Privacy Policy

Anna September 26, 2026

VapeOz (“we”, “us”, “our”) operates an online retail store selling vaping products and related accessories to customers in Australia. We are committed to protecting your privacy and handling your personal information in accordance with the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs).

This Privacy Policy explains what personal information we collect, how we use it, how we share it, and the rights you have under Australian law.

1. Who We Are

Here at VapeOz, we wanted to create an online vape shop based near Sydney that is filled with everything enthusiasts across Australia could ever need in one location.

2. What Personal Information We Collect

We may collect the following categories of personal information depending on how you interact with us:

a) Identity & contact information

  • Full name
  • Email address
  • Phone number
  • Postal address and shipping address
  • Username and password

b) Order & payment information

  • Order history and product preferences
  • Billing address
  • Payment card details (processed by our third-party payment processor — we do not store full card numbers on our servers)
  • GST status

c) Device & technical information

  • IP address
  • Browser type and version
  • Device identifiers
  • Operating system
  • Pages visited, time spent on pages, referring URL
  • Cookies and similar tracking technologies (see Section 9)

e) Communications

  • Records of your enquiries, support tickets, and any correspondence with us
  • Marketing preferences
  • Browser, notifications, and cookie consent choices

We do not knowingly collect personal information from anyone under 18 years of age. Our website is not intended for minors.

3. How We Collect Personal Information

We collect personal information directly from you when you:

  • Visit our website or place an order
  • Create an account or subscribe to our newsletter
  • Contact us via email, phone, live chat or social media
  • Participate in surveys, promotions or competitions
  • Leave reviews or product ratings

We may also collect information automatically through your interaction with our website using cookies, pixels and similar technologies (see Section 9).

We generally do not collect personal information from third parties. If we ever do (for example, a delivery address provided by a gift purchaser), we will take reasonable steps to notify you.

4. Why We Collect, Hold and Use Your Information (Purposes)

We collect, hold, use and disclose your personal information for the following purposes:

a) To sell and deliver our products to you

  • Processing and fulfilling orders
  • Verifying that you are of legal age to purchase vaping products
  • Verifying any required prescriptions under the Therapeutic Goods Act 1989 and related TGA regulations
  • Arranging shipping and tracking deliveries
  • Processing payments and refunds

b) To operate and improve our business

  • Customer service and responding to enquiries
  • Internal record-keeping, accounting and reporting
  • Quality assurance and staff training
  • Analytics to understand how our website is used

c) For safety, compliance and legal reasons

  • Complying with Australian federal, state and territory laws relating to the sale of vaping products (including the Tobacco and Other Vaping Products Act 2024 and equivalent state/territory legislation)
  • Complying with the Privacy Act 1988, Spam Act 2003, Australian Consumer Law and taxation obligations
  • Detecting and preventing fraud, identity verification failures, or unlawful transactions
  • Cooperating with law enforcement, regulators (including the TGA, OAIC and state health authorities), and courts where lawfully required

d) For direct marketing (with your consent or where permitted)

  • Sending promotional emails, SMS or browser notifications about our products, offers and news
  • Personalising content and ads on our website and partner platforms

You may opt out of marketing communications at any time (see Section 12).

We will not use your information for any other purpose unless we have your consent or are required/authorised by law.

5. To Whom We Disclose Your Information

We will never sell your personal information. We may disclose your information to the following types of third parties, strictly as needed:

a) Service providers

  • Payment processors (e.g. Credit card, PayID, Afterpay, Zip)
  • Shipping and logistics carriers (e.g. Australia Post)
  • Cloud hosting providers
  • IT, security, analytics and database service providers
  • Email and SMS marketing platforms
  • Customer service and helpdesk tools

b) Professional advisers

  • Legal, accounting and insurance professionals

c) Regulators, law enforcement and courts

  • Where we are required by law, subpoena, court order, or to cooperate with lawful requests
  • To the Office of the Australian Information Commissioner (OAIC) for privacy matters
  • To the Therapeutic Goods Administration (TGA) or state/territory health authorities where required for nicotine product sales
  • To the Australian Taxation Office (ATO) for GST and tax compliance

d) Other parties

  • With your explicit consent or at your direction
  • To a purchaser, successor or assignee in the event of a business sale, merger, restructuring or insolvency

Some of these recipients may be located overseas. Where personal information is disclosed overseas, we take reasonable steps to ensure it is handled in accordance with the APPs (see Section 6).

6. Overseas Disclosure

We may disclose your personal information to overseas recipients, including but not limited to:

  • Cloud and hosting providers located in the United States, Ireland, Singapore or other jurisdictions
  • Payment processors and SaaS providers headquartered overseas
  • Manufacturing or wholesale suppliers

Where we disclose information outside Australia, we take reasonable steps to ensure the recipient handles your information in a manner consistent with the APPs. Please be aware that once your information is overseas, Australian Privacy Principle protections may no longer apply, and overseas recipients may be subject to different privacy laws.

7. Data Quality and Security

Accuracy: We take reasonable steps to ensure the personal information we collect is accurate, up-to-date and complete. You can help us by keeping your account details current.

Security: We take reasonable steps to protect your personal information from misuse, interference, loss, unauthorised access, modification or disclosure. These steps include:

  • SSL/TLS encryption on our website
  • Encryption of payment data in transit and at rest
  • Access controls and role-based permissions for staff
  • Regular security reviews and vulnerability scanning
  • Secure, PCI-DSS compliant payment processing
  • Secure backups stored in restricted environments

However, no method of transmission over the internet or electronic storage is 100% secure. We cannot guarantee absolute security.

Data breaches: In the event of an eligible data breach that is likely to result in serious harm, we will comply with the Notifiable Data Breaches (NDB) scheme — notifying affected individuals and the OAIC as required.

8. Data Retention

We retain your personal information only for as long as reasonably necessary for the purposes described in this policy, or as required by law. Retention periods vary by information type:

  • Order and transaction records: at least 5 years (ATO and Australian Consumer Law requirements)
  • Age and prescription verification records: as required by state/territory vaping laws (commonly 2–3 years)
  • Marketing data: until you opt out or your consent is withdrawn
  • Account information: until you close your account, plus a reasonable period afterwards for record-keeping
  • Website analytics: typically 12–26 months

When personal information is no longer needed, we will take reasonable steps to destroy or de-identify it.

9. Cookies, Tracking and Online Analytics

Our website uses cookies, web beacons, pixels and similar technologies to:

  • Remember your preferences (e.g. shopping cart, login status)
  • Provide site functionality
  • Analyse traffic and usage (e.g. Google Analytics, Meta Pixel)
  • Deliver and measure advertising
  • Enable social media features

Types of cookies we use:

  • Strictly necessary cookies — required for the website to function
  • Performance/analytics cookies — to understand how visitors use our site
  • Functionality cookies — to remember your preferences
  • Targeting/advertising cookies — to deliver relevant ads on other sites

You can manage cookie preferences through your browser settings or our cookie consent banner. Disabling certain cookies may affect site functionality.

For more information, see our [Cookie Policy] (or the relevant section below).

Do Not Track: Our website does not currently respond to “Do Not Track” browser signals. You may opt out of tracking via cookie settings and the tools listed in this section.

10. Your Rights Under Australian Privacy Law

Under the APPs, you have the right to:

a) Request access to the personal information we hold about you (APP 12)

b) Request correction of personal information that is inaccurate, out-of-date, incomplete, irrelevant or misleading (APP 13)

c) Opt out of marketing communications (APP 7)

d) Make a complaint about our handling of your personal information (see Section 13)

How to exercise these rights:

  • Email us at [privacy@vapeoz.com.au]
  • We will respond within 30 days, or such longer period as is reasonable in the circumstances
  • We may need to verify your identity before actioning your request to protect your information from unauthorised disclosure
  • We may charge a reasonable fee for providing access (where allowed by law), but not for making a correction or complaint

If we refuse your request, we will provide written reasons and inform you of the available complaint mechanisms.

11. Sensitive Information

We do not collect “sensitive information” (as defined in the Privacy Act — e.g. racial or ethnic origin, political opinions, religious beliefs, health information, genetic data, biometric data) except:

  • Where you voluntarily provide it (e.g. health information for prescription verification)
  • Where required or authorised by law
  • Where necessary for the establishment, exercise or defence of a legal claim

We treat all prescription and health-related information with heightened confidentiality and access controls.

12. Direct Marketing and Opt-Out

We may send you marketing communications about our products, offers and news via email, SMS, browser notifications, or display advertising on our website and other websites.

We will:

  • Always give you the option to opt out
  • Honour your opt-out request promptly (usually within 5 business days, or as soon as practicable)
  • Comply with the Spam Act 2003

How to opt out:

  • Click “unsubscribe” in any marketing email
  • Reply “STOP” to any SMS
  • Contact us at [privacy@vapeoz.com.au]
  • Update your preferences in your account settings

Even if you opt out of marketing, we may still send you transactional messages (order confirmations, shipping updates, important notices about your account or product recalls).

13. Complaints

If you have a complaint about how we have handled your personal information, please contact us first so we can try to resolve it:

Privacy Officer Anna:anna@vapeoz.com.au

We will:

  • Acknowledge your complaint within 7 days
  • Investigate and respond within 30 days
  • Take corrective action where appropriate

Our website may contain links to third-party sites (e.g. payment providers, social media, manufacturers). We are not responsible for the privacy practices of those sites. We encourage you to read their privacy policies before providing your information.

15. Children’s Privacy

Our products and website are intended for adults (18+) in accordance with Australian law. We do not knowingly collect personal information from anyone under 18. If we become aware that we have inadvertently collected information from a minor, we will delete it promptly.

16. Specific Notice for Nicotine Vaping Products

In line with the Therapeutic Goods Act 1989, the Tobacco and Other Vaping Products Act 2024 (Cth) and applicable state/territory laws:

  • We may require proof of age (18+) and, for nicotine-containing products, a valid TGA-authorised prescription
  • Information collected for prescription verification is stored securely, used only for verification and regulatory compliance, and disclosed to regulators only as required by law
  • We are required to maintain certain transaction records and may be subject to regulatory inspection
  • We will not market nicotine vaping products to minors

17. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, or applicable law. The latest version will always be posted on our website with the “Last updated” date at the top. If changes are material, we will notify you by email or via a prominent notice on our website. Your continued use of our services after changes take effect constitutes acceptance of the revised policy.

18. Contact Us

If you have any questions about this Privacy Policy or our privacy practices, please contact:

VapeOz Privacy Officer Email:anna@vapeoz.com.au

This policy is provided for general informational purposes and does not constitute legal advice. We recommend that you review this draft with a qualified Australian privacy lawyer before publishing, particularly to ensure alignment with the Tobacco and Other Vaping Products Act 2024, state/territory vaping laws, and any specific contractual obligations with your payment, shipping or age-verification providers.