Origin Roasters Pty Ltd ("ORIGIN", "we", "us") sells coffee directly to consumers through originroasters.com.au. We are the data controller for the personal data described in this policy. We keep this document in plain English on purpose: if anything is unclear, write to privacy@originroasters.com.au and a person — not a bot — will answer.
1. Who we are
Data controller: Origin Roasters Pty Ltd
Registered office: 14 Little Collins Street, Melbourne VIC 3000, Australia
Company registration (company registration): 41 28 66 73 · VAT: GST Reg. No. 62 118 447 903
Privacy contact: privacy@originroasters.com.au · +61 3 9042 8810
Data protection officer: Harriet Ng, dpo@originroasters.com.au
We are established in the European Union. For orders shipped to the United States, the same entity is responsible for your data; we do not operate a separate US subsidiary for data processing.
2. Scope
This policy applies to personal data processed through our website, our checkout, our customer support channels (email, phone and web form) and our marketing communications. It does not apply to third-party websites we link to, including Google's own services, which are governed by their own privacy policies.
3. Data we collect
We collect only what we need to sell you a product, deliver it, support you afterwards and meet our legal obligations.
| Category | What it includes | Source |
|---|---|---|
| Identity & contact | Name, email address, phone number, delivery and billing address | You, at checkout or when contacting us |
| Order & transaction | Items purchased, order value, currency, discounts used, order status, invoice records | Generated when you order |
| Payment | Payment method type, card brand and last four digits, transaction identifier, authorisation result. We never receive or store your full card number, CVV or Google Pay credentials. | Our payment processor and Google Pay |
| Delivery | Carrier, tracking number, delivery status, proof of delivery | Our carriers |
| Support | Messages, attachments, return reasons, call notes | You, when you contact us |
| Technical | IP address, device and browser type, approximate location derived from IP, pages viewed, referring URL, session identifiers | Automatically when you browse |
| Marketing preferences | Newsletter opt-in status, consent timestamps, unsubscribes | You |
We do not collect special category data (such as health, religion or biometric data), and we do not ask for government identification numbers. If you send us sensitive information in a support message, we will delete it once your request is resolved.
4. How and why we use your data
Under the EU and UK GDPR, we must have a lawful basis for each processing activity. This table sets out what we do and why we are allowed to do it.
| Purpose | Data used | Lawful basis |
|---|---|---|
| Taking and fulfilling your order, issuing invoices | Identity, contact, order, payment, delivery | Performance of a contract (Art. 6(1)(b)) |
| Customer support, returns and warranty handling | Identity, contact, order, support | Contract; legitimate interests (Art. 6(1)(f)) |
| Fraud prevention and payment screening | Order, payment, technical | Legitimate interests; legal obligation where applicable |
| Accounting, tax and customs records | Order, payment, delivery | Legal obligation (Art. 6(1)(c)) |
| Site analytics and performance | Technical | Consent (Art. 6(1)(a)) — non-essential cookies only |
| Marketing emails | Contact, marketing preferences | Consent, or soft opt-in for existing customers |
| Defending legal claims | Any relevant records | Legitimate interests (Art. 6(1)(f)) |
Where we rely on legitimate interests, we have carried out a balancing test and concluded that our interest does not override your rights. You can object at any time (see section 10).
5. Payments and Google Pay
When you pay with Google Pay, Google shares a one-time payment token with our payment processor; we receive only the confirmation, the last four digits of the underlying card and the transaction reference. Your card details are never transmitted to or stored on our servers.
- Payment processor: Stripe Payments Europe, Ltd. acts as our processor for card, Google Pay and Apple Pay transactions. Stripe is PCI DSS Level 1 certified.
- Google Pay: Google Payment Corp. and its affiliates process the payment token and may process limited transaction data as an independent controller for fraud prevention and their own legal obligations. See the Google Privacy Policy.
- Other methods: PayPal (Europe) S.à r.l. for PayPal payments, and Klarna Bank AB for instalment payments where offered.
- Fraud screening: we share order and device signals with our processor and fraud-screening provider to detect stolen cards and account takeover. This processing does not use special category data and does not make solely automated decisions with legal effect — a declined order is always reviewed by a human on request.
We retain payment transaction records for seven years to comply with the Australian tax law.
6. Cookies and similar technologies
We use cookies and local storage. Strictly necessary cookies are set on the basis of our legitimate interest in operating the shop; everything else requires your consent, which you can give, refuse or withdraw at any time through the cookie banner or your browser settings.
| Type | Purpose | Duration |
|---|---|---|
| Strictly necessary | Cart and session, checkout security, load balancing, remembering your cookie choices | Session to 12 months |
| Preferences | Currency, language and region selection | 12 months |
| Analytics | Aggregated page views, funnel and performance measurement (Google Analytics 4, IP anonymised) | 14 months |
| Marketing | Measuring campaign effectiveness and limiting ad frequency | Up to 13 months |
We honour the Global Privacy Control (GPC) signal where your browser sends one. To change your choices, use the "Cookie settings" link in the footer of any page.
7. Who we share data with
We do not sell personal data, and we do not share it with advertising networks for cross-site profiling without consent. We share it only with service providers who need it to do a specific job for us, under written data processing agreements:
- E-commerce platform: Shopify International Ltd. (hosting, orders, checkout).
- Payments: Stripe Payments Europe, Ltd.; Google Payment Corp. (Google Pay); PayPal (Europe) S.à r.l.; Klarna Bank AB.
- Delivery: DHL Express, UPS, PostNord and their local delivery partners, who receive your name, address, phone number and order contents.
- Communications: our email service provider (Klaviyo, Inc.) for transactional and marketing email, and our helpdesk provider for support tickets.
- Analytics: Google Ireland Ltd. (Google Analytics 4) — consent-based, IP anonymised.
- Professional advisers and authorities: auditors, lawyers, tax and customs authorities, and law enforcement where legally required.
If we are ever involved in a merger or sale, personal data may transfer to the buyer as part of the business, subject to this policy and to applicable law.
8. International transfers
Our order data is hosted in the EU. Some providers (for example Google, Klaviyo and Shopify) process data in the United States. Where data leaves the EEA, we rely on an adequacy decision (such as the EU–US Data Privacy Framework where the recipient is certified) or on the European Commission's Standard Contractual Clauses together with supplementary technical measures such as encryption in transit and at rest. You can request a copy of the relevant safeguards from privacy@originroasters.com.au.
9. How long we keep data
| Record | Retention period | Reason |
|---|---|---|
| Order and invoice records | 7 years after the financial year ends | Australian tax law |
| Payment and fraud records | 5 years | Chargeback and fraud defence |
| Customer support tickets | 3 years after last contact | Warranty and dispute handling |
| Marketing consent records | Until withdrawal + 3 years | Proof of consent |
| Analytics data | 14 months | Aggregated reporting |
| Server and security logs | 90 days | Security monitoring |
When a retention period ends, we delete or irreversibly anonymise the data.
10. Your rights
If you are in the EEA, the UK or Switzerland, you have the right to:
- Access the personal data we hold about you and receive a copy;
- Correct inaccurate or incomplete data;
- Erase your data where we no longer have a lawful reason to keep it;
- Restrict or object to processing, including direct marketing;
- Port data you gave us to another provider in a machine-readable format;
- Withdraw consent at any time, without affecting processing already carried out;
- Not be subject to solely automated decisions with legal or similarly significant effects;
- Complain to a supervisory authority. In Australia this is GPO Box 5218, Sydney NSW 2001, Australia (datatilsynet.dk).
To exercise any right, email privacy@originroasters.com.au. We reply within 30 days and may ask you to verify your identity. Exercising your rights is free, and we will never treat you differently for doing so.
11. California residents (CCPA/CPRA)
If you are a California resident, you have the right to know the categories and specific pieces of personal information we have collected, the sources, our purposes and the categories of third parties with whom we share it; the right to delete; the right to correct; the right to opt out of "sale" or "sharing" for cross-context behavioural advertising; and the right to limit the use of sensitive personal information. We do not sell personal information as defined by the CCPA. We do not knowingly sell or share the personal information of consumers under 16.
To exercise these rights, email privacy@originroasters.com.au with the subject "California request", or use our contact form. You may designate an authorised agent. We will verify your request using your order email and, where necessary, order number. We honour browser-based opt-out preference signals such as Global Privacy Control.
12. Marketing
We send marketing email only with your consent, or to existing customers about similar products where the law allows a soft opt-in. Every email contains a one-click unsubscribe link, and unsubscribing takes effect immediately. We do not buy or rent email lists.
13. Security
All traffic to originroasters.com.au is encrypted with TLS 1.2 or higher. Payment data is handled exclusively by our PCI DSS Level 1 certified processor. Access to customer records is limited to staff who need it, protected by single sign-on and multi-factor authentication, logged, and reviewed quarterly. We carry out annual penetration tests and maintain an incident response plan; if a breach is likely to result in a high risk to your rights, we will notify you and the relevant authority without undue delay.
14. Children
Our shop is intended for adults. We do not knowingly collect personal data from anyone under 16. If you believe a child has provided us with personal data, contact us and we will delete it.
15. Changes to this policy
We review this policy at least once a year and whenever we change our systems or suppliers. Material changes are announced on this page and, for customers with an account or active marketing consent, by email at least 14 days before they take effect. The version number and date at the top of this page always refer to the current text.
16. How to contact us
Questions, requests or complaints about privacy:
- Email: privacy@originroasters.com.au
- Data protection officer: dpo@originroasters.com.au
- Post: Origin Roasters Pty Ltd, Attn. Data Protection, 14 Little Collins Street, Melbourne VIC 3000, Australia
- Phone: +61 3 9042 8810, Monday to Friday, Mon–Fri, 08:00–16:00 AEST
EU consumers may also use the European Commission's Online Dispute Resolution platform at ec.europa.eu/consumers/odr. We are not obliged to participate in alternative dispute resolution proceedings before a consumer arbitration board, but we will always try to resolve your complaint directly first.