Dolly and Dotty is a trading name of Calveos Group Pte. Ltd., ABN 97 851 862 346. In this policy, “we”, “us” and “our” mean Calveos Group Pte. Ltd. trading as Dolly and Dotty.

This policy explains how we collect, hold, use and disclose your personal information when you visit dollyanddotty.com.au (the Site), place an order with us for delivery in Australia, or otherwise deal with us.

We handle personal information in accordance with the Privacy Act 1988 (Cth) (the Privacy Act) and the 13 Australian Privacy Principles (APPs). We carry on business in Australia and collect personal information in Australia, so the Privacy Act applies to us.

Where we send marketing messages, we also comply with the Spam Act 2003 (Cth) and the Do Not Call Register Act 2006 (Cth).

This policy forms part of our Terms and Conditions and is available free of charge on the Site. Our Cookie Policy expands on section 4 below.

1. What is personal information?

“Personal information” means information or an opinion about an identified individual, or an individual who is reasonably identifiable - whether the information is true or not, and whether it is recorded in a material form or not.

“Sensitive information” is a special category of personal information that includes health information, racial or ethnic origin, political opinions, religious beliefs, sexual orientation and criminal record. We do not seek to collect sensitive information about you. If we ever needed to, we would ask for your consent first and explain why.

2. What personal information do we collect?

We may collect, hold, use and disclose the following kinds of personal information:

•      Identity and contact details: your name, billing and delivery addresses, email address and phone number.

•      Order and transaction information: the items you have bought, returned or enquired about, your order history, sizes and preferences, delivery instructions, tracking information, refund and exchange records, and limited payment information such as the card type, the last four digits and the expiry date. We do not receive or store your full card number or security code - see section 7.

•      Account information: the details you give us if you register an account, including your login details and saved preferences. You do not need an account to order.

•      Marketing information: the details you give us when you subscribe to our newsletter or SMS updates, your marketing preferences, and whether you have opened or clicked our emails.

•      Sizing and fit information: measurements you send us when you ask for help choosing a size.

•      Returns and claims information: the reason for your return, and any photographs you send us to support a claim that an item is faulty, damaged or incorrect.

•      Business details: if you order in a business capacity, your business name and ABN for the purposes of your tax invoice.

•      Technical and usage information: your IP address, approximate geographic location, device and browser type and version, operating system, referral source, length of visit, pages viewed, page response times, download errors, and how you navigate to, through and away from the Site.

•      Communications: records of your enquiries, complaints, reviews, chatbot transcripts, emails and social media messages, and our replies.

•      Any other information you choose to send us.

Information about other people: If you give us someone else’s personal information - for example, the delivery address of a gift recipient - you must have that person’s consent, or otherwise be entitled to give it to us, before you do so.

Unsolicited information (APP 4): If we receive personal information we did not ask for, and we could not lawfully have collected it ourselves, we will destroy it or de-identify it as soon as practicable, unless the law requires us to keep it.

3. How we collect personal information

We collect personal information:

•      Directly from you : when you place an order, create an account, subscribe to marketing, use our chatbot, email customer care, ask for sizing help, start a return, leave a review or enter a competition.

•      Automatically: through cookies and similar technologies when you use the Site (see section 4).

•      From third parties: including our payment provider, our fulfilment provider and delivery carriers, our analytics, review and marketing platforms, and social media platforms where you interact with our pages.

We collect personal information only by lawful and fair means, and only where it is reasonably necessary for one or more of our functions or activities.

Anonymity and pseudonymity (APP 2): You can browse the Site without telling us who you are, and you do not need an account to place an order. However, we cannot process and deliver an order, handle a return or answer a personal enquiry without the information described in section 2, so dealing with us anonymously or under a pseudonym is not practicable in those situations.

If you do not give us what we ask for. We may not be able to process your order, deliver your goods, issue a tax invoice or provide the service you have asked for.

4. Cookies and tracking technologies

A cookie is a small file containing an identifier - a string of letters and numbers - that is sent by a web server to your browser and stored there. The identifier is sent back to the server each time your browser requests a page, which allows the server to recognise and track the browser.

We use both session cookies (deleted when you close your browser) and persistent cookies (which stay until they expire or you delete them).

We use session cookies to:

•      keep track of you as you move around the Site;

•      keep track of the items in your shopping bag;

•      prevent fraud and improve Site security.

We use persistent cookies to:

•      recognise you when you return to the Site;

•      remember your preferences, including your size and region;

•      measure Site performance and, where you have agreed, deliver and measure advertising.

Analytics. We use Google Analytics to understand how the Site is used. It uses cookies to generate statistical information about Site use, which is used to produce reports. That information is held by Google and may be transferred outside Australia. You can review Google’s privacy policy at policies.google.com/privacy and opt out of Google Analytics using Google’s browser add-on at tools.google.com/dlpage/gaoptout.

Advertising and social media. [If applicable: We use the Meta Pixel and Google Ads tags to measure how our campaigns perform and to show you relevant advertising. These providers may match the information they receive with information they already hold about you. You can manage your ad preferences at facebook.com/adpreferences and adssettings.google.com.]

Other providers. Our e-commerce platform (Shopify), the chatbot built into it (Shopify Inbox), our email and SMS platform (Klaviyo) and our review platforms (Trustpilot and Reviews.io) also set cookies or similar identifiers when you use those features.

Managing cookies. Most browsers let you refuse all cookies, refuse third-party cookies only, or delete cookies already stored. The steps differ between browsers, check your browser’s help or privacy settings. Blocking all cookies will affect the usability of many websites, including ours. 

Our Cookie Policy sets out the cookie categories we use, who sets them, how long they last and the choices available to you.

5. Why we use your personal information

We use your personal information for the purpose we collected it, for directly related purposes you would reasonably expect, and where you have consented or the law otherwise permits. Specifically, we use it to:

•      operate, administer and secure the Site;

•      process your order, take payment and dispatch your goods from our Melbourne fulfilment centre;

•      send you order confirmations, dispatch notices, tracking links, tax invoices and delivery updates;

•      manage returns, exchanges, refunds and claims, and meet our obligations under the Australian Consumer Law;

•      create and manage your account;

•      help you choose a size, and answer questions about fabric, fit and care;

•      personalise your browsing experience, including remembering your size and showing you relevant products;

•      send you marketing communications where permitted - see section 6;

•      respond to your enquiries, reviews and complaints;

•      detect, investigate and prevent fraud, payment misuse and security incidents;

•      verify compliance with our Terms and Conditions;

•      analyse and improve our products, the Site, our service and our marketing;

•      meet our tax, record-keeping and other legal obligations, and to establish, exercise or defend legal claims.

6. Direct marketing (APP 7 and the Spam Act)

We will only send you marketing emails or SMS messages where you have consented, or where you have bought from us or enquired with us and would reasonably expect to hear from us about similar products.

Every marketing message we send identifies us and includes a functional unsubscribe facility. You can opt out at any time by using the unsubscribe link at the bottom of any marketing email or emailing us at sales@dollyanddotty.com.au. We will action your request within 5 business days.

Opting out of marketing will not stop transactional messages about an order you have placed, such as your dispatch confirmation or tracking link.

We will not sell your personal information, and we will not disclose it to a third party for that third party’s own direct marketing, without your express consent.

If you ask us, we will tell you where we obtained your personal information, unless it would be impracticable or unreasonable to do so.

7. Payments and fraud screening

Card payments on the Site are processed by Shopify Payments. Your card details are entered into and handled by Shopify’s systems, not ours - we do not receive or store your full card number or security code. We share information with Shopify only as necessary to take payment, issue refunds and deal with related queries and disputes. Shopify’s privacy policy is at shopify.com/legal/privacy.

Fraud screening and automated processing. Shopify applies automated fraud analysis to orders and gives us a risk indicator based on signals such as your IP address, billing and delivery address match, and past order patterns. We use that indicator as one input only. Our team reviews the order before we decline or cancel it on fraud grounds, and we will email you to explain and refund you in full if we do (see clause 4 of our Terms and Conditions). If you think an order was declined in error, contact us and we will look at it again.

Apart from the fraud screening described above, we do not make decisions about you using automated processes alone where those decisions could reasonably be expected to significantly affect your rights or interests. We do not offer buy-now-pay-later at checkout, so no credit or eligibility assessment is carried out on   . If this changes, we will update this policy.

8. Who we disclose your personal information to

We may disclose your personal information to:

•      our own personnel, contractors and agents, where reasonably necessary for the purposes in this policy;

•      our fulfilment and warehousing provider, Invenco, which picks, packs, dispatches and receives returns for us in Melbourne;

•      our delivery carriers - CouriersPlease, Direct Freight, Team Global Express, Aramex and Australia Post - so they can deliver your parcel and provide tracking;

•      our payment provider, Shopify Payments;

•      our technology and service providers, including Shopify (e-commerce platform, hosting, and our chatbot through Shopify Inbox), Klaviyo (email and SMS marketing), Google and Meta (analytics and advertising), and Trustpilot and Reviews.io (collecting and displaying customer reviews);

•      professional advisers, including lawyers, accountants and auditors;

•      an actual or prospective purchaser of any business or asset we are selling or contemplating selling;

•      law enforcement, regulators, courts and other authorities, where we are required or authorised by law to disclose;

•      any other party where you have consented.

We may also disclose your personal information where reasonably necessary in connection with actual or prospective legal proceedings, or to establish, exercise or defend our legal rights, including for fraud prevention and credit risk reduction.

We require our service providers to protect your personal information and to use it only for the purposes we have engaged them for.

Except as described in this policy, we will not disclose your personal information to third parties.

9. Overseas disclosure (APP 8)

Within Australia. Order fulfilment, returns handling and delivery are carried out in Australia by our fulfilment provider Invenco, at their Melbourne warehouse, and by our delivery carriers CouriersPlease, Direct Freight, Team Global Express, Aramex and Australia Post.

Overseas. Part of our technology stack and support functions sit outside Australia. Your personal information is likely to be disclosed to recipients in the following countries:

Country	Why	Who
United States and Canada	E-commerce platform and hosting, payments and fraud screening, chatbot, email and SMS marketing, analytics and advertising	Shopify (including Shopify Payments and Shopify Inbox), Klaviyo, Google, Meta
United Kingdom and Denmark	Collecting and displaying customer reviews	Reviews.io, Trustpilot
Singapore	Company administration and corporate correspondence	Calveos Group Pte. Ltd. (registered office)

 

Before disclosing personal information overseas, we take reasonable steps to ensure the recipient handles it in a way consistent with the Australian Privacy Principles - principally through contractual commitments in our agreements with them. Some of these countries do not have data protection laws equivalent to Australia’s, and we may not be able to control or enforce how an overseas recipient handles your information in every case. If an overseas recipient we have disclosed your information to mishandles it, you can still complain to us under section 15.

If you post personal information for publication on the Site - for example, in a public product review - it will be published on the internet and may be accessible worldwide.

10. Security of your personal information (APP 11)

We take reasonable technical and organisational steps to protect your personal information from misuse, interference and loss, and from unauthorised access, modification or disclosure. These include:

•      holding personal information on secure, access-controlled systems operated by us or our providers;

•      protecting transactions and Site traffic with encryption in transit (TLS);

•      restricting staff and contractor access on a need-to-know basis;

•      imposing security obligations on our service providers by contract.

You acknowledge that transmitting information over the internet is inherently insecure, and we cannot guarantee the security of data sent to us over the internet.

Your part. You are responsible for keeping your password and login details confidential. We will never ask you for your password, except when you log in to the Site. If you think your account has been compromised, contact us straight away.

11. Data breaches

We have procedures for detecting, containing, assessing and responding to data breaches. If a breach occurs that is likely to result in serious harm to you, we will notify you and the Office of the Australian Information Commissioner (OAIC) as required by the Notifiable Data Breaches scheme in Part IIIC of the Privacy Act.

12. How long we keep your personal information

We keep personal information only for as long as we need it for the purposes in this policy, or for as long as the law requires. For example:

•      Order, transaction and tax records - at least 5 years, as required by Australian tax law, because we are registered for GST and issue tax invoices.

•      Account records - while your account is open, and for a reasonable period afterwards.

•      Marketing records - while you are subscribed, plus a record of your unsubscribe so we do not contact you again.

•      Returns, claims and complaints records - for as long as needed to resolve the matter and for a reasonable period afterwards, having regard to the time limits for consumer guarantee claims.

When we no longer need your personal information and we are not required to keep it, we destroy it or de-identify it.

13. Accessing and correcting your personal information (APPs 12 and 13)

Access. You can ask us for a copy of the personal information we hold about you. We will:

•      acknowledge your request promptly and respond within 30 days;

•      ask for reasonable proof of identity, proportionate to what you have asked for - for most requests, confirming details already on your account is enough. We do not require certified copies of passports or original utility bills. We will not collect more identity information than we need, and we will destroy it once your request is closed;

•      give you access in the form you have asked for, where that is reasonable and practicable;

•      not charge you for making the request. If significant work is involved in giving access, we may charge a reasonable, non-excessive fee for our costs, and we will tell you the amount before we do the work.

Correction. If the personal information we hold about you is inaccurate, out of date, incomplete, irrelevant or misleading, tell us and we will correct it. If we have already passed incorrect information to a third party - a carrier, for instance - you can ask us to tell them about the correction, and we will take reasonable steps to do so.

Deletion. You can ask us to close your account and delete your personal information. We will do so unless we are required or entitled by law to keep it - for example, transaction and tax records - and we will tell you if that applies.

Refusals. In limited circumstances the Privacy Act allows us to refuse access or correction - for example, where giving access would unreasonably affect another person’s privacy, or where we are required by law to refuse. If we refuse, we will tell you in writing, give our reasons, and explain how to complain.

14. Government related identifiers (APP 9)

We do not adopt, use or disclose government related identifiers - such as a tax file number, Medicare number, driver licence number or passport number - as our own identifier for you, except where the Privacy Act permits it. If you give us an ABN for a tax invoice, we use it only for that purpose.

15. Third party websites

The Site links to third-party websites and integrates third-party services - payment, delivery tracking, chatbot, reviews and social media. We do not control those services and we are not responsible for their content or for how they handle your information. Their own terms and privacy policies apply, so please read them before providing personal information.

16. Changes to this policy

We may update this policy from time to time by publishing a new version on the Site - for example, to reflect changes to our practices, our providers or the law. Please check this page occasionally. Where changes are significant, we will take reasonable steps to notify you, for example by email or a notice on the Site.

17. Complaints and how to contact us

Email: sales@dollyanddotty.com.au

We aim to reply within one business day.

Please note: email is the quickest way to reach us. Our Melbourne fulfilment centre is not a retail location and cannot accept correspondence or in-person requests. Returns go to the address on our Return Policy page.

If you have a complaint about how we have handled your personal information, please tell us in writing with as much detail as you can. We will acknowledge your complaint within 2 business days and give you a substantive response within 30 days. We may need to ask you for more information to investigate.