how the Services are used and personalise your experience based on your consent where required. Where consent is not required, we rely on our legitimate interest in understanding and improving our store and services.

• Advertising: We use information to deliver and measure advertising based on your consent where required. Where the law permits us to rely on legitimate interests, our interest is promoting our products and measuring the effectiveness of our advertising. You may exercise the choices described in Section 06.

• Security, fraud prevention and order verification: We authenticate accounts, protect the Services, prevent fraud and misuse, verify orders and retain relevant evidence because of our legitimate interests in protecting our customers and business and establishing, exercising or defending legal claims.

• Legal and regulatory requirements: We process information where necessary to comply with legal obligations, respond to lawful requests, and maintain required tax and accounting records. We rely on our legitimate interests where necessary to enforce our terms and establish, exercise or defend legal claims.

Where we rely on consent, you may withdraw it at any time. Withdrawal does not affect processing that occurred before your consent was withdrawn. Where we rely on legitimate interests, we consider whether those interests are outweighed by your rights and interests.

We disclose personal information only where necessary for the purposes described in this Policy, including to:

• Shopify, which provides our storefront, checkout, customer accounts, analytics, Shop and Shop Pay features, and related platform services.

• Payment providers, including Shopify Payments, PayPal, Afterpay, card networks, digital-wallet providers and financial institutions, to process payments, refunds and chargebacks. These providers may act independently under their own privacy policies.

• Australia Post and its delivery partners, to quote shipping, create labels, deliver orders and investigate delivery issues.

• Klaviyo, to manage email and SMS subscriptions, customer segments and marketing communications.

• Judge.me, to request, collect, moderate and display product reviews.

• Google and YouTube, and Meta services including Facebook and Instagram, to provide analytics, measure advertising and deliver advertising, subject to your cookie and privacy choices.

• Customer-support, cloud-hosting and information-technology providers that help us operate and secure the Services and respond to enquiries.

We may also disclose personal information where you direct or consent to the disclosure; where required by law or legal process; to protect our rights or the rights of others; or in connection with a sale, merger, financing or restructure of the business.

Some providers act only on our instructions, while others decide independently how they process information for their own services. Their privacy policies apply to processing for which they are responsible. We do not sell personal information for money.

We and our providers use cookies, pixels and similar technologies to operate the Services, remember your preferences, understand how the Services are used, personalise content, and measure or deliver advertising.

Strictly necessary technologies are used where required to provide the Services, keep them secure, remember your privacy choices, process payments and maintain your cart or account. Where UK or EEA law applies, we seek your consent before using non-essential analytics, personalisation and advertising technologies through the cookie controls available on the Services. You may accept, reject or change those choices at any time using those controls.

Our analytics and advertising technologies may include Shopify analytics and Network Intelligence, Klaviyo, Judge.me, Google and YouTube, and Meta services including Facebook and Instagram. Subject to your choices, these providers may receive device identifiers, IP addresses, browsing activity, purchase information and similar usage data.

You can also manage cookies through your browser settings. Blocking some technologies may affect how parts of the Services work. Withdrawing consent does not affect processing that occurred before it was withdrawn.

• Email and SMS. Where you have consented, we may send you marketing by email and SMS. You can opt out of email marketing at any time using the unsubscribe link in our emails, and out of SMS marketing by replying STOP. You may still receive non-marketing messages, such as order updates. Standard message and data rates may apply to SMS.
• Targeted advertising. We may use your information to show you personalised advertising based on your activity, including through Shopify and third-party advertising services. Depending on where you live, you may have the right to opt out of the "sale" or "sharing" of your personal information for targeted advertising. You can opt out by contacting us at hello@kkumi.com.au or by using any opt-out controls we provide on the Services.
• Global Privacy Control. If you visit our website with a Global Privacy Control (GPC) signal enabled, we will, where required by law, treat it as a request to opt out of targeted advertising for that browser. We do not currently respond to other "Do Not Track" signals.

The Services are intended for adults. We do not direct the Services to children, and a person under the age of majority should only use the Services with the involvement of a parent or guardian who agrees to our Terms.

We do not knowingly collect personal information from children under 16 without parental consent, and we do not knowingly use the personal information of anyone under 18 for targeted advertising or profiling. If you believe a child has provided us with personal information, please contact us using the details below and we will delete it.

Kkumi uses Shopify to host and operate the Services. When Shopify processes personal information to provide our storefront, checkout and related services on our instructions, Shopify generally acts as our service provider or processor. Shopify may also act independently under its own privacy policy when you use Shopify consumer services, such as Shop or Shop Pay.

We have Shopify Network Intelligence enabled. This allows Shopify to use information from your interactions with Kkumi together with information from your interactions with other Shopify merchants and Shopify to provide enhanced services, including improved analytics, personalisation, store performance and advertising. For this processing, Shopify acts as an independent controller. Other merchants cannot access Kkumi’s customer data.

Shopify states that it respects applicable cookie-consent and data-sharing opt-out choices when using data through Network Intelligence. You can use the privacy controls available on the Services and may also submit requests to Shopify through its privacy portal at privacy.shopify.com.

We take reasonable steps to protect your personal information, but no system is perfectly secure, and information sent over the internet is not guaranteed to be secure in transit. Please avoid sending sensitive or confidential information through unsecured channels.

We keep personal information only as long as we need it for the purposes described in this Policy, for example, to provide the Services, maintain your account, comply with the law, and resolve disputes. Order-verification (packing) footage is kept for up to 120 days from dispatch and is then deleted, except where it relates to an active or anticipated dispute or chargeback, in which case we keep it until that matter is resolved.

Depending on where you live, you may have some or all of the following rights over your personal information. These rights are not absolute and may not apply in every case.

• Access , to request a copy of the personal information we hold about you.
• Correction , to ask us to correct inaccurate information.
• Deletion , to ask us to delete your information.
• Portability , to receive a copy of certain information, or have it transferred, where applicable.
• Opt out of sale/share or targeted advertising, see Section 06.
• Withdraw consent , where we rely on your consent, you can withdraw it at any time. This does not affect processing carried out before you withdrew it.
• Object to or restrict processing, if you are in the UK or EEA, you may ask us to stop or limit certain processing.

To exercise a right, contact us at hello@kkumi.com.au. We may need to verify your identity, and you may use an authorised agent where the law allows. We will not discriminate against you for exercising your rights. To learn about rights relating to data processed by Shopify, see privacy.shopify.com.

Although Kkumi is based in Australia, some of our providers process personal information overseas. Based on their current disclosures, known destinations may include:

• Shopify: the United States, Canada and Singapore.

• Klaviyo: the United States, with support access possible from Australia, Ireland, Singapore and the United Kingdom.

• Judge.me, Google and Meta: the United States and other countries where they or their subprocessors operate.

• PayPal and Afterpay: Australia, New Zealand, the United States, Canada, the United Kingdom, countries in the EEA, Singapore, China and other locations identified in their privacy notices.

These locations may change when a provider changes its infrastructure or subprocessors. We will update this Policy when material changes come to our attention.

Where UK or EEA personal information is transferred to a country without an applicable adequacy decision, we or the relevant provider use a lawful transfer mechanism where required, such as the European Commission’s Standard Contractual Clauses, the UK International Data Transfer Agreement or UK Addendum, or another recognised safeguard. You may contact us for more information about the safeguards relevant to your information.

The Services may contain links to websites or platforms we do not operate or control. We are not responsible for their content or privacy practices, and we recommend reviewing their policies before sharing information with them.

If you are concerned about how we have handled your personal information, email hello@kkumi.com.au with enough detail for us to understand the issue and the outcome you are seeking. We will acknowledge your complaint, investigate it fairly and explain the outcome without undue delay. Where UK data protection law applies, we will acknowledge your complaint within 30 days. We may ask for additional information or identity verification where reasonably necessary.

If you are dissatisfied with our response, you may also have the right to complain to the relevant privacy regulator:

• United Kingdom: the Information Commissioner’s Office at ico.org.uk.

• EEA: the national data protection authority in your country. Details are available at edpb.europa.eu/contact/file-a-complaint.

• Australia: the Office of the Australian Information Commissioner at oaic.gov.au/privacy/privacy-complaints, where the OAIC has jurisdiction over the complaint. The OAIC generally requires you to complain to us first and allow 30 days for a response.

Nothing in this section limits any right you have to approach a regulator directly where applicable law permits it.

We may update this Privacy Policy from time to time to reflect changes in our practices or for legal or operational reasons. We will post the updated version here, update the "Last updated" date, and provide notice where the law requires it.

For any questions about this Privacy Policy, or to exercise your rights, contact us at:

Kkumi
hello@kkumi.com.au

37 Endeavour Drive,
Port Kennedy WA 6172,
Australia