Privacy Policy

Last updated: 1 October 2026

HYGGO PTY LTD (ABN 26 680 569 653), trading as Lushyard ("Lushyard", "we", "us"), respects your privacy. This Privacy Policy explains how we collect, use, disclose and protect personal information when you use lushyard.com.au. We are bound by the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs).

What personal information we collect

Depending on how you use Lushyard, we may collect:

• Identity and contact details – your name, email address, phone number, and delivery and billing addresses.
• Account details – your login details, preferences and communication settings.
• Order information – what you buy, from which sellers, order values, delivery and tracking details, returns, refunds and claims.
• Payment information – limited payment details such as card type, last four digits, expiry date and transaction status. Card payments are processed by Stripe and PayPal payments by PayPal; we do not store your full card number.
• Communications – messages you send to us or to sellers through Lushyard, and reviews, questions and photos you post.
• Technical and usage information – IP address, device and browser type, pages viewed, search terms, and information collected through cookies and similar technologies.
• Seller information – if you apply to sell, business details, contact people, and information needed to verify your business and pay you.

We collect most information directly from you. We may also receive information from our payment providers (for example, fraud-check results), delivery carriers (tracking events), sellers (about your order) and analytics providers.

You can browse Lushyard without giving us your name, but we need certain information to process orders and provide our services.

Why we collect and use it

• to process your orders and payments and arrange delivery through the seller
• to manage your account and provide customer support
• to handle returns, refunds, Buyer Protection claims and disputes
• to detect and prevent fraud, abuse and security incidents
• to operate, maintain and improve our website and services
• to send you service messages, such as order confirmations and delivery updates
• to send you marketing, if you agreed to receive it (you can unsubscribe at any time using the link in each message)
• to comply with our legal obligations, including tax, consumer and product safety laws

Who we disclose it to

Sellers

When you buy from a seller, we share the information the seller needs to fulfil your order and provide after-sales support – usually your name, delivery address, phone number (for delivery), order details and messages about the order. We do not share your full card details with sellers. Sellers must only use this information to fulfil your order, handle returns and comply with the law, and must protect it in line with our seller terms.

Service providers

We use service providers to help run Lushyard, such as payment processors (Stripe and PayPal), hosting and IT providers, email providers, delivery carriers, analytics providers and customer support tools. They may only use your information to provide services to us.

Others

We may also disclose personal information to our professional advisers, to government agencies and regulators where required or authorised by law (for example, the ACCC for product safety matters or the ATO for tax), to law enforcement where we reasonably believe it's necessary, or to a buyer of our business if Lushyard is sold or restructured.

We do not sell your personal information.

Overseas disclosure

Your orders are sent directly by our suppliers, most of whom are located outside Australia, mainly in China. When you place an order we disclose the information needed to fulfil your order (such as your name, delivery address, phone number and order details) to that supplier in its country.

Our service providers, including payment processors and IT providers, may also store or process information outside Australia, for example in the United States, the European Union or other countries where they operate.

We take reasonable steps to ensure overseas recipients handle personal information in a way that is consistent with the APPs, including through contractual obligations. However, overseas recipients may not be subject to privacy laws that give the same protection as Australian law, and you may not be able to seek redress in that country. By placing an order with an overseas seller, you acknowledge that your information will be disclosed to that seller for this purpose.

Cookies and analytics

We use cookies and similar technologies to keep you signed in, remember your cart, keep Lushyard secure, understand how our website is used and, where relevant, measure marketing. See our Cookie Policy for details and how to manage cookies.

Automated decisions

We and our payment providers use automated fraud checks when you place an order. These checks may hold or cancel an order without a person reviewing it first. If a decision like this affects you, you can ask us to review it by emailing [email protected] with the subject "Privacy request".

How we protect your information

We take reasonable steps to protect personal information from misuse, interference, loss and unauthorised access, modification or disclosure. These include encrypted connections (HTTPS), access controls, and using PCI DSS-compliant payment providers so we don't handle full card numbers. We keep personal information only as long as we need it for the purposes above or as required by law, then delete or de-identify it.

If we experience a data breach that is likely to result in serious harm, we will notify affected individuals and the Office of the Australian Information Commissioner (OAIC) as required by the Notifiable Data Breaches scheme.

Accessing and correcting your information

You can ask for access to the personal information we hold about you, or ask us to correct it, by emailing [email protected] with the subject "Privacy request". You can also update many details in your account settings. We'll need to verify your identity before responding. We will respond within a reasonable time, usually within 30 days. If we refuse a request, we'll tell you why in writing and how to complain.

Direct marketing

We only send marketing emails or messages in line with the Spam Act 2003 (Cth). You can opt out at any time by using the unsubscribe link or emailing [email protected] with the subject "Privacy request". You'll still receive service messages about your orders.

Complaints

If you have a concern about how we've handled your personal information, please email [email protected] with the subject "Privacy complaint" and details. We'll acknowledge your complaint, investigate it and respond within 30 days.

If you're not satisfied with our response, you can complain to the Office of the Australian Information Commissioner (OAIC) at oaic.gov.au.

Changes to this policy

We may update this Privacy Policy from time to time. The current version will always be on this page with its "Last updated" date.

Contact us

• Email: [email protected] (subject "Privacy request" or "Privacy complaint")
• Phone: 0493 624 208 (Monday to Friday, 9am–5pm Melbourne time, excluding public holidays)
• Privacy Officer: HYGGO PTY LTD (ABN 26 680 569 653), Melbourne, Victoria, Australia