Privacy Policy

Last updated: June 2026

Pepreta (“we”, “us”) is based in Sydney, NSW, Australia. This policy explains how we handle personal information in accordance with the Australian Privacy Act 1988 and its Australian Privacy Principles (APPs), and the EU General Data Protection Regulation (GDPR) for customers in the European Union.

Information we collect

• Name, email address, shipping address, and phone number (if provided)
• Order history
• IP address and browser type

How we collect it

We collect this information when you use the checkout form (processed by Snipcart), submit the contact form (processed by Web3Forms), or sign up to our newsletter.

Why we collect it

• To process and fulfil your orders
• To send order confirmations and dispatch notifications
• To respond to your enquiries
• To send our newsletter (only with your consent)
• To improve and secure our website

Who we share it with

We share personal information only with the service providers needed to operate our store. We never sell your data. Each provider has its own privacy policy:

• Stripe — payment processing (privacy policy)
• PayPal — payment processing (privacy policy)
• Snipcart — cart and checkout platform (privacy policy)
• Netlify — website hosting (privacy policy)
• Web3Forms — contact form delivery (privacy policy)
• Google Analytics 4 — website analytics (privacy policy)
• We use ipapi.co to detect your approximate country based on your IP address in order to display relevant shipping information. Your IP address is sent to ipapi.co for this purpose. See ipapi.co/privacy for their privacy policy.

Data retention

• Order data is retained for 7 years to meet Australian tax law requirements.
• Newsletter subscriptions are retained until you unsubscribe.
• Contact enquiries are retained for 2 years.

Security

All data is transmitted using SSL/TLS encryption. Payment card details are never stored by Pepreta — they are handled entirely by Stripe and PayPal.

Access and correction

You can request access to, or correction of, your personal data by emailing [email protected].

Complaints

If you are unsatisfied with how we handle your data, you can contact the Office of the Australian Information Commissioner (OAIC) at oaic.gov.au.

Your rights under the GDPR (EU customers)

Legal basis for processing: we process your data to perform our contract with you (order fulfilment), for our legitimate interests (fraud prevention and site improvement), and with your consent (the newsletter).

Your rights: you have the right to access, rectification, erasure (the “right to be forgotten”), data portability, objection to processing, and to withdraw consent at any time.

International transfers: your personal data may be transferred to Australia and the United States, where Stripe, PayPal and Netlify servers are located. These transfers are made under standard contractual clauses or equivalent safeguards.

Data Protection Officer: a DPO is not required for a business of our size. For any data enquiry, contact [email protected].

You also have the right to lodge a complaint with the data protection supervisory authority in your EU member state.

Cookies

• Strictly necessary: the Snipcart session cookie (required for cart functionality) and Stripe cookies (required for payment security).
• Analytics: The site uses Google Analytics 4 (measurement ID G-TN7EGBLYNX) to collect anonymised data about site usage including page views, session duration, and traffic sources. These analytics cookies are set only after you accept them via our cookie banner. You can also opt out via your browser settings or Google's opt-out tool.
• We use no advertising or tracking cookies.

Strictly necessary cookies are required for the site to function. Analytics cookies (Google Analytics) are loaded only if you choose “Accept” on the cookie banner shown on your first visit; choosing “Decline” means Google Analytics is never loaded. Your choice is remembered for 12 months.

Contact

For any privacy question, email [email protected].