This Privacy Policy explains how MESAK GROUP PTY LTD (ABN 47 700 022 135) (“MESAK”, “we”, “us”, “our”) collects, uses, discloses, stores and protects your personal information when you visit mesak.com.au, purchase from us, or otherwise interact with us.
We handle personal information in accordance with the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs). Where we collect information from people outside Australia, we also take into account the privacy laws that apply in those places.
By using our website or purchasing from us, you agree to this Privacy Policy. If you do not agree, please do not use the site.
1. Personal information we collect
1.1 Information you give us
- Identity and contact details — your name, email address, phone number, shipping address and billing address.
- Order information — the items you buy, sizes, order value, order history, discount or promotional codes used, and delivery preferences.
- Payment information — your payment method and the details needed to process it. Card numbers are entered into, and handled by, our payment providers. MESAK does not receive or store your full card number, expiry date or security code. We receive only a confirmation of payment, the payment method type and the last four digits of the card.
- Account information — if you create an account, your login details and saved addresses.
- Enquiries — the name, email address, phone number (optional), subject and message you submit through our Contact form, and any correspondence that follows.
- Marketing preferences — your email address and consent status when you subscribe to our newsletter, and your subsequent subscribe or unsubscribe actions.
- Other information you choose to give us — such as sizing or fit feedback, product reviews, competition entries, or content you send us on social media.
1.2 Information collected automatically
When you visit the site, certain information is collected automatically by cookies, pixels, tags and similar technologies:
- Device and connection data — IP address, device type, operating system, browser type and version, screen size, language and time zone.
- Usage data — pages and products viewed, time spent on pages, links clicked, search terms entered on our site, items added to or removed from your cart, referring website, and how you move through the site.
- Session and cart data — the identifiers that keep you logged in and keep your cart intact between pages.
- Email engagement data — whether you opened a marketing email and which links you clicked.
1.3 Information we receive from others
- Payment and buy-now-pay-later providers — payment confirmations, fraud and risk signals, and chargeback or dispute information.
- Delivery carriers — tracking events and delivery outcomes.
- Advertising and analytics platforms — aggregated campaign performance and, where you have consented, audience and conversion data.
- Social media platforms — your public profile information if you interact with us there.
1.4 Sensitive information
We do not seek to collect sensitive information (such as health, racial or ethnic origin, religious beliefs, or biometric information) as defined in the Privacy Act 1988. Please do not send us sensitive information unless we specifically ask for it.
2. Why we collect and use your information
- To process, fulfil, package and deliver your orders, and to send order confirmations, dispatch notices and tracking updates.
- To process payments, verify transactions, and detect and prevent fraud, chargebacks and misuse of the site.
- To manage returns, exchanges, refunds, warranty claims and consumer guarantee obligations.
- To respond to your enquiries submitted through our Contact page and to provide customer support.
- To create and manage your account, if you choose to create one.
- To send you marketing communications about new releases, restocks, events and community news, where you have consented — and to stop sending them when you opt out.
- To understand how the site is used, measure the performance of our pages and campaigns, and improve our products, sizing, content and checkout experience.
- To deliver, measure and improve advertising, including showing you MESAK ads on third-party platforms and excluding you from ads that are not relevant.
- To maintain the security, integrity and proper operation of the site.
- To comply with our legal obligations, including taxation, consumer protection and record-keeping laws, and to establish, exercise or defend legal claims.
3. Cookies and tracking technologies
Cookies are small text files placed on your device. We and our service providers use cookies and similar technologies (pixels, tags, local storage and software development kits) for the purposes below.
3.1 Strictly necessary
These are required for the site to work and cannot be switched off. They are set by Shopify, the ecommerce platform our store runs on. They keep your session active, remember the contents of your cart, secure the checkout, balance traffic across servers, and record your cookie preferences. Without them you cannot place an order.
3.2 Analytics and performance
- Shopify Analytics — reports on store traffic, orders and conversion, provided as part of the Shopify platform.
- Google Analytics (GA4) — helps us understand how visitors find and use the site, which pages and products perform, and where people drop off. Google may set cookies and process identifiers such as your IP address and a randomly assigned user identifier. You can opt out across all sites using the Google Analytics Opt-out Browser Add-on.
- Google Search Console — shows us how our pages perform in Google Search. It does not place cookies on your device and does not collect personal information about individual visitors; it reports aggregated search data to us.
3.3 Advertising and re-marketing
- Meta Pixel (Facebook and Instagram, operated by Meta Platforms) — records actions you take on our site, such as viewing a product, adding to cart or completing a purchase, so we can measure our advertising, build audiences and show you relevant MESAK ads on Meta platforms.
- TikTok Pixel (operated by TikTok) — performs the same function for advertising on TikTok.
These platforms may match the data they receive against their own records of your account. Their handling of that data is governed by their own privacy policies. You can manage your advertising preferences in your Meta account settings and your TikTok account settings.
3.4 Marketing and functional
Our email marketing platform uses tracking pixels within emails to record opens and clicks, so we can measure what our subscribers find useful. Functional cookies remember preferences such as your chosen currency or whether you have dismissed a banner.
3.5 Managing your preferences
Where a cookie consent banner is presented to you, you can accept or decline non-essential cookies and change your choice at any time through the banner or preferences link on the site. You can also block or delete cookies in your browser settings, though some parts of the site may then not work correctly. Many browsers also offer a “Do Not Track” signal; there is currently no consistent industry standard for responding to these signals, and our site does not respond to them differently from the settings described above.
4. Payments
Payments on our store are processed by third-party providers. Each is a separate organisation that handles your information under its own privacy policy:
- Shopify Payments — our primary payment processor, provided by Shopify. It handles card details, performs fraud analysis and processes refunds.
- Shop Pay — Shopify’s accelerated checkout. If you choose to save your details with Shop Pay, Shopify stores your contact, shipping and payment information so it can be used across other Shop Pay stores. That storage is between you and Shopify.
- Afterpay — a buy-now-pay-later service. If you pay with Afterpay, you enter into a separate agreement with Afterpay and provide your information directly to them. Afterpay may verify your identity, assess your suitability for its service and share information with credit reporting or fraud prevention bodies. Their handling of your information is governed by the Afterpay Privacy Policy, not this one.
- Apple Pay — processes your payment through a device-specific token. Apple does not share your actual card number with us.
- Google Pay — operates in the same way, using a tokenised card number.
MESAK never receives your full card number, expiry date or security code.
5. Who we share your information with
We do not sell your personal information. We disclose it only as set out below.
- Shopify — our ecommerce platform, which hosts the store and stores our customer, order and product data.
- Payment and buy-now-pay-later providers — as listed in section 4.
- Delivery carriers and fulfilment partners — your name, delivery address, phone number and email, so your order can be delivered and tracked.
- Analytics and advertising platforms — Google, Meta and TikTok, as described in section 3, subject to your cookie preferences.
- Our email marketing platform — your email address, name and engagement history, so we can send communications you have subscribed to.
- Customer service, review and support tools — where used, so we can answer your enquiries and manage feedback.
- Professional advisers — accountants, auditors, insurers and lawyers, where reasonably required.
- Law enforcement, regulators and courts — where we are required or authorised by law to disclose information, or where disclosure is necessary to protect our rights, your safety or the safety of others.
- A purchaser of our business — if MESAK is sold, merged or restructured, customer information may be transferred as part of that transaction, subject to the buyer continuing to handle it in line with this policy.
Where we engage service providers, we require them to use your information only for the purposes we have engaged them for.
6. Overseas disclosure
Several of the providers we rely on are located outside Australia, or store data on servers outside Australia. This means your personal information may be disclosed to, or accessed from, overseas. The countries in which our recipients are likely to be located include:
- Shopify — Canada, the United States and the European Union.
- Google (Analytics, Search Console, Google Pay) — the United States and other countries in which Google operates data centres.
- Meta Platforms — the United States and Ireland.
- TikTok — Singapore, the United States and Ireland.
- Our email marketing provider — the United States and/or the European Union.
- Apple — the United States.
Before disclosing personal information overseas we take steps that are reasonable in the circumstances to ensure the recipient handles it consistently with the Australian Privacy Principles. However, you should be aware that overseas recipients may be subject to different privacy laws to those in Australia, and that Australian law may not apply to them.
7. Direct marketing
If you subscribe to our newsletter, create an account, or opt in at checkout, we may send you emails about new releases, restocks, events, community initiatives and offers. We send these in accordance with the Spam Act 2003 (Cth).
Every marketing email includes an unsubscribe link, and unsubscribing takes effect promptly. You can also ask us to stop at any time through our Contact page. Opting out of marketing will not stop transactional messages such as order confirmations, dispatch notifications and responses to your enquiries — those are necessary to complete your order.
You may also ask us to tell you the source of the information we used to contact you, and we will respond within a reasonable period.
8. How we store and protect your information
Your information is held on Shopify’s infrastructure and within the systems of the service providers described above. We take reasonable steps to protect it from misuse, interference, loss, and unauthorised access, modification or disclosure, including:
- encryption of data in transit using TLS across the entire site and checkout;
- PCI DSS compliant payment handling by our payment providers;
- restricting access to customer data to those in our business who need it;
- two-factor authentication and strong password requirements on our administrative accounts;
- reviewing the access held by our service providers.
No method of transmission over the internet or method of electronic storage is completely secure, and we cannot guarantee absolute security. If we become aware of a data breach that is likely to result in serious harm, we will respond in accordance with the Notifiable Data Breaches scheme under the Privacy Act 1988, including notifying affected individuals and the Office of the Australian Information Commissioner where required.
9. How long we keep your information
We keep personal information only as long as we need it for the purposes described in this policy, or as long as the law requires.
- Order and transaction records — at least seven years, to meet Australian taxation and business record-keeping requirements.
- Account information — while your account is open, and for a reasonable period afterwards.
- Marketing subscriptions — until you unsubscribe, after which we retain a minimal record of your unsubscribe so we do not contact you again.
- Contact form enquiries — for as long as needed to resolve the matter and for a reasonable period afterwards.
- Analytics and advertising data — for the retention periods set by each platform, which are generally between two and 26 months.
When information is no longer needed and we are not required to keep it, we take reasonable steps to destroy it or de-identify it.
10. Accessing and correcting your information
You have the right to ask us for access to the personal information we hold about you, and to ask us to correct it if it is inaccurate, out of date, incomplete, irrelevant or misleading.
To make a request, get in touch through our Contact page. We may need to verify your identity before we act on a request, and we will respond within a reasonable period — usually within 30 days. Access is free, although we may charge a reasonable fee for the cost of supplying information where a request is substantial.
If we refuse access or correction, we will tell you why in writing and explain how you can complain about that decision.
You can also update your own details at any time by signing in to your account, if you have one.
11. Complaints
If you believe we have breached the Australian Privacy Principles or mishandled your personal information, please tell us first through our Contact page, marking your enquiry as a privacy complaint. We will acknowledge your complaint, investigate it, and respond in writing — normally within 30 days.
If you are not satisfied with our response, you can refer the matter to the Office of the Australian Information Commissioner:
- Website: oaic.gov.au
- Phone: 1300 363 992
- Post: GPO Box 5218, Sydney NSW 2001
12. Third-party websites
Our site contains links to other websites, including our social media profiles and the sites of our payment providers. We are not responsible for the privacy practices or content of those sites. We encourage you to read their privacy policies before providing information to them.
13. Children
Our website and products are intended for people aged 16 and over. We do not knowingly collect personal information from children under 16. If you believe a child has provided us with personal information, please contact us through our Contact page and we will take reasonable steps to delete it.
14. Visitors outside Australia
MESAK is based in Australia and our services are directed primarily at Australian customers. If you access the site from outside Australia, your information will be transferred to and processed in Australia and in the other countries listed in section 6.
If you are located in the European Economic Area or the United Kingdom, you may have additional rights, including the right to object to processing, to request erasure or restriction, and to data portability. To exercise those rights, contact us through our Contact page.
15. Changes to this policy
We may update this Privacy Policy from time to time to reflect changes in our practices, the services we use, or the law. The current version will always be published on this page with its “last updated” date. Where changes are significant, we will take reasonable steps to notify you.
16. Contact us
For any question about this policy, or to make a privacy request or complaint, please get in touch through our Contact page.
MESAK GROUP PTY LTD
ABN 47 700 022 135