Privacy policy

Last updated: 13 August 2026

This Privacy Policy explains how Frenly Bricks Store, the registered business operating the Frenly Bricks brand under ABN 48 238 162 094 ("Frenly Bricks", "we", "us" or "our"), collects, holds, uses and discloses personal information when you visit frenlybricks.store, visit our Carrara store, contact us, create an account, join a loyalty program, enter a promotion, sell or consign goods to us, attend or appear in a live event, or buy our products and services.

Our annual turnover is currently below A$3 million and we do not trade in personal information. We therefore understand that the small-business exemption in the Privacy Act 1988 (Cth) generally applies to our current operations, unless another statutory exception applies to a particular activity. We nevertheless apply the privacy practices in this policy as our operating standard and aim to follow the Australian Privacy Principles. Where the Privacy Act or another privacy law applies, we will comply with it.

Contact details

Privacy contact: Frenly Bricks Privacy Officer

Email: frenlybricks.store@gmail.com

Store: Frenly Bricks, corner of Manchester Road and Gooding Drive, Carrara QLD 4211, Australia

Telephone: 0405 981 349

Personal information we collect

Depending on how you deal with us, we may collect:

  • identity and contact details, including name, email address, telephone number, billing and delivery address;
  • account, loyalty, wishlist, marketing preference and customer-service information;
  • order and transaction details, including products, price, discounts, returns, refunds, shipping and collection information;
  • payment status and limited payment details supplied by our payment providers. We do not intentionally store complete payment-card numbers;
  • information about goods you offer to sell or consign, including ownership, condition, provenance, images, payout details and identity information where reasonably needed to prevent fraud or comply with law;
  • communications, including contact-form submissions, email, chat, social messages and call notes;
  • device and online activity information, including IP address, browser, device identifiers, cookies, pages viewed, searches, cart activity, referring pages and advertising interactions;
  • promotion, giveaway, event and live-stream information, including entries, winner details and recordings of our presenters or participants who have agreed to appear; and
  • information you choose to provide, plus information lawfully received from Shopify, delivery providers, marketplaces, payment services, social platforms and other service providers.

Please do not send sensitive information, government identifiers or payment-card information through chat, email, social messages or an AI assistant unless we specifically request it through a secure channel and explain why it is needed.

How we collect information

We collect information directly from you, automatically through our website and connected services, from people acting for you, and from service providers and marketplaces involved in your transaction. We may also receive publicly available information where reasonably necessary for fraud prevention, authenticity checks, dispute resolution or business contact verification.

If you do not provide required information, we may be unable to process an order, deliver goods, provide an account, assess goods offered for sale, resolve a dispute or meet a legal obligation.

Why we use personal information

We use personal information to:

  • provide the website, store, accounts, orders, pickup, delivery, returns and customer support;
  • process payments and payouts, maintain transaction records and prevent fraud;
  • manage loyalty, wishlists, stock alerts, promotions, events and live auctions;
  • communicate service messages and, with valid consent or another lawful basis, marketing;
  • personalise products and measure advertising and website performance, subject to available consent and opt-out controls;
  • verify product authenticity, ownership and condition;
  • improve products, services, accessibility, security and internal operations;
  • meet tax, accounting, consumer, legal and regulatory obligations; and
  • establish, exercise or defend legal claims.

We do not use personal information for a materially different purpose without taking appropriate steps, which may include giving notice or obtaining consent.

Cookies, pixels and similar technology

We and our service providers use necessary cookies to operate the store and may use analytics, advertising and personalisation technologies where permitted. Connected services can include Shopify, Google, Meta, Klaviyo, Yotpo, Nitro, Growave, Stamped and other providers listed in our current vendor register.

Where required, our cookie banner lets you accept, decline or manage non-essential technologies. You can revisit preferences using the privacy or cookie link in our footer. Browser controls may also block cookies, but doing so can affect store functions.

Some US privacy laws treat certain advertising disclosures as a "sale" or "sharing" of personal information even when no money changes hands. Eligible visitors can use the data-sharing opt-out link in our footer.

Marketing

We send email or SMS marketing only where we have consent or are otherwise permitted by law. Checkout marketing choices are not preselected. New email and SMS subscriptions use a confirmation step. Each marketing message identifies us, provides contact details and includes a functional unsubscribe method. We action unsubscribe requests within five working days and keep a suppression record so we do not accidentally resubscribe you.

Service messages about an order, account, safety issue or legal notice are not marketing and may still be sent where necessary.

Artificial intelligence

We use AI-assisted tools for tasks such as drafting and editing public content, organising product information, analysing website or catalogue data and assisting staff with business operations. Some installed or connected services may include AI features, including Agentic, Microsoft Copilot, Shopify's Claude connector and AI-labelled merchandising tools. We require staff to minimise personal information and use approved business accounts and integrations.

We do not permit staff to enter payment-card details, identity documents, account credentials or unnecessary customer information into public AI services. We do not use AI as the sole decision-maker for refunds, fraud allegations, account restrictions, pricing or customer eligibility. A person reviews decisions that could materially affect a customer. If we introduce a materially different automated decision, we will update this policy and provide any notice required by law before using it.

When we disclose information

We disclose information only as reasonably necessary to:

  • Shopify and its related commerce, hosting, fraud, payment and customer-account services;
  • payment providers, banks, buy-now-pay-later providers and fraud-prevention services;
  • delivery, shipping, fulfilment and pickup providers, including Starshipit and the carrier selected for an order;
  • marketing, analytics and advertising providers where permitted, including Google, Meta, Klaviyo, Yotpo and connected pixel providers;
  • loyalty, reviews, wishlist, messaging, forms, support, stock-alert and store-function providers, including Growave, Stamped, Shopify Inbox, Shopify Forms and approved replacement services;
  • marketplace and integration providers used to sell or manage listings, including eBay-related providers;
  • approved contractors, accountants, insurers, lawyers and technology providers bound by appropriate duties;
  • regulators, courts, law enforcement or other parties where required or authorised by law; and
  • a buyer or adviser in a proposed business sale or restructure, subject to confidentiality and lawful handling.

We do not disclose more information than reasonably needed for the relevant purpose.

Overseas disclosure and storage

Shopify reports that store data is hosted in the United States. Our providers may process information in Australia, the United States, Canada, the European Economic Area, the United Kingdom and countries where their support or infrastructure operates. Provider locations can change as their infrastructure and subprocessors change. Overseas privacy protections may differ from Australian law.

Where the Australian Privacy Principles apply, we take reasonable steps required by APP 8 before disclosing personal information overseas, unless an exception applies. These steps can include assessing the provider, limiting data, using contractual protections and reviewing security and deletion terms.

Security

We use access controls, secure sign-in methods, encryption provided by our platforms, least-privilege app permissions, staff guidance, backups, logging and incident-response procedures appropriate to the information and risks. No internet or storage system is completely secure.

If we suspect a data breach, we contain and assess it promptly. Where the Notifiable Data Breaches scheme applies and a breach is likely to result in serious harm, we notify affected people and the Office of the Australian Information Commissioner as required.

Retention and deletion

We keep personal information only for as long as reasonably needed for the purpose collected, legal obligations, tax and accounting, consumer claims, chargebacks, fraud prevention and dispute resolution. Our current operating schedule is:

  • unsuccessful contact and general support enquiries: normally 24 months after closure;
  • marketing consent and suppression records: while subscribed, then for the period reasonably needed to prove consent and respect opt-out;
  • abandoned-cart and browsing marketing data: normally 12 months unless a shorter provider setting applies;
  • order, payment, refund, payout and tax records: generally at least five years after the relevant transaction or longer where legally required;
  • customer accounts and loyalty records: while active, then reviewed after 24 months of inactivity;
  • event recordings and winner evidence: normally for the life of the published promotional material or as reasonably required to prove the promotion, unless consent is withdrawn and continued use is not otherwise lawful; and
  • legal disputes, fraud investigations and chargebacks: until final resolution and expiry of relevant limitation periods.

When information is no longer required, we take reasonable steps to delete or de-identify it, including by making deletion requests to processors where appropriate. Backup copies may remain for a limited cycle and are protected from routine use.

Access and correction

You can ask for access to personal information we hold about you or ask us to correct it. Email frenlybricks.store@gmail.com with "Privacy request" in the subject line. We may need to verify your identity and authority before responding.

We aim to acknowledge requests within seven days and respond within 30 days. If we refuse access or correction where permitted by law, we will give written reasons and available complaint options. We do not charge for making a request, although a reasonable access cost may apply where lawful and notified in advance.

Complaints

Send privacy complaints to frenlybricks.store@gmail.com with "Privacy complaint" in the subject line. Include enough detail for us to investigate. We aim to acknowledge the complaint within seven days and provide a substantive response within 30 days.

If you are not satisfied and the Privacy Act applies, you may complain to the Office of the Australian Information Commissioner at oaic.gov.au. Other consumer or communications regulators may also have jurisdiction depending on the issue.

Children and young people

Our products may interest families and young people, but customer accounts, purchases, selling or consignment arrangements and promotions are intended for people who can lawfully enter the relevant transaction. A parent or guardian should act for a child where required. We do not knowingly use children's information for targeted advertising or ask children to provide sensitive information. A parent or guardian can contact us to request review or deletion.

Changes to this policy

We may update this policy to reflect legal, service or data-use changes. The current version and date will remain available on our website. We will provide additional notice where a change is material and required by law.