We take the protection of your data seriously. This Privacy Statement explains how your information is handled and the measures we take to keep your privacy secure. Bali Body sells Australian-made sun-care and skincare products online through our website. The business is registered as Bali Body Pty Ltd, trading as Bali Body, located at 428 New Street, Victoria, 3186, Australia. This Statement covers personal information from individuals in the European Union (under GDPR) as well as customers worldwide that is collected, processed, disclosed and stored (together, "used") by Bali Body. For any questions or requests about this Statement or our handling of your personal information, reach us at balibodytanningoil@gmail.com.

Your information is gathered in several ways when you browse our site and buy our products. In some cases you give it to us directly, and in others it is captured automatically through cookies. If you reach out to us via our website, social media or email and/or place an order, we collect the details below so we can fulfil our agreement with you and respond properly to your enquiry:

Your name, your postal address, your email address, order details, and financial or payment information.

The following is gathered automatically through cookies while you navigate our website:

Internet Protocol (IP) address, country geolocation derived from your IP, and browsing data from Google Analytics.

The information collected from you is put to several uses. For instance, we rely on it to process your orders, to review and improve the way our business and websites operate, and, where you have agreed, to send you marketing updates. We will never sell your data to any third party, and we only make use of it when we have a lawful basis for doing so.

To meet our obligations to you:

We gather your personal details, contact information and address so that we can process and complete your order.

Where you have given consent:

We send emails to the address you supply so you can keep up with our store and products. You may withdraw this consent whenever you like.

Where we are legally required to:

We must retain certain financial records for reporting and accounting reasons.

Where we have a legitimate interest in using your information (and it is not outweighed by your own rights as an individual):

We rely on information collected automatically through technical means such as cookies to study how visitors use our website, so we can understand how people interact with Bali Body and improve how the site works. We also keep records of transactions and correspondence so we can bring or defend claims should a legal claim or complaint arise.

We share the information we hold about you with our service providers only as far as necessary for the purposes described above. We may disclose your personal information where the law requires it or if you breach our Terms of Service.

Sharing your information with Shopify:

Shopify supplies the online e-commerce platform that lets us sell our products and services to you, and consequently hosts the data we collect about you.

Your data is held within Shopify's data storage, databases and general application, on a secure server behind a firewall. It is stored on Shopify's servers in the USA.

If you choose a direct payment gateway to complete a purchase, Shopify stores your credit card details, encrypted under the Payment Card Industry Data Security Standard (PCI-DSS).

Your purchase transaction data is kept only for as long as needed to finish your purchase. Once that is done, the transaction information is removed. All direct payment gateways follow the standards set by PCI-DSS, managed by the PCI Security Standards Council, a joint effort of brands such as Visa, MasterCard, American Express and Discover. These requirements help ensure that credit card information is handled securely by our store and its service providers.

Sharing your information with other third parties:

When we use third party service providers, we may disclose your personal information to them, but only to the extent needed for them to carry out the services on our behalf.

Bali Body may share your information with the following types of service providers:

Third parties that supply payment gateways

Third parties that process payments or transactions for us

MaxMind delivers IP intelligence through its GeoIP brand. Thousands of companies rely on GeoIP data to locate their online visitors and serve relevant content and ads, run analytics, enforce digital rights, and route internet traffic efficiently.

Google AdWords is an online advertising service built by Google in which advertisers pay to display short adverts, product listings and video content across the Google ad network. The system works partly through cookies and partly through keywords chosen by advertisers, which Google uses to place ads on pages it considers relevant. Advertisers pay when a user clicks through, and partner sites earn a share of the resulting income.

Google Analytics is a freemium web analytics service from Google that measures and reports website traffic. It has become the most widely used analytics service on the internet.

Facebook is an American social media and networking company based in Menlo Park, California.

Yotpo: we use Yotpo's platform to gather customer reviews and visual marketing content to display on the site and highlight product benefits. Yotpo is based in the United States.

Other situations in which we may share your information:

From time to time we may need to disclose your information to law enforcement agencies or regulators.

We may also need to disclose your information if you breach our Terms of Service.

If our store is acquired by or merged with another company, your information may be passed to the new owners so we can continue selling products to you.

Bali Body takes steps to make sure the third parties we engage to provide services on our behalf use your data in line with this Statement.

Such third parties may sit outside the European Economic Area ("EEA"), and where that is the case the following Section 5 applies.

Once you leave our store's website or are directed to a third-party site or application, this Statement and our Terms of Service no longer apply. Links on our store may take you away from our site. We are not responsible for the privacy practices of other sites and encourage you to read their privacy statements.

By signing up for Bali Body SMS notifications, you agree to receive automated marketing text messages from us about our products, promotions and services at the phone number you provided at sign-up, and you accept that these messages may be sent using an automatic telephone dialling system or similar technology. Messages are recurring. Consent is not a condition of purchase. Message and data rates may apply. You can unsubscribe at any time by replying STOP, using the unsubscribe link where available, or contacting our customer service team. You understand and agree that trying to opt out by any other means is not a reasonable way of opting out.

Bali Body may transfer your information outside the EEA to places where data protection standards are less strict. Whenever we do, we take steps to keep your information protected in accordance with this Statement.

The internet is a global environment, and in practice it is quite common for information to move across borders, for example when the servers hosting your data are located abroad. If we transfer personal information outside the EEA (for instance to our parent company in Australia) we follow certain safeguards approved under data protection laws. To learn more or request a copy of the safeguards in place to protect your privacy, please contact us using the details below.

To keep your personal information safe, we put appropriate technical and organisational measures in place and follow industry best practices so that it is not improperly lost, misused, accessed, disclosed, altered or destroyed. When you provide credit card details, the information is encrypted with secure socket layer technology (SSL) and stored with AES-256 encryption. No method of transmission over the internet or electronic storage is completely secure, but we meet all PCI-DSS requirements and apply additional generally accepted industry standards.

We do use cookies and similar technologies on our site.

Our site is not aimed at anyone under the age of 16, and customers need a credit or debit card to make a purchase.

We do not carry out any automated decision making.

Bali Body keeps your information only for as long as is reasonably needed for the purposes described in this Statement and to meet our legal obligations. If you are a customer, this is usually at least for the time you remain a customer, so we can fulfil our legal and contractual duties to you and, where needed, resolve any disputes.

We retain your information only as long as necessary to use it as described above or to comply with our legal obligations. Please note that we may keep some of your information after you stop using our services, for example where it is needed to meet legal obligations such as retaining data for tax and accounting purposes.

When setting the relevant retention periods, we consider factors including:

Our contractual obligations and rights relating to the information concerned;

any legal obligation under applicable law to keep data for a set period of time;

the statute of limitations under applicable law;

(potential) disputes; and

guidance issued by relevant data protection authorities.

Otherwise, we securely delete your information once it is no longer needed.

Subject to certain conditions, the law allows you to exercise certain rights over your information. Further details about these rights can be obtained from your national data protection authority. In almost all cases these rights are free to exercise, though if requests are repeated or clearly unfounded we may charge a reasonable administrative fee.

The right to be informed. You are entitled to clear, transparent and easy-to-understand information about how we use your data and your rights, which is why we provide the details in this Statement.

The right of access. You may obtain access to your information (if we are processing it) along with certain other details similar to those in this Statement.

The right to rectification. You are entitled to have your information corrected if it is inaccurate or incomplete. You can ask us to fix any errors in the information we hold by getting in touch.

The right to erasure. Also known as "the right to be forgotten", this lets you request the deletion or removal of the information we hold about you.

The right to object to processing. You may object to certain kinds of processing by contacting us using the details below.

The right to restrict processing. You may "block" or suppress further use of your information. When processing is restricted, we can still store your data but will not use it further.

The right to data portability. You may obtain and reuse your information for your own purposes across different services. Where this right applies, we will give you an accessible copy of your information so you can use a similar service elsewhere.

The right to lodge a complaint. You may complain about the way we handle or process your information to your national data protection regulator.

The right to withdraw consent. Where we rely on your consent as our lawful basis for processing, you may withdraw it at any time. Doing so does not make unlawful anything we did with your personal data while your consent was active. You can withdraw consent to the processing of your information at any time by contacting us using the details below.

If you would like to exercise your rights, make a complaint, or simply want more information about this Privacy Statement or how we use your data, please get in touch with us using the details below.

You can email us at balibodytanningoil@gmail.com.

Or reach us by post at: Bali Body, P.O Box 626, Elwood, VIC 3184, Australia.

We reserve the right to update this privacy policy and will post any changes on our site. If we make material changes, we will let you know here that it has been updated, so you stay aware of what information we collect, how we use it, and the circumstances, if any, under which we use and/or disclose it.