Brandon's Gifts

Privacy Policy

Last Updated: 15 July 2026

This Privacy Policy is issued by Brandon Park Lotto Cards & Gifts (ABN XX XXX XXX XXX), trading as Brandon's Gifts. We are committed to protecting the privacy and security of our customers and site visitors. This policy explains how we collect, use, disclose, and protect your personal information in accordance with the Australian Privacy Principles (APPs) contained in the Privacy Act 1988 (Cth).

1. Our Core Promise: No Data Selling

We respect your privacy. We do not, and will never, sell, rent, or trade your personal data to any third party. Your information is only used to provide you with our products and services as described in this policy.

2. Information We Collect

We collect information necessary to fulfil your orders, keep the store secure, and provide a personalised shopping experience. This includes:

  • Personal Details: Your name, delivery address, billing address, email address, and phone number when you place an order.
  • Account Information: Your name, email address and password (stored only as a secure one-way hash — we cannot see your password), plus your order history, saved addresses, wishlist and preferences. If you check out as a guest, we create an account record from your order details so you can track the order and access it later; you can claim this account by setting a password.
  • Payment Information: We never receive or store your full credit card details. Card and wallet payments (including Apple Pay and Google Pay) are tokenised in your browser and processed directly by our payment providers under PCI-DSS. We keep a record of the payment method used, the amount, and the provider's transaction reference.
  • Order Security Data: When you place an order we record the IP address, browser/device information (user agent), a device fingerprint, and approximate location (country, state and city derived from the IP address) associated with the transaction. We collect this solely for fraud prevention and payment security, and it is retained with the order's security log. IP addresses associated with suspected fraud or abuse may be added to a block list.
  • Session & Device Data: To keep you logged in and your cart working, our session records include your IP address and browser type. Our web server and security infrastructure also keep standard technical logs of requests to the site (IP address, pages requested, browser type).
  • Contact Messages: If you use our contact form, we store your name, email address, phone number (if provided), your message, and our reply, so we can respond to you and keep a record of the enquiry.
  • Restock & Newsletter Details: Your email address if you ask to be notified when a product is back in stock, or subscribe to our newsletter.
  • Promotion Usage: When you use a discount code, we record that use against your order to apply per-customer limits and prevent misuse.

3. How We Use Your Information

  • Processing, fulfilling, and dispatching your orders (including Click & Collect and delivery).
  • Communicating with you regarding your order status, collection reminders for pay-in-store orders, refunds, or customer service enquiries. These service messages are not marketing and are sent to anyone with an active order or enquiry.
  • Detecting and preventing fraudulent or unauthorised transactions, and blocking abusive traffic.
  • Maintaining and securing your registered customer account.
  • Sending newsletters and marketing offers via email only where you have opted in, in accordance with the Spam Act 2003 (Cth). Every marketing email we send identifies us and contains a working unsubscribe link, actioned within 5 business days.
  • Analysing website traffic and usage to improve our store layout, product offerings, and user experience.
  • Meeting our legal obligations, including tax and consumer law record-keeping.

4. Disclosure to Third Parties (Including Overseas)

To operate our store we share limited information with service providers, some of which store or process data outside Australia (principally in the United States). We take reasonable steps to ensure these providers handle your information consistently with the APPs:

  • Payment Processors: Stripe (which also processes Apple Pay and Google Pay wallet payments), PayPal, and Afterpay handle your payment. Your payment details go directly to them and are subject to their privacy policies. These providers operate globally, including in the United States.
  • Shipping & Logistics: We share your name, delivery address, and phone number with our delivery partners (such as Australia Post) solely to deliver your order.
  • Hosting, Security & Backups: Website traffic is routed through Cloudflare, a content delivery and security network that processes visitor IP addresses (including on servers overseas) to protect the site. Copies of our database and files are kept as backups on secure, access-controlled cloud storage, which may be located overseas, and are retained on a rolling basis for disaster recovery.
  • Order Notifications: We use Telegram (a service with servers located overseas) to notify our own staff of new orders. These notifications contain order summary details.
  • Analytics & Marketing: Where enabled, we use analytics services (such as Google Analytics) and advertising pixels to understand how customers use our site, and an email service provider to manage newsletter lists.
  • Where required by law: We may disclose information to government agencies or law enforcement where legally obliged to do so.

5. Cookies and Tracking Technologies

  • Essential Cookies: Required for the basic functioning of the store, such as your shopping cart, login session, and checkout security (CSRF protection). These cannot be disabled. Session data associated with these cookies is stored securely on our server.
  • Analytics & Marketing Cookies: Where used, these help us measure site traffic and marketing performance. You can decline or delete these via your browser settings without affecting your ability to shop.

6. Security, Retention and Data Breaches

All data transmitted between your browser and our website is encrypted (HTTPS/TLS). Passwords are stored as one-way hashes, and access to personal information is restricted to staff who need it. We retain personal data only as long as necessary for the purposes above and to satisfy legal, accounting, and reporting requirements (order and tax records are kept for the periods required by Australian law; fraud-prevention records are kept while relevant to protecting the store).

We participate in the Notifiable Data Breaches (NDB) scheme. If a data breach occurs that is likely to result in serious harm, we will notify affected individuals and the Office of the Australian Information Commissioner (OAIC) as required by the Privacy Act. Security issues can be reported via our Security & Responsible Disclosure page.

7. Your Rights and Complaints

Under the Australian Privacy Principles, you may:

  • Request access to the personal information we hold about you.
  • Request that your personal information be corrected or updated.
  • Request the deletion of your account and personal data (subject to records we must keep by law, such as tax and order records).
  • Opt out of marketing communications at any time via the unsubscribe link in our emails.

To exercise these rights, contact us at hello@brandonparkgifts.com.au or Shop 2, Brandon Park Shopping Centre, Springvale Rd, Wheelers Hill VIC 3150. We aim to respond within 30 days. If you are not satisfied with our response, you may complain to the Office of the Australian Information Commissioner (oaic.gov.au, 1300 363 992).

8. Changes to This Policy

We may update this policy from time to time as our store and services change. The current version will always be published on this page with its "Last Updated" date.

We use cookies for analytics to understand how our store is used and improve your experience. See our Privacy Policy.