Consumer Data Privacy Policy

CHAPPOS AVOS PTY LTD (ABN 13 633 006 292), trading as Chappos Avos, is a family farm in Brunswick, Western Australia. We handle personal information in line with the Australian Privacy Principles under the Privacy Act 1988 (Cth). We are a small business, but we have chosen to comply with those principles anyway, because you are trusting us with your details when you place an order.

What we collect

We only collect what we need to take your order and get your avocados to you:

• Your name — so we can match you to your order at the pickup point.
• Your email address — for your order confirmation, your pickup QR code and pickup reminders.
• Your phone number — so we can contact you if there is a problem with your order or your pickup slot, and to send SMS reminders if that option is switched on.
• Your order details — the products and quantities you bought, the amount paid, and the pickup location and time slot you selected.
• Basic website analytics — Google Analytics records anonymised usage data such as which pages were visited and roughly which region the visit came from.

What we never collect

We never see or store your card details. Card numbers, expiry dates and CVV codes are entered directly into a secure payment form hosted by Square and are sent straight to Square. They never reach our servers or our database. The same applies to Apple Pay and Google Pay. We only ever receive a confirmation that a payment succeeded, plus the last four digits and card brand for reconciliation.

We do not collect your date of birth, your physical address, government identifiers, or any sensitive information such as health, racial, political or religious information.

Why we collect it

• To process and fulfil your order.
• To send transactional messages — order confirmation, pickup reminders, and notice of any change to a slot.
• To answer your questions and resolve problems with an order.
• To meet our record-keeping obligations under Australian tax law.
• To understand, in aggregate, how the website is used so we can improve it.

We do not sell your personal information. We do not rent, trade or disclose it for anyone else's marketing. We will not add you to a marketing list without asking you first, and any marketing email we send will have a one-click unsubscribe link.

Who we share it with

We use a small number of service providers to run the store. Each one only receives what it needs to do its job:

• Square — processes your payment. Square receives your card details directly and your name and email for the receipt. Square is PCI DSS Level 1 certified. See Square's own privacy notice at squareup.com/au/en/legal/general/privacy.
• Supabase — hosts the database that stores your order, name, email and phone number.
• Amazon Web Services — sends your confirmation emails and SMS reminders, and hosts the website.
• Mapbox — renders the pickup location map. Mapbox receives the map view you are looking at, not your identity or order.
• Google Analytics — receives anonymised website usage data, not your order or contact details.

Some of these providers store data on servers outside Australia, including in the United States. We use them because they offer stronger security than we could run ourselves, and we only use providers that contractually commit to protecting the data they hold.

Beyond these providers, we will only disclose your information if you ask us to, or where the law requires it — for example a court order or a lawful request from a government agency.

How long we keep it

We keep order records for seven years, because Australian tax law requires us to retain financial records for that long. If you ask us to delete your details, we will remove your name, email and phone number from our systems and keep only the anonymised financial record needed for tax purposes.

How we protect it

• The whole site is served over HTTPS, so anything you send us is encrypted in transit.
• Order data is encrypted at rest in our database.
• Access to the admin system is restricted to the family members who run the farm, and requires a login.
• Card data never touches our infrastructure, so there is nothing for us to lose.

No system is perfect. If a data breach occurs that is likely to cause you serious harm, we will notify you and the Office of the Australian Information Commissioner as required by the Notifiable Data Breaches scheme.

Cookies

We use cookies that are strictly necessary to keep your shopping cart and your admin session working, and Google Analytics cookies that measure site usage. You can block or delete cookies in your browser settings; the store will still work, but your cart may not persist between visits.

Your rights

You can, at any time:

• Ask for a copy of the personal information we hold about you.
• Ask us to correct anything that is wrong.
• Ask us to delete your details, subject to the tax record-keeping above.
• Opt out of SMS or email reminders while still receiving your order confirmation.

Email info@chapposavos.com.au with your request and the email address you used to order. We will respond within 2 business days and action valid requests within 30 days, at no charge.

Complaints

If you think we have mishandled your personal information, email info@chapposavos.com.au and we will investigate and respond within 30 days. If you are not satisfied with our response, you can complain to the Office of the Australian Information Commissioner at oaic.gov.au or on 1300 363 992.

Changes to this policy

If we change this policy we will update the date at the top of this page. Material changes will also be noted on our home page.