Privacy Policy

Bedzy
Operated by Hedger Enterprises Pty Ltd
Last updated: 5 August 2026

1. About this Privacy Policy

Bedzy, operated by Hedger Enterprises Pty Ltd, respects your privacy and is committed to protecting the personal information of our customers, website visitors and other individuals who interact with us.

In this Privacy Policy, “Bedzy”, “we”, “us” and “our” refer to Bedzy and Hedger Enterprises Pty Ltd.

This Privacy Policy explains how we collect, hold, use, disclose and protect personal information when you:

• visit or use our website at www.bedzy.com.au;

• create a customer account;

• place or attempt to place an order;

• subscribe to email or SMS marketing;

• communicate with our customer service team;

• interact with our advertisements, social media pages or promotions;

• submit a review, complaint, warranty request, return request or other enquiry; or

• otherwise interact with us.

We manage personal information in accordance with the Privacy Act 1988 (Cth), the Australian Privacy Principles and other applicable Australian laws.

“Personal information” means information or an opinion about an identified individual, or an individual who is reasonably identifiable, whether or not the information is true or recorded in a material form.

2. Personal information we collect

The personal information we collect depends on how you interact with us.

Identity and contact information

We may collect:

• your name;

• email address;

• telephone or mobile number;

• billing address;

• delivery address;

• business name and business contact details;

• customer account information;

• the name and contact details of an authorised representative;

• the name and contact details of a delivery or gift recipient; and

• information used to verify your identity or account.

Order and transaction information

We may collect:

• products viewed, saved, added to your cart or purchased;

• order numbers and order history;

• product preferences, sizes, colours and configurations;

• billing and delivery information;

• delivery instructions;

• payment method type;

• payment, refund and transaction status;

• discount or promotional codes used;

• returns, exchanges, credits and refunds;

• warranty and replacement claims;

• courier tracking and delivery information;

• communications relating to an order;

• payment dispute and chargeback information;

• fraud prevention and transaction verification information; and

• records required for accounting, taxation, audit or legal purposes.

We generally do not directly receive or store complete payment card numbers. Payments are processed through Shopify and the payment provider selected by you.

We may receive limited payment information such as:

• the selected payment method;

• a payment or transaction identifier;

• whether a payment was approved or declined;

• payment, refund or dispute status; and

• the last digits of a payment card.

Customer service information

When you communicate with us, we may collect:

• copies of emails;

• SMS messages;

• online chats;

• WhatsApp messages;

• social media messages;

• telephone call notes;

• details of your enquiry, complaint or feedback;

• photographs or videos you provide;

• product, assembly or delivery issues;

• warranty, return or refund information;

• records of resolutions, refunds, replacements or store credits;

• invoices, receipts or supporting documents you provide; and

• information required to investigate an issue or verify your identity.

Marketing and communication information

We may collect:

• your email and SMS subscription status;

• when, where and how you subscribed;

• the form or wording through which consent was provided;

• your communication preferences;

• whether you opened, clicked or interacted with a marketing communication;

• products, collections or promotions that may interest you;

• whether you unsubscribed or requested that communications stop;

• campaign attribution information;

• competition and promotion entries; and

• records maintained to ensure we respect your marketing choices.

Website, device and usage information

When you use our website, we and our service providers may automatically collect:

• IP address;

• browser type and version;

• device type;

• operating system;

• device identifiers;

• advertising identifiers;

• approximate location derived from your IP address;

• pages, products and collections viewed;

• website searches;

• referring websites or advertisements;

• date and time of visits;

• links and buttons selected;

• shopping cart activity;

• checkout activity;

• completed purchase activity;

• session information;

• cookie and similar technology identifiers;

• website performance information;

• diagnostic information; and

• website security and fraud-prevention information.

Some of this information may be personal information where it identifies you or can reasonably be linked with you.

Advertising and analytics information

We may collect or receive information relating to:

• advertisements you viewed or interacted with;

• campaigns that referred you to Bedzy;

• conversion events;

• advertising audience membership;

• website and advertising attribution;

• advertising performance;

• interactions with Facebook, Instagram or Google advertisements;

• information associated with cookies, pixels, tags and similar technologies; and

• hashed or otherwise protected identifiers used for advertising measurement, conversion matching or audience matching.

Social media, reviews and public content

If you interact with Bedzy through Facebook, Instagram, Google, Trustpilot, ProductReview.com.au or another review or social media platform, we may collect:

• your username or public profile name;

• public reviews, comments and posts;

• ratings;

• private messages sent to Bedzy;

• photographs or videos you submit;

• competition or promotion entries; and

• information the platform makes available to us under your account settings and its terms.

Information you publish in a public review, comment or social media post may be visible to other people.

Information about another person

You may provide information about another person, such as a:

• delivery recipient;

• gift recipient;

• family member;

• authorised representative;

• support person; or

• person collecting an order on your behalf.

You must only provide another person’s personal information where you are authorised to do so and have informed them that their information may be handled in accordance with this Privacy Policy.

Sensitive information

We do not ordinarily seek to collect sensitive information, such as health information, racial or ethnic origin, religious beliefs, political opinions or biometric information.

We may incidentally receive sensitive information if you voluntarily provide it, for example information about:

• a disability;

• accessibility requirements;

• health or mobility considerations relevant to delivery;

• a personal hardship situation; or

• circumstances relevant to a customer service complaint.

We will only collect and use sensitive information where reasonably necessary and with your consent, or as otherwise permitted by law.

Please do not provide sensitive information unless it is reasonably necessary for us to assist you.

3. How we collect personal information

Directly from you

We may collect personal information when you:

• browse our website;

• create or update a customer account;

• place an order;

• begin or abandon a checkout;

• add products to a cart;

• enter your details into a form or popup;

• subscribe to email or SMS marketing;

• contact customer service;

• request a return, replacement, refund or warranty remedy;

• participate in a promotion, survey or competition;

• submit a review;

• communicate through social media;

• make a payment;

• open a payment dispute or chargeback; or

• otherwise provide information to us.

Information entered during checkout may be stored before the checkout is completed. This may allow us to:

• preserve your shopping cart;

• provide checkout functionality;

• assist with customer service;

• detect and prevent fraud; and

• where we have appropriate consent or are otherwise permitted by law, send a checkout reminder.

Automatically

We may collect information automatically through:

• cookies;

• pixels;

• web beacons;

• local storage;

• server logs;

• analytics tools;

• advertising tags;

• software development kits;

• application programming interfaces;

• Shopify integrations;

• server-side advertising integrations; and

• similar technologies.

From third parties

We may receive personal information from:

• Shopify;

• Omnisend;

• payment providers;

• buy now, pay later providers;

• product suppliers and manufacturers;

• warehouses and fulfilment partners;

• courier, postal and freight providers;

• customer service providers;

• fraud prevention and payment security providers;

• Meta, including Facebook and Instagram;

• Google;

• review platforms;

• social media platforms;

• analytics and advertising providers;

• professional advisers;

• publicly available sources; and

• third-party applications connected to our Shopify store.

For example:

• a payment provider may confirm whether a transaction was approved;

• a supplier may confirm whether an item has been dispatched;

• a courier may provide tracking, attempted delivery or proof-of-delivery information;

• an advertising platform may report that an advertisement resulted in a visit or purchase; and

• a review platform may notify us that you submitted a review.

Unsolicited personal information

If we receive personal information that we did not request, we will determine whether we could have lawfully collected it.

Where we are not required or permitted to retain it, we will take reasonable steps to destroy or de-identify it.

4. Why we collect, hold, use and disclose personal information

Processing and fulfilling orders

We may use personal information to:

• process and confirm orders;

• arrange payment;

• perform fraud or transaction checks;

• communicate about an order;

• allocate an order to a supplier or warehouse;

• arrange dispatch and delivery;

• provide tracking information;

• provide delivery instructions to couriers;

• resolve missed or unsuccessful deliveries;

• provide products and services;

• issue invoices and receipts;

• process returns, replacements, exchanges and refunds;

• administer warranties;

• issue vouchers, store credits or promotional benefits; and

• maintain transaction and fulfilment records.

Providing customer service

We may use personal information to:

• respond to enquiries;

• verify your identity;

• confirm account or order ownership;

• investigate delivery or product issues;

• resolve complaints;

• provide product and assembly information;

• process warranty requests;

• communicate with suppliers or couriers on your behalf;

• maintain records of customer communications;

• prevent duplicate or conflicting requests; and

• improve customer service processes.

Processing payments and preventing fraud

We may use and disclose information to:

• process payments;

• confirm payment status;

• process refunds;

• verify transactions;

• detect suspected fraud;

• manage payment risk;

• prevent unauthorised transactions;

• respond to payment disputes and chargebacks;

• provide evidence to banks and payment providers;

• protect customers and Bedzy;

• enforce our terms;

• recover unpaid amounts; and

• comply with payment provider requirements.

Information disclosed in response to a payment dispute or chargeback may include:

• order information;

• payment information;

• communications;

• tracking information;

• proof of delivery;

• delivery photographs;

• refund information; and

• evidence relevant to the dispute.

Operating and improving Bedzy

We may use personal information to:

• operate our Shopify store;

• manage products and inventory;

• remember shopping carts and preferences;

• analyse website traffic;

• understand how customers use our website;

• test website functionality;

• improve our website and customer experience;

• improve products, offers and promotions;

• forecast demand;

• measure advertising performance;

• produce aggregated or de-identified reports;

• manage suppliers and contractors;

• conduct audits;

• maintain business records; and

• plan and administer our business.

Communicating with you

We may send:

• order confirmations;

• payment confirmations;

• dispatch notifications;

• delivery and tracking updates;

• backorder or delay notifications;

• customer service responses;

• refund and replacement updates;

• account or security notifications;

• product recall or safety notices;

• changes to an order;

• changes to policies or services; and

• other transactional or service-related communications.

These communications are not necessarily marketing communications and may continue even where you have unsubscribed from marketing.

Marketing and personalised communications

Where permitted by law, we may use personal information to send or personalise:

• welcome emails;

• newsletters;

• promotional emails;

• promotional SMS messages;

• abandoned cart reminders;

• abandoned checkout reminders;

• browse-abandonment reminders;

• product recommendations;

• back-in-stock notifications;

• price-drop notifications;

• post-purchase communications;

• review requests;

• sales and promotional announcements;

• voucher and discount offers;

• birthday or anniversary offers, where applicable; and

• other communications about Bedzy products and promotions.

We may use information such as:

• your purchase history;

• website browsing activity;

• cart activity;

• communication engagement;

• location;

• product preferences; and

• previous promotion use

to determine which communications may be relevant to you.

Advertising and advertising measurement

We may use information to:

• display advertisements on Facebook, Instagram, Google and other services;

• retarget people who visited Bedzy or viewed particular products;

• create advertising audiences;

• create audiences of people with similar characteristics;

• exclude existing customers from certain campaigns;

• measure whether advertisements resulted in visits or purchases;

• match advertising interactions with orders;

• attribute sales to campaigns;

• improve advertising performance; and

• prevent advertising fraud or invalid activity.

Legal, regulatory and business purposes

We may use or disclose information to:

• comply with laws and regulations;

• comply with court or tribunal orders;

• respond to lawful government or law enforcement requests;

• obtain legal, accounting, insurance or professional advice;

• establish, exercise or defend legal claims;

• protect Bedzy’s legal rights and property;

• protect customers, personnel and systems;

• investigate suspected unlawful or fraudulent conduct;

• manage a proposed or completed sale, merger or restructure;

• transfer assets or business operations; and

• perform activities authorised or required by law.

5. What happens if you do not provide information

You may browse some parts of our website without identifying yourself.

If you do not provide information that is reasonably necessary, we may not be able to:

• process or deliver an order;

• contact you about a delivery;

• process a payment or refund;

• assist with a return or warranty request;

• create or maintain your account;

• investigate a complaint;

• provide customer service;

• send a requested product notification; or

• provide certain website features.

You are not required to subscribe to marketing to make a purchase.

6. Email, SMS and marketing automation

We use marketing and customer communication platforms, including Omnisend and Shopify marketing tools, to manage email and SMS communications, customer profiles and automated customer journeys.

These systems may process:

• your name;

• email address;

• telephone number;

• subscription status;

• consent records;

• shopping cart activity;

• checkout activity;

• browsing activity;

• order history;

• marketing engagement;

• product preferences;

• customer segments;

• discount or voucher information; and

• unsubscribe and suppression records.

Automated customer journeys may include:

• welcome messages;

• abandoned cart reminders;

• abandoned checkout reminders;

• browse-abandonment reminders;

• product recommendations;

• post-purchase messages;

• review requests;

• back-in-stock notifications;

• price-drop notifications;

• customer re-engagement messages; and

• promotional communications.

We will only send commercial electronic messages where we have consent or are otherwise permitted to do so under applicable law.

Email marketing

Marketing emails will identify Bedzy as the sender and include a functional unsubscribe facility.

You may unsubscribe by:

• selecting the unsubscribe link in a marketing email;

• changing available communication preferences;

• replying with an unsubscribe request; or

• contacting our customer service team.

SMS marketing

Where you subscribe to Bedzy SMS marketing:

• message frequency may vary;

• consent is not a condition of purchase;

• standard message or data charges imposed by your telecommunications provider may apply;

• you can reply STOP to unsubscribe; and

• you may contact our customer service team for assistance.

You may receive a final message confirming that your SMS unsubscribe request has been processed.

Providing a telephone number for delivery, customer service or order purposes does not automatically mean that you have consented to receive SMS marketing.

Opt-out requests

We will process marketing unsubscribe and opt-out requests within the period required by law.

You may opt out using the provided unsubscribe facility or by otherwise clearly communicating that you no longer wish to receive marketing.

We may retain limited information on a suppression list after you unsubscribe so that we can continue to honour your preference.

Unsubscribing from marketing does not prevent us from sending necessary:

• order communications;

• payment communications;

• delivery updates;

• safety or recall notices;

• account or security notices;

• legal communications; or

• customer service responses.

7. Cookies and similar technologies

Cookies are small data files stored on your browser or device.

We use cookies and similar technologies to:

• operate our store;

• maintain website security;

• remember customer preferences;

• provide shopping cart and checkout functions;

• understand website use;

• improve website performance;

• prevent fraud;

• provide marketing automation;

• measure advertising; and

• personalise advertisements and communications.

Similar technologies may include:

• pixels;

• web beacons;

• tags;

• local storage;

• advertising identifiers;

• APIs;

• conversion tracking;

• server-side tracking; and

• software development kits.

Strictly necessary technologies

These technologies support functions such as:

• website security;

• customer sessions;

• account login;

• shopping carts;

• checkout;

• payment processing;

• fraud prevention;

• load balancing; and

• remembering privacy choices.

Disabling these technologies may prevent parts of the website from functioning.

Functional technologies

These technologies may remember:

• your region;

• account preferences;

• recently viewed products;

• saved shopping cart information;

• customer service settings; and

• other website choices.

Analytics and performance technologies

We may use Shopify analytics, Google Analytics and other analytics services to understand:

• visitor numbers;

• traffic sources;

• website navigation;

• product and collection performance;

• checkout behaviour;

• conversion rates;

• website errors;

• advertising attribution; and

• aggregated customer trends.

Advertising technologies

We may use technologies provided by Meta, Google and other advertising providers to:

• measure advertisements;

• understand campaign performance;

• attribute sales;

• retarget website visitors;

• create advertising audiences;

• display personalised advertisements; and

• prevent advertising fraud.

Omnisend and marketing platform technologies

Omnisend and Shopify marketing tools may use cookies and related technologies to connect website activity with a customer or subscriber profile, where permitted.

This may allow us to:

• remember shopping cart activity;

• trigger automated communications;

• recommend relevant products;

• measure communication performance; and

• determine whether a message resulted in a website visit or purchase.

Managing cookies

You may manage cookies using:

• the cookie banner or privacy controls available on our website;

• your browser settings;

• your device settings;

• advertising controls provided by Meta or Google; and

• available industry opt-out services.

Blocking cookies may affect the operation or availability of some website features.

The cookies and technologies used by Shopify and third-party applications may change over time. Our cookie banner or consent management tool may provide more current information about active technologies where available.

Do Not Track signals

There is no consistent industry standard for responding to browser “Do Not Track” signals.

We do not necessarily alter our data collection practices when a browser sends a Do Not Track signal.

Where our website provides a cookie preference or data-sharing control, you should use that control to record your preference.

8. Meta, Facebook and Instagram advertising

We use Meta advertising services in connection with Facebook and Instagram.

Depending on our configuration, Meta Business Tools may include:

• the Meta Pixel;

• Conversions API;

• advertising audiences;

• custom audiences;

• lookalike or similar audiences;

• catalogue advertising; and

• conversion measurement tools.

These tools may collect or receive:

• IP address;

• browser and device information;

• cookie and advertising identifiers;

• pages and products viewed;

• searches;

• add-to-cart activity;

• checkout activity;

• purchase events;

• order value;

• currency;

• campaign information;

• referral information; and

• hashed or otherwise protected contact identifiers, where enabled.

Meta may use this information to provide advertising, measurement, reporting, audience, security and fraud-prevention services in accordance with its terms and privacy policy.

We do not intentionally provide sensitive information to Meta for advertising purposes.

You may manage advertising preferences through your Facebook or Instagram settings and through available privacy controls on our website.

9. Google Analytics and Google advertising

We use Google Analytics and Google advertising services to:

• understand website use;

• measure website and advertising performance;

• attribute sales;

• display relevant advertisements;

• build advertising audiences; and

• improve campaigns.

Google technologies may collect or receive:

• IP address;

• browser and device information;

• cookies and advertising identifiers;

• approximate location;

• pages and products viewed;

• campaign information;

• checkout and purchase events;

• conversion information; and

• analytics information.

Where Google Customer Match, enhanced conversions or user-provided data features are enabled, customer information such as an email address, telephone number, name or address may be transformed or hashed before being transmitted to Google for matching, conversion measurement or advertising purposes.

Google processes information in accordance with its own terms and privacy policies.

You may manage personalised advertising through your Google account advertising settings and manage cookies through our website privacy controls or your browser.

10. Shopify

Our online store is hosted and powered by Shopify.

Shopify processes personal information when you:

• visit Bedzy;

• create an account;

• begin or complete checkout;

• make a payment;

• make a purchase; or

• interact with Shopify-powered store features.

Depending on the services and settings enabled, Shopify may process information to:

• host and operate our store;

• provide customer account functions;

• provide checkout and payment functionality;

• secure accounts and transactions;

• detect fraud;

• provide analytics;

• provide customer privacy controls;

• improve Shopify services;

• provide personalised commerce features; and

• provide services based on interactions with Shopify, Bedzy and, in some circumstances, other Shopify merchants.

Shopify and its service providers may process personal information in countries outside Australia.

Further information about Shopify’s handling of customer personal information is available in Shopify’s Consumer Privacy Policy.

11. Omnisend

We use Omnisend to provide:

• email marketing;

• SMS marketing;

• customer segmentation;

• marketing automation;

• website forms and popups;

• campaign reporting;

• abandoned cart communications;

• customer profile management; and

• related marketing services.

Omnisend may process:

• customer contact information;

• consent and subscription status;

• order information;

• shopping cart activity;

• checkout activity;

• website activity;

• marketing engagement; and

• customer segment information.

Omnisend and its subprocessors may process personal information outside Australia.

We use Omnisend subject to its contractual terms and applicable data-processing arrangements.

12. Payment and buy now, pay later providers

Payments may be processed by third-party payment providers.

Depending on the payment option selected, these providers may include:

• Shopify Payments;

• PayPal;

• Afterpay;

• Zip;

• Klarna;

• card networks;

• banks;

• financial institutions; and

• payment security or fraud-prevention providers.

These providers may collect personal information directly from you.

They may independently assess:

• transaction approval;

• identity verification;

• fraud risk;

• payment risk;

• credit eligibility;

• repayment arrangements; and

• account security.

Their handling of personal information is governed by their own privacy policies and terms.

We may exchange information with payment providers to:

• process payments;

• issue refunds;

• verify transactions;

• investigate suspected fraud;

• respond to payment disputes and chargebacks;

• recover unpaid amounts; and

• comply with legal or contractual requirements.

13. Suppliers, warehouses and couriers

Bedzy may use third-party suppliers, manufacturers, warehouses, fulfilment partners, couriers and freight companies to supply and deliver products.

We may disclose information such as:

• your name;

• delivery address;

• telephone number;

• email address;

• products ordered;

• delivery instructions;

• order reference;

• authority-to-leave instructions; and

• information relevant to a delivery issue.

These parties may provide us with:

• dispatch information;

• tracking information;

• delivery estimates;

• attempted delivery information;

• proof of delivery;

• photographs;

• delivery signatures;

• depot information;

• return-to-sender information; and

• information relevant to delivery complaints or disputes.

Some Bedzy orders may be supplied directly by a third-party supplier or dispatched from a supplier-managed warehouse.

14. Reviews, surveys and customer feedback

We may use third-party platforms to collect:

• product reviews;

• service reviews;

• customer ratings;

• customer photographs;

• surveys; and

• feedback.

Where you submit a public review, your name or profile name, rating, comments and uploaded content may be publicly displayed by the review platform.

Where Bedzy offers an incentive for submitting a review, the incentive is for submitting an honest review and is not conditional on the review being positive.

We may use reviews and feedback to:

• respond to customer concerns;

• improve products and services;

• verify purchases;

• request further information;

• display customer feedback; and

• promote Bedzy where permitted.

We will seek any additional permission required before using customer photographs, videos or private communications in advertising.

15. Who we disclose personal information to

We may disclose personal information to:

• Shopify and Shopify service providers;

• Omnisend;

• payment and buy now, pay later providers;

• suppliers and manufacturers;

• warehouses and fulfilment providers;

• courier, postal and freight companies;

• customer service providers and contractors;

• website hosting and IT providers;

• cloud storage and security providers;

• fraud prevention and payment security providers;

• Meta;

• Google;

• advertising and analytics providers;

• marketing, email and SMS providers;

• review and customer feedback platforms;

• accountants;

• lawyers;

• insurers;

• auditors;

• banks and financial institutions;

• government departments;

• regulators;

• courts and tribunals;

• law enforcement agencies;

• potential purchasers or investors in our business; and

• other third-party applications used to operate Bedzy.

We provide service providers with the personal information reasonably necessary to perform the relevant service.

We do not sell personal information to third parties in exchange for money.

However, advertising platforms may receive identifiers and website activity for advertising, attribution and audience-matching purposes as described in this Privacy Policy.

16. Third-party Shopify applications and integrations

We may use third-party applications that connect with Shopify, Omnisend, advertising platforms, payment providers or other systems.

These applications may support:

• product sourcing;

• inventory management;

• order processing;

• supplier communication;

• delivery and tracking;

• customer service;

• email and SMS marketing;

• reviews;

• analytics;

• fraud prevention;

• accounting;

• payments;

• returns;

• refunds;

• website features; and

• advertising.

An application may access personal information where reasonably necessary for its function and according to the permissions granted to it.

We review our applications and service providers from time to time. Their services, ownership, subprocessors and data-hosting locations may change.

17. Overseas disclosures

Some of our service providers, contractors and technology platforms are located outside Australia or may store, access or process personal information outside Australia.

Countries in which recipients or service providers are likely to be located may include:

• the United States;

• Canada;

• the Philippines;

• Singapore;

• the United Kingdom;

• Lithuania;

• other countries in the European Economic Area; and

• other countries in which Shopify, Omnisend, Meta, Google, payment providers, suppliers or their subprocessors operate.

The particular countries involved may change when a provider changes its infrastructure, personnel or subprocessors.

Before disclosing personal information to an overseas recipient, we take reasonable steps in the circumstances to ensure that the information will be handled consistently with applicable Australian privacy requirements, unless an exception under the Privacy Act applies.

18. Automated processing, segmentation and profiling

We may use automated systems to:

• segment customers and subscribers;

• select marketing communications;

• personalise product recommendations;

• personalise website content;

• trigger abandoned cart communications;

• measure advertising;

• calculate marketing attribution;

• identify potentially fraudulent transactions;

• prioritise customer service tasks; and

• determine which advertisements or promotions may be relevant.

These systems may use:

• website activity;

• shopping cart activity;

• order history;

• marketing engagement;

• product preferences;

• approximate location;

• device information; and

• transaction information.

These processes do not ordinarily make decisions that significantly affect your legal rights or interests without appropriate review.

Where we introduce automated decision-making that could reasonably be expected to significantly affect an individual’s rights or interests, we will update this Privacy Policy and provide the information required by applicable law.

19. Security of personal information

We take reasonable administrative, technical and physical measures to protect personal information from:

• misuse;

• interference;

• loss;

• unauthorised access;

• unauthorised modification; and

• unauthorised disclosure.

These measures may include:

• access controls;

• account security controls;

• secure technology providers;

• staff and contractor confidentiality requirements;

• system monitoring;

• backups;

• multi-factor authentication where available;

• payment security controls; and

• internal security and incident-response procedures.

No method of transmission or electronic storage is completely secure. We cannot guarantee absolute security, but we take reasonable steps to protect the personal information we hold.

You are responsible for:

• maintaining the confidentiality of your account password;

• using a secure and unique password;

• protecting access to your email account and devices; and

• notifying us if you suspect unauthorised access to your Bedzy account.

20. Retention and destruction

We retain personal information for as long as reasonably necessary to:

• fulfil the purposes described in this Privacy Policy;

• process and fulfil orders;

• provide customer service;

• administer warranties;

• process returns and refunds;

• maintain tax, accounting and transaction records;

• resolve complaints;

• manage payment disputes and chargebacks;

• detect and prevent fraud;

• enforce agreements;

• comply with laws;

• comply with court or tribunal orders; and

• establish, exercise or defend legal claims.

Different types of personal information may be retained for different periods.

We may retain marketing suppression records after you unsubscribe so that we can continue to honour your preference.

Where personal information is no longer required for a permitted purpose and we are not legally required to retain it, we will take reasonable steps to destroy it or ensure it is de-identified.

Some information may remain temporarily in secure backups until those backups are deleted or overwritten through ordinary processes.

21. Accessing your personal information

You may request access to personal information that we hold about you by contacting us using the details below.

To protect your privacy, we may ask for information to verify:

• your identity;

• the information requested; and

• the authority of a person acting on your behalf.

We will respond within a reasonable period and aim to provide a response within 30 calendar days.

There is no charge for making an access request.

In limited circumstances, we may charge a reasonable and non-excessive amount for providing access. We will explain any proposed charge before providing access.

We may refuse access where permitted or required by law.

Where we refuse an access request, we will generally provide written reasons and information about available complaint options, except where it would be unreasonable or unlawful to do so.

22. Correcting your personal information

You may ask us to correct personal information that is:

• inaccurate;

• out of date;

• incomplete;

• irrelevant; or

• misleading.

There is no charge for requesting or making a correction.

We will respond within a reasonable period and aim to provide a response within 30 calendar days.

Where we refuse to make a requested correction, we will generally:

• provide written reasons;

• explain available complaint options; and

• where applicable, allow you to request that a statement be associated with the information indicating that you consider it incorrect.

You may update certain account or contact information through your customer account where that functionality is available.

23. Requests for deletion

You may ask us to delete personal information.

Australian privacy law does not provide an unrestricted right to require deletion in every circumstance.

We will consider deletion requests and take reasonable steps to delete or de-identify information where:

• it is no longer reasonably required;

• it is not required for a permitted purpose; and

• we are not legally or reasonably required to retain it.

We may retain information required for:

• processing or recording orders;

• taxation and accounting;

• warranties;

• returns and refunds;

• customer complaints;

• payment disputes;

• chargebacks;

• fraud prevention;

• legal claims; and

• compliance obligations.

24. Withdrawing consent

Where we rely on your consent, you may withdraw that consent by:

• contacting us;

• using an unsubscribe facility;

• adjusting available privacy settings; or

• using our website cookie controls.

Withdrawing consent does not affect handling that occurred before the withdrawal and may not prevent handling that is required or otherwise permitted by law.

25. Anonymity and pseudonyms

Where practicable, you may interact with us anonymously or using a pseudonym, such as when browsing our website or making a general product enquiry.

We will need accurate identifying and contact information where it is impracticable to provide a service anonymously, including when:

• processing payment;

• delivering an order;

• issuing a refund;

• handling a warranty request;

• responding to a chargeback;

• verifying account ownership; or

• investigating a complaint.

26. Data breaches

We maintain procedures for responding to suspected or actual data breaches.

Where a data breach is likely to result in serious harm and notification is required under the Notifiable Data Breaches scheme or another applicable law, we will notify:

• the Office of the Australian Information Commissioner; and

• affected individuals

as required.

A notification may include:

• information about the breach;

• the types of information involved;

• steps Bedzy has taken; and

• recommended steps affected individuals can take.

27. Children and minors

Bedzy’s purchasing and customer account services are intended for adults.

We do not knowingly collect personal information directly from individuals under 18 for the purpose of:

• creating customer accounts;

• processing orders; or

• sending marketing communications

without appropriate involvement from a parent or guardian.

If you are a parent or guardian and believe a minor has provided personal information to us without appropriate authorisation, please contact us so we can investigate and take appropriate action.

28. Third-party websites and services

Our website and communications may contain links to websites or services operated by third parties, including:

• payment providers;

• couriers;

• social media platforms;

• review platforms;

• product information websites; and

• other external services.

We do not control those third parties and are not responsible for their privacy practices.

You should review the privacy policy of any third-party service before providing personal information.

A link does not necessarily represent Bedzy’s endorsement of that third party’s privacy practices.

29. Privacy complaints

If you believe we have mishandled your personal information or breached an applicable privacy obligation, please contact us in writing.

Please include:

• your name and contact details;

• a description of your concern;

• relevant dates;

• relevant order numbers;

• copies or details of relevant communications; and

• the outcome you are seeking.

We will acknowledge and investigate your complaint and aim to provide a response within 30 calendar days.

If additional time is reasonably required, we will contact you and explain the expected timeframe.

We encourage you to contact Bedzy first so we have an opportunity to investigate and resolve the matter.

If you are not satisfied with our response, you may lodge a complaint with the Office of the Australian Information Commissioner.

30. Contact us

For privacy questions, access requests, correction requests, deletion requests or complaints, contact:

Privacy Officer
Bedzy
Operated by Hedger Enterprises Pty Ltd
Level 23, 727 Collins Street
Melbourne VIC 3008
Australia

Email: support@bedzy.com.au
Website: www.bedzy.com.au

This is a mailing and head office address and is not a retail showroom.

31. Changes to this Privacy Policy

We may update this Privacy Policy when:

• our business practices change;

• we add or remove services;

• we add or remove Shopify applications;

• our suppliers or service providers change;

• our advertising or analytics technologies change;

• applicable laws or regulatory guidance change; or

• an update is otherwise reasonably necessary.

An updated version will be published on our website with a revised “Last updated” date.

Where a change is material, we may also provide notice through:

• our website;

• customer accounts;

• email; or

• another appropriate communication method.

We encourage you to review this Privacy Policy periodically.