Privacy policy

Last updated 29 October 2026. This page describes how this shop works in plain English. It is not legal advice.

Who the controller is

BuyFactory Direct Pty Ltd, trading as Baby Shop Company Australia, Suite 307, Norwest Central, 12 Century Circuit, Norwest NSW 2153, Australia. Email theteam@mybabyshop.net.au.

What we collect, and why

• Order data: your name, delivery address, email address, phone number and what you ordered. We need it to take payment, pick the order and get it to you.
• Enquiries: whatever you put in an email or a form, so we can answer it.
• Analytics and advertising measurement: page visits, device/browser information, ad-click information and confirmed purchase events. Purchase events include a hashed order reference, AUD value and currency; Google Analytics also receives item details, shipping and tax. We do not include your name, email, postal address or raw payment reference in these events.

We do not collect special category data, we do not knowingly collect anything from children, and this site has no comments and no customer accounts.

Card details

We never see them. Payment is taken by Stripe or PayPal on their own systems, and this website receives only a confirmation that the payment succeeded.

Who else processes your data

• Stripe and PayPal: payment.
• Supabase: the order record.
• Resend: your order confirmation and dispatch emails.
• Vercel: hosting and delivery of this website.
• Google Analytics 4 and Google Ads: website and purchase measurement. Google tags load with region-specific consent settings. Where prior consent is required, storage and advertising-data consent default to denied until you accept. In Australia they default to granted unless you decline. When consent is denied, Google may receive cookieless measurement signals. Use Cookie settings in the footer to change your choice.
• The courier carrying your parcel, which needs your address.

Lawful basis

Performance of a contract for anything needed to fulfil your order; legitimate interests for fraud prevention and service messages; consent for analytics and for marketing email, which you can withdraw at any time.

How long we keep it

Order records for six years, because tax law requires it. Enquiry emails for two years. Analytics data for the retention period set in Google Analytics.

Your rights

Under the Australian Privacy Principles you can ask for a copy of the personal information we hold about you (APP 12) and ask us to correct it if it is wrong (APP 13). Australia has no general right to erasure or to data portability, but we will delete what we no longer need, and we have to destroy or de-identify it once it is no longer required (APP 11.2). Email theteam@mybabyshop.net.au and we will answer within one month. If you are not satisfied you can complain to the Office of the Australian Information Commissioner at oaic.gov.au.

Cookies

See the cookie policy.