1. The short version

We collect what we need to sell you our products and get them to you. We do not sell your personal information. You can ask us what we hold, ask us to correct or delete it, and unsubscribe at any time.

2. Who we are

Surnui Pty Ltd (ACN 686 364 590, ABN 71 686 364 590) is responsible for the personal information described in this policy. We handle personal information in accordance with the Australian Privacy Principles in the Privacy Act 1988 (Cth).

Privacy enquiries: customercare@surnui.com .

3. What we collect

When you buy: name, email, delivery and billing address, phone number, order history and delivery details.

Payment: handled by our payment providers. We receive confirmation the payment succeeded plus the card type and last four digits. We do not hold your full card number.

When you create an account, review or contact us: name, email, phone if you give it, marketing preferences, and whatever you write to us.

When you browse: IP address, device and browser type, pages viewed, referring site and how you move through the site, collected through cookies and similar tools.

We do not collect sensitive information as defined in the Privacy Act, and we ask that you do not send it to us.

4. Why we use it

To process, pack and deliver your order; handle returns and exchanges; provide customer service; manage your account; prevent fraud; improve our products and the site; meet our legal and tax obligations; and, where you have opted in, send you marketing.

5. Who we share it with

We share personal information with service providers who help us run the business, and only to the extent they need it to do that job. They include our ecommerce platform, payment providers, marketing and review platforms, analytics and advertising platforms, our logistics, warehousing and delivery partners, our operations and technology contractors, and our professional advisers.

Some of those providers store or process personal information outside Australia. The countries where they are likely to be located are Canada, the United States, Ireland, the United Kingdom, the Philippines, India and New Zealand. Those recipients are subject to the laws of their own countries, which may differ from Australian privacy law. We take reasonable steps to require them to protect your information but cannot guarantee they will comply with the Australian Privacy Principles.

We may also disclose information where the law requires it or to protect our rights, our customers or the public. If our business is sold or restructured, customer information may transfer with it.

We do not sell your personal information.

6. Marketing

We send marketing email and SMS where you have opted in, or where you have bought from us and would reasonably expect to hear from us. Every message carries an unsubscribe link and you can opt out at any time. Opting out does not stop transactional messages such as order and dispatch confirmations.

7. Cookies and advertising

We use cookies and similar technologies to keep your cart working, remember your preferences, understand how the site is used, and measure our advertising.

Advertising tools operated by platforms including Meta and Google let us show relevant advertising and measure whether it worked. This can involve sharing a hashed version of your email address with those platforms so they can match it to their own records. If you would rather we did not, decline advertising cookies in our banner or use the ad settings offered by those platforms.

You can block or delete cookies in your browser. Some parts of the site will not work properly if you do.

8. Security and retention

We take reasonable steps to protect personal information, including access controls, encryption in transit and choosing reputable providers. No system is completely secure and we cannot guarantee absolute security.

We keep order and transaction records for at least seven years to meet Australian tax and record-keeping obligations.

Marketing records are kept until you unsubscribe and for a reasonable period afterwards so we can honour that request. We destroy or de-identify what we no longer need.

If there is a data breach likely to cause serious harm, we will notify you and the relevant regulator in line with the Notifiable Data Breaches scheme.

9. Access, correction and deletion

You can ask for a copy of the personal information we hold about you, ask us to correct it, or ask us to delete it where we are not required to keep it. Email customercare@surnui.com and we will respond within 30 days. We may need to verify who you are first. In limited circumstances we may refuse access, and if we do we will tell you why.

10. Complaints

If you think we have mishandled your personal information, email customercare@surnui.com with the detail. We will acknowledge within five business days and respond within 30 days. If you are not satisfied, you can contact the Office of the Australian Information Commissioner at oaic.gov.au or 1300 363 992.

11. Children

Our products and site are intended for adults. We do not knowingly collect personal information from anyone under 18. If you believe we have, contact us and we will delete it.

12. Changes

We may update this policy. The current version is always on this page with the date it was last updated.