Privacy Policy - kv-vapes

1. Who we are

This Privacy Policy describes how kv-vapes (“we”, “us”, “our”) collects, uses, stores, discloses and protects your personal information. We are the operator of the website located at https://idibaps.com/ (the “Website”).

We are bound by the Privacy Act 1988 (Cth) (the “Privacy Act”) and the Australian Privacy Principles (APPs) set out in that Act.

If you have any questions about this Policy or our handling of your personal information, please contact us using the details in Section 13.

2. What “personal information” means

“Personal information” means information or an opinion about an identified individual, or an individual who is reasonably identifiable, whether the information is true or not and whether it is recorded in a material form or not. This includes things like your name, contact details, payment information, and information about how you use our Website.

3. What personal information we collect

We collect personal information in three main ways: (a) information you give us directly, (b) information we collect automatically when you use the Website, and (c) information from third parties.

3.1 Information you give us

Account information: name, email address, password (stored as a one-way hash), phone number.
Order information: shipping address, billing address, delivery instructions, order notes, invoice details.
Payment information: processed by our payment provider (e.g. PayPal, Stripe, Afterpay, bank transfer). We do not store full credit card numbers, CVV/CVC, or expiry dates on our servers.
Customer support: any information you provide when contacting us via email, phone, contact form, or social media (including Instagram, Facebook Messenger, WhatsApp).
Marketing opt-ins: confirmation that you have subscribed to our newsletter, SMS or push notifications.

3.2 Information collected automatically

Device & technical information: IP address, browser type and version, operating system, screen resolution, device identifiers.
Usage information: pages viewed, time on page, referring website, click patterns, search terms, cart activity.
Location information: approximate geographic location derived from your IP address.
Cookies and similar technologies: see Section 8.

3.3 Information from third parties

Payment processors: transaction IDs, fraud-screening results.
Shipping carriers: delivery status, signature on delivery (where applicable).
Analytics providers: aggregated, de-identified usage statistics.
Advertising partners: conversion and attribution data from Facebook, Google, TikTok and similar platforms.

4. How we collect personal information

We collect personal information directly from you wherever possible, including when you:

browse our Website;
create an account;
place an order or make a purchase;
subscribe to our newsletter or marketing communications;
contact us with a question, complaint or feedback;
enter a competition, complete a survey, or take part in a promotion; and
interact with us on social media.

We also collect some information automatically through cookies and similar technologies (see Section 8).

We only collect personal information by lawful and fair means.

5. Why we collect, hold, use and disclose personal information

We collect, hold, use and disclose your personal information for the following purposes:

To provide our products and services — including processing and fulfilling orders, arranging delivery, managing returns and refunds, and providing customer support.
To manage your account — including verifying your identity, maintaining your account, and communicating with you about your account.
To process payments and detect or prevent fraud.
To improve our Website and services — including analysing usage, debugging, and conducting research and development.
To send you marketing communications — but only if you have consented (or where we are otherwise permitted by law, e.g. the Spam Act 2003 (Cth) exemption for existing customers).
To comply with our legal obligations — including under the Privacy Act 1988 (Cth), Australian Consumer Law (Schedule 2 of the Competition and Consumer Act 2010 (Cth)), Anti-Money Laundering and Counter-Terrorism Financing Act 2006 (Cth), tax laws, and any product-specific regulations applicable to the goods we sell.
To enforce our terms and protect our rights, property or safety, or those of our customers or third parties.

If we collect your personal information for a purpose that is not listed above, we will either update this Policy or notify you at the point of collection (whichever is required by APP 5).

6. To whom we disclose your personal information

We may disclose your personal information to:

Payment service providers (e.g. PayPal, Stripe, Afterpay, your bank) to process payments and detect fraud.
Shipping and logistics providers (e.g. Australia Post, StarTrack, Aramex/Fastway, Toll) to deliver your order.
IT and cloud service providers who host our Website, email, and back-office systems. Our Website is currently hosted by [hosting provider], with servers located in [server location, e.g. Australia / United States / Singapore].
Marketing and analytics providers such as Google Analytics, Meta (Facebook/Instagram), TikTok, and Klaviyo/Mailchimp, who help us understand how customers use our Website and show you relevant advertising.
Professional advisors such as our accountants, lawyers and insurers.
Government authorities, regulators, courts and law enforcement where we are legally required to do so.
A buyer or potential buyer of all or part of our business or assets, in connection with a corporate transaction.

We require our third-party service providers to handle your personal information in accordance with the Privacy Act and only for the purposes we specify.

Overseas disclosure

Some of the third parties listed above (for example, our hosting, email, analytics and advertising partners) may be located in or store data in countries outside Australia, including the United States, Singapore, the European Union, and the United Kingdom.

When we disclose personal information overseas, we take reasonable steps to ensure that the recipient handles it in a way that is consistent with the APPs (APP 8.1). By using our Website and providing your personal information to us, you acknowledge that your information may be transferred overseas. If you would like more information about the countries our service providers operate in, please contact us.

7. Storage and security (APP 11)

We take reasonable steps to protect your personal information from misuse, interference, unauthorised access, modification, disclosure or destruction. These steps include:

Encryption in transit — your browser is secured by TLS/SSL (HTTPS) when communicating with our Website.
Encryption at rest — sensitive data (such as passwords) is stored as a one-way cryptographic hash.
Access controls — staff access to personal information is limited to those who need it to perform their role, and protected by unique credentials and two-factor authentication where possible.
Vendor due diligence — we select reputable third-party providers and require them to maintain appropriate security measures.
Regular backups and monitoring.

Despite our efforts, no system can be 100% secure. If we become aware of a data breach that is likely to result in serious harm, we will notify you and the Office of the Australian Information Commissioner (OAIC) as required by the Notifiable Data Breaches Scheme (Part IIIC of the Privacy Act).

We will keep your personal information only for as long as needed for the purposes described in this Policy or as required by law (for example, Australian tax law generally requires us to keep transaction records for 5 years). When we no longer need your information, we will securely destroy or de-identify it.

8. Cookies and similar technologies

A cookie is a small text file placed on your device by a website. We use cookies and similar technologies (such as pixels and local storage) to:

remember your preferences (e.g. language, currency);
keep you signed in to your account;
keep items in your shopping cart between visits;
understand how you use the Website (analytics);
show you advertising that may be relevant to your interests.

We use the following categories of cookies:

Category	Purpose	Can be disabled?
Strictly necessary	Sign-in, cart, fraud prevention, payment processing.	No — required for the site to function.
Functional	Remember preferences such as language and currency.	Yes.
Analytics	Aggregated, de-identified usage statistics (e.g. Google Analytics, Microsoft Clarity).	Yes.
Advertising	Conversion tracking and remarketing (e.g. Meta Pixel, TikTok Pixel, Google Ads).	Yes.

You can manage cookies through your browser settings and, where available, through our cookie banner / consent tool. Blocking strictly necessary cookies may prevent parts of the Website from working.

9. Accessing and correcting your personal information (APPs 12 & 13)

You have the right to:

Access the personal information we hold about you; and
Request correction of personal information that is inaccurate, out-of-date, incomplete, irrelevant or misleading.

To make a request, please contact us using the details in Section 13. We will respond to your request within 30 days, or such longer period as is reasonable in the circumstances (APP 12.4). We may need to verify your identity before providing access, and we may charge a reasonable fee for providing copies (APP 12.7).

If we refuse your request to access or correct personal information, we will provide you with a written notice that sets out the reasons for the refusal and the mechanisms available to you to complain (APP 12.9 / APP 13.4).

10. Complaints

If you believe that we have breached the APPs or handled your personal information in an inappropriate way, please contact us first using the details in Section 13. We will:

acknowledge your complaint within a reasonable time;
investigate your complaint and respond with the outcome and any proposed action; and
try to resolve the matter with you directly.

If you are not satisfied with our response, you may lodge a complaint with the Office of the Australian Information Commissioner (OAIC) at:

Website: https://www.oaic.gov.au
Phone: 1300 363 992
Email: enquiries@oaic.gov.au

11. Age restriction

Our products (including e-cigarettes, vapes, pods, e-liquids and related accessories) are only intended for adults aged 18 years or over, in accordance with the Public Health (Tobacco and Other Products) Act 2023 (Cth) and any applicable state or territory laws.

We do not knowingly collect personal information from anyone under 18. We use age-verification checks at checkout to prevent buying alcohol from our Website by minors.

If you are under 18, please do not:

create an account with us;
place an order with us; or
provide any personal information to us.

If you believe a person under 18 has provided personal information to us, please contact us and we will delete that information.

12. Changes to this Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, or applicable law. The current version will always be posted on our Website with an updated “Last updated” date at the top. If we make a material change, we may also notify you by email or via a notice on the Website. We encourage you to review this Policy periodically.

13. Contact us

If you have any questions about this Privacy Policy, want to access or correct your personal information, or wish to make a complaint, please contact us:

Business name: kv-vapes
ABN: [ABN]
Email: [privacy@kv-vapes.com.au]
Postal address: [PO Box / Street address]
Phone: [Phone number]

We will respond to your enquiry as soon as reasonably practicable, and in any case within 30 days.