Vilaine — Privacy Policy

Last updated: 20 August 2026

Jessica Bosnic, trading as Vilaine (ABN 32 141 762 513) (“Vilaine”, “we”, “us”, “our”), respects your privacy and is committed to protecting the personal information of everyone who visits our website, creates an account, or purchases from us.

We currently sell to customers in Australia and New Zealand. This policy is written to comply with the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs), and the Privacy Act 2020 (NZ) and the Information Privacy Principles (IPPs), which apply to us because we sell to customers located in New Zealand. If we begin selling into the United Kingdom or the European Union, we will update this policy to address those requirements (including UK GDPR / EU GDPR) before doing so.

1. What personal information we collect

Depending on how you interact with us, we may collect:

  • Name, email address, phone number, billing and shipping address
  • Account login details, order history, and saved preferences (if you create a customer account)
  • Payment confirmation details — we do not collect or store your full card number. Card payments are processed directly by Square, our payment processor (see “Third parties” below)
  • Correspondence you send us, including customer service enquiries and reviews
  • Technical and browsing information such as IP address, device and browser type, and pages viewed on our website, collected automatically via cookies and similar technologies
  • Marketing preferences, including whether you have subscribed to or unsubscribed from our emails

We do not knowingly collect sensitive information (such as health information) except where you choose to provide it to us, for example in a customer service enquiry, and only for the purpose for which you provided it.

2. How we collect personal information

We collect personal information directly from you when you create an account, place an order, subscribe to our mailing list, or contact us. We also collect information automatically through cookies and similar tracking technologies when you browse our website. We do not currently knowingly collect personal information from third parties, other than the payment confirmation data we receive from Square when you complete an order.

3. Why we collect and use your personal information

We collect and use personal information to:

  • Process and fulfil your orders, including payment, packing, and delivery
  • Create and manage your customer account
  • Respond to enquiries and provide customer support
  • Send you marketing communications, where you have subscribed or otherwise consented, and in accordance with the Spam Act 2003 (Cth). You can unsubscribe at any time using the link in any marketing email or by contacting us
  • Improve our website and product range, including through aggregated analysis of browsing behaviour
  • Meet our legal and tax obligations, including record-keeping obligations under Australian and New Zealand law
  • Detect and prevent fraud

4. Cookies and website analytics

Our website uses cookies and similar technologies to remember your preferences, keep your cart and account session active, and understand how visitors use our site. Most web browsers let you control or disable cookies through their settings; disabling cookies may affect how parts of our website function, including checkout.

5. Third parties we share information with

We share personal information with trusted service providers who help us run our business, and only for the purposes described in this policy:

  • Square — processes card payments on our behalf. Square is a PCI DSS – compliant payment processor; we do not see or store your full card details
  • Brevo — our email marketing platform, used to send newsletters and marketing communications to subscribers
  • Delivery and courier partners — to fulfil and ship your orders
  • Professional advisors (such as our accountant), regulators, or law enforcement, where required or authorised by law

We do not sell your personal information to third parties.

6. Overseas disclosure

Our website and customer/order data are hosted with DigitalOcean in Sydney, Australia, so this data is not disclosed overseas. Some of our other service providers do store or process personal information outside Australia and New Zealand. Based on our current providers, this may include the United States (Square) and the European Union (Brevo, headquartered in France). Where we disclose personal information overseas, we take reasonable steps to ensure the recipient handles it consistently with the APPs and, for New Zealand customers, with the comparable safeguards required under Information Privacy Principle 12 of the Privacy Act 2020 (NZ).

7. Data security

We take reasonable technical and organisational steps to protect the personal information we hold from misuse, interference, loss, unauthorised access, modification, or disclosure. No method of storage or transmission is completely secure, but we review our practices on an ongoing basis.

8. How long we keep your information

We keep order, payment, and transaction records for 5 years, in line with Australian Taxation Office record-keeping requirements. We keep customer account information for as long as your account remains active. If you unsubscribe from marketing communications, we stop using your details for marketing purposes and delete or de-identify them within a reasonable period, except where we need to retain a record that you opted out. Where personal information is no longer needed for the purpose it was collected, we take reasonable steps to destroy or de-identify it.

9. Access to and correction of your information

You can request access to, or correction of, the personal information we hold about you at any time by contacting us at [email protected]. We will not charge a fee for a straightforward request. We may need to verify your identity before releasing information, and there are some circumstances (set out in the Privacy Act and the Privacy Act 2020) where we are permitted to refuse a request — if that happens, we will explain why.

10. Data breaches

If we experience a data breach that is likely to result in serious harm to you, we will notify affected individuals and, where required, the Office of the Australian Information Commissioner and/or the New Zealand Privacy Commissioner, in accordance with the Notifiable Data Breaches scheme (Australia) and the notifiable privacy breach requirements under the Privacy Act 2020 (New Zealand).

11. New Zealand customers

If you are located in New Zealand, the Privacy Act 2020 (NZ) applies to how we handle your personal information, and we handle it in accordance with the Information Privacy Principles. You have the right to access and correct your personal information, and to complain to us or to the Office of the Privacy Commissioner (New Zealand) if you believe we have not met our obligations.

12. Children

Our website and products are intended for adults. We do not knowingly collect personal information from children. If you believe a child has provided us with personal information, please contact us and we will take steps to delete it.

13. Complaints

If you have a concern about how we have handled your personal information, please contact us first at [email protected] so we can try to resolve it directly. If you are not satisfied with our response, you can lodge a complaint with:
Australia: Office of the Australian Information Commissioner (OAIC)
New Zealand: Office of the Privacy Commissioner

14. Changes to this policy

We may update this policy from time to time to reflect changes in our practices or the law. The current version will always be available on our website, with the date it was last updated shown at the top.

15. Contact us

Jessica Bosnic, trading as Vilaine
Schoolhouse Studios, 28 Victoria Street, Coburg, VIC, 3058
Email: [email protected]