Last updated: 9 October 2026
This policy explains how PEPPERMAYO PTY LTD (ABN 71 159 978 800), trading online as CURVELLAA, handles personal information. We follow the Australian Privacy Principles in the Privacy Act 1988 (Cth). If you are in the European Union, the EEA or the United Kingdom, the GDPR or UK GDPR also applies; see the section for you below.
What we collect
- When you order: name, email, delivery and billing address, phone number (optional), the pieces you order, and payment status. Your card details go straight to our payment provider; we never receive your full card number.
- When you create an account: your email, password (stored encrypted) and order history.
- When you write to us or use the withdrawal form: what you send us.
- When you browse: the technical data a web server needs (IP address, browser type, pages requested) and the cookies described in our Cookie Policy. We do not use advertising or analytics cookies.
We collect information directly from you. You can browse without giving us any personal information; we need your name, email and address to fulfil an order.
Why we use it
- to process, deliver and support your order, including returns, refunds and warranty claims;
- to answer your messages;
- to keep our records as the law requires (for example tax records);
- to protect the shop and our customers against fraud.
We do not sell personal information, and we do not send marketing emails.
Who we share it with
- Payment providers (Stripe or PayPal, whichever you choose) to take your payment and prevent fraud.
- Carriers to deliver your parcel.
- Our web host and email provider (Hostinger) who store the website and our mailbox for us.
- Authorities when the law requires it.
Overseas disclosure
Some of these providers store or process information outside Australia, including in the United States, the European Union and the United Kingdom, and carriers in the country you ship to. We take reasonable steps to make sure they handle it in line with the Australian Privacy Principles.
How we keep it safe and for how long
The site uses HTTPS, admin access is limited and protected by strong passwords, and we keep only what we need. We keep order records for seven years for tax purposes, messages for two years after the conversation ends, and delete account data when you ask us to unless we must keep it by law.
Access and correction
You can ask for a copy of the personal information we hold about you, or ask us to correct it, by emailing support@curvellaa.shop. We answer within 30 days and do not charge for it.
Complaints
If you think we have mishandled your information, write to us first and we will respond within 30 days. If you are not satisfied, you can complain to the Office of the Australian Information Commissioner (OAIC) at oaic.gov.au.
For customers in the EU, EEA and UK
Controller: PEPPERMAYO PTY LTD, NSW 2010, Australia, support@curvellaa.shop.
Legal bases: performing our contract with you (orders, delivery, returns); legal obligations (tax records, consumer law); our legitimate interest in preventing fraud and answering messages.
Transfers: your data is processed in Australia, which does not have an EU adequacy decision, and by providers in the United States. We transfer it because it is necessary to perform the contract you asked for, and our providers use the European Commission’s standard contractual clauses or equivalent safeguards where they apply.
Your rights: access, rectification, erasure, restriction, data portability and objection, and the right to complain to the data protection authority in your country (in the UK, the Information Commissioner’s Office). Write to support@curvellaa.shop to use them.
Changes
We will post any change to this policy on this page with a new date.