Privacy Policy

Last updated: September 1, 2026

1. Entity and scope

This policy explains how the store operator identified in the required legal notice and order records6 Compass Court, Mermaid Waters, QLD 4218, Australiahello@jnruimo.com

2. Application of Australian privacy law

Applicability of the Privacy Act 1988, Australian Privacy Principles, small-business exemptions and any higher sector or state requirements is the applicable details confirmed on the storefront, at checkout, or through support

3. Information collected

Depending on the interaction, we may collect names, contact and delivery details, account data, order and return history, payment tokens and results, communications, device and log data, cookie identifiers, marketing preferences, fraud signals and product-safety information. Actual categories are the applicable details provided on the storefront, at checkout, or through support

4. Collection and purposes

Information comes from customers, devices, Shopify, payment and delivery providers, fraud tools, marketing partners and lawful public sources. We use it to fulfil orders, provide support, process payments and refunds, secure services, prevent fraud, meet tax and safety duties, handle complaints, improve the store and market where permitted.

5. Disclosure and service providers

We disclose information only as reasonably required to service providers used only as described in this policy

6. Cookies, analytics and advertising

Cookies and similar tools support checkout, preferences, analytics, security and advertising. The actual categories, providers and retention are the applicable details confirmed on the storefront, at checkout, or through supportthe applicable details provided on the storefront, at checkout, or through support

7. Direct marketing

Electronic marketing is sent only with the consent or other basis permitted by the Spam Act and related rules, identifies the sender and provides a functional unsubscribe facility. Unsubscribe requests are honoured within the legal period and do not stop transactional or safety messages.

8. Overseas disclosure

Likely overseas recipient countries and safeguards are the applicable details confirmed on the storefront, at checkout, or through support

9. Security, retention and breaches

Information is retained for the timeframe shown at checkout, in the order confirmation, or by support where applicable

10. Access and correction

Individuals may request access to and correction of personal information through the privacy contact. We respond within a reasonable period, verify identity proportionately, give written reasons where access or correction is refused, and explain available complaint mechanisms.

11. Children and automated decisions

The minimum customer age and parental rules are the minimum age required by applicable lawthe applicable details confirmed on the storefront, at checkout, or through support

12. Complaints and changes

Privacy complaints go to hello@jnruimo.com

13. Collection notices

At or before collection, or as soon as practicable afterwards, we provide the matters required for the actual entity and activity, including identity and contact, circumstances and purpose of collection, consequences of non-provision, usual disclosures, access and complaint information, and likely overseas recipients where applicable. A generic privacy-policy link does not replace a more specific notice where context requires one.

14. Activity and purpose detail

Orders use identity, contact, basket, payment-result and delivery data to transact and fulfil. Support uses order and communication data to answer requests and manage claims. Tax, fraud and product-safety records support legal and legitimate operational duties. Analytics, personalisation and advertising use only the data and choice described for the deployed tool.

15. Cookie and tracking categories

• Necessary: cart, checkout, authentication, security and preference storage essential to the requested service.
• Analytics: audience, navigation and performance measurement.
• Personalisation: remembered choices and content tailoring.
• Advertising: conversion, audience or cross-service identifiers.

The actual provider, purpose, information collected, retention and control are documented in the applicable details confirmed on the storefront, at checkout, or through support

16. Access and correction procedure

1. Submit the request through the privacy contact and describe the information or correction sought.
2. We verify identity proportionately and clarify scope where necessary.
3. We search the relevant storefront, support, payment-reference, fulfilment and marketing systems.
4. We respond within a reasonable period and in the requested manner where reasonable and practicable.
5. If access or correction is refused, we give written reasons where required and explain complaint options.

17. Direct marketing records

We record the source and scope of marketing consent or other lawful basis, sender identity, unsubscribe event and suppression status. Purchased or shared lists are not used unless permission and source can be demonstrated. Unsubscribe facilities remain functional for the legal period and requests are honoured within the statutory time.

18. Overseas recipients and cloud services

Before overseas disclosure, we identify likely countries, provider roles and contractual or technical safeguards and assess the steps required by APP 8. A provider's global terms do not alone establish compliance. Where an exception is relied upon, the basis and customer notice are documented.

19. Retention schedule and de-identification

Order and tax records follow applicable accounting periods; support and warranty records follow service and claim needs; consent and suppression records remain long enough to prove and honour the choice; fraud and security data is limited to the documented risk period; safety and recall records follow product obligations. The approved schedule is the applicable details confirmed on the storefront, at checkout, or through support

20. Data breaches and incident response

We contain suspected incidents, preserve evidence, assess affected information and likely serious harm, and take remedial action. Where an eligible data breach is established and no exception applies, we prepare the required statement and notify the OAIC and affected individuals using the method required by law. Security contact: hello@jnruimo.com

21. Automated decisions and human review

Fraud, recommendation or moderation tools may produce scores or suggestions. Material use, data sources and available human review are the applicable details confirmed on the storefront, at checkout, or through support