Privacy Policy

Last updated: 13 May 2026

1. Who We Are

Bonvale Australia Pty Ltd (ACN 696 252 721 / ABN 93 696 252 721), incorporated in Australia, with its registered office at Unit 52 / 5 Milray Street, Lindfield NSW 2070, Australia ("Bonvale", "we", "us", "our"), is the APP entity and data controller for personal information collected from customers in Australia through our website (bonvale.com), mobile application, and related services (our "Services"). We handle personal information in accordance with the Privacy Act 1988 (Cth) and the Australian Privacy Principles ("APPs"). We may share personal information with the Bonvale group and related entities as described in Section 6. Where personal information is disclosed outside Australia, we comply with APP 8 (see Section 7).

2. Personal Information We Collect

2.1 Information You Provide Directly

When you create an account, place an order, contact us, or otherwise use our Services:

• Identity: full name, date of birth
• Contact: email address, telephone number, postal address
• Account: username, password (stored in hashed form), preferences
• Transaction: products purchased, order and returns history, payment method type (full card numbers are held by our payment gateway, not by Bonvale)
• Communications: messages sent to our customer care team
• Marketing preferences: email, SMS, and push notification opt-in and opt-out choices

2.2 Information We Collect Automatically

When you visit our Website or use our App:

• Device and technical: IP address, browser type and version, operating system, device identifiers, time zone
• Usage: pages viewed, products browsed, search queries, clickstream, session duration, referral source
• Tracking: data collected via cookies, pixels, and similar technologies (see Section 5)
• Location: approximate location from IP address (we do not collect GPS location unless you grant App permission)

2.3 Information We Receive From Third Parties

• Payment gateways: transaction status, fraud risk signals, and payment verification data
• Logistics providers: delivery status, confirmation, and address validation data
• Meta Platforms: aggregated advertising performance data and, where you have consented to Meta's terms, audience matching data via the Meta Pixel (see Section 5)
• Google: analytics and advertising performance data via Google Analytics and Google Ads (see Section 5)

3. How and Why We Use Your Personal Information

We collect, hold, use, and disclose personal information for the purposes set out below. These purposes are consistent with APP 3 (collection) and APP 6 (use and disclosure).

4. Marketing Communications

We send marketing communications (email, SMS, push notifications) only where you have given consent (express or, where permitted by the Spam Act 2003, inferred through an existing customer relationship). You may withdraw consent at any time by:

• Clicking 'unsubscribe' in any marketing email
• Replying STOP to any marketing SMS
• Adjusting push notification preferences in your device settings or Bonvale account
• Contacting us at privacy@bonvale.com

Withdrawing marketing consent does not affect transactional communications (order confirmations, dispatch, returns), which are sent under our contract with you. Australia: Spam Act 2003 We comply with the Spam Act 2003 (Cth). We send commercial electronic messages only where you have provided express or inferred consent, every message identifies Bonvale as the sender and includes a functional unsubscribe facility, and we will action unsubscribe requests within 5 business days. Australia: Do Not Call Register Act 2006 We do not make unsolicited telemarketing calls. If you have nonetheless received such a call that appears to originate from us, please notify us at privacy@bonvale.com.

5. Cookies, Pixels, and Tracking Technologies

5.1 What We Use

Essential Cookies Strictly necessary for core functionality including shopping basket, login, security, and fraud prevention. Cannot be disabled. Analytics Cookies: Google Analytics We use Google Analytics (Google LLC) to understand how visitors use our Website including pages visited, session duration, referral source, and device. This aggregated data improves our Services. Data is transferred to Google's servers, which may be outside Australia (see Section 7). You may opt out via the Google Analytics Opt-Out Browser Add-on at tools.google.com/dlpage/gaoptout or by rejecting analytics cookies in our consent banner. Advertising and Targeting Cookies: Meta Pixel We use the Meta Pixel (Meta Platforms, Inc.) to measure advertising effectiveness, build audiences, and track conversions. When active, it collects your IP address, browser data, page URL, and on-site actions (such as product views and purchases). This data is transmitted to Meta and used to serve targeted advertisements on Facebook, Instagram, and the Meta Audience Network ('retargeting'). Meta may also use it for its own purposes under its Privacy Policy. We activate the Meta Pixel only with your consent; you may withdraw consent at any time via your cookie preferences.

5.2 Consent Management

We use Shopify's native cookie consent banner to manage cookie consent on our Website. On your first visit, our cookie banner presents the categories of cookies in use. Non-essential cookies, including analytics and advertising categories, do not activate until you actively accept them. Your consent choice is recorded with a timestamp and the version of this Policy in force at the time. You can review or change your preferences at any time via the "Cookie Settings" link in the footer of our Website. Withdrawing consent for a category takes effect immediately. Any tracking scripts relying on that consent will stop firing for your session.

5.3 Your Cookie Choices

Manage preferences via our cookie preference centre (footer of our Website), your browser settings, or the opt-out tools provided by Google and Meta. Restricting certain cookies may affect Website functionality.

6. Who We Share Your Personal Information With

We do not sell or rent your personal information. We share it only as described below.

6.1 Service Providers

We share data with service providers acting under our instruction, including:

• Shopify Inc.: storefront platform, transactional emails, order notifications, and native cookie consent management.
• Shopify Payments, Klarna Bank AB, and Afterpay Australia Pty Ltd: payment processing, fraud screening, and Buy Now, Pay Later. Your full card details are held by the relevant payment provider, not by Bonvale.
• KEC and KLN: outbound logistics from our fulfilment warehouse and inbound returns logistics to our local Australian returns warehouse.
• Australia Post: last-mile delivery within Australia.
• Loop Returns, Inc. (with EasyPost for return label generation): returns and exchanges portal.
• Gorgias, Inc.: customer support and ticketing.
• Klaviyo, Inc.: marketing emails, SMS, and push notifications.
• Amazon Web Services, Inc.: cloud infrastructure for custom apps and integrations.
• Google LLC (Google Analytics): Website usage analytics.
• Meta Platforms, Inc. (Meta Pixel): advertising measurement and audience targeting, subject to consent.

6.2 Legal and Regulatory Disclosure

We disclose personal information to law enforcement, courts, or regulators only where required or authorised by Australian law, court order, or regulatory direction. We will notify you of such disclosures where legally permitted.

6.3 Business Transfers

If Bonvale Australia Pty Ltd undergoes a merger, acquisition, or asset sale, your information may transfer to the relevant entity. We will notify you and ensure equivalent protections apply.

6.4 Group Companies

We may share data with the Bonvale group and related entities for the purposes set out in this Policy, including group-wide analytics, IT infrastructure, and customer support. All intra-group transfers are subject to an intra-group data sharing agreement and the safeguards described in Section 7.

7. Cross-Border Disclosure of Personal Information (APP 8)

Bonvale Australia Pty Ltd is located in Australia. Some of our service providers and group companies are located outside Australia, which means your personal information may be disclosed to recipients in overseas countries including Singapore, the United States, and other countries where our service providers operate. Before disclosing personal information to an overseas recipient, we take reasonable steps to ensure that the recipient does not breach the Australian Privacy Principles in relation to your information, as required by APP 8.1. This includes entering into written contracts that require the recipient to handle the information consistently with the APPs. Where you have consented to the overseas disclosure (or where another APP 8.2 exception applies), Bonvale will not be accountable under the Privacy Act for a subsequent breach by the overseas recipient. By providing your personal information you acknowledge that it may be disclosed to overseas recipients for the purposes described in this Policy.

8. How Long We Keep Your Personal Information

We retain personal information only as long as necessary for the purposes described in this Policy, or as required by Australian law (APP 11.2).

On expiry of the retention period, we take reasonable steps to destroy or de-identify the information (APP 11.2).

9. How We Protect Your Personal Information (APP 11.1)

We implement technical and organisational measures to protect your information, including:

• Encryption in transit (TLS/SSL) and at rest
• Access controls and role-based permissions
• Regular security assessments and penetration testing
• Staff privacy training
• Incident response procedures (see Section 10)

Payment card data is processed by our PCI-DSS certified payment gateway. We do not store full card numbers. If you believe your account has been compromised, contact us at privacy@bonvale.com immediately.

10. Notifiable Data Breaches

We comply with the Notifiable Data Breaches (NDB) scheme in Part IIIC of the Privacy Act 1988 (Cth). On becoming aware of a suspected eligible data breach (one likely to result in serious harm to an individual), we will:

• Investigate the breach and assess whether it is an eligible data breach
• Where the breach is eligible, notify the Office of the Australian Information Commissioner (OAIC) and affected individuals as soon as practicable after becoming aware of the breach
• Document the breach and our response

OAIC contact details: oaic.gov.au · 1300 363 992 · GPO Box 5218, Sydney NSW 2001.

11. Your Rights Under Australian Privacy Law

Under the Privacy Act 1988 (Cth) and the APPs, you have the following rights:

To exercise any right, contact privacy@bonvale.com. We may ask you to verify your identity. We do not charge for requests.

12. Complaints & the OAIC

If you have a concern about how we handle your personal information, please contact us first at privacy@bonvale.com. We will acknowledge your complaint within 5 business days and respond substantively within 30 days. If you are not satisfied with our response, you may lodge a complaint with the Office of the Australian Information Commissioner:

• Website: oaic.gov.au
• Telephone: 1300 363 992
• Address: GPO Box 5218, Sydney NSW 2001

13. Children's Privacy

Our Services are for individuals aged 18 and over. We do not knowingly collect personal information from under-18s. If you believe a child has provided us with their information, contact privacy@bonvale.com and we will promptly delete it unless retention is required by law.

14. Third-Party Links

Our Website and App may link to third-party sites. This Policy does not cover those sites and we are not responsible for their privacy practices.

15. Cookie Policy

What are cookies? Cookies are small text files placed on your device when you visit our Website. They allow the site to remember your actions and preferences over time, and help us and our third-party partners understand how visitors interact with our content. Similar technologies, including pixels and device identifiers, work in an equivalent way. The cookies we use We use four categories of cookies. The table below lists each cookie, who sets it, what it does, and how long it remains on your device. Category 1: Strictly Necessary These cookies are essential for our Website to function. They cannot be disabled. No consent is required to set them.

Category 2: Analytics These cookies help us understand how visitors use our Website. The data is aggregated and not used to identify you personally. These cookies are set only with your consent.

Google Analytics data is transferred to Google's servers, which may be located outside Australia. See Section 7 of this Policy on cross-border disclosure. You may opt out of Google Analytics tracking at any time using the Google Analytics Opt-Out Browser Add-on or by adjusting your preferences in our cookie banner. Category 3: Marketing and Advertising These cookies are used to deliver targeted advertising based on your browsing and purchase behaviour on our Website, and to measure the effectiveness of our advertising campaigns. They are set only with your consent.

Meta Pixel data is transferred to Meta's servers in the United States. See Section 7 on cross-border disclosure and Section 5.1 for a full description of how the Meta Pixel operates. Managing your preferences You can review and change your cookie preferences at any time by clicking Cookie Settings in the footer of our Website. You can also:

• Use your browser settings to block or delete cookies. Blocking strictly necessary cookies will affect core Website functionality.
• Opt out of Google Analytics via the Google Analytics Opt-Out Browser Add-on.
• Manage your Meta advertising preferences at facebook.com/ads/preferences.

Withdrawing consent for analytics or advertising cookies takes effect immediately. It does not affect the lawfulness of any processing that took place while consent was in place.

16. Updates to This Policy

We may update this Policy to reflect changes in our data practices, applicable law, or our Services. The updated Policy will be published with a revised 'Last Updated' date. For material changes, we will notify you by email or prominent Website notice before the change takes effect. Continued use of our Services after the effective date constitutes acceptance of the updated Policy.

17. Contact Us

For all privacy queries, requests, and complaints: Email: privacy@bonvale.com We aim to respond within 30 days. If unsatisfied, you may escalate to the Office of the Australian Information Commissioner (see Section 12).