Your data. Your call.
Ordin Studios ("we", "us", "our") is an Australian business and handles your personal information in accordance with the Australian Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs). For visitors from outside Australia we also align our practices with the EU General Data Protection Regulation (GDPR), the UK GDPR, the California Consumer Privacy Act (CCPA) as amended by the California Privacy Rights Act (CPRA), and other applicable privacy laws. This policy explains what we collect, why we collect it, how we share it, how long we keep it, and the rights you have over it.
The data controller.
Ordin Studios is the data controller responsible for your personal information.
Legal entity: Ordin Studios
ABN: 76 633 604 495
Jurisdiction: New South Wales, Australia
Email: privacy@ordinstudios.co
General contact: hello@ordinstudios.co
Australia. If you believe we have mishandled your personal information, you can complain to us at privacy@ordinstudios.co. We will acknowledge within 5 business days and aim to resolve within 30 days. If you are not satisfied with our response, you can escalate to the Office of the Australian Information Commissioner (oaic.gov.au). As an Australian sole trader with annual turnover under AUD $3 million, we are classified as a "small business operator" under the Privacy Act 1988 (Cth), which means we are not bound by all of the Australian Privacy Principles by default. We have nevertheless chosen to handle personal information in accordance with the APPs across the board, and we comply with the Notifiable Data Breaches scheme in respect of the data we hold.
EEA / UK. If you are in the European Economic Area or the United Kingdom and you believe we have not handled your personal data properly, you have the right to lodge a complaint with your local supervisory authority. For the UK, this is the Information Commissioner's Office (ico.org.uk). For the EU, a list of national authorities is at edpb.europa.eu. We'd appreciate the chance to resolve it directly first: email privacy@ordinstudios.co.
Three categories of data.
1. Information you give us directly
- Contact details: name, email address, phone number (optional), shipping and billing addresses.
- Order information: items ordered, order history, preferences (colorway, quantity), gift messages (if provided).
- Payment information: processed by our payment providers (see S-04). We do not store full card numbers on our servers. We receive a token and the last four digits of your card.
- Account credentials: if you create an account, your login email and password hash.
- Communications: emails, form submissions, reviews, creator applications, and any message you send us.
- Marketing preferences: whether you've opted in to email, SMS, or other marketing.
2. Information collected automatically
- Device and browser: IP address, browser type and version, operating system, device type, screen size, referring URL, language.
- Usage data: pages visited, time on page, scroll depth, click events, carts abandoned, search queries on our site.
- Location: approximate location inferred from IP address (city/country level only).
- Cookies and similar technologies: see S-08 below.
3. Information from third parties
- Payment processors (Stripe, Shop Pay, PayPal) confirm transactions and return fraud-risk indicators.
- Advertising platforms (Meta, TikTok, Google) share aggregated performance data and, when you interact with our ads, event data tied to your browser or account.
- Analytics providers (e.g. Google Analytics, Shopify analytics) share browsing and conversion data.
- Shipping carriers share tracking and delivery status.
- Social media platforms, if you interact with us through them, share your public profile information subject to your platform settings.
Purposes and legal bases.
Under GDPR and UK GDPR, we must identify a legal basis for every use of your data. Here's the breakdown:
- To process and fulfil your order: confirming, shipping, invoicing, handling returns. Legal basis: performance of a contract.
- To communicate about your order: shipping updates, delivery confirmations, return status. Legal basis: performance of a contract.
- To provide customer support: answering questions, resolving complaints. Legal basis: performance of a contract and legitimate interests (operating a responsive business).
- To send marketing communications: pre-launch updates, new colorways, restock alerts, brand news. Legal basis: consent (you opted in) or legitimate interests where permitted. You can unsubscribe at any time using the link in any email or by emailing privacy@ordinstudios.co.
- To run and improve our website: analytics, A/B testing, bug fixing, security. Legal basis: legitimate interests, and consent for non-essential cookies.
- To run advertising: showing you relevant ads on Meta, TikTok, Google, and measuring campaign performance. Legal basis: consent (for tracking cookies) and legitimate interests (aggregate reporting).
- To prevent fraud and abuse: checking risk indicators, reviewing suspicious orders, enforcing our Terms. Legal basis: legitimate interests and, where relevant, legal obligation.
- To comply with legal obligations: tax records, consumer protection law, responding to lawful requests. Legal basis: legal obligation.
- To defend legal claims: keeping records we may need in a dispute. Legal basis: legitimate interests.
We do not use your personal information for automated decision-making or profiling that produces legal or similarly significant effects on you.
Our processors and partners.
We do not sell your personal information for money. We share it only with service providers who help us operate the business, and only for the purposes described below. Each provider is contractually required to protect your data and use it only on our instructions.
- E-commerce platform: Shopify (hosting our store, processing orders). Shopify Privacy Policy.
- Payment processors: Stripe, Shop Pay, PayPal. They handle payment data directly and we receive confirmation and the last four digits of your card.
- Email marketing: Klaviyo (or equivalent) for email campaigns and transactional email.
- Analytics: Google Analytics, Shopify analytics.
- Advertising: Meta (Facebook, Instagram), TikTok, Google Ads, Pinterest, for ad delivery and measurement.
- Shipping and fulfilment: carriers relevant to your region, plus our third-party logistics provider, which is located overseas. Your name, delivery address, and contact details are disclosed to them so they can pick, pack, and ship your order.
- Customer support: our helpdesk tooling (e.g. Gorgias, Zendesk, or equivalent).
- Reviews: our reviews platform, if reviews are enabled.
- Fraud prevention: Shopify fraud analysis, Stripe Radar.
- Professional advisors: lawyers, accountants, auditors, where necessary and under confidentiality obligations.
- Authorities and acquirers: if required by law, court order, or as part of a business transfer (merger, acquisition, asset sale), in which case we'll notify you and your rights will travel with the data.
Some regulators treat sharing data with advertising platforms as a "sale" or "share" of personal information under laws like the CCPA. See S-09 for how to opt out.
Data crossing borders.
We operate internationally and many of our service providers are based in the United States or other countries outside the EEA and UK. Where we transfer your personal data outside your country of residence, we rely on one or more of these safeguards:
- The European Commission or UK government has found the destination country to provide an adequate level of data protection (an "adequacy decision").
- Standard Contractual Clauses (SCCs) approved by the European Commission, supplemented by the UK International Data Transfer Addendum where applicable.
- The EU-US Data Privacy Framework for transfers to certified US providers.
- Your explicit consent, where relevant.
You can request a copy of the safeguards we have in place for a specific transfer by emailing privacy@ordinstudios.co.
How long we keep it.
We keep personal data only for as long as we need it for the purpose we collected it, plus any period required by law. Broad guide:
- Order and transaction records: 7 years (tax and consumer protection record-keeping).
- Customer support conversations: up to 3 years after the last interaction.
- Marketing email lists: until you unsubscribe or after 24 months of inactivity, whichever is sooner.
- Website analytics: aggregated after 14 months; individual events sooner.
- Account data: for the life of the account plus 2 years after closure, unless you request earlier deletion.
- Legal claims data: for the applicable limitation period in your jurisdiction.
When we no longer need your data, we delete it or anonymise it so it can no longer be tied to you.
What you can ask us to do.
Depending on where you live, you have some or all of the following rights over your personal data. To exercise any of these, email privacy@ordinstudios.co from the address on your account. We'll verify your identity and respond within the time limit set by the relevant law (typically 30 days under GDPR and 45 days under CCPA).
General rights (GDPR, UK GDPR, and most privacy laws)
- Access: request a copy of the personal data we hold about you.
- Correction: ask us to fix anything that's wrong.
- Deletion: ask us to erase your data, subject to legal exceptions (we can't delete what we're legally required to keep).
- Restriction: ask us to stop using your data while we review a complaint.
- Portability: receive your data in a structured, machine-readable format, or have us send it to another provider.
- Objection: object to our use of your data for direct marketing (we'll always honour this) or for legitimate interests where your rights outweigh ours.
- Withdraw consent: where we rely on consent, you can withdraw it at any time. This doesn't affect processing we already did before you withdrew.
- Complain to a regulator: see S-01.
California residents (CCPA / CPRA)
In addition to the rights above, California residents can:
- Know what categories and specific pieces of personal information we've collected in the last 12 months, where we got it, and who we shared it with.
- Delete personal information we've collected, subject to legal exceptions.
- Correct inaccurate personal information.
- Opt out of the "sale" or "sharing" of your personal information. We don't sell your data for money, but advertising cookies may qualify as "sharing" under California law. Opt out below.
- Limit the use of sensitive personal information. We don't use sensitive PI beyond what's necessary to provide the service.
- Non-discrimination: we won't give you worse service or worse pricing for exercising your rights.
To opt out of "sale" or "sharing", email privacy@ordinstudios.co with the subject "Do Not Sell or Share My Personal Information" or use our cookie consent banner to disable advertising cookies. We also honour Global Privacy Control (GPC) browser signals.
Categories of personal information collected in the last 12 months: identifiers (name, email, IP address), commercial information (purchase history), internet activity (browsing on our site), geolocation (approximate), inferences (preferences). We do not knowingly collect protected classifications or biometric data.
Other US state rights
Residents of Virginia, Colorado, Connecticut, Utah, and other states with comprehensive privacy laws have similar rights. Contact us to exercise them.
The small files and pixels.
We use cookies and similar technologies (pixels, SDKs, local storage) to operate the site, remember your preferences, measure performance, and deliver relevant advertising. Four categories:
- Strictly necessary: required for the site to work (shopping cart, checkout, login sessions). These can't be turned off.
- Functional: remember preferences like language or region.
- Analytics: help us understand how people use the site so we can improve it (e.g. Google Analytics, Shopify analytics).
- Advertising: used by Meta, TikTok, Google, and similar partners to show you ads on their platforms and measure performance (e.g. Meta Pixel, TikTok Pixel, Google Ads conversion tag).
On your first visit from the EEA, UK, or California, our cookie banner asks you to accept, reject, or customise cookies. You can change your choice at any time via the "Cookie preferences" link in the footer (coming at launch) or through your browser settings.
We honour Global Privacy Control (GPC) signals for users in jurisdictions that recognise them.
Opt in. Opt out. Any time.
We'll only send you marketing emails if you've asked us to (by joining the waitlist, creating an account with marketing opt-in, or ticking a box at checkout). Every email has an unsubscribe link. You can also email privacy@ordinstudios.co to opt out.
Opting out of marketing doesn't affect transactional emails: order confirmations, shipping updates, return status, and account-related notices still go out because we need them to deliver the service you paid for.
Not aimed at under-16s.
Our site and products are not directed at children. We do not knowingly collect personal data from anyone under 16 (or under 13 in the United States). If you believe we've collected data from a child, email privacy@ordinstudios.co and we'll delete it.
How we protect it.
We use industry-standard technical and organisational measures to protect your data: HTTPS everywhere, encrypted storage, access controls on internal tools, regular reviews of our processors, and vetted payment providers (PCI DSS compliant). No system is perfectly secure. If we ever discover a breach that affects you, we'll notify you and the relevant authority within the timeframes required by law.
Off-site is off-policy.
Our site may link to third-party sites: creators' accounts, press coverage, platform pages. We're not responsible for their privacy practices. Read their policies before sharing personal data with them.
When this policy changes.
We may update this policy from time to time. We'll post the updated version here with a new "Last updated" date. For material changes, we'll also notify email subscribers and (where required) get fresh consent. Continuing to use the site after an update means you accept the revised policy.
Reach a human.
Questions, requests, complaints, or you just want to know what we have on file?
Privacy inbox: privacy@ordinstudios.co
General: hello@ordinstudios.co
We answer every one.
Email our privacy inbox and we'll respond within the timeframe required by the law that applies to you.
privacy@ordinstudios.coOne of 1,000.
Twelve months from now: a year you can account for, in your own handwriting.
Ships worldwide in 7 to 10 days. 90-day results or refund. You keep the book.