The Card Garage ("we", "us", "our") is committed to protecting your personal information. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you visit our website or make a purchase, in accordance with the Australian Privacy Principles (APPs) contained in the Privacy Act 1988 (Cth).
1. Information We Collect
Information you provide to us
When you create an account, place an order, or contact us, we may collect:
- Account information â name, email address, password (stored securely as a hash, never in plain text)
- Order information â shipping address, billing address, phone number
- Contact form submissions â your name, email, and message content
- Wishlist and preferences â products you save for later
Information collected automatically
When you browse the Site, we automatically collect:
- Log data â IP address, browser type, pages visited, referring URL, date and time of visit. Note: IP addresses may be considered personal information under the Privacy Act 1988
- Session data â we use a session cookie to keep you logged in and maintain your shopping cart. This cookie is essential for the Site to function and expires when you close your browser or after a period of inactivity
We do not currently use advertising cookies, tracking pixels, or third-party analytics cookies.
Wishlist data is stored to provide you with restock notifications and is not shared with third parties.
2. How We Use Your Information
We use your personal information to:
- Process and fulfil your orders, including payment, shipping, and delivery
- Send order confirmations, shipping notifications, and invoices
- Manage your account and provide customer support
- Maintain your wishlist and order history
- Respond to your enquiries via the contact form or email
- Detect and prevent fraud or unauthorised access
- Comply with our legal and regulatory obligations
- Improve the Site and our services
We will not use your personal information for direct marketing unless you have opted in. You can opt out at any time by contacting us.
3. How We Share Your Information
We do not sell your personal information to any third party.
We share your information only with the following service providers who help us operate our business:
- Stripe (payment processing) â receives your payment card details to process transactions. Stripe's privacy policy: stripe.com/au/privacy
- Australia Post (shipping) â receives your name and shipping address to deliver your order
- Backblaze (cloud backups) â our database backups are encrypted and stored on Backblaze B2 cloud storage. Backblaze cannot access the contents of our encrypted backups
- Gmail / Google (email) â used to send order confirmations and respond to enquiries
Service providers may change over time; any updates will be reflected in this policy.
We may also disclose your information if required by law, court order, or to protect our legal rights.
4. Payment Security
All payment processing is handled by Stripe, which is PCI-DSS Level 1 certified â the highest level of security certification in the payments industry.
We never see, store, or have access to your full credit card number. Payment information is transmitted directly from your browser to Stripe's servers using industry-standard encryption (TLS).
5. Data Storage & Security
Your data is stored on our secure servers hosted in Australia. We take reasonable steps to protect your personal information from misuse, interference, loss, and unauthorised access, including:
- Passwords stored using bcrypt hashing (we cannot see your password)
- HTTPS encryption on all pages
- CSRF protection on all forms
- Rate limiting on login attempts
- Automated daily encrypted backups
- Periodic review of our security practices
While we take security seriously, no method of transmission over the internet is 100% secure. We cannot guarantee absolute security of your data.
6. Cookies
We use a single essential session cookie to operate the Site. This cookie:
- Keeps you logged in to your account
- Maintains your shopping cart contents
- Stores your security token (CSRF protection)
This cookie is strictly necessary for the Site to function and does not track you across other websites. We do not use advertising, analytics, or third-party tracking cookies.
You can configure your browser to refuse cookies, but this will prevent you from using the shopping cart and account features.
7. Data Retention
We retain your personal information for as long as necessary to fulfil the purposes outlined in this policy:
- Account data â retained until you delete your account or ask us to remove it
- Order data â retained for 7 years to comply with Australian tax record-keeping requirements
- Contact form messages â retained for up to 12 months
- Server logs â retained for up to 90 days
8. Your Rights
Under the Australian Privacy Principles, you have the right to:
- Access your personal information that we hold
- Correct inaccurate or out-of-date information
- Request deletion of your personal information (subject to legal retention requirements)
- Withdraw consent for any optional processing
To exercise any of these rights, contact us at [email protected]. We may require proof of identity before processing your request. We will respond within 30 days.
If you have an account, you can view and update your personal information directly from your account settings page.
9. Children's Privacy
The Site is not directed at children under the age of 16. We do not knowingly collect personal information from children under 16. If you believe we have inadvertently collected information from a child, please contact us and we will delete it promptly.
10. Changes to This Policy
We may update this Privacy Policy from time to time. Changes will be posted on this page with an updated date. We encourage you to review this page periodically.
11. Complaints
If you believe we have breached the Australian Privacy Principles, please contact us first at [email protected]. We will investigate your complaint and respond within 30 days.
If you are not satisfied with our response, you may lodge a complaint with the Office of the Australian Information Commissioner (OAIC):
- Website: www.oaic.gov.au
- Phone: 1300 363 992
12. Contact Us
If you have any questions about this Privacy Policy or how we handle your personal information, please contact us:
Email: [email protected]
Location: Blue Mountains, NSW, Australia