Gray & Co is committed to handling your personal information responsibly and in accordance with the Australian Privacy Principles (APPs) under the Privacy Act 1988 (Cth). This policy explains what we collect, why we collect it, and how you can access or correct your information.

Last updated: 23 May 2026

1. What Information We Collect

We collect personal information that is reasonably necessary to operate our store and provide our services. This includes:

• Contact and order details — name, email address, phone number, delivery address, and billing address collected at checkout.
• Payment information — card or payment details processed securely by our payment provider. We do not store raw card numbers on our systems.
• Account information — if you create a customer account, we store your login details and order history.
• Marketing preferences — whether you've opted in to receive emails or SMS from us.
• Technical data — IP address, browser type, device information, pages visited, and time spent on the site, collected automatically via cookies and analytics tools.
• Communications — any messages, enquiries, or feedback you send us by email, phone, or through a contact form.

Where possible, you may browse our website without identifying yourself. However, completing a purchase or creating an account requires identification.

2. How We Use Your Information

We use your personal information to:

• Process and fulfil your orders, including arranging delivery and sending order confirmations and updates.
• Respond to your enquiries and provide customer support.
• Send you marketing communications — including new arrivals, promotions, and editorial content — but only if you have opted in. You can unsubscribe at any time.
• Improve our website, product range, and services using aggregated, anonymised analytics data.
• Comply with legal obligations, resolve disputes, and enforce our agreements.
• Prevent fraud and maintain the security of our store.

We do not sell your personal information to third parties.

3. Cookies and Tracking

Our website uses cookies and similar tracking technologies to remember your preferences, analyse site traffic, and serve relevant advertising. You can control cookie settings through your browser, though disabling certain cookies may affect how the site functions.

We use the following tracking tools:

• Google Analytics — to understand site traffic and user behaviour in aggregate.
• Meta Pixel (Facebook/Instagram) — to measure the effectiveness of our advertising and, where you've consented, to show you relevant ads on Meta platforms.

4. Third-Party Service Providers

To run our store, we work with a small number of trusted third-party platforms that may process your personal information on our behalf:

• Shopify — our ecommerce platform, which stores order data, customer accounts, and site content. Shopify is certified to international security standards. See Shopify's Privacy Policy.
• Shopify Payments — processes card transactions securely. PCI-DSS compliant.
• Buy-now-pay-later providers — where offered at checkout, these providers handle their own credit assessment and data collection under their own privacy policies.
• Email and marketing platforms — used to send transactional and marketing emails where you've opted in.
• Delivery and courier partners — delivery providers who receive your name and delivery address to fulfil shipments.

Some of these providers are based overseas (including the United States). Where your information is disclosed to an overseas recipient, we take reasonable steps to ensure it is handled in a manner consistent with the APPs. However, by using our store you acknowledge that we may not always be able to ensure equivalent protection by overseas entities.

5. Data Security

We take reasonable steps to protect your personal information from misuse, interference, loss, and unauthorised access, modification, or disclosure. Our website is SSL-encrypted, and access to customer data is restricted to those who need it to do their job.

In the event of a data breach likely to result in serious harm, we will notify affected individuals and the Office of the Australian Information Commissioner (OAIC) in accordance with the Notifiable Data Breaches (NDB) scheme.

6. Data Retention

We retain your personal information for as long as reasonably necessary to fulfil the purposes described in this policy, or as required by law. Order records are retained as required for accounting and legal compliance purposes. If you ask us to delete your account and we have no overriding legal obligation to retain your data, we will do so within a reasonable timeframe.

7. Your Rights

Under the APPs, you have the right to:

• Access the personal information we hold about you.
• Correct any information that is inaccurate, out of date, or incomplete.
• Request deletion of your personal information, subject to our legal obligations.
• Opt out of marketing at any time — use the unsubscribe link in any email, or contact us directly.
• Complain about how we've handled your information.

To exercise any of these rights, email us at gray@grayandco.com.au. We'll respond within 30 days.

8. Privacy Complaints

If you have a concern about how we've handled your personal information, please contact us first and give us the opportunity to resolve it. If you're not satisfied with our response, you can lodge a complaint with the Office of the Australian Information Commissioner (OAIC):

• Website: www.oaic.gov.au
• Phone: 1300 363 992

9. Updates to This Policy

We may update this policy from time to time. The most current version will always be available on this page, with the date of the last update noted at the top. Continued use of our store after an update constitutes acceptance of the revised policy.

Contact Us

For any privacy-related questions: gray@grayandco.com.au or 0404 449 017.