Privacy Policy: How We Protect Your Information

This is the privacy policy ( Privacy Policy or Policy) of GAIA Skin Naturals, registered trademark of NP Brands, including its successors, assignees and related bodies corporate (defined in the Corporations Act 2001 (Cth)) ( NP Brands or we or us).

This Policy outlines how your information is collected, used and disclosed when you access or use:

1. Our Website and Services as defined in our website terms and conditions (Terms)
2. https://www.gaiaskinnaturals.com;
3. https://www.npbrands.com.au/brands (Brands);
4. any social media platforms owned or operated by us or our Brands; and
5. our services, including without limitation, access to our sites or our Brand sites, participation in our competitions and trade promotions, buying our goods and services, sending us an email, registering an account with us, and using our contact form (Services).

This information is collected, used and disclosed in accordance with the Privacy Act 1988 (Cth) (Privacy Act). By using our Services, you agree to our Terms and this Privacy Policy.

This Privacy Policy is incorporated by reference into our Terms. Any capitalised terms not defined in this Policy are defined in the Terms. You agree to comply with all Terms when accessing or using our Website and Services, including this Privacy Policy.

Our payment processing is handled by Stripe and Shopify. The Stripe Privacy Policy and the Shopify Privacy Policy applies in relation to any Personal Information collected, stored and processed on Stripe and Shopify servers. We may also use this Personal Information for the purposes as set out in this Policy and in accordance with the terms set out in this Policy.

We collect Personal Information, as defined in the Privacy Act (including Sensitive Information as defined in the Privacy Act), when you access or use our Website and Services.

2.1. Personal Information provided by you

We collect information that you provide to us via use of our Website and Services as well as through any other means used to contact us.

The kinds of Personal Information we collect include your contact information such as your name, email address, organisation, address and phone or mobile number, and other information your provide to us such as in relation to your order history, purchasing habits, products purchased, and location of purchase. We do not sell your Personal Information to third parties.

We reserve the right to maintain, store and use any information or data where we reasonably believe that such action is required to comply with any legal or regulatory obligations, to prevent criminal or other unlawful activity whether immediate or in the future, or where we have a legitimate business reason to do so, including collection of amounts owed, resolving disputes, enforcing our Terms or for record keeping integrity.

2.2. Automatically collected Personal Information

Website and Website, date and time stamp and cookies that may uniquely identify your browser or account.

When accessing our Website and Services using a mobile device, we may also receive and collect identification numbers associated with your device, mobile carrier, device type and manufacturer, and, if enabled, geographical location data (including GPS). Please note that some of the information we collect, for example an IP address, can sometimes be used to approximate a device's location.

2.3. Personal Information collected via cookies

Website may use small pieces of data called cookies to identify a user who engages with our Website and to compile records of a user’s history of engaging with our Website. Cookies are stored by a users’ browser while the user browses a website. Cookies do not usually contain information that personally identifies a person, but each time the user visits the website, the browser sends the cookie data back to the server to notify the system of the user's previous activity. If you wish to disable cookies, you may do so through your browser settings, however please be aware that if you choose to do this, some functionality of our Website will not be available to you.

The Stripe and Shopify platforms are governed by its own Stripe Cookie Policy and the Shopify Cookie Policy. We bear no responsibility for how Stripe uses your data for cookies. If you are concerned with any use and storage of your data for cookies by Stripe, please contact Stripe Support and Shopify Support directly.

2.4. Personal Information collected via Google Analytics

We use Google Analytics, which allows us to anonymously track the use of our Website and Services by recording the number of users who have visited, the number of pages viewed, navigation patterns, what systems users have and the date and time of visits through cookies. This information is collected for statistical purposes only and cannot be used to identify you.

We may use a range of services and functions offered by Google Analytics. We also use Google Analytics to partner with third parties and advertise online including via social media. Our third-party partner may use technologies such as cookies and third party Tracking Technologies to gather information about your activities on our Website and other sites in order to provide you advertising based on your browsing activities and interests which may then provide you with advertisements based on your interests.

Please see this link for how your data is collected and this link for instructions on how to opt-out of any Google Analytics data tracking.

2.5. Personal Information collected via Meta Pixels

We may use Meta Pixel (formerly Facebook Pixel). Meta Pixel collects data through cookies about actions you make on our Website, such as viewing a page or clicking on a specific link. This helps us track conversions from Facebook advertisements, optimise advertisements for users, and build targeted audiences for advertisements. See clause 2.3 above for more information about our use of cookies. We may use a range of services and functions offered by Meta Business Tools. Please note we are not liable for the way Meta uses your information and it is your responsibility to familiarise yourself with the Meta terms. You can access Meta Business Tools Terms here.

2.6. Third Party Payment Processors

Website, whose use of your personal information is governed by their own terms and conditions and privacy policy. We do not store or retain any sensitive financial/billing information (being credit card numbers, bank account details, etc.) (Financial Information) obtained by us in connection with processing such payments or cashbacks is destroyed when no longer necessary for us to provide our Services to you. For the avoidance of doubt, any Financial Information obtained for the purposes of our cashback promotions is removed off our servers once the promotion has ceased.

2.7. Anonymity and the use of pseudonyms

When we collect your Personal Information, as far as reasonably practicable, you are permitted to interact and/or contact us anonymously or by using a pseudonym except where:

1. we are required or authorised by a law or a court or tribunal order to deal with identified individuals; or
2. it is impracticable for us to deal with individuals who have not identified themselves.

3.1. Use of Personal Information

We collect your Personal Information as outlined in this Privacy Policy for the purposes described below:

1. for provision of the Services;
2. for the purpose of conducting consumer promotions and marketing campaigns on behalf of brands that we own or distribute which shall include fulfilling your Orders;
3. for communication with you and to provide messaging and/or communications to you in association with the functions and features of the Website;
4. for communicating to you any announcements and updates, updated terms, conditions and policies, security alerts, technical notices, support and administrative messages;
5. for analysis, monitoring, development and improvement of our Website and Services, including other products or services;
6. for security purposes, including to protect the Website and our property from abuse, fraud, malicious, unauthorised access or potentially illegal activities, and to protect our rights, safety and property and that of our other users;
7. for sending marketing communications to you, including notifying you of promotional or advertising offers, contests and rewards, upcoming events and other news about products and services offered by us and use of our Website and Services;
8. to comply with relevant laws and regulations where applicable; and
9. for the performance of other functions described at the time of collection or as consented to in relation to our Website and Services.

4.1. Storage of Personal Information

We take reasonable steps to protect your Personal Information in accordance with this Privacy Policy. The Personal Information we collect from you is transferred and stored electronically in our company ERP software on servers located in Australia, protected by user authentication, firewall and antivirus software (including Sophos), and other administrative, technical and physical safeguards designed to protect against unauthorised access, modification, disclosure and misuse. We may also store or process Personal Information using third party digital platforms and services which are hosted on servers located outside Australia, as described in paragraph 5.5. We periodically review our security measures and may update or enhance them from time to time having regard to what is reasonable in the circumstances. You agree and consent to us storing your Personal Information on this software and on such third party platforms.

4.2. Who can access your Personal Information?

Website host and technical support providers. We may also store your Personal Information in password-protected email databases for the purpose of sending out communications and marketing emails in accordance with this Privacy Policy.

Please note that no method of electronic transmission or storage is 100% secure and we cannot guarantee the absolute security of your Personal Information. We implement safeguards that are intended to protect your Personal Information, but transmission of Personal Information over the Internet is at your own risk and you should only enter, or instruct the entering of, Personal Information to the Website within a secure environment. It is your responsibility to ensure that you keep your Personal Information safe, including keeping your software, passwords and security settings up to date to help prevent security breaches.

We reserve the right to maintain and store any Personal Information or other information or data where, we reasonably believe, in our sole discretion, that such action is required to comply with any legal or regulatory obligations, to prevent criminal or other unlawful activity whether immediate or in the future, or where we have a legitimate business reason to do so, including collection of amounts owed, resolving disputes, enforcing our Terms or for record keeping integrity. We will not keep such information for longer than is reasonably necessary for these purposes and will periodically review our retention of Personal Information to determine whether it continues to be required.

When it is no longer needed for the purposes outlined in this Policy subject to our legal obligations to retain certain records for longer periods under applicable laws. However, we may also be required to keep some of your personal information for specified periods of time, for example under certain laws relating to corporations, money laundering, and financial reporting legislation.

Your Personal Information may be disclosed to individuals and companies, for the purposes described in this Policy, as outlined below:

5.1. NP Brands and Related Bodies Corporate

Your Personal Information may be accessed by us, including our directors, employees, officers and contractors. You consent to us providing your Personal Information, including Sensitive Information to our Related Bodies Corporate (as defined in the Corporations Act 2001 (Cth)).

5.2. Parties required by law

Your Personal Information may be disclosed by us to any party to whom we are required by law to provide your Personal Information and to any party to whom disclosure is permitted under the Australian Privacy Principles, or where we reasonably believe that disclosure is required to comply with any court orders, subpoenas, or other legal process or investigation including by tax authorities, if such disclosure is required by law. Where possible and appropriate, we will notify you if we are required by law to disclose your Personal Information.

5.3. Direct marketing

You agree and expressly and indefinitely consent to us using or disclosing Personal Information (other than Sensitive Information) to keep you informed about our products and services and other products and services that we consider may be of interest to you. For this purpose, disclosure may be made to our third-party service providers. We may communicate with you via phone, email, social media, SMS, or regular mail. If you have indicated a preference for a method of communication, we will endeavour to use that method wherever practical to do so.

You can opt-out of direct marketing communication activities undertaken by us at any time by clicking the “unsubscribe” or “opt-out” link on email communications from us, replying ‘Stop’ to a promotional SMS or by contacting us by phone or email.

5.4. Other third parties

We may share your Personal Information with third parties if it is reasonably related to the provision of our Services. The third parties that we may share your Personal Information with includes consultants, contractors, credit agencies, debt collection agencies and other service providers to us that perform services on our behalf. Such services we procure may include identifying and disseminating advertisements, enforcement of our Terms, providing fraud detection and prevention services, processing payments or providing analytics services. We may also share your Personal Information with our business partners who offer goods or services to you jointly with us (for example, contests or promotions).

We may share your Personal Information where we have reason to believe that doing so is necessary to identify, contact or bring legal action against anyone damaging, injuring, or interfering (intentionally or unintentionally) with our rights or property, users, or anyone else who could be harmed by such activities.

We may also share your Personal Information with third parties with your consent in a separate agreement, in connection with any company transaction (such as a merger, sale of assets or shares, reorganisation, financing, change of control or acquisition of all or a portion of our business by another company or third party) or in the event of bankruptcy, dissolution, divestiture or any related or similar proceedings.

Note that we reserve the right to share your Personal Information with other third parties where, in our sole discretion, it is required to:

1. investigate and defend ourselves against any third party claims or allegations;
2. protect against harm to the rights, property or safety of us, our users or the public as required or permitted by law; and
3. detect, prevent or otherwise address criminal (including fraud or stalking), security or technical issues.

5.5. Overseas disclosures

We may share your Personal Information with third parties if it is reasonably related to the provision of our Services. The third parties that we may share your Personal Information with includes delivery partners, consultants, contractors, credit agencies, debt collection agencies and other service providers to us that perform services on our behalf. Such services we procure may include fulfilling our Orders, identifying and disseminating advertisements, enforcement of our Terms, providing fraud detection and prevention services, processing payments or providing analytics services. We may also share your Personal Information with our business partners who offer goods or services to you jointly with us (for example, contests or promotions).

We may share your Personal Information where we have reason to believe that doing so is necessary to identify, contact or bring legal action against anyone damaging, injuring, or interfering (intentionally or unintentionally) with our rights or property, users, or anyone else who could be harmed by such activities.

We may also share your Personal Information with third parties with your consent in a separate agreement, in connection with any company transaction (such as a merger, sale of assets or shares, reorganisation, financing, change of control or acquisition of all or a portion of our business by another company or third party) or in the event of bankruptcy, dissolution, divestiture or any related or similar proceedings.

Note that we reserve the right to share your Personal Information with other third parties where, in our sole discretion, it is required to:

1. investigate and defend ourselves against any third party claims or allegations;
2. protect against harm to the rights, property or safety of us, our users or the public as required or permitted by law; and
3. detect, prevent or otherwise address criminal (including fraud or stalking), security or technical issues.

Website may, from time to time, contain links to and from websites which are owned or operated by other parties. You acknowledge and agree that we have no control over, and shall not be liable for, the privacy practices or content of these third party websites and we do not make any representation about the privacy practices of, any third-party websites, whether or not linked from or transferred from our Website. You are responsible for checking the privacy policy of any such third party websites and applications so that you can be informed of how they will handle Personal Information.

We run pages and advertising on a number of social media platforms, including Facebook, Instagram, X (formerly Twitter), LinkedIn, Youtube, and TikTok (Social Media Platforms). By accessing, interacting with and using our social media pages, you agree to the terms and privacy policy of those Social Media Platforms. You acknowledge and agree that these Social Media Platforms may collect your information and that the privacy practices of those Social Media Platforms are not controlled by us and that we hold no responsibility for such privacy practices.

Social Media Platforms also allow public access to your public social media profile, which may include your username, age range, country/language, list of friends or other information that you make publicly available, and you understand that such information may therefore be accessible by us if you interact with its social media pages.

We may from time to time, have access to statistics regarding the number of views, navigation patterns, posts that you like, comment on or share and any user interactions with our social media pages and may use such information for the purpose of its marketing and promotion strategies.

At any time, you may request access to Personal Information we hold about you. We may refuse to provide access if the law allows us to do so, in which case we will provide reasons for our decision as required by law.

We take reasonable steps to keep your Personal Information accurate, complete and up-to-date. If, at any time, you discover that information held about you is incorrect, you may contact us to have the information deleted or corrected.

You may request access to the information we hold about you, or request that we delete, update or correct any Personal Information we hold about you, by setting out your request in writing and sending it to us in accordance with paragraph 10.

We will process your request as soon as reasonably practicable, provided we are not otherwise prevented from doing so on legal grounds. If we are unable to meet your request, we will let you know why.

You may submit a written complaint about how we handle your Personal Information to our Privacy Officer via the details below. We will investigate your complaint and respond to you within a reasonable period of time. Nothing in this Privacy Policy limits any rights you may have under the Privacy Act 1988 (Cth) or other applicable privacy or data protection laws. If you are not satisfied with our handling of your complaint or we have not replied to you within a reasonable period of time, then you are entitled to make a complaint to the Office of the Australian Information Commissioner or, if you are in the EU, a data protection authority or supervisory authority, or to seek any other remedies available to you at law.

We reserve the right to amend this Privacy Policy from time to time with reasonable notice to you. While we endeavour to notify you as soon as reasonably possible of any changes to our Policies by email or by a notice on our Website, it is your responsibility to keep up to date with any changes or amendments by checking this page prior to using our Website and Services. This page contains our most accurate and up to date version of our Privacy Policy.

All requests for access or corrections to your Personal Information and complaints should be directed to our Privacy Officer. If submitting a complaint, please provide our Privacy Officer with full details of your complaint and any supporting documentation:

1. https://www.npbrands.com.au/contact;
2. info@npbrands.com.au; or
3. 120-124 Woodlands Drive, Braeside, VIC 3195.

If you are not satisfied with our handling of your complaint or we have not replied to you within a reasonable period of time, then you are entitled to make a complaint to the Office of the Australian Information Commissioner or to seek any other remedies available to you at law.

If a dispute arises out of or relates to this Privacy Policy, a party must not commence any court or other proceedings relating to the dispute unless it has first complied with the following procedure:

1. the party claiming that a dispute has arisen must give written notice to the other party specifying the nature of the dispute;
2. on receipt of that notice by that other party, the parties must endeavour in good faith to resolve the dispute using informal dispute resolution techniques such as mediation, expert evaluation, arbitration or similar methods agreed by them;
3. if the parties do not agree within 10 days of receipt of the notice (or such further period as the parties agree in writing) as to:
   1. the dispute resolution method and procedures to be adopted;Security and retention of children’s Personal Information: We apply the same security and data minimisation practices described in this Privacy Policy to Personal Information about children, and we take reasonable steps to limit access to such information to those who need it to operate the relevant promotion or provide the relevant Services. We will not keep Personal Information about children for longer than is reasonably necessary for the purposes for which it was collected, unless we are required to retain it by law.
   2. the timetable for all steps in those procedures; and
   3. the selection and compensation of the independent person required for such method,
   4. the parties must mediate the dispute in accordance with the Mediation Rules of the Law Institute of Victoria.

Nothing in this Privacy Policy will prejudice the right of a party to seek injunctive or declaratory relief in respect of a dispute or any matter arising under this Privacy Policy.

If any provision of this Agreement is prohibited by law or judged by a court to be unlawful, void or unenforceable, the provision shall, to the extent required, be severed from this Agreement and rendered ineffective as far as possible without modifying the remaining provisions of this Agreement, and shall not in any way affect any other circumstances of or the validity or enforcement of this Agreement.

As described in paragraphs 2.4 and 2.5, we use tools such as Google Analytics, Meta Pixel and similar technologies to understand how users interact with our Website and Services and to deliver more relevant content and advertising. These tools may analyse information such as your device identifiers, IP address, browsing behaviour, pages visited, interactions with our content and approximate location to create or infer audience segments (profiling). We may use these audience segments to tailor which promotions, offers or advertisements you see on our Services or on third party platforms. These activities typically involve automated processing, but they do not involve making decisions that have legal or similarly significant effects on you. You can manage your preferences through your browser or device settings, by adjusting your cookie settings on our Website (where available), or by using the privacy controls offered by the relevant third party platform.

The parties irrevocably submit to the exclusive jurisdiction of the courts of the state of Victoria, Australia.

This Agreement will be governed by and construed and interpreted in accordance with the laws of Victoria, Australia.

You may contact us at any time using the details in paragraph 10 if you would like more information about our use of automated decision making, profiling or AI in connection with your Personal Information. In particular: