Privacy policy

Last Updated: December 21, 2025

My Mystery Parcel (“we”, “our”, “us”) is committed to protecting your privacy. This Privacy Policy explains how we collect, use, store, disclose, and safeguard your personal information in accordance with:

  • Privacy Act 1988 (Cth)
  • Australian Privacy Principles (APPs 1–13)
  • Notifiable Data Breaches (NDB) Scheme
  • Disability Discrimination Act 1992 (DDA)
  • Australian Consumer Law (ACL)

This policy applies to all visitors, customers, and users interacting with our website (My Mystery Parcel)

1. Introduction/Overview

  • This section explains the purpose of the Privacy Policy and how it applies to website users, customers, and visitors.
  • Commitment to transparent, fair, and lawful handling of personal information.
  • Users are informed about their rights and how their data is collected, used, and protected.

2. Personal Information We Collect

  • Directly collected information: name, email, phone number, billing/shipping address, payment information, account credentials, order history, shopping preferences, and accessibility requests.
  • Automatically collected information: IP address, device and browser type, cookies, session data, and navigation patterns.
  • Sensitive information: Only collected when necessary, e.g., delivery instructions for accessibility or special handling.

3. How We Collect Information

  • Directly from users: through forms, checkout, account registration, newsletter subscription, and customer support interactions.
  • Indirectly: cookies, tracking pixels, analytics tools, and third-party service providers.

4. Use of Personal Information

  • We use personal information to efficiently process orders, payments, and shipping.
  • We also use the information to reply to enquiries and offer customer support.
  • We aim to enhance the shopping experience by providing personalised recommendations and promotional offers, only with consent.
  • It is crucial to adhere to legal obligations, which encompass taxation, fraud prevention, and regulatory requirements.
  • Legal Reference: APP 6—Limitation on use and disclosure of personal information.

5. Sharing Personal Information

  • Service providers: Payment gateways (Shop Pay, Visa, Mastercard, Apple Pay, Google Pay), shipping carriers (Australia Post, StarTrack), and cloud hosting providers.
  • Legal obligations: government authorities, tax authorities, law enforcement.
  • Marketing partners: Only shared with explicit consent for promotional purposes.
  • Legal Reference: APP 6 – limits on use and disclosure.

6. Cookies and Tracking Technologies

Types of cookies:

  • Essential: Required for website functionality and security.
  • Analytics: Track website performance, page views, referral sources, and time spent.
  • Marketing: Retargeting ads, personalised offers, and conversion tracking.

Users may manage or disable cookies via browser settings.

Legal Reference: APP 1 & APP 3 – transparency and lawful collection.

7. Data Security

  • Measures: SSL/TLS encryption, secure servers, access controls, firewalls, strong passwords, and two-factor authentication where applicable.
  • Access is limited to authorised personnel.
  • Legal Reference: APP 11 – protection against misuse, loss, or unauthorised access.

8. Data Retention

  • Personal information is retained only as long as necessary for order fulfilment, customer support, marketing (with consent), accounting, and legal obligations.
  • Data no longer required is securely deleted or anonymised.
  • Legal Reference: APP 11 – storage Limitations.

9. User Rights

Users can:

  • Access the personal data we hold.
  • Request correction of inaccurate information.
  • Request deletion of personal data (subject to legal obligations).

Requests are handled via email, phone, or postal mail within a reasonable time.

Legal Reference: APP 12 – access and correction rights.

10. Marketing Communications

  • Marketing communications (emails, SMS, notifications) are sent only with explicit consent.
  • Users can unsubscribe anytime via links in emails or by contacting us directly.
  • Legal Reference: Spam Act 2003 – consent and opt-out requirements.

11. Third-Party Links and Services

  • The website may include links to external websites (suppliers, affiliates).
  • We are not responsible for third-party privacy practices.
  • Users should review third-party policies before providing personal information.

12. Children’s Privacy

  • We do not knowingly collect personal information from children under 18.
  • Parental consent is required if data is collected from minors.
  • Legal Reference: APP 3—Collection Limitation.

13. International Data Transfers

Personal information may be transferred outside Australia for:

  • Payment processing
  • Cloud hosting and analytics

Safeguards: contractual agreements, encryption, and compliance checks to ensure data protection.

Legal Reference: APP 8 – cross-border disclosure compliance.

14. Data Breach Notification

  • In case of a data breach, affected users are notified promptly under the NDB Scheme.
  • Notifications include mitigation steps and guidance for protection.

15. Automated Decision Making / Profiling

  • We do not make automated decisions with legal significance.
  • Personalisation (recommendations, ads) is non-decision-impacting.
  • Legal Reference: APP 13 – limits on automated decision-making.

16. Data Portability

  • Users may request their personal data in a structured, commonly used, machine-readable format.

17. Third-Party Analytics & Tracking

  • Tools like Google Analytics and Facebook Pixel track anonymous users' behaviour.
  • Purpose: improve website performance, marketing efficiency, and user experience.
  • Users may opt out via browser privacy settings or third-party tools.

18. Retention & Archiving

  • Key documents (invoices, tax records) are retained for the legally required minimum (usually 7 years).
  • Data no longer needed is securely deleted or anonymised.

19. Risk Management

  • Regular privacy risk assessments are conducted for website processes, third-party integrations, and operational changes.
  • Mitigation measures include security audits, penetration testing, monitoring for suspicious activity, and staff training.

20. Changes to Privacy Policy

  • Policy updates reflect legal or operational changes.
  • Significant changes are communicated via website announcements or email.
  • The effective date is displayed at the top of the policy.

21. Contact Information

Users can contact us for privacy enquiries, access requests, complaints, or feedback:

Registered Company Name: My Mystery Parcel

ABN: 63 385 406 700

Registered Address: 12 Weigand Avenue, Bankstown New South Wales 2200, Australia

Email: contact@mymysteryparcel.com

Phone: +61 493 530 342

Live chat: Live chat available on our website

Business Hours: 10 AM–6 PM (Monday–Friday), (GMT+10:00) Australian Eastern Standard Time (Sydney)