Privacy policy

1. ABOUT THIS POLICY

1.1 Introduction

This website is owned and operated by FRESH FACE SKIN PTY LTD (ABN 20 621 349 246) ("We", "Our", "Us", or "Fresh Face Skin").

By using this website and Our services, you agree to this Privacy Policy, which governs how We handle your personal information. This Privacy Policy applies in addition to any other terms and conditions applicable to Our Website and services.

We are committed to protecting your privacy in accordance with:

• The Privacy Act 1988 (Cth) ("Privacy Act")

• The Australian Privacy Principles (APPs) contained in the Privacy Act

• The Spam Act 2003 (Cth)

• Other applicable Australian privacy laws

1.2 Updates to This Policy

We may update this Privacy Policy from time to time to reflect changes in Our practices, legal requirements, or business operations. When We make material changes, We will:

1. Update the "Effective Date" and "Last Reviewed" dates at the top of this webpage

2. Post the updated Privacy Policy on Our Website at https://freshfaceskin.com.au/policies/privacy-policy

We encourage you to review this Privacy Policy periodically. If you continue to use Our services after changes are posted, you agree to the updated policy.

1.3 Your Privacy Rights

Under Australian law, you have important privacy rights, including:

• The right to know what personal information We hold about you

• The right to access and correct your personal information

• The right to make a complaint about how We handle your information

• The right to opt out of direct marketing communications

• From June 10, 2025, the right to take legal action for serious invasions of privacy under the new statutory tort provisions

This Privacy Policy explains how to exercise these rights.

 

---

 

2. UNDERSTANDING PERSONAL INFORMATION

2.1 What is Personal Information?

Personal information is information or an opinion about an identified individual or an individual who is reasonably identifiable, whether the information or opinion is true or not, and whether recorded in a material form or not.

Examples include: name, email address, telephone number, postal address, date of birth, IP address (when linked to an individual), purchase history, and preferences.

2.2 Sensitive Information

Sensitive information is a special category of personal information that includes:

• Health information

• Racial or ethnic origin

• Political opinions or associations

• Religious beliefs or affiliations

• Sexual orientation or practices

• Criminal records

• Biometric information used for identification

Our Practice: We do not actively collect sensitive information unless:

1. You voluntarily provide it (e.g., skin type or skin condition information for product recommendations)

2. It is reasonably necessary for Our functions

3. We obtain your explicit consent

4. We handle it in accordance with stricter privacy protections

If you provide sensitive information, We will:

• Obtain your express consent

• Use it only for the specific purpose for which it was provided

• Apply enhanced security measures

• Limit access to authorized personnel only

2.3 De-identified and Anonymous Information

We also collect non-personal information, such as:

• Aggregated usage statistics

• De-identified demographic data

• General Website analytics

This information does not identify you personally and is not subject to the same privacy protections as personal information.

 

---

 

3. WHAT PERSONAL INFORMATION WE COLLECT

We collect personal information that is reasonably necessary for Our business functions. The specific information We collect depends on how you interact with Us.

3.1 Contact and Identity Information

• Full name

• Email address

• Postal/delivery address

• Telephone numbers (mobile and landline)

• Date of birth (where required for age verification)

3.2 Account Information

• Username

• Password (stored in hashed/encrypted form only)

• Account preferences and settings

• Communication preferences (email, SMS, postal)

• Purchase history and order details

3.3 Payment Information

• Credit/debit card details (processed by secure third-party payment processors only - We do not store complete card numbers)

• Billing address

• Transaction records

• PayPal or other payment platform identifiers

3.4 Technical and Usage Information

• IP addresses

• Browser type and version

• Device information (type, operating system, unique device identifiers)

• Cookies and similar tracking technologies

• Pages visited and time spent on Our Website

• Referring website addresses

• Search terms used to find Our Website

3.5 Communication and Interaction Data

• Correspondence sent to Us (emails, contact forms, live chat)

• Enquiries and feedback

• Customer service interactions

• Survey responses

• Product reviews and ratings

3.6 Marketing and Preferences

• Marketing communication preferences (opt-in for newsletters, promotional emails, SMS)

• Product interests and preferences

• Skin type and skincare concerns (if voluntarily provided)

• Purchase preferences and wish lists

3.7 Information About Children

We do not knowingly collect personal information from children under 18 years of age without appropriate consent. If you are under 18, please obtain your parent's or guardian's permission before providing any personal information to Us.

If We become aware that We have inadvertently collected personal information from a child under 18 without proper consent, We will take steps to delete that information as soon as practicable.

Parents and Guardians: If you believe We have collected personal information from your child without consent, please contact Us immediately using the details in Section 14.

 

---

 

4. HOW WE COLLECT PERSONAL INFORMATION

4.1 Direct Collection

We primarily collect personal information directly from you when you:

1. Register for an account on Our Website

2. Make a purchase or place an order

3. Subscribe to communications (email newsletters, SMS promotions)

4. Contact Us via email, phone, contact forms, or live chat

5. Participate in surveys, promotions, or competitions

6. Provide feedback or reviews about Our products or services

7. Apply for employment or submit an application

8. Visit Our Website (automatic collection via cookies and analytics)

4.2 Automatic Collection

When you visit Our Website, We automatically collect certain information through:

• Cookies and similar technologies (see Section 9)

• Web server logs (IP addresses, browser information, access times)

• Analytics tools (Google Analytics, heatmaps, session recordings)

4.3 Third-Party Collection

We may receive personal information about you from third parties, including:

• Payment processors (transaction confirmation data)

• Delivery and logistics providers (delivery status updates)

• Social media platforms (if you interact with Our social media pages)

• Marketing platforms and service providers

• Publicly available sources (to verify information you provide)

When We receive unsolicited personal information, We will:

1. Determine whether We could have collected it directly under the APPs

2. If not, destroy or de-identify the information as soon as practicable (unless legally required to retain it)

3. If yes, handle it in accordance with this Privacy Policy

4.4 Anonymity and Pseudonymity

Where practicable, We provide the option to interact with Us anonymously or using a pseudonym. For example:

• Browsing Our Website without creating an account

• Contacting Us with general enquiries without providing full contact details

• Participating in surveys anonymously

However, in some circumstances, We cannot provide services without collecting personal information (e.g., processing orders, creating accounts, providing customer support for specific issues).

 

---

 

5. WHY WE COLLECT, HOLD, USE, AND DISCLOSE PERSONAL INFORMATION

5.1 Primary Purposes

We collect, hold, use, and disclose personal information for the primary purposes for which it was collected, including:

1. Providing Products and Services

• Processing and fulfilling orders

• Managing accounts and registrations

• Providing customer service and support

• Processing returns, refunds, and exchanges

• Delivering products to you

2. Payment Processing

• Facilitating secure payment transactions through third-party processors

• Maintaining transaction records

• Detecting and preventing fraud

3. Communications

• Responding to enquiries and correspondence

• Sending order confirmations and shipping notifications

• Providing technical support

• Notifying you of changes to Our services or policies

4. Website Operation and Improvement

• Operating and maintaining the Website

• Analyzing usage patterns to improve user experience

• Diagnosing technical issues and providing support

• Ensuring Website security and preventing unauthorized access

5. Legal and Compliance Obligations

• Complying with legal requirements (e.g., taxation laws, consumer protection laws)

• Maintaining records for audit and compliance purposes

• Responding to lawful requests from government authorities

• Protecting Our legal rights and interests

5.2 Secondary Purposes

We may also use or disclose personal information for related secondary purposes that you would reasonably expect, including:

1. Internal Business Operations

• Conducting internal audits and quality assurance

• Business planning and forecasting

• Risk management and insurance

• Dispute resolution and complaint handling

2. Research and Development

• Developing new products and services

• Improving existing products and customer experience

• Conducting market research (anonymized where possible)

3. Special Circumstances

• Preventing or investigating suspected fraud, illegal activity, or security threats

• Protecting the health, safety, or rights of individuals

• Managing legal proceedings or enforcing Our rights

If We intend to use or disclose your personal information for a purpose that you would not reasonably expect and consent is required, We will obtain your consent before doing so.

5.3 Direct Marketing

We may use your personal information to send you direct marketing communications about Our products, services, offers, and promotions if:

1. We have obtained your consent at the time of collection (via opt-in checkbox, SMS sign-up, or explicit agreement), OR

2. You would reasonably expect to receive such communications based on your relationship with Us

Types of Marketing Communications:

• Email newsletters featuring new products, tips, and special offers

• SMS promotions, cart reminders, and exclusive deals

• Postal mail (catalogues, promotional materials)

• Targeted online advertising

Your Right to Opt Out:

You can opt out of marketing communications at any time by:

• Clicking the "unsubscribe" link in any marketing email

• Replying "STOP" to any SMS message (standard SMS rates apply)

• Contacting Us using the details in Section 14

• Updating your account preferences (for registered users)

We will process your opt-out request promptly and free of charge. Please note:

• Opting out of marketing does not affect transactional communications (order confirmations, shipping notifications, customer service responses)

• Consent to receive marketing is not a condition of purchase

• Message frequency varies; standard data and messaging rates may apply

Marketing Best Practices:

All marketing communications will:

• Clearly identify Fresh Face Skin as the sender

• Provide a simple and clear opt-out mechanism

• Include Our contact information

• Comply with the Spam Act 2003 (Cth)

 

---

 

6. HOW WE DISCLOSE PERSONAL INFORMATION

6.1 Third-Party Service Providers

We may disclose your personal information to trusted third-party service providers who assist Us in operating Our business, including:

1. Payment Processors

• PayPal (United States)

• Stripe (United States)

• Other secure payment gateway providers

• Purpose: Processing transactions securely

• Data Shared: Name, billing address, payment information, transaction details

2. Delivery and Logistics Providers

• Australia Post, CouriersPlease, StarTrack, and other delivery services

• Purpose: Delivering products to your address

• Data Shared: Name, delivery address, contact number, order details

3. IT and Cloud Service Providers

• E-commerce platform provider (Shopify Inc., Canada)

• Cloud storage providers

• Email service providers

• Customer relationship management (CRM) platforms

• Purpose: Operating and maintaining Our systems

• Data Shared: As necessary for specific services (may include all personal information collected through Our Website, including customer orders, account details, and transaction information)

4. Marketing and Analytics Providers

• Email marketing platforms (e.g., Klaviyo)

• SMS marketing providers

• Google Analytics and similar analytics tools

• Social media platforms (for targeted advertising)

• Purpose: Delivering marketing communications and analyzing effectiveness

• Data Shared: Contact details, marketing preferences, anonymized usage data

5. Professional Advisors

• Lawyers, accountants, business advisors, auditors, insurers

• Purpose: Obtaining professional advice

• Data Shared: As necessary for specific advisory purposes

6.2 Legal and Regulatory Disclosure

We may disclose personal information where required or authorized by law, including to:

• Law enforcement agencies (police, regulatory authorities)

• Courts and tribunals

• Government agencies (taxation authorities, consumer protection agencies)

• The Office of the Australian Information Commissioner (OAIC)

Circumstances include:

• Compliance with subpoenas, court orders, or legal processes

• Investigation of suspected criminal activity

• Enforcement of Our legal rights

• Protection of public health and safety

6.3 Business Transactions

In the event of a merger, acquisition, sale of assets, or business restructuring, your personal information may be disclosed to potential buyers, investors, or successor entities. We will:

• Provide reasonable notice (where practicable)

• Ensure the recipient agrees to handle your information in accordance with this Privacy Policy

6.4 With Your Consent

We may disclose personal information to other third parties with your express consent for specific purposes not otherwise covered by this Privacy Policy.

6.5 Important Principles

• We do NOT sell or rent personal information to third parties for their own marketing purposes

• We do NOT disclose sensitive information without your explicit consent (except where required by law)

• Third-party service providers are contractually required to:

• Use personal information only for the specified purposes

• Protect personal information with appropriate security measures

• Comply with Australian privacy laws (or equivalent standards)

• Return or delete personal information when no longer required

 

---

 

7. OVERSEAS DISCLOSURE OF PERSONAL INFORMATION

7.1 Countries to Which We Disclose

We may disclose your personal information to overseas recipients located in the following countries:

1. Canada 

• E-commerce platform provider (Shopify Inc.)

• Shopify processes and stores customer and order data on Our behalf

• Shopify uses distributed cloud infrastructure across multiple countries

2. United States of America

• Payment processors (PayPal, Stripe)

• Cloud service providers

• Analytics and marketing platforms

3. Multiple Countries (Global Infrastructure)

• Our e-commerce platform (Shopify) uses distributed cloud servers that may be located in various countries including but not limited to Canada, United States, Europe, Asia, and Australia

• The specific server location for Our store data may vary and is managed by Shopify

• Shopify maintains security standards and compliance measures across all server locations

7.2 Ensuring Compliance with APPs

Before disclosing personal information to overseas recipients, We take reasonable steps to ensure that:

1. The recipient is subject to laws or binding schemes substantially similar to the APPs, OR

2. We have contractual arrangements requiring the recipient to:

• Handle personal information in accordance with the APPs or equivalent standards

• Implement appropriate security measures

• Use the information only for specified purposes

• Comply with data protection obligations

Third-Party Platform Providers:

Where We use third-party platform providers (such as Shopify), We:

• Select reputable providers with strong privacy and security practices

• Enter into contracts that require compliance with privacy obligations

• Rely on the provider's own privacy frameworks and certifications (e.g., ISO 27001, SOC 2)

• Review the provider's privacy policies and data handling practices

Note: While We take these reasonable steps, We have limited control over third-party infrastructure decisions, including specific server locations used by cloud-based platform providers.

7.3 Your Consent

By using Our services, you consent to the overseas disclosure of your personal information as described in this Section 7, subject to the protections outlined above.

For Sensitive Information: We will seek your explicit consent before disclosing sensitive information to overseas recipients, except where required or authorized by law.

7.4 Our Accountability

While We take reasonable steps to ensure overseas recipients comply with privacy obligations, Australian privacy law may not apply to those recipients' handling of your information. If you have concerns about overseas disclosures, please contact Us before providing personal information.

 

---

 

8. HOW WE PROTECT PERSONAL INFORMATION

Protecting your personal information is a fundamental priority. We implement comprehensive security measures in accordance with APP 11 of the Privacy Act.

8.1 Technical Measures

We use industry-standard technical security measures, including:

1. Encryption

• SSL/TLS encryption for all data transmitted between your browser and Our servers

• Encryption of sensitive data at rest (e.g., passwords are hashed using strong cryptographic algorithms)

• Secure payment processing through PCI-DSS compliant payment gateways

2. Access Controls

• Multi-factor authentication for administrative access

• Role-based access controls (employees access only the information necessary for their roles)

• Secure password policies and regular password updates

• Automatic session timeouts

3. Network Security

• Firewalls and intrusion detection/prevention systems

• Regular security monitoring and threat detection

• Secure server configurations

• Regular software updates and security patches

4. Secure Infrastructure

• Redundant backup systems with encryption

• Disaster recovery and business continuity planning

5. Data Minimization

• We collect only the personal information reasonably necessary

• Payment card details are NOT stored on Our systems (processed directly by secure third-party gateways)

• Regular review and deletion of unnecessary data

8.2 Organisational Measures

We implement robust organizational measures to protect personal information, including:

1. Privacy Governance Framework

• Designated Privacy Officer responsible for privacy compliance

• Privacy policies and procedures documented and regularly reviewed

• Privacy impact assessments for new systems and processes

• Privacy-by-design principles integrated into business operations

2. Staff Training and Awareness

• Regular privacy and security training for all employees

• Confidentiality obligations in employment contracts

• Clear policies on acceptable use of information systems

• Incident response training

3. Vendor Management

• Selection of reputable service providers with strong security practices

• Review of third-party privacy policies and security measures

• Contractual requirements for security and privacy protections (via Terms of Service or Data Processing Agreements)

• Use of security features and settings provided by service platforms

4. Access Management

• Need-to-know basis for access to personal information

• Periodic audits of access logs

• Immediate access revocation for departing employees

• Visitor management and physical security at Our premises

5. Data Breach Preparedness

• Data breach response plan (see Section 8.3)

• Regular testing and updating of breach response procedures

• Clear escalation and notification protocols

8.3 Notifiable Data Breaches Scheme

Under the Privacy Act's Notifiable Data Breaches (NDB) scheme, We are required to assess suspected data breaches and notify affected individuals and the OAIC when an eligible data breach occurs.

What is an Eligible Data Breach?

An eligible data breach occurs when:

1. Unauthorized access to or disclosure of personal information occurs (or information is lost in circumstances likely to result in unauthorized access or disclosure), AND

2. A reasonable person would conclude that the breach is likely to result in serious harm to affected individuals

Our Process:

If We suspect a data breach, We will:

1. Assess the breach within 30 days to determine if it is an eligible data breach

2. Contain and remediate the breach immediately

3. Notify the OAIC as soon as practicable after becoming aware of an eligible data breach

4. Notify affected individuals directly (via email, phone, or letter) if their contact information is available

5. Issue a public statement on Our Website if direct notification is not practicable

6. Provide recommendations to individuals on steps they can take to protect themselves (e.g., changing passwords, monitoring accounts)

Notification Contents:

Our breach notification will include:

• A description of the breach

• The kinds of information involved

• Recommendations for steps individuals can take

• Contact information for further enquiries

Your Role:

If you suspect your personal information has been compromised or if you notice suspicious activity, please contact Us immediately at the details in Section 14.

8.4 Limitations and Acknowledgments

While We implement comprehensive security measures, no internet transmission or electronic storage method is completely secure. We cannot guarantee absolute security of your personal information.

You are responsible for:

• Keeping your account credentials (username and password) confidential

• Using strong, unique passwords

• Not sharing your account access with others

• Logging out after using shared devices

• Notifying Us immediately of any unauthorized access or suspicious activity

We are not liable for unauthorized access or disclosure that occurs beyond Our reasonable control, except as required by law.

8.5 Data Retention and Destruction

We retain personal information only for as long as necessary to fulfill the purposes for which it was collected, or as required by law.

Retention Periods:

• Financial records: At least 7 years (as required by taxation laws)

• Account information: Duration of account plus 7 years

• Marketing data: Until you opt out or unsubscribe

• Customer service records: 3-7 years depending on nature

• Website usage data: 13-26 months (analytics)

When personal information is no longer required, We will:

• Securely delete or destroy the information, OR

• De-identify the information so that it can no longer identify you

Secure Destruction Methods:

• Electronic data: Secure deletion using industry-standard wiping tools

• Physical records: Shredding or secure destruction services

• Backup data: Overwritten according to retention schedules

 

---

 

9. COOKIES AND TRACKING TECHNOLOGIES

9.1 What Are Cookies?

Cookies are small text files stored on your device when you visit a website. They help the website recognize your device on subsequent visits and can store information about your preferences and activities.

9.2 Types of Cookies We Use

We use the following categories of cookies on Our Website:

1. Essential Cookies (Strictly Necessary)

• Required for the Website to function properly

• Enable core functionality such as security, session management, and accessibility

• Examples: Shopping cart maintenance, secure login sessions, load balancing

• Cannot be disabled without significantly affecting Website functionality

2. Functional Cookies

• Remember your choices and preferences

• Provide enhanced, personalized features

• Examples: Language preferences, recently viewed products, saved shipping addresses

• Can be disabled in cookie settings, but may affect Website functionality

3. Analytics and Performance Cookies

• Collect information about how visitors use the Website

• Help Us understand usage patterns and improve user experience

• Examples: Google Analytics, heatmaps, session recording

• Data is typically aggregated and anonymized

• Can be disabled in cookie settings

4. Marketing and Targeting Cookies

• Track your browsing activity across different websites

• Enable Us to display relevant advertisements

• Used for retargeting campaigns and measuring ad effectiveness

• Examples: Facebook Pixel, Google Ads cookies, third-party ad networks

• Can be disabled in cookie settings

9.3 Third-Party Cookies

Some cookies are placed by third-party services that appear on Our pages, including:

• Google Analytics

• Facebook/Meta Pixel

• Payment processors (during checkout)

• Social media plugins (if you interact with sharing buttons)

• Other third-party web analytics tracking software

These third parties may collect information about your online activities over time and across different websites. We do not control these third-party cookies; they are subject to the third parties' own privacy policies.

9.4 Cookie Lifespan

• Session cookies: Deleted when you close your browser

• Persistent cookies: Remain on your device for a set period (typically 13 months) or until you delete them

9.5 Managing Cookies

You have several options to control or disable cookies:

Browser Settings:

• Most browsers allow you to refuse or accept cookies

• You can delete cookies already stored on your device

• You can set your browser to notify you when a cookie is being placed

Instructions for common browsers:

• Chrome: Settings > Privacy and security > Cookies

• Firefox: Settings > Privacy & Security > Cookies

• Safari: Preferences > Privacy > Cookies

• Edge: Settings > Cookies and site permissions

Cookie Preference Tool:

• Access cookie settings via the banner that appears on your first visit or via the "Cookie Preferences" link in the footer

Important Notes:

• Disabling cookies may affect Website functionality

• Essential cookies cannot be fully disabled without preventing Website use

• Some opt-outs use cookies, so clearing all cookies will remove your opt-out preferences

9.6 Other Tracking Technologies

We may also use:

• Web beacons (pixels): Small graphic images embedded in emails or webpages to track interactions

• Local storage: HTML5 local storage for similar purposes to cookies

• SDKs (Software Development Kits): In mobile apps, if applicable

9.7 Do Not Track Signals

Currently, We do not respond to browser "Do Not Track" (DNT) signals, as there is no consistent industry standard for how to interpret these signals. We will update this policy if DNT standards are established.

9.8 IP Address Logging

We log IP addresses for:

• Security and fraud prevention

• Diagnostic and technical support purposes

• Aggregated geographic analytics

IP addresses are not linked to individual users except when necessary for security investigations or as required by law.

 

---

 

10. AUTOMATED DECISION-MAKING

10.1 Current Practice

As of the effective date of this Privacy Policy (January 6, 2026), We do not currently engage in automated decision-making that significantly affects you.

Automated decision-making refers to decisions made solely by automated systems (such as algorithms or artificial intelligence) without meaningful human involvement.

10.2 Future Use

If We introduce automated decision-making in the future, particularly processes that significantly affect you (such as eligibility for services, pricing, credit decisions, or personalized recommendations), We will:

1. Update this Privacy Policy to provide clear information about:

• The types of automated decisions being made

• The logic involved in the decision-making process

• The significance and consequences of such decisions for you

• Your rights in relation to automated decision-making

2. Provide meaningful information about automated decision-making, including:

• How the automated system works

• What personal information is used

• How you can challenge or request review of automated decisions

• Options for human intervention or review

3. Comply with APP 1.3 requirements for transparency about automated decision-making

10.3 Current Automated Processing

We currently use basic automated processing for:

• Email marketing personalization (e.g., product recommendations based on browsing history)

• Fraud detection (automated flags for suspicious transactions, with human review)

• Website functionality (e.g., search algorithms, product sorting)

These automated processes do not constitute "automated decision-making" as they either:

• Do not significantly affect you, OR

• Involve meaningful human review and intervention

 

---

 

11. YOUR RIGHTS: ACCESS AND CORRECTION

Under APPs 12 and 13, you have the right to access and correct the personal information We hold about you.

11.1 Right to Access (APP 12)

What You Can Request:

• Confirmation of whether We hold personal information about you

• Access to that personal information

• Information about how We collect, hold, use, and disclose your personal information

How to Request Access:

1. For Registered Users:

• Log in to your account at freshfaceskin.com.au

• Navigate to "Account Settings" or "My Profile"

• View and download your personal information

2. For All Users:

• Email Us at: privacy@freshfaceskin.com.au

• Call Us at: +61 497 730 890

• Write to Us at:
  Privacy Officer
  Fresh Face Skin Pty Ltd
  30 Collins Pl, Kilsyth VIC 3137, Australia

3. Verification:

• We may require identification to verify your identity before providing access

• Acceptable forms of ID: driver's license, passport, or other government-issued ID

Our Response:

We will respond to your access request within 30 days of receiving it. We will provide access:

• Free of charge (for reasonable requests)

• In the format you request (where reasonable and practicable)

• At a time and manner convenient to both parties

Circumstances Where We May Refuse Access:

We may deny or limit access if:

• Providing access would pose a serious threat to life, health, or safety

• Providing access would have an unreasonable impact on the privacy of others

• The request is frivolous or vexatious

• The information relates to existing or anticipated legal proceedings

• Providing access would be unlawful

• Denying access is required or authorized by law

• Providing access would compromise law enforcement, investigation, or security activities

• The request is unreasonable (e.g., excessive frequency or volume)

If We Refuse Access:

We will provide you with:

• A written notice explaining the reasons for refusal

• The mechanisms available to you to complain about the refusal (see Section 13)

• Alternative means of access (where practicable), such as:

• Providing a summary of the information

• Allowing inspection in Our presence

• Providing access through a mutually agreed intermediary

Charges:

Access is generally provided free of charge. However, We may charge a reasonable fee if:

• Your request requires extensive administrative effort

• The request is for a large volume of information

• You request information in a specific format that requires significant effort

We will inform you of any charges before processing your request, and you may choose to withdraw your request.

11.2 Right to Correction (APP 13)

You have the right to request correction of personal information if you believe it is:

• Inaccurate

• Out of date

• Incomplete

• Irrelevant

• Misleading

How to Request Correction:

Use the same contact methods as for access requests (Section 11.1).

Our Response:

1. If We Agree to Correct:

• We will correct the information promptly and free of charge

• We will notify any third parties to whom We have disclosed the information (where practicable)

• We will provide you with confirmation of the correction

2. If We Refuse to Correct:

• We will provide you with written reasons for refusal

• We will, at your request, associate a statement with your information noting that you believe it is inaccurate, out of date, incomplete, irrelevant, or misleading

• We will inform you of the mechanisms available to complain about the refusal

Proactive Correction:

If We become aware that personal information We hold is inaccurate, out of date, incomplete, irrelevant, or misleading, We will take reasonable steps to correct it, even without a request from you.

11.3 Data Portability

While the Privacy Act does not currently mandate data portability, We are committed to facilitating data mobility where practicable. If you wish to transfer your personal information to another service provider, please contact Us, and We will endeavor to provide your information in a commonly used, machine-readable format.

11.4 Right to Erasure ("Right to be Forgotten")

While Australian law does not currently provide a general "right to erasure," you may request that We delete your personal information in certain circumstances:

• The information is no longer necessary for the purposes for which it was collected

• You withdraw consent (where consent was the basis for collection)

• You have opted out of marketing

Please note that We may be required to retain certain information for legal or regulatory purposes (e.g., financial records for taxation compliance).

To request deletion of your personal information, contact Us using the details in Section 14.

 

---

 

12. SERIOUS INVASIONS OF PRIVACY: YOUR RIGHT TO SUE

12.1 New Statutory Tort

As of June 10, 2025, Australian privacy law includes a statutory tort (legal right to sue) for serious invasions of privacy. This means you have the right to take legal action against Us in court if We commit a serious invasion of your privacy.

12.2 What Constitutes a Serious Invasion of Privacy?

A serious invasion of privacy may occur if:

1. We invade your privacy by:
   
   

• Intruding upon your seclusion (e.g., surveillance, monitoring, physical intrusion into private spaces), OR

• Misusing your personal information (e.g., unauthorized collection, use, disclosure, or modification of personal information)

2. You had a reasonable expectation of privacy in the circumstances
   
   

3. The invasion was serious (a reasonable person would consider it highly offensive)
   
   

4. Our conduct was intentional or reckless
   
   

5. Your privacy interest outweighs any competing public interest (such as freedom of expression, public health and safety, national security)
   
   

12.3 What You Can Claim

If you successfully establish a serious invasion of privacy, you may be entitled to:

• Damages for emotional distress, financial loss, or other harm (without needing to prove economic loss)

• Injunctions to prevent further invasions

• Corrective orders requiring Us to take specific actions

• Apology orders

• Declaratory orders confirming the invasion occurred

12.4 Our Commitment

We take this new legal right seriously. Our comprehensive privacy practices are designed to prevent serious invasions of privacy through:

• Strict adherence to the APPs

• Robust security measures (see Section 8)

• Regular staff training and oversight

• Privacy impact assessments for new initiatives

• Prompt investigation and remediation of privacy concerns

If you have concerns about a potential serious invasion of privacy, please contact Us immediately (Section 14) so We can address the issue before legal action becomes necessary.

 

---

 

13. COMPLAINTS AND DISPUTE RESOLUTION

13.1 How to Make a Complaint

If you believe We have breached the APPs, mishandled your personal information, or have any other privacy concerns, please contact Our Privacy Officer:

Privacy Officer
Fresh Face Skin Pty Ltd

Email Us at: privacy@freshfaceskin.com.au

Call Us at: +61 497 730 890

Write to Us at:

Privacy Officer

Fresh Face Skin Pty Ltd

30 Collins Pl, Kilsyth VIC 3137, Australia

Your Complaint Should Include:

• Your contact details

• A detailed description of the privacy concern or breach

• Any relevant dates, events, and interactions

• Copies of any supporting documentation

• The outcome or resolution you are seeking

13.2 Our Complaints Process

We are committed to resolving complaints fairly, efficiently, and transparently.

Step 1: Acknowledgment (Within 7 days)

• We will acknowledge receipt of your complaint in writing

• We will confirm the details of your complaint and ask for any additional information if needed

Step 2: Investigation (Within 30 days)

• We will thoroughly investigate your complaint

• We may contact you for further information or clarification

• We will review relevant records, policies, and practices

Step 3: Response (Within 30 days)

• We will provide you with a written response outlining:

• Our findings and conclusions

• Whether We agree the APPs were breached

• Any remedial action We will take (e.g., correction of information, policy changes, staff training)

• The reasons for Our decision

• Your options if you are not satisfied (see Section 13.3)

Extensions: If We require more than 30 days (e.g., due to complexity), We will notify you and explain the reasons for the extension.

13.3 Escalation to the OAIC

If you are not satisfied with Our response or We do not respond within the required timeframe, you can escalate your complaint to the Office of the Australian Information Commissioner (OAIC):

Office of the Australian Information Commissioner (OAIC)
Website: https://www.oaic.gov.au/
Email: enquiries@oaic.gov.au
Phone: 1300 363 992 (9:00 AM - 5:00 PM AEST/AEDT, Monday to Friday)
Mail:
Office of the Australian Information Commissioner
GPO Box 5218
Sydney NSW 2001

The OAIC can investigate your complaint and may:

• Attempt to conciliate the matter

• Make a determination

• Refer the matter to the Federal Court or Federal Circuit and Family Court

Note: You must generally complain to Us first before the OAIC will investigate, unless there are exceptional circumstances.

13.4 Alternative Dispute Resolution

We are also open to alternative dispute resolution mechanisms, such as mediation, to resolve privacy disputes efficiently and amicably.

13.5 Legal Action

In addition to lodging a complaint with Us or the OAIC, you may have the right to:

• Seek a determination from the OAIC

• Take legal action in the Federal Court or Federal Circuit and Family Court for breaches of the Privacy Act

• From June 10, 2025, sue for serious invasions of privacy under the statutory tort (see Section 12)

 

---

 

14. CONTACT US

If you have any questions about this Privacy Policy, how We handle your personal information, or wish to exercise your privacy rights, please contact Us:

Fresh Face Skin Pty Ltd
ABN 20 621 349 246

Privacy Officer
Email Us at: privacy@freshfaceskin.com.au

Mail:
Privacy Officer
Fresh Face Skin Pty Ltd
30 Collins Pl, Kilsyth VIC 3137, Australia

General Enquiries:
Email: privacy@freshfaceskin.com.au
Website: https://freshfaceskin.com.au/

For Urgent Privacy or Security Concerns:
If you believe there has been a data breach or unauthorized access to your personal information, please contact Us immediately at privacy@freshfaceskin.com.au or call +61 497 730 890.

 

---

 

15. LINKS TO THIRD-PARTY WEBSITES

Our Website may contain links to third-party websites, services, or applications that are not owned or controlled by Us, including:

• Social media platforms (Facebook, Instagram, TikTok)

• Payment processors

• Product review platforms

• Partner websites

Important:

• We are NOT responsible for the privacy practices of third-party websites

• This Privacy Policy does NOT apply to third-party sites

• Third-party sites have their own privacy policies and terms of use

• We encourage you to review the privacy policies of any third-party sites before providing personal information

Inclusion of a link does not imply endorsement of the linked site or its privacy practices.

 

---

 

16. SMS TERMS OF SERVICE

16.1 Consent to Receive SMS

By providing your mobile phone number and opting in to receive SMS communications (e.g., via form submission, appointment booking, checkout opt-in, or texting a keyword to Our number), you expressly consent to receive marketing text messages from Fresh Face Skin at the mobile number provided.

Types of SMS Messages:

• Promotional offers and exclusive deals

• New product announcements

• Cart abandonment reminders

• Order updates and shipping notifications (transactional, cannot be opted out)

16.2 Message Frequency and Charges

• Message frequency varies depending on your activity and Our marketing campaigns

• You may receive up to 5 promotional messages per week

• Message and data rates may apply based on your mobile carrier's plan

• Fresh Face Skin is not responsible for carrier charges

16.3 Consent Not Required for Purchase

Consent to receive marketing SMS is NOT a condition of purchase or use of Our services. You can make purchases without subscribing to SMS communications.

16.4 Opt-Out

You can opt out of receiving marketing SMS at any time by:

• Replying "STOP" to any SMS message from Us

• Texting "STOP" to [XXXXX] (Our SMS short code or number)

• Contacting Us at privacy@freshfaceskin.com.au or +61 497 730 890

• Updating your account preferences (for registered users)

After opting out, you will receive one final confirmation message. You may continue to receive transactional SMS (order confirmations, shipping updates) unless you opt out of these separately.

To opt back in, reply "START" or re-subscribe through Our Website.

16.5 Help and Support

For SMS support:

• Email: privacy@freshfaceskin.com.au

• Phone: +61 497 730 890

16.6 Supported Carriers

Our SMS service is available for all major Australian mobile carriers, including but not limited to Telstra, Optus, and Vodafone. If you experience issues, please contact your carrier or Us for assistance.

 

---

 

17. CHILDREN'S PRIVACY

17.1 Age Restrictions

Our products and services are intended for individuals aged 18 years and older. We do not knowingly collect, use, or disclose personal information from children under 18 years of age without appropriate parental or guardian consent.

17.2 Parental Consent

If you are under 18 years of age:

• Please obtain your parent's or legal guardian's permission before providing any personal information to Us

• Do not create an account, make purchases, or subscribe to marketing communications without parental consent

• Your parent or guardian should review this Privacy Policy with you

17.3 Parental Rights

If you are a parent or guardian and believe your child has provided personal information to Us without your consent:

• Please contact Us immediately at privacy@freshfaceskin.com.au

• We will promptly verify your relationship to the child

• We will delete the child's personal information as soon as practicable (unless We are required by law to retain it)

17.4 Children's Online Privacy Code (Future)

The Australian Government is developing a Children's Online Privacy Code, which will impose additional requirements for online services likely to be accessed by children. The Code is expected to include:

• Age-appropriate design standards

• Enhanced parental consent mechanisms

• Restrictions on collection and use of children's personal information

• Transparency requirements

Effective Date: Specific date to be announced

If Our services become subject to the Children's Online Privacy Code, We will:

1. Update this Privacy Policy to reflect the Code's requirements

2. Implement necessary technical and operational changes

3. Provide clear information about how We handle children's personal information

4. Notify parents and guardians of material changes

We will continue monitoring the development of the Children's Online Privacy Code and will update Our practices accordingly.

 

---

 

18. CHANGES TO THIS PRIVACY POLICY

18.1 How We Update

We reserve the right to update this Privacy Policy at any time to reflect:

• Changes in Our information handling practices

• Changes in privacy laws or regulations

• New product or service offerings

• Technological advancements

• Feedback from customers or regulators

18.2 Notice of Material Changes

When We make material changes to this Privacy Policy, We will:

1. Update the "Effective Date" and "Last Reviewed" dates at the top of this webpage

2. Post the updated Privacy Policy on Our Website at https://freshfaceskin.com.au/policies/privacy-policy

Material changes include:

• Significant changes to how We collect, use, or disclose personal information

• Changes to your privacy rights

• Introduction of new technologies that affect privacy (e.g., automated decision-making)

• Changes to overseas disclosures or security practices

18.3 Non-Material Changes

For minor or administrative updates (e.g., updated contact details, clarifications), We may update this Privacy Policy without prior notice. We encourage you to review this Privacy Policy periodically.

18.4 Your Continued Use

By continuing to use Our services after the updated Privacy Policy becomes effective, you agree to be bound by the updated terms. If you do not agree to the changes, please:

• Stop using Our services

• Contact Us to close your account (for registered users)

• Request deletion of your personal information (subject to legal retention requirements)

 

---

 

19. INTERPRETATION AND DEFINITIONS

19.1 Interpretation

In this Privacy Policy:

• "We", "Us", "Our" refers to Fresh Face Skin Pty Ltd (ABN 20 621 349 246)

• "You", "Your" refers to the individual accessing or using Our services

• "Website" refers to freshfaceskin.com.au and any associated mobile applications or digital platforms

• Words importing the singular include the plural and vice versa

• Headings are for convenience only and do not affect interpretation

19.2 Governing Law

This Privacy Policy is governed by the laws of Victoria, Australia. The Privacy Act 1988 (Cth) is a Commonwealth law that applies nationally throughout Australia.

19.3 Severability

If any provision of this Privacy Policy is found to be invalid or unenforceable, the remaining provisions will remain in full force and effect.

 

---

 

20. FURTHER INFORMATION

20.1 Privacy Resources

For more information about privacy in Australia, visit:

Office of the Australian Information Commissioner (OAIC)
Website: https://www.oaic.gov.au/
Phone: 1300 363 992

Resources:

• Australian Privacy Principles Guidelines: https://www.oaic.gov.au/privacy/australian-privacy-principles-guidelines/

• Privacy fact sheets and guides: https://www.oaic.gov.au/privacy/privacy-guidance-for-organisations-and-government-agencies/

• Guide to data breach preparation and response: https://www.oaic.gov.au/privacy/guidance-and-advice/data-breach-preparation-and-response/

20.2 Your Privacy Matters

We are committed to protecting your privacy and handling your personal information responsibly. If you have any questions, concerns, or feedback about this Privacy Policy or Our privacy practices, please do not hesitate to contact Us.

Thank you for trusting Fresh Face Skin with your personal information.

Policy Updated: 10/02/2026