Legal
Privacy policy
Draft — to be confirmed by the client’s legal adviser before public launch
This page is a working draft written from the agreed business rules. It has not been reviewed by a lawyer, and it must be before the store goes live. Selling this category of product into Australia carries obligations under the Therapeutic Goods Act that a template cannot cover.
The clauses marked below need the client’s own decision or their lawyer’s wording.
What this store collects about you, why, who handles it and where it is kept. The short version: only what is needed to send you an order, and it is stored in Australia.
Trading entity: trading name and ABN to be supplied
Who we are
This policy explains how EVOLVD handles personal information collected through this website. We handle it in accordance with the Privacy Act 1988 (Cth) and the Australian Privacy Principles, to the extent they apply to us.
To be settled — the trading entity behind EVOLVD — its legal name, ABN and business address — which this section should name.
What we collect
Only what is needed to take and send an order: your name, email address, phone number and delivery address, along with what you ordered, what you paid, and the payment reference used to match your bank transfer to your order.
If you use the contact form, we collect your name, email address and the message you send. There are no customer accounts on this store, so there is no password and no browsing history tied to you.
What we do not collect
We never see or store your bank details. Payment is by bank transfer, made by you, in your own internet banking — nothing about your account passes through this website.
We do not collect health information, and we do not ask what you are researching. The research-use acknowledgement you tick when entering the site is stored only in your own browser, as a date, so you are not asked again for 30 days; it is not sent to us.
What we use it for
To take, pack and send your order; to match your bank transfer to it; to email you about that order — its confirmation and payment details, then confirmation of payment, then dispatch and tracking; to reply to your enquiries; and to meet our record-keeping obligations under Australian tax and consumer law.
We do not send marketing email. We do not sell your information, and we do not share it with anyone else for their own purposes.
Who else handles it
Running an online store means a small number of service providers necessarily process some of your information on our behalf: the company that hosts our database (Neon, on servers in Sydney, Australia); the company that hosts the website (Vercel); the service that delivers our emails (Resend); and Australia Post, which receives your name, address and phone number so the parcel can be delivered.
Each provider handles your information only to provide its service to us. Where a provider is based outside Australia, or routes data through servers outside Australia, we take reasonable steps to ensure it is handled in a way that is consistent with Australian privacy law.
Where your data is stored
Order records are held on encrypted database infrastructure hosted in Sydney, Australia. The region was chosen deliberately so that Australian customer data stays in Australia, and it is not something that changes quietly.
How we protect it
The website is served over an encrypted connection, order data is stored on encrypted infrastructure, and access to the admin is limited to the people who run the store, by password. No system is perfectly secure, and we cannot guarantee that information sent over the internet will never be intercepted, but we take reasonable steps to protect what we hold.
Cookies and tracking
This website does not use advertising cookies or third-party analytics trackers. Your cart and your research-use acknowledgement are kept in your own browser’s storage so they survive between pages; neither is sent to us until you place an order.
How long we keep it
Order records are kept for as long as Australian tax law requires business records to be kept, which is currently five years. Contact form messages are kept only as long as needed to deal with your enquiry.
To be settled — whether the client wants to keep order records for longer than the legal minimum, and how contact form messages are actually retained once the mailbox is set up.
Getting a copy, or asking us to correct or delete it
You can ask what we hold about you, ask for it to be corrected, or ask for it to be deleted. Use the contact form, quoting an order number if you have one. We will respond within a reasonable time. Where the law requires us to keep a record — an order we must retain for tax purposes, for example — we will tell you what we have to keep and why.
Complaints
If you believe we have handled your personal information in a way that breaches Australian privacy law, contact us first and we will investigate and respond. If you are not satisfied with our response, you can complain to the Office of the Australian Information Commissioner.
To be settled — the named contact point for privacy enquiries and complaints, and the timeframe within which the client commits to responding. Australian privacy law expects one to be named.
Changes to this policy
We may update this policy from time to time. The current version is always published on this page, and the date it was last changed will be shown here once it has been settled.
Questions about any of this? Get in touch.