Privacy Policy
Last updated: 2 August 2026
This policy explains what personal information we collect, why we collect it, who we share it with, and what you can do about it. We've written it to meet the Australian Privacy Principles under the Privacy Act 1988 (Cth), and we apply it whether or not we're currently required to.
1. The short version
- We collect what we need to take your order, deliver it and look after you afterwards.
- We never see your card details. Payments are handled by PCI DSS compliant payment processors.
- We do not sell your personal information. Ever.
- We only send marketing if you've opted in, and every message has a working unsubscribe.
- Some of our providers are overseas, mostly in the United States. Section 5 explains who we share information with.
- You can ask us for a copy of what we hold, ask us to fix it, or ask us to delete it. Section 11.
2. Who we are
Nesty Boxes
ABN 69 678 994 413
20 Oborn Road, Mount Barker SA 5251
sales@nestyboxes.com.au
This policy covers nestyboxes.com.au, our emails and SMS, and any dealings you have with our customer service team.
3. What we collect
3.1 When you buy something
- Your name, email address, phone number, delivery address and billing address
- What you ordered, when, and what you paid
- Delivery and tracking information
- Your order history with us
3.2 When you subscribe to marketing
- Your email address, and your mobile number if you opt in to SMS
- Which emails you open and what you click, so we send you fewer irrelevant ones
- Anything you volunteer, such as your flock size or what you keep
3.3 When you use the site
- Your IP address, device type, browser and operating system
- Pages you viewed, what you searched for, what you added to cart
- Which site or ad you arrived from
- Cookie identifiers (see section 7)
3.4 When you contact us or leave a review
- Your messages to us through live chat, email or our contact form
- Reviews, ratings and any photos you submit
- Competition and giveaway entries
3.5 What we never collect
We do not collect, see or store your card number. Payment details go directly to our payment processors, who are PCI DSS compliant. We only ever see the last four digits and the card type on your order record.
4. Why we collect it
- To take your order, charge you correctly and get it delivered
- To answer your questions and handle returns, refunds and warranty claims
- To run subscriptions and process recurring payments
- To send you marketing, if you've agreed to it
- To understand what's useful on our site and improve it
- To detect and prevent fraud
- To meet our tax, consumer law and record keeping obligations
We don't use your information for anything unrelated to the reason we collected it, unless you'd reasonably expect it or you've agreed.
5. Who we share it with
5.1 The services that run our business
We share information with the providers who help us operate. Each only receives what it needs to do its job:
- our online store platform, which hosts the store and holds your account and order records
- payment processors
- our email and SMS marketing platform
- subscription management, live chat, product review and affiliate platforms
- website analytics and advertising providers, including tools that record how visitors move through the site
- Australia Post and our freight carriers
- our accountants and professional advisers, under confidentiality obligations
Our providers change from time to time. If you'd like to know exactly which of them holds your information, email us and we'll tell you.
5.2 We do not sell your information
We have never sold personal information and we won't. We don't rent, trade or provide it to data brokers.
5.3 Information sent overseas
Several of the providers above store or process information outside Australia, principally in the United States and Canada.
Where we disclose your information to an overseas recipient we take reasonable steps to ensure it's handled consistently with the Australian Privacy Principles. Their own privacy terms also apply, and you can read them on their websites.
5.4 When the law requires it
We may disclose information where we're required to by law, where it's necessary to prevent fraud or a serious threat to someone's safety, or to establish or defend a legal claim.
5.5 If the business is sold
If Nesty is sold or merges with another business, customer information may transfer to the new owner so they can keep supplying you. Any buyer takes on the obligations in this policy.
6. Marketing emails and SMS
6.1 Only if you've opted in
We send marketing only to people who have agreed to receive it. Ticking a box at checkout, entering a giveaway or signing up through a popup all count as opting in.
6.2 How to stop it
Every marketing email has an unsubscribe link at the bottom. Every marketing SMS accepts a reply of STOP. Both work immediately and permanently. You can also email us and we'll do it for you.
6.3 What unsubscribing doesn't stop
You'll still get transactional messages, because you need them. That means order confirmations, dispatch and tracking notices, subscription charge reminders, and replies to your own enquiries. These aren't marketing and you can't unsubscribe from them while you have an active order or subscription.
7. Cookies, analytics and session recording
7.1 What cookies do here
Cookies keep your cart working between pages, remember your preferences, keep you logged in, and let us measure how the site is performing. Some are essential; the site won't work properly without them.
7.2 Advertising and analytics
We use analytics and advertising tools to understand how people find and use our site, and to show relevant advertising. These set identifiers that can recognise your device across websites and, where you are signed in to an account with that provider, across your devices. We may share limited data with these platforms for measurement and advertising, subject to their own privacy terms.
7.3 Session recording
We use a website analytics tool that records how people move through our site, including mouse movement, clicks, scrolling and which pages caused people to give up. We use it to find broken and confusing parts of the site.
It is configured to mask text entered into form fields, so it should not capture what you type into a checkout or contact form. We use it to understand behaviour in aggregate, not to watch individuals.
7.4 Turning it off
You can manage cookies through your browser settings, and opt out of personalised advertising through your advertising provider settings. Blocking cookies won't stop you using the site, though some features will work less well. Where our cookie banner offers you a choice, that choice is honoured.
8. How long we keep it
- Order and transaction records: 7 years, because tax law requires it
- Marketing data: until you unsubscribe, then 12 months
- Customer service correspondence: 3 years
- Website analytics: up to 26 months
- Session recordings: up to 90 days
After that we delete it, or strip out anything that identifies you.
9. How we protect it
Your data sits on our online store platform's servers, behind their security controls. Connections to our site are encrypted. Inside Nesty, access is limited to the people who need it to do their job, and access is removed when someone leaves.
We can't promise absolute security. No business honestly can, and you should be sceptical of any that does. What we can tell you is that we don't hold your card details, we don't keep data we no longer need, and we take security incidents seriously.
10. If there's a data breach
If a data breach occurs that is likely to result in serious harm to you, we will notify you and the Office of the Australian Information Commissioner, as required under the Notifiable Data Breaches scheme.
We'll tell you what happened, what information was involved, and what you should do about it. We won't wait to be asked.
11. Your information: access, correction and deletion
11.1 What you can ask for
- A copy of the personal information we hold about you
- Correction of anything that's wrong or out of date
- Deletion of your information, where we're not legally required to keep it
11.2 How to ask
Email sales@nestyboxes.com.au and tell us what you want. There's no charge.
11.3 What happens next
We'll respond within 30 days. We may need to verify who you are first, so nobody else can get at your information. If we can't do what you've asked, for example where we're required to keep order records for tax purposes, we'll tell you why.
12. Making a complaint
If you think we've mishandled your information, email sales@nestyboxes.com.au with "Privacy complaint" in the subject line. We'll acknowledge it within 5 business days and give you a full response within 30 days.
If you're not satisfied with how we've handled it, you can take it to the Office of the Australian Information Commissioner:
- oaic.gov.au
- 1300 363 992
- GPO Box 5218, Sydney NSW 2001
13. Children
Our site isn't aimed at children and we don't knowingly collect information from anyone under 18. If you believe a child has given us their information, contact us and we'll delete it.
14. Changes to this policy
We may update this policy. The date at the top always tells you the current version. If we make a change that materially affects how we handle your information, we'll post a notice on the site and email subscribers.
15. Contact us
Privacy questions, requests and complaints all go to the same place:
Nesty Boxes · ABN 69 678 994 413
U2, 20 Oborn Road, Mount Barker SA 5251
